@open-mercato/core 0.6.6-develop.6460.1.f94c74174c → 0.6.6-develop.6471.1.9ab5bdd79a

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3458 entry points
+[build:core] found 3459 entry points
 [build:core] built successfully
 [build:core:generated] found 186 entry points
 [build:core:generated] built successfully

package/dist/bootstrap.js

@@ -14,6 +14,8 @@ import {
 } from "@open-mercato/search";
 import { RateLimiterService } from "@open-mercato/shared/lib/ratelimit/service";
 import { readRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("core");
 const RL_GLOBAL_KEY = "__openMercatoRateLimiterService__";
 const RL_SHUTDOWN_KEY = "__openMercatoRateLimiterShutdown__";
 const CACHE_GLOBAL_KEY = "__openMercatoCacheService__";
@@ -33,7 +35,7 @@ function getCachedCacheService() {
       try {
         service = createCacheService();
       } catch (err) {
-        console.warn("Cache service initialization failed; falling back to memory strategy:", err?.message || err);
+        logger.warn("Cache service initialization failed; falling back to memory strategy", { err });
         service = createCacheService({ strategy: "memory" });
       }
       ;
@@ -48,7 +50,7 @@ function getCachedCacheService() {
         globalThis[CACHE_SHUTDOWN_KEY] = true;
       }
     } catch (err) {
-      console.warn("[cache] Failed to create cache service:", err?.message || err);
+      logger.warn("Failed to create cache service", { component: "cache", err });
     }
   }
   return service;
@@ -60,7 +62,7 @@ function getCachedRateLimiterService() {
       const rateLimitConfig = readRateLimitConfig();
       service = new RateLimiterService(rateLimitConfig);
       service.initialize().catch((err) => {
-        console.warn("[ratelimit] Async initialization failed:", err?.message || err);
+        logger.warn("Async initialization failed", { component: "ratelimit", err });
       });
       globalThis[RL_GLOBAL_KEY] = service;
       if (!globalThis[RL_SHUTDOWN_KEY]) {
@@ -73,7 +75,7 @@ function getCachedRateLimiterService() {
         globalThis[RL_SHUTDOWN_KEY] = true;
       }
     } catch (err) {
-      console.warn("[ratelimit] Failed to create rate limiter service:", err?.message || err);
+      logger.warn("Failed to create rate limiter service", { component: "ratelimit", err });
     }
   }
   return service;
@@ -84,7 +86,7 @@ async function bootstrap(container) {
     try {
       cache = createCacheService();
     } catch (err) {
-      console.warn("Cache service initialization failed; falling back to memory strategy:", err?.message || err);
+      logger.warn("Cache service initialization failed; falling back to memory strategy", { err });
       cache = createCacheService({ strategy: "memory" });
     }
   }
@@ -95,7 +97,7 @@ async function bootstrap(container) {
     const queueStrategy = strategyEnv === "async" || strategyEnv === "redis" ? "async" : "local";
     eventBus = createEventBus({ resolve: container.resolve.bind(container), queueStrategy });
   } catch (err) {
-    console.warn("Event bus initialization failed; falling back to local strategy:", err?.message || err);
+    logger.warn("Event bus initialization failed; falling back to local strategy", { err });
     try {
       eventBus = createEventBus({ resolve: container.resolve.bind(container), queueStrategy: "local" });
     } catch {
@@ -140,7 +142,7 @@ async function bootstrap(container) {
       }
     }
   } catch (err) {
-    console.error("Failed to register module subscribers:", err);
+    logger.error("Failed to register module subscribers:", { err });
   }
   const kmsService = createKmsService();
   container.register({ kmsService: asValue(kmsService) });
@@ -159,13 +161,13 @@ async function bootstrap(container) {
       try {
         registerTenantEncryptionSubscriber(em, tenantEncryptionService);
       } catch (err) {
-        console.warn("[encryption] Failed to register MikroORM encryption subscriber:", err?.message || err);
+        logger.warn("Failed to register MikroORM encryption subscriber", { component: "encryption", err });
       }
     } else if (isTenantDataEncryptionEnabled() && !kmsService.isHealthy()) {
