@open-mercato/core 0.6.6-develop.6296.1.5e8bdfee17 → 0.6.6-develop.6299.1.29224e2d86

package/dist/modules/auth/lib/setup-app.js

@@ -183,7 +183,7 @@ async function setupInitialTenant(em, options) {
     const passwordHash = await resolvePasswordHash(primaryUser);
     await em.transactional(async (tem) => {
       const tenant = tem.create(Tenant, {
-        name: `${options.orgName} Tenant`,
+        name: options.orgName,
         isActive: true,
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()

package/dist/modules/auth/lib/setup-app.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/setup-app.ts"],
-  "sourcesContent": ["import { hash } from 'bcryptjs'\nimport { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { normalizeTenantId } from './tenantAccess'\nimport { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nconst DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const\nconst DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'\nconst DEFAULT_DERIVED_EMAIL_DOMAIN = DEMO_SUPERADMIN_EMAIL.split('@')[1] ?? 'acme.com'\n\nexport type EnsureRolesOptions = {\n  roleNames?: string[]\n  tenantId?: string\n}\n\nasync function ensureRolesInContext(\n  em: EntityManager,\n  roleNames: string[],\n  tenantId: string,\n) {\n  for (const name of roleNames) {\n    const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })\n    if (existing) continue\n    em.persist(em.create(Role, { name, tenantId, createdAt: new Date() }))\n  }\n}\n\nexport async function ensureRoles(em: EntityManager, options: EnsureRolesOptions = {}) {\n  const roleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const tenantId = normalizeTenantId(options.tenantId ?? null)\n  if (!tenantId) {\n    throw new Error('ensureRoles requires a tenantId \u2014 global roles are not supported')\n  }\n  await em.transactional(async (tem) => {\n    await ensureRolesInContext(tem, roleNames, tenantId)\n    await tem.flush()\n  })\n}\n\nasync function findRoleByName(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const normalizedTenant = normalizeTenantId(tenantId ?? null) ?? null\n  return findOneWithDecryption(em, Role, { name, tenantId: normalizedTenant }, {}, { tenantId: normalizedTenant, organizationId: null })\n}\n\nasync function findRoleByNameOrFail(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role> {\n  const role = await findRoleByName(em, name, tenantId)\n  if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`)\n  return role\n}\n\ntype PrimaryUserInput = {\n  email: string\n  password?: string\n  hashedPassword?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  displayName?: string | null\n  confirm?: boolean\n}\n\nconst DERIVED_EMAIL_ENV = {\n  admin: 'OM_INIT_ADMIN_EMAIL',\n  employee: 'OM_INIT_EMPLOYEE_EMAIL',\n} as const\n\nexport type DemoUserRole = 'superadmin' | 'admin' | 'employee'\nexport type DemoUserEmail = { role: DemoUserRole; email: string }\n\n/**\n * Returns the canonical list of demo user emails the setup path may have\n * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the\n * same way the derived-user seeding branch does, so the deactivation loop\n * never drifts from the seeding loop.\n *\n * Pure function \u2014 no side effects, safe to unit-test in isolation.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport function resolveDemoUserEmails(): DemoUserEmail[] {\n  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  return [\n    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },\n    { role: 'admin', email: adminEmail },\n    { role: 'employee', email: employeeEmail },\n  ]\n}\n\nexport type SetupInitialTenantOptions = {\n  orgName: string\n  primaryUser: PrimaryUserInput\n  roleNames?: string[]\n  includeDerivedUsers?: boolean\n  failIfUserExists?: boolean\n  primaryUserRoles?: string[]\n  includeSuperadminRole?: boolean\n  /** Optional list of enabled modules. When provided, module setup hooks are called. */\n  modules?: Module[]\n  /**\n   * Optional global slug to persist on the new Organization. When set, a\n   * pre-flight uniqueness check across all tenants throws OrgSlugExistsError\n   * on collision so scriptable callers can fail loudly instead of silently\n   * reusing or clobbering an existing organization.\n   */\n  orgSlug?: string\n  /**\n   * Opt-in flag that allows seeding the derived admin/employee accounts when\n   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.\n   *\n   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are\n   *   seeded with the well-known `'secret'` password so local dev workflows\n   *   (e.g. `mercato init`) stay predictable for developers.\n   * - In production: the fallback uses a randomly generated 96-bit password\n   *   (printed once by the CLI) so an operator who deliberately opts in still\n   *   avoids the historical hardcoded credential. When this flag is false/unset\n   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`\n   *   is thrown instead of silently seeding any account.\n   */\n  allowDemoDerivedPasswords?: boolean\n}\n\nexport class OrgSlugExistsError extends Error {\n  constructor(public readonly slug: string) {\n    super(`ORG_SLUG_EXISTS: an organization with slug \"${slug}\" already exists`)\n    this.name = 'OrgSlugExistsError'\n  }\n}\n\nexport class DerivedUserPasswordRequiredError extends Error {\n  constructor(public readonly missing: string[]) {\n    super(\n      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,\n    )\n    this.name = 'DerivedUserPasswordRequiredError'\n  }\n}\n\nexport type SetupInitialTenantResult = {\n  tenantId: string\n  organizationId: string\n  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>\n  reusedExistingUser: boolean\n}\n\nexport async function setupInitialTenant(\n  em: EntityManager,\n  options: SetupInitialTenantOptions,\n): Promise<SetupInitialTenantResult> {\n  const {\n    primaryUser,\n    includeDerivedUsers = true,\n    failIfUserExists = false,\n    primaryUserRoles,\n    includeSuperadminRole = true,\n  } = options\n  const primaryRolesInput = primaryUserRoles && primaryUserRoles.length ? primaryUserRoles : ['superadmin']\n  const primaryRoles = includeSuperadminRole\n    ? primaryRolesInput\n    : primaryRolesInput.filter((role) => role !== 'superadmin')\n  if (primaryRoles.length === 0) {\n    throw new Error('PRIMARY_ROLES_REQUIRED')\n  }\n  const defaultRoleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const resolvedRoleNames = includeSuperadminRole\n    ? defaultRoleNames\n    : defaultRoleNames.filter((role) => role !== 'superadmin')\n  const roleNames = Array.from(new Set([...resolvedRoleNames, ...primaryRoles]))\n  const resolvedModules = options.modules ?? tryGetModules()\n  const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)\n\n  const mainEmail = primaryUser.email\n  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })\n  if (existingUser && failIfUserExists) {\n    throw new Error('USER_EXISTS')\n  }\n\n  if (options.orgSlug) {\n    const slugConflict = await findOneWithDecryption(\n      em,\n      Organization,\n      { slug: options.orgSlug },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    if (slugConflict) {\n      throw new OrgSlugExistsError(options.orgSlug)\n    }\n  }\n\n  let tenantId: string | undefined\n  let organizationId: string | undefined\n  let reusedExistingUser = false\n  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []\n\n  await em.transactional(async (tem) => {\n    if (!existingUser) return\n    reusedExistingUser = true\n    tenantId = existingUser.tenantId ? String(existingUser.tenantId) : undefined\n    organizationId = existingUser.organizationId ? String(existingUser.organizationId) : undefined\n    const roleTenantId = normalizeTenantId(existingUser.tenantId ?? null) ?? null\n    if (!roleTenantId) {\n      throw new Error('Cannot reuse a user without a tenantId \u2014 global roles are not supported')\n    }\n\n    await ensureRolesInContext(tem, roleNames, roleTenantId)\n    await tem.flush()\n\n    const requiredRoleSet = new Set([...roleNames, ...primaryRoles])\n    const links = await findWithDecryption(\n      tem,\n      UserRole,\n      { user: existingUser },\n      { populate: ['role'] },\n      { tenantId: roleTenantId, organizationId: null },\n    )\n    const currentRoles = new Set(links.map((link) => link.role.name))\n    for (const roleName of requiredRoleSet) {\n      if (!currentRoles.has(roleName)) {\n        const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n        tem.persist(tem.create(UserRole, { user: existingUser, role, createdAt: new Date() }))\n      }\n    }\n    await tem.flush()\n    const roles = Array.from(new Set([...currentRoles, ...roleNames]))\n    userSnapshots.push({ user: existingUser, roles, created: false })\n  })\n\n  if (!existingUser) {\n    const baseUsers: Array<{\n      email: string\n      roles: string[]\n      name?: string | null\n      passwordHash?: string | null\n      generatedPassword?: string | null\n    }> = [\n      { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },\n    ]\n    if (includeDerivedUsers) {\n      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)\n      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)\n      const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')\n      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')\n      const isProduction = process.env.NODE_ENV === 'production'\n      const allowDemo = options.allowDemoDerivedPasswords === true\n      if (isProduction && !allowDemo) {\n        const missing: string[] = []\n        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')\n        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')\n        if (missing.length) {\n          throw new DerivedUserPasswordRequiredError(missing)\n        }\n      }\n      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so\n      // local dev workflows stay predictable (admin@/employee@ login with the\n      // documented demo password). In production we either have env-supplied\n      // values, or \u2014 for opt-in --include-demo-users flows \u2014 we generate a\n      // random one-time password and surface it via `generatedPassword` so the\n      // operator can capture it. Production callers without env vars and\n      // without the opt-in already threw above.\n      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd\n      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd\n      const adminPasswordHash = await hash(adminPasswordPlain, 10)\n      const employeePasswordHash = await hash(employeePasswordPlain, 10)\n      addUniqueBaseUser(baseUsers, {\n        email: adminEmail,\n        roles: ['admin'],\n        passwordHash: adminPasswordHash,\n        generatedPassword: envAdminPwd ? null : adminPasswordPlain,\n      })\n      addUniqueBaseUser(baseUsers, {\n        email: employeeEmail,\n        roles: ['employee'],\n        passwordHash: employeePasswordHash,\n        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,\n      })\n    }\n    const passwordHash = await resolvePasswordHash(primaryUser)\n\n    await em.transactional(async (tem) => {\n      const tenant = tem.create(Tenant, {\n        name: `${options.orgName} Tenant`,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(tenant)\n      await tem.flush()\n\n      const organization = tem.create(Organization, {\n        name: options.orgName,\n        slug: options.orgSlug ?? null,\n        tenant,\n        isActive: true,\n        depth: 0,\n        ancestorIds: [],\n        childIds: [],\n        descendantIds: [],\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(organization)\n      await tem.flush()\n\n      tenantId = String(tenant.id)\n      organizationId = String(organization.id)\n      const roleTenantId = tenantId\n\n      if (isTenantDataEncryptionEnabled()) {\n        try {\n          const kms = createKmsService()\n          if (kms.isHealthy()) {\n            if (isEncryptionDebugEnabled()) {\n              console.info('\uD83D\uDD11 [encryption][setup] provisioning tenant DEK', { tenantId: String(tenant.id) })\n            }\n            await kms.createTenantDek(String(tenant.id))\n            if (isEncryptionDebugEnabled()) {\n              console.info('\uD83D\uDD11 [encryption][setup] created tenant DEK during setup', { tenantId: String(tenant.id) })\n            }\n          } else {\n            if (isEncryptionDebugEnabled()) {\n              console.warn('\u26A0\uFE0F [encryption][setup] KMS not healthy, skipping tenant DEK creation', { tenantId: String(tenant.id) })\n            }\n          }\n        } catch (err) {\n          if (isEncryptionDebugEnabled()) {\n            console.warn('\u26A0\uFE0F [encryption][setup] Failed to create tenant DEK', err)\n          }\n        }\n      }\n\n      await ensureRolesInContext(tem, roleNames, roleTenantId)\n      await tem.flush()\n\n      if (isTenantDataEncryptionEnabled()) {\n        for (const spec of defaultEncryptionMaps) {\n          const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })\n          if (!existing) {\n            tem.persist(tem.create(EncryptionMap, {\n              entityId: spec.entityId,\n              tenantId: tenant.id,\n              organizationId: organization.id,\n              fieldsJson: spec.fields,\n              isActive: true,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            }))\n          } else {\n            existing.fieldsJson = spec.fields\n            existing.isActive = true\n          }\n        }\n        await tem.flush()\n      }\n    })\n\n    await em.transactional(async (tem) => {\n      if (!tenantId || !organizationId) return\n      const roleTenantId = tenantId\n      const encryptionService = isTenantDataEncryptionEnabled()\n        ? new TenantDataEncryptionService(tem as any, { kms: createKmsService() })\n        : null\n      if (encryptionService) {\n        await encryptionService.invalidateMap('auth:user', String(tenantId), String(organizationId))\n        await encryptionService.invalidateMap('auth:user', String(tenantId), null)\n      }\n\n      for (const base of baseUsers) {\n        const resolvedPasswordHash = base.passwordHash ?? passwordHash\n        let user = await findOneWithDecryption(tem, User, { email: base.email }, {}, { tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n        const confirm = primaryUser.confirm ?? true\n        const encryptedPayload = encryptionService\n          ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)\n          : { email: base.email, emailHash: computeEmailHash(base.email) }\n        if (user) {\n          user.passwordHash = resolvedPasswordHash\n          user.organizationId = organizationId\n          user.tenantId = tenantId\n          if (isTenantDataEncryptionEnabled()) {\n            user.email = encryptedPayload.email as any\n            user.emailHash = (encryptedPayload as any).emailHash ?? computeEmailHash(base.email)\n          }\n          if (base.name) user.name = base.name\n          if (confirm) user.isConfirmed = true\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })\n        } else {\n          user = tem.create(User, {\n            email: (encryptedPayload as any).email ?? base.email,\n            emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,\n            passwordHash: resolvedPasswordHash,\n            organizationId,\n            tenantId,\n            name: base.name ?? undefined,\n            isConfirmed: confirm,\n            createdAt: new Date(),\n          })\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })\n        }\n        await tem.flush()\n        for (const roleName of base.roles) {\n          const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })\n          if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))\n        }\n        await tem.flush()\n      }\n    })\n  }\n\n  if (!tenantId || !organizationId) {\n    throw new Error('SETUP_FAILED')\n  }\n\n  if (!reusedExistingUser) {\n    await rebuildHierarchyForTenant(em, tenantId)\n  }\n\n  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })\n  await deactivateDemoUsersIfSelfOnboardingEnabled(em)\n\n  // Call module onTenantCreated hooks\n  for (const mod of resolvedModules) {\n    if (mod.setup?.onTenantCreated) {\n      await mod.setup.onTenantCreated({ em, tenantId, organizationId })\n    }\n  }\n\n  return {\n    tenantId,\n    organizationId,\n    users: userSnapshots,\n    reusedExistingUser,\n  }\n}\n\nfunction resolvePrimaryName(input: PrimaryUserInput): string | null {\n  if (input.displayName && input.displayName.trim()) return input.displayName.trim()\n  const parts = [input.firstName, input.lastName].map((value) => value?.trim()).filter(Boolean)\n  if (parts.length) return parts.join(' ')\n  return null\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  const value = process.env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction addUniqueBaseUser(\n  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,\n  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },\n) {\n  if (!entry.email) return\n  const normalized = entry.email.toLowerCase()\n  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return\n  baseUsers.push(entry)\n}\n\n/**\n * Well-known demo password seeded for derived admin@/employee@ accounts in\n * non-production (`NODE_ENV !== 'production'`) when no env override is set.\n * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used\n * in production: the production branch either consumes env-supplied values or\n * falls back to `generateDerivedPassword()` so credentials remain non-guessable.\n */\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\n/**\n * Generate a 16-character base64url password (96 bits of entropy) for a derived\n * demo user in production when no env override is provided AND the caller\n * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the\n * `users[].generatedPassword` snapshot so CLI callers can print it to the\n * operator \u2014 there is no other recovery path for these credentials.\n */\nfunction generateDerivedPassword(): string {\n  return randomBytes(12).toString('base64url')\n}\n\nfunction isDemoModeEnabled(): boolean {\n  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  return parsed === false ? false : true\n}\n\nfunction shouldKeepDemoSuperadminDuringInit(): boolean {\n  if (process.env.OM_INIT_FLOW !== 'true') return false\n  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false\n  return isDemoModeEnabled()\n}\n\nasync function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {\n  if (typeof input.hashedPassword === 'string') return input.hashedPassword\n  if (input.password) return hash(input.password, 10)\n  return null\n}\n\nexport async function ensureDefaultRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n  options: { includeSuperadminRole?: boolean } = {},\n) {\n  const includeSuperadminRole = options.includeSuperadminRole ?? true\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const superadminRole = includeSuperadminRole ? await findRoleByName(em, 'superadmin', roleTenantId) : null\n  const adminRole = await findRoleByName(em, 'admin', roleTenantId)\n  const employeeRole = await findRoleByName(em, 'employee', roleTenantId)\n\n  // Merge features from all enabled modules' setup configs\n  const builtInRoles = ['superadmin', 'admin', 'employee'] as const\n  const superadminFeatures: string[] = []\n  const adminFeatures: string[] = []\n  const employeeFeatures: string[] = []\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of modules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)\n    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)\n    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)\n\n    // Collect features for custom roles (any key not in builtInRoles)\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if ((builtInRoles as readonly string[]).includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  console.log('\u2705 Seeded default role features', {\n    superadmin: superadminFeatures,\n    admin: adminFeatures,\n    employee: employeeFeatures,\n    ...(customRoleFeatures.size > 0\n      ? Object.fromEntries(customRoleFeatures)\n      : {}),\n  })\n\n  if (includeSuperadminRole && superadminRole) {\n    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })\n  }\n  if (adminRole) {\n    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)\n  }\n  if (employeeRole) {\n    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)\n  }\n\n  // Seed ACLs for custom roles defined by app modules.\n  // NOTE: Custom roles may not exist yet if they are created in seedDefaults\n  // (which runs after this function). In that case, use ensureCustomRoleAcls()\n  // after seedDefaults to pick them up.\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n    }\n  }\n}\n\n/**\n * Seed ACLs for custom roles defined in module defaultRoleFeatures.\n * Call this AFTER seedDefaults to pick up roles created by app modules.\n * Safe to call multiple times \u2014 ensureRoleAclFor merges features idempotently.\n */\nexport async function ensureCustomRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules?: Module[],\n): Promise<void> {\n  const resolvedModules = modules ?? tryGetModules()\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const builtInRoles = ['superadmin', 'admin', 'employee']\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of resolvedModules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if (builtInRoles.includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  if (customRoleFeatures.size === 0) return\n\n  let seeded = 0\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n      seeded++\n    }\n  }\n  if (seeded > 0) {\n    console.log(`\u2705 Seeded custom role ACLs (${seeded} roles)`)\n  }\n}\n\nasync function ensureRoleAclFor(\n  em: EntityManager,\n  role: Role,\n  tenantId: string,\n  features: string[],\n  options: { isSuperAdmin?: boolean } = {},\n) {\n  const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })\n  if (!existing) {\n    const acl = em.create(RoleAcl, {\n      role,\n      tenantId,\n      featuresJson: features,\n      isSuperAdmin: !!options.isSuperAdmin,\n      createdAt: new Date(),\n    })\n    await em.persist(acl).flush()\n    return\n  }\n  const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []\n  const merged = Array.from(new Set([...currentFeatures, ...features]))\n  const changed =\n    merged.length !== currentFeatures.length ||\n    merged.some((value, index) => value !== currentFeatures[index])\n  if (changed) existing.featuresJson = merged\n  if (options.isSuperAdmin && !existing.isSuperAdmin) {\n    existing.isSuperAdmin = true\n  }\n  if (changed || options.isSuperAdmin) {\n    await em.persist(existing).flush()\n  }\n}\n\n/**\n * Neutralizes every demo account the setup path may have seeded\n * (superadmin, admin, employee \u2014 honoring OM_INIT_*_EMAIL overrides)\n * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not\n * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.\n *\n * Each user is processed in its own try/catch so a single failure (e.g.\n * decryption error on a legacy row) does not skip the remaining accounts.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {\n  if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return\n  if (shouldKeepDemoSuperadminDuringInit()) return\n  for (const { role, email } of resolveDemoUserEmails()) {\n    try {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { email },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!user) continue\n      let dirty = false\n      if (user.passwordHash) {\n        user.passwordHash = null\n        dirty = true\n      }\n      if (user.isConfirmed !== false) {\n        user.isConfirmed = false\n        dirty = true\n      }\n      if (dirty) {\n        await em.persist(user).flush()\n      }\n    } catch (error) {\n      console.error(\n        `[auth.setup] failed to deactivate demo ${role} user (${email})`,\n        error,\n      )\n    }\n  }\n}\n\n/**\n * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}\n * because the helper now neutralizes admin/employee demo accounts in addition\n * to superadmin (security tracker finding #5). Kept as an internal alias to\n * avoid breaking any out-of-tree caller that imported the old name; will be\n * removed in a future major.\n */\nconst deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled\n\n/** Try to get modules from runtime registry; returns empty array if not yet registered. */\nfunction tryGetModules(): Module[] {\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,gCAA6C;AACtD,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAElC,MAAM,qBAAqB,CAAC,YAAY,SAAS,YAAY;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B,sBAAsB,MAAM,GAAG,EAAE,CAAC,KAAK;AAO5E,eAAe,qBACb,IACA,WACA,UACA;AACA,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACjH,QAAI,SAAU;AACd,OAAG,QAAQ,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,YAAY,IAAmB,UAA8B,CAAC,GAAG;AACrF,QAAM,YAAY,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AAC7D,QAAM,WAAW,kBAAkB,QAAQ,YAAY,IAAI;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,uEAAkE;AAAA,EACpF;AACA,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,qBAAqB,KAAK,WAAW,QAAQ;AACnD,UAAM,IAAI,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,eACb,IACA,MACA,UACsB;AACtB,QAAM,mBAAmB,kBAAkB,YAAY,IAAI,KAAK;AAChE,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,UAAU,iBAAiB,GAAG,CAAC,GAAG,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,CAAC;AACvI;AAEA,eAAe,qBACb,IACA,MACA,UACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,MAAM,QAAQ;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACnD,SAAO;AACT;AAYA,MAAM,oBAAoB;AAAA,EACxB,OAAO;AAAA,EACP,UAAU;AACZ;AAeO,SAAS,wBAAyC;AACvD,QAAM,aAAa,aAAa,kBAAkB,KAAK,KAAK,SAAS,4BAA4B;AACjG,QAAM,gBAAgB,aAAa,kBAAkB,QAAQ,KAAK,YAAY,4BAA4B;AAC1G,SAAO;AAAA,IACL,EAAE,MAAM,cAAc,OAAO,sBAAsB;AAAA,IACnD,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,IACnC,EAAE,MAAM,YAAY,OAAO,cAAc;AAAA,EAC3C;AACF;AAmCO,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAA4B,MAAc;AACxC,UAAM,+CAA+C,IAAI,kBAAkB;AADjD;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,yCAAyC,MAAM;AAAA,EAC1D,YAA4B,SAAmB;AAC7C;AAAA,MACE,2CAA2C,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/D;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,mBACpB,IACA,SACmC;AACnC,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA,wBAAwB;AAAA,EAC1B,IAAI;AACJ,QAAM,oBAAoB,oBAAoB,iBAAiB,SAAS,mBAAmB,CAAC,YAAY;AACxG,QAAM,eAAe,wBACjB,oBACA,kBAAkB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC5D,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,mBAAmB,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AACpE,QAAM,oBAAoB,wBACtB,mBACA,iBAAiB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC3D,QAAM,YAAY,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,mBAAmB,GAAG,YAAY,CAAC,CAAC;AAC7E,QAAM,kBAAkB,QAAQ,WAAW,cAAc;AACzD,QAAM,wBAAwB,yBAAyB,eAAe;AAEtE,QAAM,YAAY,YAAY;AAC9B,QAAM,eAAe,MAAM,sBAAsB,IAAI,MAAM,EAAE,OAAO,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC7H,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,QAAI,cAAc;AAChB,YAAM,IAAI,mBAAmB,QAAQ,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,qBAAqB;AACzB,QAAM,gBAA6G,CAAC;AAEpH,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,QAAI,CAAC,aAAc;AACnB,yBAAqB;AACrB,eAAW,aAAa,WAAW,OAAO,aAAa,QAAQ,IAAI;AACnE,qBAAiB,aAAa,iBAAiB,OAAO,aAAa,cAAc,IAAI;AACrF,UAAM,eAAe,kBAAkB,aAAa,YAAY,IAAI,KAAK;AACzE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,8EAAyE;AAAA,IAC3F;AAEA,UAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,UAAM,IAAI,MAAM;AAEhB,UAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAC/D,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,aAAa;AAAA,MACrB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,IACjD;AACA,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AAChE,eAAW,YAAY,iBAAiB;AACtC,UAAI,CAAC,aAAa,IAAI,QAAQ,GAAG;AAC/B,cAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,YAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,cAAc,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AACjE,kBAAc,KAAK,EAAE,MAAM,cAAc,OAAO,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,CAAC,cAAc;AACjB,UAAM,YAMD;AAAA,MACH,EAAE,OAAO,YAAY,OAAO,OAAO,cAAc,MAAM,mBAAmB,WAAW,EAAE;AAAA,IACzF;AACA,QAAI,qBAAqB;AACvB,YAAM,gBAAgB,aAAa,kBAAkB,KAAK;AAC1D,YAAM,mBAAmB,aAAa,kBAAkB,QAAQ;AAChE,YAAM,aAAa,iBAAiB,SAAS,4BAA4B;AACzE,YAAM,gBAAgB,oBAAoB,YAAY,4BAA4B;AAClF,YAAM,cAAc,aAAa,wBAAwB;AACzD,YAAM,iBAAiB,aAAa,2BAA2B;AAC/D,YAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,YAAM,YAAY,QAAQ,8BAA8B;AACxD,UAAI,gBAAgB,CAAC,WAAW;AAC9B,cAAM,UAAoB,CAAC;AAC3B,YAAI,CAAC,YAAa,SAAQ,KAAK,wBAAwB;AACvD,YAAI,CAAC,eAAgB,SAAQ,KAAK,2BAA2B;AAC7D,YAAI,QAAQ,QAAQ;AAClB,gBAAM,IAAI,iCAAiC,OAAO;AAAA,QACpD;AAAA,MACF;AAQA,YAAM,mBAAmB,eAAe,wBAAwB,IAAI;AACpE,YAAM,sBAAsB,eAAe,wBAAwB,IAAI;AACvE,YAAM,qBAAqB,eAAe;AAC1C,YAAM,wBAAwB,kBAAkB;AAChD,YAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE;AAC3D,YAAM,uBAAuB,MAAM,KAAK,uBAAuB,EAAE;AACjE,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,OAAO;AAAA,QACf,cAAc;AAAA,QACd,mBAAmB,cAAc,OAAO;AAAA,MAC1C,CAAC;AACD,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,UAAU;AAAA,QAClB,cAAc;AAAA,QACd,mBAAmB,iBAAiB,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,UAAM,eAAe,MAAM,oBAAoB,WAAW;AAE1D,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,QAChC,MAAM,GAAG,QAAQ,OAAO;AAAA,QACxB,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,MAAM;AAClB,YAAM,IAAI,MAAM;AAEhB,YAAM,eAAe,IAAI,OAAO,cAAc;AAAA,QAC5C,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ,WAAW;AAAA,QACzB;AAAA,QACA,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,CAAC;AAAA,QACd,UAAU,CAAC;AAAA,QACX,eAAe,CAAC;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,YAAY;AACxB,YAAM,IAAI,MAAM;AAEhB,iBAAW,OAAO,OAAO,EAAE;AAC3B,uBAAiB,OAAO,aAAa,EAAE;AACvC,YAAM,eAAe;AAErB,UAAI,8BAA8B,GAAG;AACnC,YAAI;AACF,gBAAM,MAAM,iBAAiB;AAC7B,cAAI,IAAI,UAAU,GAAG;AACnB,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,yDAAkD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAChG;AACA,kBAAM,IAAI,gBAAgB,OAAO,OAAO,EAAE,CAAC;AAC3C,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,iEAA0D,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACxG;AAAA,UACF,OAAO;AACL,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,kFAAwE,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACtH;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,yBAAyB,GAAG;AAC9B,oBAAQ,KAAK,gEAAsD,GAAG;AAAA,UACxE;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,YAAM,IAAI,MAAM;AAEhB,UAAI,8BAA8B,GAAG;AACnC,mBAAW,QAAQ,uBAAuB;AACxC,gBAAM,WAAW,MAAM,sBAAsB,KAAK,eAAe,EAAE,UAAU,KAAK,UAAU,UAAU,OAAO,IAAI,gBAAgB,aAAa,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,gBAAgB,OAAO,aAAa,EAAE,EAAE,CAAC;AACjP,cAAI,CAAC,UAAU;AACb,gBAAI,QAAQ,IAAI,OAAO,eAAe;AAAA,cACpC,UAAU,KAAK;AAAA,cACf,UAAU,OAAO;AAAA,cACjB,gBAAgB,aAAa;AAAA,cAC7B,YAAY,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC,CAAC;AAAA,UACJ,OAAO;AACL,qBAAS,aAAa,KAAK;AAC3B,qBAAS,WAAW;AAAA,UACtB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,eAAe;AACrB,YAAM,oBAAoB,8BAA8B,IACpD,IAAI,4BAA4B,KAAY,EAAE,KAAK,iBAAiB,EAAE,CAAC,IACvE;AACJ,UAAI,mBAAmB;AACrB,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3F,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,IAAI;AAAA,MAC3E;AAEA,iBAAW,QAAQ,WAAW;AAC5B,cAAM,uBAAuB,KAAK,gBAAgB;AAClD,YAAI,OAAO,MAAM,sBAAsB,KAAK,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AACnJ,cAAM,UAAU,YAAY,WAAW;AACvC,cAAM,mBAAmB,oBACrB,MAAM,kBAAkB,qBAAqB,aAAa,EAAE,OAAO,KAAK,MAAM,GAAG,UAAU,cAAc,IACzG,EAAE,OAAO,KAAK,OAAO,WAAW,iBAAiB,KAAK,KAAK,EAAE;AACjE,YAAI,MAAM;AACR,eAAK,eAAe;AACpB,eAAK,iBAAiB;AACtB,eAAK,WAAW;AAChB,cAAI,8BAA8B,GAAG;AACnC,iBAAK,QAAQ,iBAAiB;AAC9B,iBAAK,YAAa,iBAAyB,aAAa,iBAAiB,KAAK,KAAK;AAAA,UACrF;AACA,cAAI,KAAK,KAAM,MAAK,OAAO,KAAK;AAChC,cAAI,QAAS,MAAK,cAAc;AAChC,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QACnH,OAAO;AACL,iBAAO,IAAI,OAAO,MAAM;AAAA,YACtB,OAAQ,iBAAyB,SAAS,KAAK;AAAA,YAC/C,WAAW,8BAA8B,IAAK,iBAAyB,aAAa,iBAAiB,KAAK,KAAK,IAAI;AAAA,YACnH,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA,MAAM,KAAK,QAAQ;AAAA,YACnB,aAAa;AAAA,YACb,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QAClH;AACA,cAAM,IAAI,MAAM;AAChB,mBAAW,YAAY,KAAK,OAAO;AACjC,gBAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,gBAAM,eAAe,MAAM,sBAAsB,KAAK,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,KAAK,CAAC;AACxI,cAAI,CAAC,aAAc,KAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,QAC5F;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,cAAc;AAAA,EAChC;AAEA,MAAI,CAAC,oBAAoB;AACvB,UAAM,0BAA0B,IAAI,QAAQ;AAAA,EAC9C;AAEA,QAAM,sBAAsB,IAAI,UAAU,iBAAiB,EAAE,sBAAsB,CAAC;AACpF,QAAM,2CAA2C,EAAE;AAGnD,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,OAAO,iBAAiB;AAC9B,YAAM,IAAI,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,MAAM,eAAe,MAAM,YAAY,KAAK,EAAG,QAAO,MAAM,YAAY,KAAK;AACjF,QAAM,QAAQ,CAAC,MAAM,WAAW,MAAM,QAAQ,EAAE,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F,MAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AACvC,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,kBACP,WACA,OACA;AACA,MAAI,CAAC,MAAM,MAAO;AAClB,QAAM,aAAa,MAAM,MAAM,YAAY;AAC3C,MAAI,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,YAAY,MAAM,UAAU,EAAG;AACvE,YAAU,KAAK,KAAK;AACtB;AASA,MAAM,wBAAwB;AAS9B,SAAS,0BAAkC;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AAC5D,SAAO,WAAW,QAAQ,QAAQ;AACpC;AAEA,SAAS,qCAA8C;AACrD,MAAI,QAAQ,IAAI,iBAAiB,OAAQ,QAAO;AAChD,MAAI,CAAC,aAAa,0BAA0B,EAAG,QAAO;AACtD,SAAO,kBAAkB;AAC3B;AAEA,eAAe,oBAAoB,OAAiD;AAClF,MAAI,OAAO,MAAM,mBAAmB,SAAU,QAAO,MAAM;AAC3D,MAAI,MAAM,SAAU,QAAO,KAAK,MAAM,UAAU,EAAE;AAClD,SAAO;AACT;AAEA,eAAsB,sBACpB,IACA,UACA,SACA,UAA+C,CAAC,GAChD;AACA,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,iBAAiB,wBAAwB,MAAM,eAAe,IAAI,cAAc,YAAY,IAAI;AACtG,QAAM,YAAY,MAAM,eAAe,IAAI,SAAS,YAAY;AAChE,QAAM,eAAe,MAAM,eAAe,IAAI,YAAY,YAAY;AAGtE,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAA+B,CAAC;AACtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,SAAS;AACzB,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,QAAI,aAAa,WAAY,oBAAmB,KAAK,GAAG,aAAa,UAAU;AAC/E,QAAI,aAAa,MAAO,eAAc,KAAK,GAAG,aAAa,KAAK;AAChE,QAAI,aAAa,SAAU,kBAAiB,KAAK,GAAG,aAAa,QAAQ;AAGzE,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAK,aAAmC,SAAS,QAAQ,EAAG;AAC5D,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,UAAQ,IAAI,uCAAkC;AAAA,IAC5C,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,GAAI,mBAAmB,OAAO,IAC1B,OAAO,YAAY,kBAAkB,IACrC,CAAC;AAAA,EACP,CAAC;AAED,MAAI,yBAAyB,gBAAgB;AAC3C,UAAM,iBAAiB,IAAI,gBAAgB,UAAU,oBAAoB,EAAE,cAAc,KAAK,CAAC;AAAA,EACjG;AACA,MAAI,WAAW;AACb,UAAM,iBAAiB,IAAI,WAAW,UAAU,aAAa;AAAA,EAC/D;AACA,MAAI,cAAc;AAChB,UAAM,iBAAiB,IAAI,cAAc,UAAU,gBAAgB;AAAA,EACrE;AAMA,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AAAA,IACrD;AAAA,EACF;AACF;AAOA,eAAsB,qBACpB,IACA,UACA,SACe;AACf,QAAM,kBAAkB,WAAW,cAAc;AACjD,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,iBAAiB;AACjC,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAI,aAAa,SAAS,QAAQ,EAAG;AACrC,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,mBAAmB,SAAS,EAAG;AAEnC,MAAI,SAAS;AACb,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,GAAG;AACd,YAAQ,IAAI,mCAA8B,MAAM,SAAS;AAAA,EAC3D;AACF;AAEA,eAAe,iBACb,IACA,MACA,UACA,UACA,UAAsC,CAAC,GACvC;AACA,QAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACpH,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,GAAG,OAAO,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc,CAAC,CAAC,QAAQ;AAAA,MACxB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,QAAQ,SAAS,YAAY,IAAI,SAAS,eAAe,CAAC;AACxF,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AACpE,QAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,MAAI,QAAS,UAAS,eAAe;AACrC,MAAI,QAAQ,gBAAgB,CAAC,SAAS,cAAc;AAClD,aAAS,eAAe;AAAA,EAC1B;AACA,MAAI,WAAW,QAAQ,cAAc;AACnC,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC;AACF;AAaA,eAAsB,2CAA2C,IAAmB;AAClF,MAAI,QAAQ,IAAI,oCAAoC,OAAQ;AAC5D,MAAI,mCAAmC,EAAG;AAC1C,aAAW,EAAE,MAAM,MAAM,KAAK,sBAAsB,GAAG;AACrD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,MAAM;AAAA,QACR,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,KAAM;AACX,UAAI,QAAQ;AACZ,UAAI,KAAK,cAAc;AACrB,aAAK,eAAe;AACpB,gBAAQ;AAAA,MACV;AACA,UAAI,KAAK,gBAAgB,OAAO;AAC9B,aAAK,cAAc;AACnB,gBAAQ;AAAA,MACV;AACA,UAAI,OAAO;AACT,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,0CAA0C,IAAI,UAAU,KAAK;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AASA,MAAM,kDAAkD;AAGxD,SAAS,gBAA0B;AACjC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { hash } from 'bcryptjs'\nimport { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { normalizeTenantId } from './tenantAccess'\nimport { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nconst DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const\nconst DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'\nconst DEFAULT_DERIVED_EMAIL_DOMAIN = DEMO_SUPERADMIN_EMAIL.split('@')[1] ?? 'acme.com'\n\nexport type EnsureRolesOptions = {\n  roleNames?: string[]\n  tenantId?: string\n}\n\nasync function ensureRolesInContext(\n  em: EntityManager,\n  roleNames: string[],\n  tenantId: string,\n) {\n  for (const name of roleNames) {\n    const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })\n    if (existing) continue\n    em.persist(em.create(Role, { name, tenantId, createdAt: new Date() }))\n  }\n}\n\nexport async function ensureRoles(em: EntityManager, options: EnsureRolesOptions = {}) {\n  const roleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const tenantId = normalizeTenantId(options.tenantId ?? null)\n  if (!tenantId) {\n    throw new Error('ensureRoles requires a tenantId \u2014 global roles are not supported')\n  }\n  await em.transactional(async (tem) => {\n    await ensureRolesInContext(tem, roleNames, tenantId)\n    await tem.flush()\n  })\n}\n\nasync function findRoleByName(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const normalizedTenant = normalizeTenantId(tenantId ?? null) ?? null\n  return findOneWithDecryption(em, Role, { name, tenantId: normalizedTenant }, {}, { tenantId: normalizedTenant, organizationId: null })\n}\n\nasync function findRoleByNameOrFail(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role> {\n  const role = await findRoleByName(em, name, tenantId)\n  if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`)\n  return role\n}\n\ntype PrimaryUserInput = {\n  email: string\n  password?: string\n  hashedPassword?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  displayName?: string | null\n  confirm?: boolean\n}\n\nconst DERIVED_EMAIL_ENV = {\n  admin: 'OM_INIT_ADMIN_EMAIL',\n  employee: 'OM_INIT_EMPLOYEE_EMAIL',\n} as const\n\nexport type DemoUserRole = 'superadmin' | 'admin' | 'employee'\nexport type DemoUserEmail = { role: DemoUserRole; email: string }\n\n/**\n * Returns the canonical list of demo user emails the setup path may have\n * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the\n * same way the derived-user seeding branch does, so the deactivation loop\n * never drifts from the seeding loop.\n *\n * Pure function \u2014 no side effects, safe to unit-test in isolation.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport function resolveDemoUserEmails(): DemoUserEmail[] {\n  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  return [\n    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },\n    { role: 'admin', email: adminEmail },\n    { role: 'employee', email: employeeEmail },\n  ]\n}\n\nexport type SetupInitialTenantOptions = {\n  orgName: string\n  primaryUser: PrimaryUserInput\n  roleNames?: string[]\n  includeDerivedUsers?: boolean\n  failIfUserExists?: boolean\n  primaryUserRoles?: string[]\n  includeSuperadminRole?: boolean\n  /** Optional list of enabled modules. When provided, module setup hooks are called. */\n  modules?: Module[]\n  /**\n   * Optional global slug to persist on the new Organization. When set, a\n   * pre-flight uniqueness check across all tenants throws OrgSlugExistsError\n   * on collision so scriptable callers can fail loudly instead of silently\n   * reusing or clobbering an existing organization.\n   */\n  orgSlug?: string\n  /**\n   * Opt-in flag that allows seeding the derived admin/employee accounts when\n   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.\n   *\n   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are\n   *   seeded with the well-known `'secret'` password so local dev workflows\n   *   (e.g. `mercato init`) stay predictable for developers.\n   * - In production: the fallback uses a randomly generated 96-bit password\n   *   (printed once by the CLI) so an operator who deliberately opts in still\n   *   avoids the historical hardcoded credential. When this flag is false/unset\n   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`\n   *   is thrown instead of silently seeding any account.\n   */\n  allowDemoDerivedPasswords?: boolean\n}\n\nexport class OrgSlugExistsError extends Error {\n  constructor(public readonly slug: string) {\n    super(`ORG_SLUG_EXISTS: an organization with slug \"${slug}\" already exists`)\n    this.name = 'OrgSlugExistsError'\n  }\n}\n\nexport class DerivedUserPasswordRequiredError extends Error {\n  constructor(public readonly missing: string[]) {\n    super(\n      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,\n    )\n    this.name = 'DerivedUserPasswordRequiredError'\n  }\n}\n\nexport type SetupInitialTenantResult = {\n  tenantId: string\n  organizationId: string\n  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>\n  reusedExistingUser: boolean\n}\n\nexport async function setupInitialTenant(\n  em: EntityManager,\n  options: SetupInitialTenantOptions,\n): Promise<SetupInitialTenantResult> {\n  const {\n    primaryUser,\n    includeDerivedUsers = true,\n    failIfUserExists = false,\n    primaryUserRoles,\n    includeSuperadminRole = true,\n  } = options\n  const primaryRolesInput = primaryUserRoles && primaryUserRoles.length ? primaryUserRoles : ['superadmin']\n  const primaryRoles = includeSuperadminRole\n    ? primaryRolesInput\n    : primaryRolesInput.filter((role) => role !== 'superadmin')\n  if (primaryRoles.length === 0) {\n    throw new Error('PRIMARY_ROLES_REQUIRED')\n  }\n  const defaultRoleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const resolvedRoleNames = includeSuperadminRole\n    ? defaultRoleNames\n    : defaultRoleNames.filter((role) => role !