-      console.warn("[encryption] Vault/KMS unhealthy - tenant data encryption is disabled until recovery");
+      logger.warn("Vault/KMS unhealthy - tenant data encryption is disabled until recovery", { component: "encryption" });
     }
   } catch (err) {
-    console.warn("[encryption] Failed to initialize tenant encryption service:", err?.message || err);
+    logger.warn("Failed to initialize tenant encryption service", { component: "encryption", err });
   }
   const rateLimiterService = getCachedRateLimiterService();
   if (rateLimiterService) {
@@ -191,7 +193,7 @@ async function bootstrap(container) {
     } catch {
     }
   } catch (err) {
-    console.warn("[search] Failed to register search module:", err?.message || err);
+    logger.warn("Failed to register search module", { component: "search", err });
   }
 }
 export {

package/dist/bootstrap.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bootstrap.ts"],
-  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport { asValue } from 'awilix'\nimport type { ModuleSubscriber } from '@open-mercato/shared/modules/registry'\nimport { createEventBus } from '@open-mercato/events/index'\nimport { setGlobalEventBus } from '@open-mercato/shared/modules/events'\nimport { createCacheService } from '@open-mercato/cache'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { registerTenantEncryptionSubscriber } from '@open-mercato/shared/lib/encryption/subscriber'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { getSearchModuleConfigs } from '@open-mercato/shared/modules/search'\nimport {\n  registerSearchModule,\n  createSearchDeleteSubscriber,\n  searchDeleteMetadata,\n} from '@open-mercato/search'\nimport { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport { readRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport type { EntityManager } from '@mikro-orm/postgresql'\n\n// Use globalThis to survive tsx/webpack module duplication (same pattern as container.ts DI registrars)\nconst RL_GLOBAL_KEY = '__openMercatoRateLimiterService__'\nconst RL_SHUTDOWN_KEY = '__openMercatoRateLimiterShutdown__'\n\nconst CACHE_GLOBAL_KEY = '__openMercatoCacheService__'\nconst CACHE_SHUTDOWN_KEY = '__openMercatoCacheShutdown__'\n\n// Escape hatch: set OM_CACHE_SINGLETON=off to fall back to the legacy\n// per-request cache instance (e.g. to isolate a regression). Default ON.\nfunction isCacheSingletonEnabled(): boolean {\n  const raw = process.env.OM_CACHE_SINGLETON\n  if (raw === undefined) return true\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return true\n  return !(normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no')\n}\n\n/**\n * Process-wide cache service singleton, mirroring getCachedRateLimiterService.\n *\n * bootstrap() previously built a fresh cache per request container, so under\n * the default memory strategy every cross-request cache was a no-op (each\n * instance is process-local) and under sqlite each request leaked a native\n * handle. Reusing one instance is safe by construction: tenant scope resolves\n * per-call via AsyncLocalStorage (packages/cache/src/tenantContext.ts), so the\n * service holds no request-bound state.\n *\n * Returns null when disabled via the escape hatch or when creation fails, so\n * the caller falls back to a per-request instance.\n */\nexport function getCachedCacheService(): CacheStrategy | null {\n  if (!isCacheSingletonEnabled()) return null\n  let service = (globalThis as any)[CACHE_GLOBAL_KEY] as CacheStrategy | null ?? null\n  if (!service) {\n    try {\n      try {\n        service = createCacheService()\n      } catch (err) {\n        console.warn('Cache service initialization failed; falling back to memory strategy:', (err as Error)?.message || err)\n        service = createCacheService({ strategy: 'memory' })\n      }\n      ;(globalThis as any)[CACHE_GLOBAL_KEY] = service\n\n      // Register shutdown hook once to close persistent handles (sqlite/redis) on process exit\n      if (!(globalThis as any)[CACHE_SHUTDOWN_KEY]) {\n        const shutdown = () => { service?.close?.