== 'superadmin')\n  const roleNames = Array.from(new Set([...resolvedRoleNames, ...primaryRoles]))\n  const resolvedModules = options.modules ?? tryGetModules()\n  const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)\n\n  const mainEmail = primaryUser.email\n  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })\n  if (existingUser && failIfUserExists) {\n    throw new Error('USER_EXISTS')\n  }\n\n  if (options.orgSlug) {\n    const slugConflict = await findOneWithDecryption(\n      em,\n      Organization,\n      { slug: options.orgSlug },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    if (slugConflict) {\n      throw new OrgSlugExistsError(options.orgSlug)\n    }\n  }\n\n  let tenantId: string | undefined\n  let organizationId: string | undefined\n  let reusedExistingUser = false\n  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []\n\n  await em.transactional(async (tem) => {\n    if (!existingUser) return\n    reusedExistingUser = true\n    tenantId = existingUser.tenantId ? String(existingUser.tenantId) : undefined\n    organizationId = existingUser.organizationId ? String(existingUser.organizationId) : undefined\n    const roleTenantId = normalizeTenantId(existingUser.tenantId ?? null) ?? null\n    if (!roleTenantId) {\n      throw new Error('Cannot reuse a user without a tenantId \u2014 global roles are not supported')\n    }\n\n    await ensureRolesInContext(tem, roleNames, roleTenantId)\n    await tem.flush()\n\n    const requiredRoleSet = new Set([...roleNames, ...primaryRoles])\n    const links = await findWithDecryption(\n      tem,\n      UserRole,\n      { user: existingUser },\n      { populate: ['role'] },\n      { tenantId: roleTenantId, organizationId: null },\n    )\n    const currentRoles = new Set(links.map((link) => link.role.name))\n    for (const roleName of requiredRoleSet) {\n      if (!currentRoles.has(roleName)) {\n        const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n        tem.persist(tem.create(UserRole, { user: existingUser, role, createdAt: new Date() }))\n      }\n    }\n    await tem.flush()\n    const roles = Array.from(new Set([...currentRoles, ...roleNames]))\n    userSnapshots.push({ user: existingUser, roles, created: false })\n  })\n\n  if (!existingUser) {\n    const baseUsers: Array<{\n      email: string\n      roles: string[]\n      name?: string | null\n      passwordHash?: string | null\n      generatedPassword?: string | null\n    }> = [\n      { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },\n    ]\n    if (includeDerivedUsers) {\n      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)\n      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)\n      const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')\n      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')\n      const isProduction = process.env.NODE_ENV === 'production'\n      const allowDemo = options.allowDemoDerivedPasswords === true\n      if (isProduction && !allowDemo) {\n        const missing: string[] = []\n        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')\n        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')\n        if (missing.length) {\n          throw new DerivedUserPasswordRequiredError(missing)\n        }\n      }\n      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so\n      // local dev workflows stay predictable (admin@/employee@ login with the\n      // documented demo password). In production we either have env-supplied\n      // values, or \u2014 for opt-in --include-demo-users flows \u2014 we generate a\n      // random one-time password and surface it via `generatedPassword` so the\n      // operator can capture it. Production callers without env vars and\n      // without the opt-in already threw above.\n      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd\n      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd\n      const adminPasswordHash = await hash(adminPasswordPlain, 10)\n      const employeePasswordHash = await hash(employeePasswordPlain, 10)\n      addUniqueBaseUser(baseUsers, {\n        email: adminEmail,\n        roles: ['admin'],\n        passwordHash: adminPasswordHash,\n        generatedPassword: envAdminPwd ? null : adminPasswordPlain,\n      })\n      addUniqueBaseUser(baseUsers, {\n        email: employeeEmail,\n        roles: ['employee'],\n        passwordHash: employeePasswordHash,\n        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,\n      })\n    }\n    const passwordHash = await resolvePasswordHash(primaryUser)\n\n    await em.transactional(async (tem) => {\n      const tenant = tem.create(Tenant, {\n        name: options.orgName,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(tenant)\n      await tem.flush()\n\n      const organization = tem.create(Organization, {\n        name: options.orgName,\n        slug: options.orgSlug ?? null,\n        tenant,\n        isActive: true,\n        depth: 0,\n        ancestorIds: [],\n        childIds: [],\n        descendantIds: [],\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(organization)\n      await tem.flush()\n\n      tenantId = String(tenant.id)\n      organizationId = String(organization.id)\n      const roleTenantId = tenantId\n\n      if (isTenantDataEncryptionEnabled()) {\n        try {\n          const kms = createKmsService()\n          if (kms.isHealthy()) {\n            if (isEncryptionDebugEnabled()) {\n              console.info('\uD83D\uDD11 [encryption][setup] provisioning tenant DEK', { tenantId: String(tenant.id) })\n            }\n            await kms.createTenantDek(String(tenant.id))\n            if (isEncryptionDebugEnabled()) {\n              console.info('\uD83D\uDD11 [encryption][setup] created tenant DEK during setup', { tenantId: String(tenant.id) })\n            }\n          } else {\n            if (isEncryptionDebugEnabled()) {\n              console.warn('\u26A0\uFE0F [encryption][setup] KMS not healthy, skipping tenant DEK creation', { tenantId: String(tenant.id) })\n            }\n          }\n        } catch (err) {\n          if (isEncryptionDebugEnabled()) {\n            console.warn('\u26A0\uFE0F [encryption][setup] Failed to create tenant DEK', err)\n          }\n        }\n      }\n\n      await ensureRolesInContext(tem, roleNames, roleTenantId)\n      await tem.flush()\n\n      if (isTenantDataEncryptionEnabled()) {\n        for (const spec of defaultEncryptionMaps) {\n          const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })\n          if (!existing) {\n            tem.persist(tem.create(EncryptionMap, {\n              entityId: spec.entityId,\n              tenantId: tenant.id,\n              organizationId: organization.id,\n              fieldsJson: spec.fields,\n              isActive: true,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            }))\n          } else {\n            existing.fieldsJson = spec.fields\n            existing.isActive = true\n          }\n        }\n        await tem.flush()\n      }\n    })\n\n    await em.transactional(async (tem) => {\n      if (!tenantId || !organizationId) return\n      const roleTenantId = tenantId\n      const encryptionService = isTenantDataEncryptionEnabled()\n        ? new TenantDataEncryptionService(tem as any, { kms: createKmsService() })\n        : null\n      if (encryptionService) {\n        await encryptionService.invalidateMap('auth:user', String(tenantId), String(organizationId))\n        await encryptionService.invalidateMap('auth:user', String(tenantId), null)\n      }\n\n      for (const base of baseUsers) {\n        const resolvedPasswordHash = base.passwordHash ?? passwordHash\n        let user = await findOneWithDecryption(tem, User, { email: base.email }, {}, { tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n        const confirm = primaryUser.confirm ?? true\n        const encryptedPayload = encryptionService\n          ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)\n          : { email: base.email, emailHash: computeEmailHash(base.email) }\n        if (user) {\n          user.passwordHash = resolvedPasswordHash\n          user.organizationId = organizationId\n          user.tenantId = tenantId\n          if (isTenantDataEncryptionEnabled()) {\n            user.email = encryptedPayload.email as any\n            user.emailHash = (encryptedPayload as any).emailHash ?? computeEmailHash(base.email)\n          }\n          if (base.name) user.name = base.name\n          if (confirm) user.isConfirmed = true\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })\n        } else {\n          user = tem.create(User, {\n            email: (encryptedPayload as any).email ?? base.email,\n            emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,\n            passwordHash: resolvedPasswordHash,\n            organizationId,\n            tenantId,\n            name: base.name ?? undefined,\n            isConfirmed: confirm,\n            createdAt: new Date(),\n          })\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })\n        }\n        await tem.flush()\n        for (const roleName of base.roles) {\n          const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })\n          if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))\n        }\n        await tem.flush()\n      }\n    })\n  }\n\n  if (!tenantId || !organizationId) {\n    throw new Error('SETUP_FAILED')\n  }\n\n  if (!reusedExistingUser) {\n    await rebuildHierarchyForTenant(em, tenantId)\n  }\n\n  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })\n  await deactivateDemoUsersIfSelfOnboardingEnabled(em)\n\n  // Call module onTenantCreated hooks\n  for (const mod of resolvedModules) {\n    if (mod.setup?.onTenantCreated) {\n      await mod.setup.onTenantCreated({ em, tenantId, organizationId })\n    }\n  }\n\n  return {\n    tenantId,\n    organizationId,\n    users: userSnapshots,\n    reusedExistingUser,\n  }\n}\n\nfunction resolvePrimaryName(input: PrimaryUserInput): string | null {\n  if (input.displayName && input.displayName.trim()) return input.displayName.trim()\n  const parts = [input.firstName, input.lastName].map((value) => value?.trim()).filter(Boolean)\n  if (parts.length) return parts.join(' ')\n  return null\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  const value = process.env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction addUniqueBaseUser(\n  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,\n  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },\n) {\n  if (!entry.email) return\n  const normalized = entry.email.toLowerCase()\n  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return\n  baseUsers.push(entry)\n}\n\n/**\n * Well-known demo password seeded for derived admin@/employee@ accounts in\n * non-production (`NODE_ENV !== 'production'`) when no env override is set.\n * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used\n * in production: the production branch either consumes env-supplied values or\n * falls back to `generateDerivedPassword()` so credentials remain non-guessable.\n */\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\n/**\n * Generate a 16-character base64url password (96 bits of entropy) for a derived\n * demo user in production when no env override is provided AND the caller\n * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the\n * `users[].generatedPassword` snapshot so CLI callers can print it to the\n * operator \u2014 there is no other recovery path for these credentials.\n */\nfunction generateDerivedPassword(): string {\n  return randomBytes(12).toString('base64url')\n}\n\nfunction isDemoModeEnabled(): boolean {\n  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  return parsed === false ? false : true\n}\n\nfunction shouldKeepDemoSuperadminDuringInit(): boolean {\n  if (process.env.OM_INIT_FLOW !== 'true') return false\n  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false\n  return isDemoModeEnabled()\n}\n\nasync function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {\n  if (typeof input.hashedPassword === 'string') return input.hashedPassword\n  if (input.password) return hash(input.password, 10)\n  return null\n}\n\nexport async function ensureDefaultRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n  options: { includeSuperadminRole?: boolean } = {},\n) {\n  const includeSuperadminRole = options.includeSuperadminRole ?? true\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const superadminRole = includeSuperadminRole ? await findRoleByName(em, 'superadmin', roleTenantId) : null\n  const adminRole = await findRoleByName(em, 'admin', roleTenantId)\n  const employeeRole = await findRoleByName(em, 'employee', roleTenantId)\n\n  // Merge features from all enabled modules' setup configs\n  const builtInRoles = ['superadmin', 'admin', 'employee'] as const\n  const superadminFeatures: string[] = []\n  const adminFeatures: string[] = []\n  const employeeFeatures: string[] = []\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of modules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)\n    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)\n    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)\n\n    // Collect features for custom roles (any key not in builtInRoles)\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if ((builtInRoles as readonly string[]).includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  console.log('\u2705 Seeded default role features', {\n    superadmin: superadminFeatures,\n    admin: adminFeatures,\n    employee: employeeFeatures,\n    ...(customRoleFeatures.size > 0\n      ? Object.fromEntries(customRoleFeatures)\n      : {}),\n  })\n\n  if (includeSuperadminRole && superadminRole) {\n    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })\n  }\n  if (adminRole) {\n    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)\n  }\n  if (employeeRole) {\n    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)\n  }\n\n  // Seed ACLs for custom roles defined by app modules.\n  // NOTE: Custom roles may not exist yet if they are created in seedDefaults\n  // (which runs after this function). In that case, use ensureCustomRoleAcls()\n  // after seedDefaults to pick them up.\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n    }\n  }\n}\n\n/**\n * Seed ACLs for custom roles defined in module defaultRoleFeatures.\n * Call this AFTER seedDefaults to pick up roles created by app modules.\n * Safe to call multiple times \u2014 ensureRoleAclFor merges features idempotently.\n */\nexport async function ensureCustomRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules?: Module[],\n): Promise<void> {\n  const resolvedModules = modules ?? tryGetModules()\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const builtInRoles = ['superadmin', 'admin', 'employee']\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of resolvedModules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if (builtInRoles.includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  if (customRoleFeatures.size === 0) return\n\n  let seeded = 0\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n      seeded++\n    }\n  }\n  if (seeded > 0) {\n    console.log(`\u2705 Seeded custom role ACLs (${seeded} roles)`)\n  }\n}\n\nasync function ensureRoleAclFor(\n  em: EntityManager,\n  role: Role,\n  tenantId: string,\n  features: string[],\n  options: { isSuperAdmin?: boolean } = {},\n) {\n  const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })\n  if (!existing) {\n    const acl = em.create(RoleAcl, {\n      role,\n      tenantId,\n      featuresJson: features,\n      isSuperAdmin: !!options.isSuperAdmin,\n      createdAt: new Date(),\n    })\n    await em.persist(acl).flush()\n    return\n  }\n  const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []\n  const merged = Array.from(new Set([...currentFeatures, ...features]))\n  const changed =\n    merged.length !== currentFeatures.length ||\n    merged.some((value, index) => value !== currentFeatures[index])\n  if (changed) existing.featuresJson = merged\n  if (options.isSuperAdmin && !existing.isSuperAdmin) {\n    existing.isSuperAdmin = true\n  }\n  if (changed || options.isSuperAdmin) {\n    await em.persist(existing).flush()\n  }\n}\n\n/**\n * Neutralizes every demo account the setup path may have seeded\n * (superadmin, admin, employee \u2014 honoring OM_INIT_*_EMAIL overrides)\n * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not\n * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.\n *\n * Each user is processed in its own try/catch so a single failure (e.g.\n * decryption error on a legacy row) does not skip the remaining accounts.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {\n  if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return\n  if (shouldKeepDemoSuperadminDuringInit()) return\n  for (const { role, email } of resolveDemoUserEmails()) {\n    try {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { email },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!user) continue\n      let dirty = false\n      if (user.passwordHash) {\n        user.passwordHash = null\n        dirty = true\n      }\n      if (user.isConfirmed !== false) {\n        user.isConfirmed = false\n        dirty = true\n      }\n      if (dirty) {\n        await em.persist(user).flush()\n      }\n    } catch (error) {\n      console.error(\n        `[auth.setup] failed to deactivate demo ${role} user (${email})`,\n        error,\n      )\n    }\n  }\n}\n\n/**\n * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}\n * because the helper now neutralizes admin/employee demo accounts in addition\n * to superadmin (security tracker finding #5). Kept as an internal alias to\n * avoid breaking any out-of-tree caller that imported the old name; will be\n * removed in a future major.\n */\nconst deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled\n\n/** Try to get modules from runtime registry; returns empty array if not yet registered. */\nfunction tryGetModules(): Module[] {\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,gCAA6C;AACtD,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAElC,MAAM,qBAAqB,CAAC,YAAY,SAAS,YAAY;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B,sBAAsB,MAAM,GAAG,EAAE,CAAC,KAAK;AAO5E,eAAe,qBACb,IACA,WACA,UACA;AACA,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACjH,QAAI,SAAU;AACd,OAAG,QAAQ,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,YAAY,IAAmB,UAA8B,CAAC,GAAG;AACrF,QAAM,YAAY,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AAC7D,QAAM,WAAW,kBAAkB,QAAQ,YAAY,IAAI;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,uEAAkE;AAAA,EACpF;AACA,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,qBAAqB,KAAK,WAAW,QAAQ;AACnD,UAAM,IAAI,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,eACb,IACA,MACA,UACsB;AACtB,QAAM,mBAAmB,kBAAkB,YAAY,IAAI,KAAK;AAChE,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,UAAU,iBAAiB,GAAG,CAAC,GAAG,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,CAAC;AACvI;AAEA,eAAe,qBACb,IACA,MACA,UACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,MAAM,QAAQ;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACnD,SAAO;AACT;AAYA,MAAM,oBAAoB;AAAA,EACxB,OAAO;AAAA,EACP,UAAU;AACZ;AAeO,SAAS,wBAAyC;AACvD,QAAM,aAAa,aAAa,kBAAkB,KAAK,KAAK,SAAS,4BAA4B;AACjG,QAAM,gBAAgB,aAAa,kBAAkB,QAAQ,KAAK,YAAY,4BAA4B;AAC1G,SAAO;AAAA,IACL,EAAE,MAAM,cAAc,OAAO,sBAAsB;AAAA,IACnD,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,IACnC,EAAE,MAAM,YAAY,OAAO,cAAc;AAAA,EAC3C;AACF;AAmCO,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAA4B,MAAc;AACxC,UAAM,+CAA+C,IAAI,kBAAkB;AADjD;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,yCAAyC,MAAM;AAAA,EAC1D,YAA4B,SAAmB;AAC7C;AAAA,MACE,2CAA2C,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/D;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,mBACpB,IACA,SACmC;AACnC,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA,wBAAwB;AAAA,EAC1B,IAAI;AACJ,QAAM,oBAAoB,oBAAoB,iBAAiB,SAAS,mBAAmB,CAAC,YAAY;AACxG,QAAM,eAAe,wBACjB,oBACA,kBAAkB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC5D,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,mBAAmB,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AACpE,QAAM,oBAAoB,wBACtB,mBACA,iBAAiB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC3D,QAAM,YAAY,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,mBAAmB,GAAG,YAAY,CAAC,CAAC;AAC7E,QAAM,kBAAkB,QAAQ,WAAW,cAAc;AACzD,QAAM,wBAAwB,yBAAyB,eAAe;AAEtE,QAAM,YAAY,YAAY;AAC9B,QAAM,eAAe,MAAM,sBAAsB,IAAI,MAAM,EAAE,OAAO,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC7H,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,QAAI,cAAc;AAChB,YAAM,IAAI,mBAAmB,QAAQ,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,qBAAqB;AACzB,QAAM,gBAA6G,CAAC;AAEpH,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,QAAI,CAAC,aAAc;AACnB,yBAAqB;AACrB,eAAW,aAAa,WAAW,OAAO,aAAa,QAAQ,IAAI;AACnE,qBAAiB,aAAa,iBAAiB,OAAO,aAAa,cAAc,IAAI;AACrF,UAAM,eAAe,kBAAkB,aAAa,YAAY,IAAI,KAAK;AACzE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,8EAAyE;AAAA,IAC3F;AAEA,UAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,UAAM,IAAI,MAAM;AAEhB,UAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAC/D,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,aAAa;AAAA,MACrB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,IACjD;AACA,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AAChE,eAAW,YAAY,iBAAiB;AACtC,UAAI,CAAC,aAAa,IAAI,QAAQ,GAAG;AAC/B,cAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,YAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,cAAc,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AACjE,kBAAc,KAAK,EAAE,MAAM,cAAc,OAAO,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,CAAC,cAAc;AACjB,UAAM,YAMD;AAAA,MACH,EAAE,OAAO,YAAY,OAAO,OAAO,cAAc,MAAM,mBAAmB,WAAW,EAAE;AAAA,IACzF;AACA,QAAI,qBAAqB;AACvB,YAAM,gBAAgB,aAAa,kBAAkB,KAAK;AAC1D,YAAM,mBAAmB,aAAa,kBAAkB,QAAQ;AAChE,YAAM,aAAa,iBAAiB,SAAS,4BAA4B;AACzE,YAAM,gBAAgB,oBAAoB,YAAY,4BAA4B;AAClF,YAAM,cAAc,aAAa,wBAAwB;AACzD,YAAM,iBAAiB,aAAa,2BAA2B;AAC/D,YAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,YAAM,YAAY,QAAQ,8BAA8B;AACxD,UAAI,gBAAgB,CAAC,WAAW;AAC9B,cAAM,UAAoB,CAAC;AAC3B,YAAI,CAAC,YAAa,SAAQ,KAAK,wBAAwB;AACvD,YAAI,CAAC,eAAgB,SAAQ,KAAK,2BAA2B;AAC7D,YAAI,QAAQ,QAAQ;AAClB,gBAAM,IAAI,iCAAiC,OAAO;AAAA,QACpD;AAAA,MACF;AAQA,YAAM,mBAAmB,eAAe,wBAAwB,IAAI;AACpE,YAAM,sBAAsB,eAAe,wBAAwB,IAAI;AACvE,YAAM,qBAAqB,eAAe;AAC1C,YAAM,wBAAwB,kBAAkB;AAChD,YAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE;AAC3D,YAAM,uBAAuB,MAAM,KAAK,uBAAuB,EAAE;AACjE,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,OAAO;AAAA,QACf,cAAc;AAAA,QACd,mBAAmB,cAAc,OAAO;AAAA,MAC1C,CAAC;AACD,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,UAAU;AAAA,QAClB,cAAc;AAAA,QACd,mBAAmB,iBAAiB,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,UAAM,eAAe,MAAM,oBAAoB,WAAW;AAE1D,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,QAChC,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,MAAM;AAClB,YAAM,IAAI,MAAM;AAEhB,YAAM,eAAe,IAAI,OAAO,cAAc;AAAA,QAC5C,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ,WAAW;AAAA,QACzB;AAAA,QACA,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,CAAC;AAAA,QACd,UAAU,CAAC;AAAA,QACX,eAAe,CAAC;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,YAAY;AACxB,YAAM,IAAI,MAAM;AAEhB,iBAAW,OAAO,OAAO,EAAE;AAC3B,uBAAiB,OAAO,aAAa,EAAE;AACvC,YAAM,eAAe;AAErB,UAAI,8BAA8B,GAAG;AACnC,YAAI;AACF,gBAAM,MAAM,iBAAiB;AAC7B,cAAI,IAAI,UAAU,GAAG;AACnB,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,yDAAkD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAChG;AACA,kBAAM,IAAI,gBAAgB,OAAO,OAAO,EAAE,CAAC;AAC3C,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,iEAA0D,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACxG;AAAA,UACF,OAAO;AACL,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,kFAAwE,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACtH;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,yBAAyB,GAAG;AAC9B,oBAAQ,KAAK,gEAAsD,GAAG;AAAA,UACxE;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,YAAM,IAAI,MAAM;AAEhB,UAAI,8BAA8B,GAAG;AACnC,mBAAW,QAAQ,uBAAuB;AACxC,gBAAM,WAAW,MAAM,sBAAsB,KAAK,eAAe,EAAE,UAAU,KAAK,UAAU,UAAU,OAAO,IAAI,gBAAgB,aAAa,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,gBAAgB,OAAO,aAAa,EAAE,EAAE,CAAC;AACjP,cAAI,CAAC,UAAU;AACb,gBAAI,QAAQ,IAAI,OAAO,eAAe;AAAA,cACpC,UAAU,KAAK;AAAA,cACf,UAAU,OAAO;AAAA,cACjB,gBAAgB,aAAa;AAAA,cAC7B,YAAY,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC,CAAC;AAAA,UACJ,OAAO;AACL,qBAAS,aAAa,KAAK;AAC3B,qBAAS,WAAW;AAAA,UACtB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,eAAe;AACrB,YAAM,oBAAoB,8BAA8B,IACpD,IAAI,4BAA4B,KAAY,EAAE,KAAK,iBAAiB,EAAE,CAAC,IACvE;AACJ,UAAI,mBAAmB;AACrB,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3F,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,IAAI;AAAA,MAC3E;AAEA,iBAAW,QAAQ,WAAW;AAC5B,cAAM,uBAAuB,KAAK,gBAAgB;AAClD,YAAI,OAAO,MAAM,sBAAsB,KAAK,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AACnJ,cAAM,UAAU,YAAY,WAAW;AACvC,cAAM,mBAAmB,oBACrB,MAAM,kBAAkB,qBAAqB,aAAa,EAAE,OAAO,KAAK,MAAM,GAAG,UAAU,cAAc,IACzG,EAAE,OAAO,KAAK,OAAO,WAAW,iBAAiB,KAAK,KAAK,EAAE;AACjE,YAAI,MAAM;AACR,eAAK,eAAe;AACpB,eAAK,iBAAiB;AACtB,eAAK,WAAW;AAChB,cAAI,8BAA8B,GAAG;AACnC,iBAAK,QAAQ,iBAAiB;AAC9B,iBAAK,YAAa,iBAAyB,aAAa,iBAAiB,KAAK,KAAK;AAAA,UACrF;AACA,cAAI,KAAK,KAAM,MAAK,OAAO,KAAK;AAChC,cAAI,QAAS,MAAK,cAAc;AAChC,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QACnH,OAAO;AACL,iBAAO,IAAI,OAAO,MAAM;AAAA,YACtB,OAAQ,iBAAyB,SAAS,KAAK;AAAA,YAC/C,WAAW,8BAA8B,IAAK,iBAAyB,aAAa,iBAAiB,KAAK,KAAK,IAAI;AAAA,YACnH,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA,MAAM,KAAK,QAAQ;AAAA,YACnB,aAAa;AAAA,YACb,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QAClH;AACA,cAAM,IAAI,MAAM;AAChB,mBAAW,YAAY,KAAK,OAAO;AACjC,gBAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,gBAAM,eAAe,MAAM,sBAAsB,KAAK,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,KAAK,CAAC;AACxI,cAAI,CAAC,aAAc,KAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,QAC5F;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,cAAc;AAAA,EAChC;AAEA,MAAI,CAAC,oBAAoB;AACvB,UAAM,0BAA0B,IAAI,QAAQ;AAAA,EAC9C;AAEA,QAAM,sBAAsB,IAAI,UAAU,iBAAiB,EAAE,sBAAsB,CAAC;AACpF,QAAM,2CAA2C,EAAE;AAGnD,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,OAAO,iBAAiB;AAC9B,YAAM,IAAI,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,MAAM,eAAe,MAAM,YAAY,KAAK,EAAG,QAAO,MAAM,YAAY,KAAK;AACjF,QAAM,QAAQ,CAAC,MAAM,WAAW,MAAM,QAAQ,EAAE,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F,MAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AACvC,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,kBACP,WACA,OACA;AACA,MAAI,CAAC,MAAM,MAAO;AAClB,QAAM,aAAa,MAAM,MAAM,YAAY;AAC3C,MAAI,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,YAAY,MAAM,UAAU,EAAG;AACvE,YAAU,KAAK,KAAK;AACtB;AASA,MAAM,wBAAwB;AAS9B,SAAS,0BAAkC;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AAC5D,SAAO,WAAW,QAAQ,QAAQ;AACpC;AAEA,SAAS,qCAA8C;AACrD,MAAI,QAAQ,IAAI,iBAAiB,OAAQ,QAAO;AAChD,MAAI,CAAC,aAAa,0BAA0B,EAAG,QAAO;AACtD,SAAO,kBAAkB;AAC3B;AAEA,eAAe,oBAAoB,OAAiD;AAClF,MAAI,OAAO,MAAM,mBAAmB,SAAU,QAAO,MAAM;AAC3D,MAAI,MAAM,SAAU,QAAO,KAAK,MAAM,UAAU,EAAE;AAClD,SAAO;AACT;AAEA,eAAsB,sBACpB,IACA,UACA,SACA,UAA+C,CAAC,GAChD;AACA,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,iBAAiB,wBAAwB,MAAM,eAAe,IAAI,cAAc,YAAY,IAAI;AACtG,QAAM,YAAY,MAAM,eAAe,IAAI,SAAS,YAAY;AAChE,QAAM,eAAe,MAAM,eAAe,IAAI,YAAY,YAAY;AAGtE,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAA+B,CAAC;AACtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,SAAS;AACzB,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,QAAI,aAAa,WAAY,oBAAmB,KAAK,GAAG,aAAa,UAAU;AAC/E,QAAI,aAAa,MAAO,eAAc,KAAK,GAAG,aAAa,KAAK;AAChE,QAAI,aAAa,SAAU,kBAAiB,KAAK,GAAG,aAAa,QAAQ;AAGzE,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAK,aAAmC,SAAS,QAAQ,EAAG;AAC5D,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,UAAQ,IAAI,uCAAkC;AAAA,IAC5C,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,GAAI,mBAAmB,OAAO,IAC1B,OAAO,YAAY,kBAAkB,IACrC,CAAC;AAAA,EACP,CAAC;AAED,MAAI,yBAAyB,gBAAgB;AAC3C,UAAM,iBAAiB,IAAI,gBAAgB,UAAU,oBAAoB,EAAE,cAAc,KAAK,CAAC;AAAA,EACjG;AACA,MAAI,WAAW;AACb,UAAM,iBAAiB,IAAI,WAAW,UAAU,aAAa;AAAA,EAC/D;AACA,MAAI,cAAc;AAChB,UAAM,iBAAiB,IAAI,cAAc,UAAU,gBAAgB;AAAA,EACrE;AAMA,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AAAA,IACrD;AAAA,EACF;AACF;AAOA,eAAsB,qBACpB,IACA,UACA,SACe;AACf,QAAM,kBAAkB,WAAW,cAAc;AACjD,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,iBAAiB;AACjC,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAI,aAAa,SAAS,QAAQ,EAAG;AACrC,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,mBAAmB,SAAS,EAAG;AAEnC,MAAI,SAAS;AACb,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,GAAG;AACd,YAAQ,IAAI,mCAA8B,MAAM,SAAS;AAAA,EAC3D;AACF;AAEA,eAAe,iBACb,IACA,MACA,UACA,UACA,UAAsC,CAAC,GACvC;AACA,QAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACpH,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,GAAG,OAAO,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc,CAAC,CAAC,QAAQ;AAAA,MACxB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,QAAQ,SAAS,YAAY,IAAI,SAAS,eAAe,CAAC;AACxF,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AACpE,QAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,MAAI,QAAS,UAAS,eAAe;AACrC,MAAI,QAAQ,gBAAgB,CAAC,SAAS,cAAc;AAClD,aAAS,eAAe;AAAA,EAC1B;AACA,MAAI,WAAW,QAAQ,cAAc;AACnC,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC;AACF;AAaA,eAAsB,2CAA2C,IAAmB;AAClF,MAAI,QAAQ,IAAI,oCAAoC,OAAQ;AAC5D,MAAI,mCAAmC,EAAG;AAC1C,aAAW,EAAE,MAAM,MAAM,KAAK,sBAAsB,GAAG;AACrD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,MAAM;AAAA,QACR,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,KAAM;AACX,UAAI,QAAQ;AACZ,UAAI,KAAK,cAAc;AACrB,aAAK,eAAe;AACpB,gBAAQ;AAAA,MACV;AACA,UAAI,KAAK,gBAAgB,OAAO;AAC9B,aAAK,cAAc;AACnB,gBAAQ;AAAA,MACV;AACA,UAAI,OAAO;AACT,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,0CAA0C,IAAI,UAAU,KAAK;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AASA,MAAM,kDAAkD;AAGxD,SAAS,gBAA0B;AACjC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/configs/data/entities.js

@@ -29,6 +29,12 @@ __decorateClass([
 __decorateClass([
   Property({ name: "value_json", type: "json", nullable: true })
 ], ModuleConfig.prototype, "valueJson", 2);
+__decorateClass([
+  Property({ name: "organization_id", type: "uuid", nullable: true })
+], ModuleConfig.prototype, "organizationId", 2);
+__decorateClass([
+  Property({ name: "tenant_id", type: "uuid", nullable: true })
+], ModuleConfig.prototype, "tenantId", 2);
 __decorateClass([
   Property({ name: "created_at", type: Date, onCreate: () => /* @__PURE__ */ new Date() })
 ], ModuleConfig.prototype, "createdAt", 2);
@@ -37,7 +43,15 @@ __decorateClass([
 ], ModuleConfig.prototype, "updatedAt", 2);
 ModuleConfig = __decorateClass([
   Entity({ tableName: "module_configs" }),
-  Unique({ name: "module_configs_module_name_unique", properties: ["moduleId", "name"] })
+  Index({
+    name: "module_configs_global_unique",
+    expression: 'create unique index "module_configs_global_unique" on "module_configs" ("module_id", "name") where "tenant_id" is null'
+  }),
+  Index({
+    name: "module_configs_scoped_unique",
+    expression: 'create unique index "module_configs_scoped_unique" on "module_configs" ("module_id", "name", "tenant_id") where "tenant_id" is not null'
+  }),
+  Index({ name: "module_configs_module_name_tenant_idx", properties: ["moduleId", "name", "tenantId"] })
 ], ModuleConfig);
 OptionalProps;
 let UpgradeActionRun = class {

package/dist/modules/configs/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/configs/data/entities.ts"],
-  "sourcesContent": ["import { OptionalProps } from '@mikro-orm/core'\nimport { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'module_configs' })\n@Unique({ name: 'module_configs_module_name_unique', properties: ['moduleId', 'name'] })\nexport class ModuleConfig {\n  [OptionalProps]?: 'createdAt' | 'updatedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'module_id', type: 'text' })\n  moduleId!: string\n\n  @Property({ name: 'name', type: 'text' })\n  name!: string\n\n  @Property({ name: 'value_json', type: 'json', nullable: true })\n  valueJson!: unknown\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n@Entity({ tableName: 'upgrade_action_runs' })\n@Index({ name: 'upgrade_action_runs_scope_idx', properties: ['organizationId', 'tenantId'] })\n@Unique({ name: 'upgrade_action_runs_action_scope_unique', properties: ['version', 'actionId', 'organizationId', 'tenantId'] })\nexport class UpgradeActionRun {\n  [OptionalProps]?: 'createdAt' | 'completedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'version', type: 'text' })\n  version!: string\n\n  @Property({ name: 'action_id', type: 'text' })\n  actionId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'completed_at', type: Date, onCreate: () => new Date() })\n  completedAt: Date = new Date()\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAKzD;AADI,IAAM,eAAN,MAAmB;AAAA,EAAnB;AAgBL,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAhBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,aAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,aAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,GAT7B,aAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZnD,aAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAf7D,aAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlB7D,aAmBX;AAnBW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,OAAO,EAAE,MAAM,qCAAqC,YAAY,CAAC,YAAY,MAAM,EAAE,CAAC;AAAA,GAC1E;AA0BV;AADI,IAAM,mBAAN,MAAuB;AAAA,EAAvB;AAmBL,uBAAoB,oBAAI,KAAK;AAG7B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,iBAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GANhC,iBAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GATlC,iBAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAZxC,iBAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAflC,iBAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlB/D,iBAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArB7D,iBAsBX;AAtBW,mBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,sBAAsB,CAAC;AAAA,EAC3C,MAAM,EAAE,MAAM,iCAAiC,YAAY,CAAC,kBAAkB,UAAU,EAAE,CAAC;AAAA,EAC3F,OAAO,EAAE,MAAM,2CAA2C,YAAY,CAAC,WAAW,YAAY,kBAAkB,UAAU,EAAE,CAAC;AAAA,GACjH;",
+  "sourcesContent": ["import { OptionalProps } from '@mikro-orm/core'\nimport { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'module_configs' })\n@Index({\n  name: 'module_configs_global_unique',\n  expression:\n    'create unique index \"module_configs_global_unique\" on \"module_configs\" (\"module_id\", \"name\") where \"tenant_id\" is null',\n})\n@Index({\n  name: 'module_configs_scoped_unique',\n  expression:\n    'create unique index \"module_configs_scoped_unique\" on \"module_configs\" (\"module_id\", \"name\", \"tenant_id\") where \"tenant_id\" is not null',\n})\n@Index({ name: 'module_configs_module_name_tenant_idx', properties: ['moduleId', 'name', 'tenantId'] })\nexport class ModuleConfig {\n  [OptionalProps]?: 'createdAt' | 'updatedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'module_id', type: 'text' })\n  moduleId!: string\n\n  @Property({ name: 'name', type: 'text' })\n  name!: string\n\n  @Property({ name: 'value_json', type: 'json', nullable: true })\n  valueJson!: unknown\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n@Entity({ tableName: 'upgrade_action_runs' })\n@Index({ name: 'upgrade_action_runs_scope_idx', properties: ['organizationId', 'tenantId'] })\n@Unique({ name: 'upgrade_action_runs_action_scope_unique', properties: ['version', 'actionId', 'organizationId', 'tenantId'] })\nexport class UpgradeActionRun {\n  [OptionalProps]?: 'createdAt' | 'completedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'version', type: 'text' })\n  version!: string\n\n  @Property({ name: 'action_id', type: 'text' })\n  actionId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'completed_at', type: Date, onCreate: () => new Date() })\n  completedAt: Date = new Date()\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAezD;AADI,IAAM,eAAN,MAAmB;AAAA,EAAnB;AAsBL,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,aAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,aAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,GAT7B,aAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZnD,aAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAfxD,aAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlBlD,aAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArB7D,aAsBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAxB7D,aAyBX;AAzBW,eAAN;AAAA,EAZN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM,EAAE,MAAM,yCAAyC,YAAY,CAAC,YAAY,QAAQ,UAAU,EAAE,CAAC;AAAA,GACzF;AAgCV;AADI,IAAM,mBAAN,MAAuB;AAAA,EAAvB;AAmBL,uBAAoB,oBAAI,KAAK;AAG7B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,iBAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GANhC,iBAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GATlC,iBAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAZxC,iBAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAflC,iBAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlB/D,iBAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArB7D,iBAsBX;AAtBW,mBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,sBAAsB,CAAC;AAAA,EAC3C,MAAM,EAAE,MAAM,iCAAiC,YAAY,CAAC,kBAAkB,UAAU,EAAE,CAAC;AAAA,EAC3F,OAAO,EAAE,MAAM,2CAA2C,YAAY,CAAC,WAAW,YAAY,kBAAkB,UAAU,EAAE,CAAC;AAAA,GACjH;",
   "names": []
 }

package/dist/modules/configs/lib/module-config-service.js

@@ -1,8 +1,9 @@
 import { ModuleConfig } from "../data/entities.js";
 import { moduleConfigKeySchema } from "../data/validators.js";
-const CACHE_VERSION = "v1";
+const CACHE_VERSION = "v2";
 const CACHE_TTL_MS = 6e4;
-const cacheKey = (moduleId, name) => `module-config:${CACHE_VERSION}:${moduleId}:${name}`;
+const scopeKeyPart = (tenantId) => tenantId ?? "global";
+const cacheKey = (moduleId, name, tenantId) => `module-config:${CACHE_VERSION}:${moduleId}:${name}:${scopeKeyPart(tenantId)}`;
 const moduleTag = (moduleId) => `module-config:module:${moduleId}`;
 const resolveEm = (container) => {
   try {
@@ -18,10 +19,13 @@ const resolveCache = (container) => {
     return null;
   }
 };
-const toRecord = (entity) => ({
+const toRecord = (entity, source) => ({
   moduleId: entity.moduleId,
   name: entity.name,
   value: entity.valueJson ?? null,
+  tenantId: entity.tenantId ?? null,
+  organizationId: entity.organizationId ?? null,
+  source,
   createdAt: entity.createdAt.toISOString(),
   updatedAt: entity.updatedAt.toISOString()
 });
@@ -59,10 +63,11 @@ const deleteCacheByModule = async (cache, moduleId) => {
 };
 const normalizeKey = (moduleId, name) => moduleConfigKeySchema.parse({ moduleId, name });
 function createModuleConfigService(container) {
-  const getRecord = async (rawModuleId, rawName) => {
+  const getRecord = async (rawModuleId, rawName, scope) => {
     const { moduleId, name } = normalizeKey(rawModuleId, rawName);
+    const tenantId = scope?.tenantId ?? null;
     const cache = resolveCache(container);
-    const key = cacheKey(moduleId, name);
+    const key = cacheKey(moduleId, name, tenantId);
     const cached = await readCache(cache, key);
     if (cached) {
       if (!cached.found) return null;
@@ -71,45 +76,71 @@ function createModuleConfigService(container) {
     const em = resolveEm(container);
     if (!em) return null;
     const repo = em.getRepository(ModuleConfig);
-    const entity = await repo.findOne({ moduleId, name });
-    if (!entity) {
+    if (tenantId) {
+      const scoped = await repo.findOne({ moduleId, name, tenantId });
+      if (scoped) {
+        const record3 = toRecord(scoped, "tenant");
+        await writeCache(cache, key, { found: true, record: record3 }, moduleId);
+        return record3;
+      }
+      const global2 = await repo.findOne({ moduleId, name, tenantId: null });
+      if (!global2) {
+        await writeCache(cache, key, { found: false }, moduleId);
+        return null;
+      }
+      const record2 = toRecord(global2, "instance");
+      await writeCache(cache, key, { found: true, record: record2 }, moduleId);
+      return record2;
+    }
+    const global = await repo.findOne({ moduleId, name, tenantId: null });
+    if (!global) {
       await writeCache(cache, key, { found: false }, moduleId);
       return null;
     }
-    const record = toRecord(entity);
+    const record = toRecord(global, "instance");
     await writeCache(cache, key, { found: true, record }, moduleId);
     return record;
   };
   const getValue = async (rawModuleId, rawName, options) => {
-    const record = await getRecord(rawModuleId, rawName);
+    const record = await getRecord(rawModuleId, rawName, options?.scope);
     if (!record) return options?.defaultValue ?? null;
     const value = record.value;
     if (value === void 0 || value === null) return options?.defaultValue ?? null;
     return value;
   };
-  const setValue = async (rawModuleId, rawName, value) => {
+  const setValue = async (rawModuleId, rawName, value, scope) => {
     const em = resolveEm(container);
     if (!em) return null;
     const { moduleId, name } = normalizeKey(rawModuleId, rawName);
+    const tenantId = scope?.tenantId ?? null;
+    const organizationId = scope?.organizationId ?? null;
     const repo = em.getRepository(ModuleConfig);
     const now = /* @__PURE__ */ new Date();
-    let entity = await repo.findOne({ moduleId, name });
+    let entity = await repo.findOne({ moduleId, name, tenantId });
     if (!entity) {
       entity = repo.create({
         moduleId,
         name,
         valueJson: value ?? null,
+        tenantId,
+        organizationId,
         createdAt: now,
         updatedAt: now
       });
       em.persist(entity);
     } else {
       entity.valueJson = value ?? null;
+      entity.organizationId = organizationId;
       entity.updatedAt = now;
     }
     await em.flush();
-    const record = toRecord(entity);
-    await writeCache(resolveCache(container), cacheKey(moduleId, name), { found: true, record }, moduleId);
+    const record = toRecord(entity, tenantId ? "tenant" : "instance");
+    const cache = resolveCache(container);
+    if (tenantId) {
+      await writeCache(cache, cacheKey(moduleId, name, tenantId), { found: true, record }, moduleId);
+    } else {
+      await deleteCacheByModule(cache, moduleId);
+    }
     return record;
   };
   const restoreDefaults = async (defaults, options) => {
@@ -124,12 +155,14 @@ function createModuleConfigService(container) {
       let entity = null;
       try {
         const { moduleId, name } = normalizeKey(entry.moduleId, entry.name);
-        entity = await repo.findOne({ moduleId, name });
+        entity = await repo.findOne({ moduleId, name, tenantId: null });
         if (!entity) {
           entity = repo.create({
             moduleId,
             name,
-            valueJson: entry.value ?? null
+            valueJson: entry.value ?? null,
+            tenantId: null,
+            organizationId: null
           });
           em.persist(entity);
           dirty = true;
@@ -146,16 +179,16 @@ function createModuleConfigService(container) {
     if (!dirty) return;
     await em.flush();
     for (const entity of touched) {
-      const record = toRecord(entity);
-      await writeCache(cache, cacheKey(entity.moduleId, entity.name), { found: true, record }, entity.moduleId);
+      const record = toRecord(entity, "instance");
+      await writeCache(cache, cacheKey(entity.moduleId, entity.name, null), { found: true, record }, entity.moduleId);
     }
   };
-  const invalidate = async (rawModuleId, rawName) => {
+  const invalidate = async (rawModuleId, rawName, scope) => {
     const cache = resolveCache(container);
     if (!cache) return;
     if (rawName) {
       const { moduleId: moduleId2, name } = normalizeKey(rawModuleId, rawName);
-      await deleteCacheKey(cache, cacheKey(moduleId2, name));
+      await deleteCacheKey(cache, cacheKey(moduleId2, name, scope?.tenantId ?? null));
       return;
     }
     const moduleId = moduleConfigKeySchema.shape.moduleId.parse(rawModuleId);

package/dist/modules/configs/lib/module-config-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/configs/lib/module-config-service.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { ModuleConfig } from '../data/entities'\nimport { moduleConfigKeySchema } from '../data/validators'\n\nconst CACHE_VERSION = 'v1'\nconst CACHE_TTL_MS = 60_000\n\ntype CachePayload = {\n  found: boolean\n  record?: ModuleConfigRecord | null\n}\n\nconst cacheKey = (moduleId: string, name: string) => `module-config:${CACHE_VERSION}:${moduleId}:${name}`\nconst moduleTag = (moduleId: string) => `module-config:module:${moduleId}`\n\nconst resolveEm = (container: AppContainer): EntityManager | null => {\n  try {\n    return (container.resolve('em') as EntityManager)\n  } catch {\n    return null\n  }\n}\n\nconst resolveCache = (container: AppContainer): CacheStrategy | null => {\n  try {\n    return (container.resolve('cache') as CacheStrategy)\n  } catch {\n    return null\n  }\n}\n\nconst toRecord = (entity: ModuleConfig): ModuleConfigRecord => ({\n  moduleId: entity.moduleId,\n  name: entity.name,\n  value: entity.valueJson ?? null,\n  createdAt: entity.createdAt.toISOString(),\n  updatedAt: entity.updatedAt.toISOString(),\n})\n\nconst readCache = async (cache: CacheStrategy | null, key: string): Promise<CachePayload | null> => {\n  if (!cache) return null\n  try {\n    const cached = await cache.get(key)\n    if (cached && typeof cached === 'object' && 'found' in cached) {\n      return cached as CachePayload\n    }\n  } catch {}\n  return null\n}\n\nconst writeCache = async (cache: CacheStrategy | null, key: string, payload: CachePayload, moduleId: string) => {\n  if (!cache) return\n  try {\n    await cache.set(key, payload, { ttl: CACHE_TTL_MS, tags: [moduleTag(moduleId)] })\n  } catch {}\n}\n\nconst deleteCacheKey = async (cache: CacheStrategy | null, key: string) => {\n  if (!cache) return\n  try {\n    await cache.delete(key)\n  } catch {}\n}\n\nconst deleteCacheByModule = async (cache: CacheStrategy | null, moduleId: string) => {\n  if (!cache) return\n  try {\n    await cache.deleteByTags([moduleTag(moduleId)])\n  } catch {}\n}\n\nconst normalizeKey = (moduleId: string, name: string) => moduleConfigKeySchema.parse({ moduleId, name })\n\nexport type ModuleConfigRecord = {\n  moduleId: string\n  name: string\n  value: unknown\n  createdAt: string\n  updatedAt: string\n}\n\nexport type ModuleConfigDefault = {\n  moduleId: string\n  name: string\n  value: unknown\n}\n\nexport type ModuleConfigService = {\n  getRecord(moduleId: string, name: string): Promise<ModuleConfigRecord | null>\n  getValue<T = unknown>(moduleId: string, name: string, options?: { defaultValue?: T | null }): Promise<T | null>\n  setValue(moduleId: string, name: string, value: unknown): Promise<ModuleConfigRecord | null>\n  restoreDefaults(defaults: ModuleConfigDefault[], options?: { force?: boolean }): Promise<void>\n  invalidate(moduleId: string, name?: string): Promise<void>\n}\n\nexport function createModuleConfigService(container: AppContainer): ModuleConfigService {\n  const getRecord = async (rawModuleId: string, rawName: string): Promise<ModuleConfigRecord | null> => {\n    const { moduleId, name } = normalizeKey(rawModuleId, rawName)\n    const cache = resolveCache(container)\n    const key = cacheKey(moduleId, name)\n    const cached = await readCache(cache, key)\n    if (cached) {\n      if (!cached.found) return null\n      if (cached.record) return cached.record\n    }\n\n    const em = resolveEm(container)\n    if (!em) return null\n    const repo = em.getRepository(ModuleConfig)\n    const entity = await repo.findOne({ moduleId, name })\n    if (!entity) {\n      await writeCache(cache, key, { found: false }, moduleId)\n      return null\n    }\n    const record = toRecord(entity)\n    await writeCache(cache, key, { found: true, record }, moduleId)\n    return record\n  }\n\n  const getValue = async <T>(rawModuleId: string, rawName: string, options?: { defaultValue?: T | null }): Promise<T | null> => {\n    const record = await getRecord(rawModuleId, rawName)\n    if (!record) return options?.defaultValue ?? null\n    const value = record.value as T | null | undefined\n    if (value === undefined || value === null) return options?.defaultValue ?? null\n    return value\n  }\n\n  const setValue = async (rawModuleId: string, rawName: string, value: unknown): Promise<ModuleConfigRecord | null> => {\n    const em = resolveEm(container)\n    if (!em) return null\n    const { moduleId, name } = normalizeKey(rawModuleId, rawName)\n    const repo = em.getRepository(ModuleConfig)\n    const now = new Date()\n    let entity = await repo.findOne({ moduleId, name })\n    if (!entity) {\n      entity = repo.create({\n        moduleId,\n        name,\n        valueJson: value ?? null,\n        createdAt: now,\n        updatedAt: now,\n      })\n      em.persist(entity)\n    } else {\n      entity.valueJson = value ?? null\n      entity.updatedAt = now\n    }\n    await em.flush()\n    const record = toRecord(entity)\n    await writeCache(resolveCache(container), cacheKey(moduleId, name), { found: true, record }, moduleId)\n    return record\n  }\n\n  const restoreDefaults = async (defaults: ModuleConfigDefault[], options?: { force?: boolean }) => {\n    if (!Array.isArray(defaults) || defaults.length === 0) return\n    const em = resolveEm(container)\n    if (!em) return\n    const repo = em.getRepository(ModuleConfig)\n    const cache = resolveCache(container)\n    let dirty = false\n    const touched: ModuleConfig[] = []\n    for (const entry of defaults) {\n      let entity: ModuleConfig | null = null\n      try {\n        const { moduleId, name } = normalizeKey(entry.moduleId, entry.name)\n        entity = await repo.findOne({ moduleId, name })\n        if (!entity) {\n          entity = repo.create({\n            moduleId,\n            name,\n            valueJson: entry.value ?? null,\n          })\n          em.persist(entity)\n          dirty = true\n          touched.push(entity)\n        } else if (options?.force) {\n          entity.valueJson = entry.value ?? null\n          entity.updatedAt = new Date()\n          dirty = true\n          touched.push(entity)\n        }\n      } catch {}\n    }\n    if (!dirty) return\n    await em.flush()\n    for (const entity of touched) {\n      const record = toRecord(entity)\n      await writeCache(cache, cacheKey(entity.moduleId, entity.name), { found: true, record }, entity.moduleId)\n    }\n  }\n\n  const invalidate = async (rawModuleId: string, rawName?: string) => {\n    const cache = resolveCache(container)\n    if (!cache) return\n    if (rawName) {\n      const { moduleId, name } = normalizeKey(rawModuleId, rawName)\n      await deleteCacheKey(cache, cacheKey(moduleId, name))\n      return\n    }\n    const moduleId = moduleConfigKeySchema.shape.moduleId.parse(rawModuleId)\n    await deleteCacheByModule(cache, moduleId)\n  }\n\n  return {\n    getRecord,\n    getValue,\n    setValue,\n    restoreDefaults,\n    invalidate,\n  }\n}\n\n"],
-  "mappings": "AAGA,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAEtC,MAAM,gBAAgB;AACtB,MAAM,eAAe;AAOrB,MAAM,WAAW,CAAC,UAAkB,SAAiB,iBAAiB,aAAa,IAAI,QAAQ,IAAI,IAAI;AACvG,MAAM,YAAY,CAAC,aAAqB,wBAAwB,QAAQ;AAExE,MAAM,YAAY,CAAC,cAAkD;AACnE,MAAI;AACF,WAAQ,UAAU,QAAQ,IAAI;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,eAAe,CAAC,cAAkD;AACtE,MAAI;AACF,WAAQ,UAAU,QAAQ,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,WAAW,CAAC,YAA8C;AAAA,EAC9D,UAAU,OAAO;AAAA,EACjB,MAAM,OAAO;AAAA,EACb,OAAO,OAAO,aAAa;AAAA,EAC3B,WAAW,OAAO,UAAU,YAAY;AAAA,EACxC,WAAW,OAAO,UAAU,YAAY;AAC1C;AAEA,MAAM,YAAY,OAAO,OAA6B,QAA8C;AAClG,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,IAAI,GAAG;AAClC,QAAI,UAAU,OAAO,WAAW,YAAY,WAAW,QAAQ;AAC7D,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEA,MAAM,aAAa,OAAO,OAA6B,KAAa,SAAuB,aAAqB;AAC9G,MAAI,CAAC,MAAO;AACZ,MAAI;AACF,UAAM,MAAM,IAAI,KAAK,SAAS,EAAE,KAAK,cAAc,MAAM,CAAC,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAClF,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,iBAAiB,OAAO,OAA6B,QAAgB;AACzE,MAAI,CAAC,MAAO;AACZ,MAAI;AACF,UAAM,MAAM,OAAO,GAAG;AAAA,EACxB,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,sBAAsB,OAAO,OAA6B,aAAqB;AACnF,MAAI,CAAC,MAAO;AACZ,MAAI;AACF,UAAM,MAAM,aAAa,CAAC,UAAU,QAAQ,CAAC,CAAC;AAAA,EAChD,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,eAAe,CAAC,UAAkB,SAAiB,sBAAsB,MAAM,EAAE,UAAU,KAAK,CAAC;AAwBhG,SAAS,0BAA0B,WAA8C;AACtF,QAAM,YAAY,OAAO,aAAqB,YAAwD;AACpG,UAAM,EAAE,UAAU,KAAK,IAAI,aAAa,aAAa,OAAO;AAC5D,UAAM,QAAQ,aAAa,SAAS;AACpC,UAAM,MAAM,SAAS,UAAU,IAAI;AACnC,UAAM,SAAS,MAAM,UAAU,OAAO,GAAG;AACzC,QAAI,QAAQ;AACV,UAAI,CAAC,OAAO,MAAO,QAAO;AAC1B,UAAI,OAAO,OAAQ,QAAO,OAAO;AAAA,IACnC;AAEA,UAAM,KAAK,UAAU,SAAS;AAC9B,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,GAAG,cAAc,YAAY;AAC1C,UAAM,SAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,KAAK,CAAC;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,GAAG,QAAQ;AACvD,aAAO;AAAA,IACT;AACA,UAAM,SAAS,SAAS,MAAM;AAC9B,UAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,OAAO,GAAG,QAAQ;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OAAU,aAAqB,SAAiB,YAA6D;AAC5H,UAAM,SAAS,MAAM,UAAU,aAAa,OAAO;AACnD,QAAI,CAAC,OAAQ,QAAO,SAAS,gBAAgB;AAC7C,UAAM,QAAQ,OAAO;AACrB,QAAI,UAAU,UAAa,UAAU,KAAM,QAAO,SAAS,gBAAgB;AAC3E,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OAAO,aAAqB,SAAiB,UAAuD;AACnH,UAAM,KAAK,UAAU,SAAS;AAC9B,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,EAAE,UAAU,KAAK,IAAI,aAAa,aAAa,OAAO;AAC5D,UAAM,OAAO,GAAG,cAAc,YAAY;AAC1C,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,SAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,KAAK,CAAC;AAClD,QAAI,CAAC,QAAQ;AACX,eAAS,KAAK,OAAO;AAAA,QACnB;AAAA,QACA;AAAA,QACA,WAAW,SAAS;AAAA,QACpB,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,SAAG,QAAQ,MAAM;AAAA,IACnB,OAAO;AACL,aAAO,YAAY,SAAS;AAC5B,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,GAAG,MAAM;AACf,UAAM,SAAS,SAAS,MAAM;AAC9B,UAAM,WAAW,aAAa,SAAS,GAAG,SAAS,UAAU,IAAI,GAAG,EAAE,OAAO,MAAM,OAAO,GAAG,QAAQ;AACrG,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,OAAO,UAAiC,YAAkC;AAChG,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,EAAG;AACvD,UAAM,KAAK,UAAU,SAAS;AAC9B,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,GAAG,cAAc,YAAY;AAC1C,UAAM,QAAQ,aAAa,SAAS;AACpC,QAAI,QAAQ;AACZ,UAAM,UAA0B,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,UAAI,SAA8B;AAClC,UAAI;AACF,cAAM,EAAE,UAAU,KAAK,IAAI,aAAa,MAAM,UAAU,MAAM,IAAI;AAClE,iBAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,KAAK,CAAC;AAC9C,YAAI,CAAC,QAAQ;AACX,mBAAS,KAAK,OAAO;AAAA,YACnB;AAAA,YACA;AAAA,YACA,WAAW,MAAM,SAAS;AAAA,UAC5B,CAAC;AACD,aAAG,QAAQ,MAAM;AACjB,kBAAQ;AACR,kBAAQ,KAAK,MAAM;AAAA,QACrB,WAAW,SAAS,OAAO;AACzB,iBAAO,YAAY,MAAM,SAAS;AAClC,iBAAO,YAAY,oBAAI,KAAK;AAC5B,kBAAQ;AACR,kBAAQ,KAAK,MAAM;AAAA,QACrB;AAAA,MACF,QAAQ;AAAA,MAAC;AAAA,IACX;AACA,QAAI,CAAC,MAAO;AACZ,UAAM,GAAG,MAAM;AACf,eAAW,UAAU,SAAS;AAC5B,YAAM,SAAS,SAAS,MAAM;AAC9B,YAAM,WAAW,OAAO,SAAS,OAAO,UAAU,OAAO,IAAI,GAAG,EAAE,OAAO,MAAM,OAAO,GAAG,OAAO,QAAQ;AAAA,IAC1G;AAAA,EACF;AAEA,QAAM,aAAa,OAAO,aAAqB,YAAqB;AAClE,UAAM,QAAQ,aAAa,SAAS;AACpC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS;AACX,YAAM,EAAE,UAAAA,WAAU,KAAK,IAAI,aAAa,aAAa,OAAO;AAC5D,YAAM,eAAe,OAAO,SAASA,WAAU,IAAI,CAAC;AACpD;AAAA,IACF;AACA,UAAM,WAAW,sBAAsB,MAAM,SAAS,MAAM,WAAW;AACvE,UAAM,oBAAoB,OAAO,QAAQ;AAAA,EAC3C;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
-  "names": ["moduleId"]
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { ModuleConfig } from '../data/entities'\nimport { moduleConfigKeySchema } from '../data/validators'\n\nconst CACHE_VERSION = 'v2'\nconst CACHE_TTL_MS = 60_000\n\ntype CachePayload = {\n  found: boolean\n  record?: ModuleConfigRecord | null\n}\n\nconst scopeKeyPart = (tenantId?: string | null) => (tenantId ?? 'global')\n\nconst cacheKey = (moduleId: string, name: string, tenantId?: string | null) =>\n  `module-config:${CACHE_VERSION}:${moduleId}:${name}:${scopeKeyPart(tenantId)}`\nconst moduleTag = (moduleId: string) => `module-config:module:${moduleId}`\n\nconst resolveEm = (container: AppContainer): EntityManager | null => {\n  try {\n    return (container.resolve('em') as EntityManager)\n  } catch {\n    return null\n  }\n}\n\nconst resolveCache = (container: AppContainer): CacheStrategy | null => {\n  try {\n    return (container.resolve('cache') as CacheStrategy)\n  } catch {\n    return null\n  }\n}\n\nconst toRecord = (entity: ModuleConfig, source: ModuleConfigSource): ModuleConfigRecord => ({\n  moduleId: entity.moduleId,\n  name: entity.name,\n  value: entity.valueJson ?? null,\n  tenantId: entity.tenantId ?? null,\n  organizationId: entity.organizationId ?? null,\n  source,\n  createdAt: entity.createdAt.toISOString(),\n  updatedAt: entity.updatedAt.toISOString(),\n})\n\nconst readCache = async (cache: CacheStrategy | null, key: string): Promise<CachePayload | null> => {\n  if (!cache) return null\n  try {\n    const cached = await cache.get(key)\n    if (cached && typeof cached === 'object' && 'found' in cached) {\n      return cached as CachePayload\n    }\n  } catch {}\n  return null\n}\n\nconst writeCache = async (cache: CacheStrategy | null, key: string, payload: CachePayload, moduleId: string) => {\n  if (!cache) return\n  try {\n    await cache.set(key, payload, { ttl: CACHE_TTL_MS, tags: [moduleTag(moduleId)] })\n  } catch {}\n}\n\nconst deleteCacheKey = async (cache: CacheStrategy | null, key: string) => {\n  if (!cache) return\n  try {\n    await cache.delete(key)\n  } catch {}\n}\n\nconst deleteCacheByModule = async (cache: CacheStrategy | null, moduleId: string) => {\n  if (!cache) return\n  try {\n    await cache.deleteByTags([moduleTag(moduleId)])\n  } catch {}\n}\n\nconst normalizeKey = (moduleId: string, name: string) => moduleConfigKeySchema.parse({ moduleId, name })\n\nexport type ModuleConfigSource = 'tenant' | 'instance'\n\nexport type ConfigScope = {\n  tenantId?: string | null\n  organizationId?: string | null\n}\n\nexport type ModuleConfigRecord = {\n  moduleId: string\n  name: string\n  value: unknown\n  tenantId: string | null\n  organizationId: string | null\n  source: ModuleConfigSource\n  createdAt: string\n  updatedAt: string\n}\n\nexport type ModuleConfigDefault = {\n  moduleId: string\n  name: string\n  value: unknown\n}\n\nexport type ModuleConfigService = {\n  getRecord(moduleId: string, name: string, scope?: ConfigScope): Promise<ModuleConfigRecord | null>\n  getValue<T = unknown>(\n    moduleId: string,\n    name: string,\n    options?: { defaultValue?: T | null; scope?: ConfigScope },\n  ): Promise<T | null>\n  setValue(moduleId: string, name: string, value: unknown, scope?: ConfigScope): Promise<ModuleConfigRecord | null>\n  restoreDefaults(defaults: ModuleConfigDefault[], options?: { force?: boolean }): Promise<void>\n  invalidate(moduleId: string, name?: string, scope?: ConfigScope): Promise<void>\n}\n\nexport function createModuleConfigService(container: AppContainer): ModuleConfigService {\n  const getRecord = async (rawModuleId: string, rawName: string, scope?: ConfigScope): Promise<ModuleConfigRecord | null> => {\n    const { moduleId, name } = normalizeKey(rawModuleId, rawName)\n    const tenantId = scope?.tenantId ?? null\n    const cache = resolveCache(container)\n    const key = cacheKey(moduleId, name, tenantId)\n    const cached = await readCache(cache, key)\n    if (cached) {\n      if (!cached.found) return null\n      if (cached.record) return cached.record\n    }\n\n    const em = resolveEm(container)\n    if (!em) return null\n    const repo = em.getRepository(ModuleConfig)\n\n    if (tenantId) {\n      const scoped = await repo.findOne({ moduleId, name, tenantId })\n      if (scoped) {\n        const record = toRecord(scoped, 'tenant')\n        await writeCache(cache, key, { found: true, record }, moduleId)\n        return record\n      }\n      const global = await repo.findOne({ moduleId, name, tenantId: null })\n      if (!global) {\n        await writeCache(cache, key, { found: false }, moduleId)\n        return null\n      }\n      const record = toRecord(global, 'instance')\n      await writeCache(cache, key, { found: true, record }, moduleId)\n      return record\n    }\n\n    const global = await repo.findOne({ moduleId, name, tenantId: null })\n    if (!global) {\n      await writeCache(cache, key, { found: false }, moduleId)\n      return null\n    }\n    const record = toRecord(global, 'instance')\n    await writeCache(cache, key, { found: true, record }, moduleId)\n    return record\n  }\n\n  const getValue = async <T>(\n    rawModuleId: string,\n    rawName: string,\n    options?: { defaultValue?: T | null; scope?: ConfigScope },\n  ): Promise<T | null> => {\n    const record = await getRecord(rawModuleId, rawName, options?.scope)\n    if (!record) return options?.defaultValue ?? null\n    const value = record.value as T | null | undefined\n    if (value === undefined || value === null) return options?.defaultValue ?? null\n    return value\n  }\n\n  const setValue = async (\n    rawModuleId: string,\n    rawName: string,\n    value: unknown,\n    scope?: ConfigScope,\n  ): Promise<ModuleConfigRecord | null> => {\n    const em = resolveEm(container)\n    if (!em) return null\n    const { moduleId, name } = normalizeKey(rawModuleId, rawName)\n    const tenantId = scope?.tenantId ?? null\n    const organizationId = scope?.organizationId ?? null\n    const repo = em.getRepository(ModuleConfig)\n    const now = new Date()\n    let entity = await repo.findOne({ moduleId, name, tenantId })\n    if (!entity) {\n      entity = repo.create({\n        moduleId,\n        name,\n        valueJson: value ?? null,\n        tenantId,\n        organizationId,\n        createdAt: now,\n        updatedAt: now,\n      })\n      em.persist(entity)\n    } else {\n      entity.valueJson = value ?? null\n      entity.organizationId = organizationId\n      entity.updatedAt = now\n    }\n    await em.flush()\n    const record = toRecord(entity, tenantId ? 'tenant' : 'instance')\n    const cache = resolveCache(container)\n    if (tenantId) {\n      await writeCache(cache, cacheKey(moduleId, name, tenantId), { found: true, record }, moduleId)\n    } else {\n      await deleteCacheByModule(cache, moduleId)\n    }\n    return record\n  }\n\n  const restoreDefaults = async (defaults: ModuleConfigDefault[], options?: { force?: boolean }) => {\n    if (!Array.isArray(defaults) || defaults.length === 0) return\n    const em = resolveEm(container)\n    if (!em) return\n    const repo = em.getRepository(ModuleConfig)\n    const cache = resolveCache(container)\n    let dirty = false\n    const touched: ModuleConfig[] = []\n    for (const entry of defaults) {\n      let entity: ModuleConfig | null = null\n      try {\n        const { moduleId, name } = normalizeKey(entry.moduleId, entry.name)\n        entity = await repo.findOne({ moduleId, name, tenantId: null })\n        if (!entity) {\n          entity = repo.create({\n            moduleId,\n            name,\n            valueJson: entry.value ?? null,\n            tenantId: null,\n            organizationId: null,\n          })\n          em.persist(entity)\n          dirty = true\n          touched.push(entity)\n        } else if (options?.force) {\n          entity.valueJson = entry.value ?? null\n          entity.updatedAt = new Date()\n          dirty = true\n          touched.push(entity)\n        }\n      } catch {}\n    }\n    if (!dirty) return\n    await em.flush()\n    for (const entity of touched) {\n      const record = toRecord(entity, 'instance')\n      await writeCache(cache, cacheKey(entity.moduleId, entity.name, null), { found: true, record }, entity.moduleId)\n    }\n  }\n\n  const invalidate = async (rawModuleId: string, rawName?: string, scope?: ConfigScope) => {\n    const cache = resolveCache(container)\n    if (!cache) return\n    if (rawName) {\n      const { moduleId, name } = normalizeKey(rawModuleId, rawName)\n      await deleteCacheKey(cache, cacheKey(moduleId, name, scope?.tenantId ?? null))\n      return\n    }\n    const moduleId = moduleConfigKeySchema.shape.moduleId.parse(rawModuleId)\n    await deleteCacheByModule(cache, moduleId)\n  }\n\n  return {\n    getRecord,\n    getValue,\n    setValue,\n    restoreDefaults,\n    invalidate,\n  }\n}\n"],
+  "mappings": "AAGA,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAEtC,MAAM,gBAAgB;AACtB,MAAM,eAAe;AAOrB,MAAM,eAAe,CAAC,aAA8B,YAAY;AAEhE,MAAM,WAAW,CAAC,UAAkB,MAAc,aAChD,iBAAiB,aAAa,IAAI,QAAQ,IAAI,IAAI,IAAI,aAAa,QAAQ,CAAC;AAC9E,MAAM,YAAY,CAAC,aAAqB,wBAAwB,QAAQ;AAExE,MAAM,YAAY,CAAC,cAAkD;AACnE,MAAI;AACF,WAAQ,UAAU,QAAQ,IAAI;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,eAAe,CAAC,cAAkD;AACtE,MAAI;AACF,WAAQ,UAAU,QAAQ,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,WAAW,CAAC,QAAsB,YAAoD;AAAA,EAC1F,UAAU,OAAO;AAAA,EACjB,MAAM,OAAO;AAAA,EACb,OAAO,OAAO,aAAa;AAAA,EAC3B,UAAU,OAAO,YAAY;AAAA,EAC7B,gBAAgB,OAAO,kBAAkB;AAAA,EACzC;AAAA,EACA,WAAW,OAAO,UAAU,YAAY;AAAA,EACxC,WAAW,OAAO,UAAU,YAAY;AAC1C;AAEA,MAAM,YAAY,OAAO,OAA6B,QAA8C;AAClG,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,SAAS,MAAM,MAAM,IAAI,GAAG;AAClC,QAAI,UAAU,OAAO,WAAW,YAAY,WAAW,QAAQ;AAC7D,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEA,MAAM,aAAa,OAAO,OAA6B,KAAa,SAAuB,aAAqB;AAC9G,MAAI,CAAC,MAAO;AACZ,MAAI;AACF,UAAM,MAAM,IAAI,KAAK,SAAS,EAAE,KAAK,cAAc,MAAM,CAAC,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAClF,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,iBAAiB,OAAO,OAA6B,QAAgB;AACzE,MAAI,CAAC,MAAO;AACZ,MAAI;AACF,UAAM,MAAM,OAAO,GAAG;AAAA,EACxB,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,sBAAsB,OAAO,OAA6B,aAAqB;AACnF,MAAI,CAAC,MAAO;AACZ,MAAI;AACF,UAAM,MAAM,aAAa,CAAC,UAAU,QAAQ,CAAC,CAAC;AAAA,EAChD,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,eAAe,CAAC,UAAkB,SAAiB,sBAAsB,MAAM,EAAE,UAAU,KAAK,CAAC;AAsChG,SAAS,0BAA0B,WAA8C;AACtF,QAAM,YAAY,OAAO,aAAqB,SAAiB,UAA4D;AACzH,UAAM,EAAE,UAAU,KAAK,IAAI,aAAa,aAAa,OAAO;AAC5D,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,QAAQ,aAAa,SAAS;AACpC,UAAM,MAAM,SAAS,UAAU,MAAM,QAAQ;AAC7C,UAAM,SAAS,MAAM,UAAU,OAAO,GAAG;AACzC,QAAI,QAAQ;AACV,UAAI,CAAC,OAAO,MAAO,QAAO;AAC1B,UAAI,OAAO,OAAQ,QAAO,OAAO;AAAA,IACnC;AAEA,UAAM,KAAK,UAAU,SAAS;AAC9B,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,GAAG,cAAc,YAAY;AAE1C,QAAI,UAAU;AACZ,YAAM,SAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,MAAM,SAAS,CAAC;AAC9D,UAAI,QAAQ;AACV,cAAMA,UAAS,SAAS,QAAQ,QAAQ;AACxC,cAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,QAAAA,QAAO,GAAG,QAAQ;AAC9D,eAAOA;AAAA,MACT;AACA,YAAMC,UAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,MAAM,UAAU,KAAK,CAAC;AACpE,UAAI,CAACA,SAAQ;AACX,cAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,GAAG,QAAQ;AACvD,eAAO;AAAA,MACT;AACA,YAAMD,UAAS,SAASC,SAAQ,UAAU;AAC1C,YAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,QAAAD,QAAO,GAAG,QAAQ;AAC9D,aAAOA;AAAA,IACT;AAEA,UAAM,SAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,MAAM,UAAU,KAAK,CAAC;AACpE,QAAI,CAAC,QAAQ;AACX,YAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,GAAG,QAAQ;AACvD,aAAO;AAAA,IACT;AACA,UAAM,SAAS,SAAS,QAAQ,UAAU;AAC1C,UAAM,WAAW,OAAO,KAAK,EAAE,OAAO,MAAM,OAAO,GAAG,QAAQ;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OACf,aACA,SACA,YACsB;AACtB,UAAM,SAAS,MAAM,UAAU,aAAa,SAAS,SAAS,KAAK;AACnE,QAAI,CAAC,OAAQ,QAAO,SAAS,gBAAgB;AAC7C,UAAM,QAAQ,OAAO;AACrB,QAAI,UAAU,UAAa,UAAU,KAAM,QAAO,SAAS,gBAAgB;AAC3E,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OACf,aACA,SACA,OACA,UACuC;AACvC,UAAM,KAAK,UAAU,SAAS;AAC9B,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,EAAE,UAAU,KAAK,IAAI,aAAa,aAAa,OAAO;AAC5D,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,iBAAiB,OAAO,kBAAkB;AAChD,UAAM,OAAO,GAAG,cAAc,YAAY;AAC1C,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI,SAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,MAAM,SAAS,CAAC;AAC5D,QAAI,CAAC,QAAQ;AACX,eAAS,KAAK,OAAO;AAAA,QACnB;AAAA,QACA;AAAA,QACA,WAAW,SAAS;AAAA,QACpB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,SAAG,QAAQ,MAAM;AAAA,IACnB,OAAO;AACL,aAAO,YAAY,SAAS;AAC5B,aAAO,iBAAiB;AACxB,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,GAAG,MAAM;AACf,UAAM,SAAS,SAAS,QAAQ,WAAW,WAAW,UAAU;AAChE,UAAM,QAAQ,aAAa,SAAS;AACpC,QAAI,UAAU;AACZ,YAAM,WAAW,OAAO,SAAS,UAAU,MAAM,QAAQ,GAAG,EAAE,OAAO,MAAM,OAAO,GAAG,QAAQ;AAAA,IAC/F,OAAO;AACL,YAAM,oBAAoB,OAAO,QAAQ;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,OAAO,UAAiC,YAAkC;AAChG,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,EAAG;AACvD,UAAM,KAAK,UAAU,SAAS;AAC9B,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,GAAG,cAAc,YAAY;AAC1C,UAAM,QAAQ,aAAa,SAAS;AACpC,QAAI,QAAQ;AACZ,UAAM,UAA0B,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,UAAI,SAA8B;AAClC,UAAI;AACF,cAAM,EAAE,UAAU,KAAK,IAAI,aAAa,MAAM,UAAU,MAAM,IAAI;AAClE,iBAAS,MAAM,KAAK,QAAQ,EAAE,UAAU,MAAM,UAAU,KAAK,CAAC;AAC9D,YAAI,CAAC,QAAQ;AACX,mBAAS,KAAK,OAAO;AAAA,YACnB;AAAA,YACA;AAAA,YACA,WAAW,MAAM,SAAS;AAAA,YAC1B,UAAU;AAAA,YACV,gBAAgB;AAAA,UAClB,CAAC;AACD,aAAG,QAAQ,MAAM;AACjB,kBAAQ;AACR,kBAAQ,KAAK,MAAM;AAAA,QACrB,WAAW,SAAS,OAAO;AACzB,iBAAO,YAAY,MAAM,SAAS;AAClC,iBAAO,YAAY,oBAAI,KAAK;AAC5B,kBAAQ;AACR,kBAAQ,KAAK,MAAM;AAAA,QACrB;AAAA,MACF,QAAQ;AAAA,MAAC;AAAA,IACX;AACA,QAAI,CAAC,MAAO;AACZ,UAAM,GAAG,MAAM;AACf,eAAW,UAAU,SAAS;AAC5B,YAAM,SAAS,SAAS,QAAQ,UAAU;AAC1C,YAAM,WAAW,OAAO,SAAS,OAAO,UAAU,OAAO,MAAM,IAAI,GAAG,EAAE,OAAO,MAAM,OAAO,GAAG,OAAO,QAAQ;AAAA,IAChH;AAAA,EACF;AAEA,QAAM,aAAa,OAAO,aAAqB,SAAkB,UAAwB;AACvF,UAAM,QAAQ,aAAa,SAAS;AACpC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS;AACX,YAAM,EAAE,UAAAE,WAAU,KAAK,IAAI,aAAa,aAAa,OAAO;AAC5D,YAAM,eAAe,OAAO,SAASA,WAAU,MAAM,OAAO,YAAY,IAAI,CAAC;AAC7E;AAAA,IACF;AACA,UAAM,WAAW,sBAAsB,MAAM,SAAS,MAAM,WAAW;AACvE,UAAM,oBAAoB,OAAO,QAAQ;AAAA,EAC3C;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": ["record", "global", "moduleId"]
 }

package/dist/modules/configs/migrations/Migration20260617150000.js

@@ -0,0 +1,21 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260617150000 extends Migration {
+  async up() {
+    this.addSql(`alter table "module_configs" add column "organization_id" uuid null, add column "tenant_id" uuid null;`);
+    this.addSql(`alter table "module_configs" drop constraint "module_configs_module_name_unique";`);
+    this.addSql(`create unique index "module_configs_global_unique" on "module_configs" ("module_id", "name") where "tenant_id" is null;`);
+    this.addSql(`create unique index "module_configs_scoped_unique" on "module_configs" ("module_id", "name", "tenant_id") where "tenant_id" is not null;`);
+    this.addSql(`create index "module_configs_module_name_tenant_idx" on "module_configs" ("module_id", "name", "tenant_id");`);
+  }
+  async down() {
+    this.addSql(`drop index if exists "module_configs_module_name_tenant_idx";`);
+    this.addSql(`drop index if exists "module_configs_scoped_unique";`);
+    this.addSql(`drop index if exists "module_configs_global_unique";`);
+    this.addSql(`alter table "module_configs" add constraint "module_configs_module_name_unique" unique ("module_id", "name");`);
+    this.addSql(`alter table "module_configs" drop column "organization_id", drop column "tenant_id";`);
+  }
+}
+export {
+  Migration20260617150000
+};
+//# sourceMappingURL=Migration20260617150000.js.map

package/dist/modules/configs/migrations/Migration20260617150000.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/configs/migrations/Migration20260617150000.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260617150000 extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"module_configs\" add column \"organization_id\" uuid null, add column \"tenant_id\" uuid null;`);\n    this.addSql(`alter table \"module_configs\" drop constraint \"module_configs_module_name_unique\";`);\n    this.addSql(`create unique index \"module_configs_global_unique\" on \"module_configs\" (\"module_id\", \"name\") where \"tenant_id\" is null;`);\n    this.addSql(`create unique index \"module_configs_scoped_unique\" on \"module_configs\" (\"module_id\", \"name\", \"tenant_id\") where \"tenant_id\" is not null;`);\n    this.addSql(`create index \"module_configs_module_name_tenant_idx\" on \"module_configs\" (\"module_id\", \"name\", \"tenant_id\");`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`drop index if exists \"module_configs_module_name_tenant_idx\";`);\n    this.addSql(`drop index if exists \"module_configs_scoped_unique\";`);\n    this.addSql(`drop index if exists \"module_configs_global_unique\";`);\n    this.addSql(`alter table \"module_configs\" add constraint \"module_configs_module_name_unique\" unique (\"module_id\", \"name\");`);\n    this.addSql(`alter table \"module_configs\" drop column \"organization_id\", drop column \"tenant_id\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,gCAAgC,UAAU;AAAA,EAErD,MAAe,KAAoB;AACjC,SAAK,OAAO,wGAAwG;AACpH,SAAK,OAAO,mFAAmF;AAC/F,SAAK,OAAO,yHAAyH;AACrI,SAAK,OAAO,0IAA0I;AACtJ,SAAK,OAAO,8GAA8G;AAAA,EAC5H;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,+DAA+D;AAC3E,SAAK,OAAO,sDAAsD;AAClE,SAAK,OAAO,sDAAsD;AAClE,SAAK,OAAO,+GAA+G;AAC3H,SAAK,OAAO,sFAAsF;AAAA,EACpG;AAEF;",
+  "names": []
+}