().catch(() => {}) }\n        process.once('SIGTERM', shutdown)\n        process.once('SIGINT', shutdown)\n        ;(globalThis as any)[CACHE_SHUTDOWN_KEY] = true\n      }\n    } catch (err) {\n      console.warn('[cache] Failed to create cache service:', (err as Error)?.message || err)\n    }\n  }\n  return service\n}\n\nexport function getCachedRateLimiterService(): RateLimiterService | null {\n  let service = (globalThis as any)[RL_GLOBAL_KEY] as RateLimiterService | null ?? null\n  if (!service) {\n    try {\n      const rateLimitConfig = readRateLimitConfig()\n      service = new RateLimiterService(rateLimitConfig)\n      // Fire-and-forget async init (only needed for Redis strategy;\n      // memory strategy works synchronously, and Redis has an in-memory\n      // insurance limiter so the first few requests are still protected)\n      service.initialize().catch((err) => {\n        console.warn('[ratelimit] Async initialization failed:', (err as Error)?.message || err)\n      })\n      ;(globalThis as any)[RL_GLOBAL_KEY] = service\n\n      // Register shutdown hook once to disconnect Redis on process exit\n      if (!(globalThis as any)[RL_SHUTDOWN_KEY]) {\n        const shutdown = () => { service?.destroy().catch(() => {}) }\n        process.once('SIGTERM', shutdown)\n        process.once('SIGINT', shutdown)\n        ;(globalThis as any)[RL_SHUTDOWN_KEY] = true\n      }\n    } catch (err) {\n      console.warn('[ratelimit] Failed to create rate limiter service:', (err as Error)?.message || err)\n    }\n  }\n  return service\n}\n\nexport async function bootstrap(container: AwilixContainer) {\n  // Register the cache service. Prefer the process-wide singleton so caches\n  // survive across request containers; fall back to a per-request instance\n  // when the singleton is disabled or fails to build.\n  let cache: any = getCachedCacheService()\n  if (!cache) {\n    try {\n      cache = createCacheService()\n    } catch (err: any) {\n      console.warn('Cache service initialization failed; falling back to memory strategy:', err?.message || err)\n      cache = createCacheService({ strategy: 'memory' })\n    }\n  }\n  container.register({ cache: asValue(cache) })\n\n  // Create and register the DI-aware event bus\n  let eventBus: any\n  try {\n    // Support both QUEUE_STRATEGY and legacy EVENTS_STRATEGY env vars\n    const strategyEnv = process.env.QUEUE_STRATEGY || process.env.EVENTS_STRATEGY\n    const queueStrategy = strategyEnv === 'async' || strategyEnv === 'redis' ? 'async' : 'local'\n    eventBus = createEventBus({ resolve: container.resolve.bind(container) as any, queueStrategy })\n  } catch (err: any) {\n    // Fall back to local strategy to avoid breaking the app on misconfiguration\n    console.warn('Event bus initialization failed; falling back to local strategy:', err?.message || err)\n    try {\n      eventBus = createEventBus({ resolve: container.resolve.bind(container) as any, queueStrategy: 'local' })\n    } catch {\n      // In extreme cases, provide a no-op bus to avoid crashes\n      eventBus = {\n        emit: async () => {},\n        on: () => {},\n        registerModuleSubscribers: () => {},\n        clearQueue: async () => ({ removed: 0 }),\n      }\n    }\n  }\n  container.register({ eventBus: asValue(eventBus) })\n  // Wire the global event bus so createModuleEvents().emit works outside DI context\n  setGlobalEventBus(eventBus)\n  // Auto-register discovered module subscribers\n  try {\n    let loadedModules: any[] = []\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/i18n/server')\n      loadedModules = getModules()\n    } catch {}\n    const subs = loadedModules.flatMap((m) =>\n      (m.subscribers || []).map((subscriber: ModuleSubscriber) => ({\n        ...subscriber,\n        moduleId: subscriber.moduleId ?? m.id,\n      })),\n    )\n    if (subs.length) (container.resolve as any)('eventBus').registerModuleSubscribers(subs)\n\n    // Extract sync subscribers and register in the sync-subscriber-store\n    const syncSubs = subs.filter((s: any) => s.sync === true)\n    if (syncSubs.length) {\n      try {\n        const { registerSyncSubscribers } = await import('@open-mercato/shared/lib/crud/sync-subscriber-store')\n        registerSyncSubscribers(\n          syncSubs.map((s: any) => ({\n            metadata: { event: s.event, sync: true as const, priority: s.priority, id: s.id },\n            handler: s.handler,\n          })),\n        )\n      } catch {\n        // sync-subscriber-store may not be available\n      }\n    }\n  } catch (err) {\n    console.error(\"Failed to register module subscribers:\", err);\n  }\n\n  // KMS + tenant encryption\n  const kmsService = createKmsService()\n  container.register({ kmsService: asValue(kmsService) })\n  try {\n    const em = container.resolve('em') as EntityManager\n    const cacheService = (() => {\n      try { return container.resolve('cache') as any } catch { return null }\n    })()\n    const tenantEncryptionService = new TenantDataEncryptionService(em, { cache: cacheService, kms: kmsService })\n    container.register({ tenantEncryptionService: asValue(tenantEncryptionService) })\n    if (isTenantDataEncryptionEnabled() && kmsService.isHealthy()) {\n      try {\n        registerTenantEncryptionSubscriber(em, tenantEncryptionService)\n      } catch (err) {\n        console.warn('[encryption] Failed to register MikroORM encryption subscriber:', (err as Error)?.message || err)\n      }\n    } else if (isTenantDataEncryptionEnabled() && !kmsService.isHealthy()) {\n      console.warn('[encryption] Vault/KMS unhealthy - tenant data encryption is disabled until recovery')\n    }\n  } catch (err) {\n    console.warn('[encryption] Failed to initialize tenant encryption service:', (err as Error)?.message || err)\n  }\n\n  // Register rate limiter service (singleton via globalThis \u2014 reused across request containers)\n  // getCachedRateLimiterService() never throws; returns null on failure\n  const rateLimiterService = getCachedRateLimiterService()\n  if (rateLimiterService) {\n    container.register({ rateLimiterService: asValue(rateLimiterService) })\n  }\n\n  // Register search module\n  try {\n    // Get configs from global registry (registered during app bootstrap)\n    const searchModuleConfigs = getSearchModuleConfigs()\n    registerSearchModule(container as any, { moduleConfigs: searchModuleConfigs })\n\n    // Register searchModuleConfigs in container so status API can access vector-enabled entities\n    container.register({\n      searchModuleConfigs: asValue(searchModuleConfigs),\n    })\n\n    // Register search delete event subscriber\n    // Note: search.index_record is now handled by auto-discovered fulltext_upsert.ts subscriber\n    try {\n      const searchIndexer = container.resolve('searchIndexer') as any\n      if (searchIndexer && eventBus) {\n        eventBus.registerModuleSubscribers([\n          {\n            event: searchDeleteMetadata.event,\n            persistent: searchDeleteMetadata.persistent,\n            handler: createSearchDeleteSubscriber(searchIndexer),\n          },\n        ])\n      }\n    } catch {\n      // searchIndexer may not be available\n    }\n  } catch (err) {\n    console.warn('[search] Failed to register search module:', (err as Error)?.message || err)\n  }\n}\n"],
-  "mappings": "AACA,SAAS,eAAe;AAExB,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AAEnC,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,0CAA0C;AACnD,SAAS,qCAAqC;AAC9C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AAIpC,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AAExB,MAAM,mBAAmB;AACzB,MAAM,qBAAqB;AAI3B,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,SAAO,EAAE,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe;AAClG;AAeO,SAAS,wBAA8C;AAC5D,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,MAAI,UAAW,WAAmB,gBAAgB,KAA6B;AAC/E,MAAI,CAAC,SAAS;AACZ,QAAI;AACF,UAAI;AACF,kBAAU,mBAAmB;AAAA,MAC/B,SAAS,KAAK;AACZ,gBAAQ,KAAK,yEAA0E,KAAe,WAAW,GAAG;AACpH,kBAAU,mBAAmB,EAAE,UAAU,SAAS,CAAC;AAAA,MACrD;AACA;AAAC,MAAC,WAAmB,gBAAgB,IAAI;AAGzC,UAAI,CAAE,WAAmB,kBAAkB,GAAG;AAC5C,cAAM,WAAW,MAAM;AAAE,mBAAS,QAAQ,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QAAE;AAC5D,gBAAQ,KAAK,WAAW,QAAQ;AAChC,gBAAQ,KAAK,UAAU,QAAQ;AAC9B,QAAC,WAAmB,kBAAkB,IAAI;AAAA,MAC7C;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,KAAK,2CAA4C,KAAe,WAAW,GAAG;AAAA,IACxF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,8BAAyD;AACvE,MAAI,UAAW,WAAmB,aAAa,KAAkC;AACjF,MAAI,CAAC,SAAS;AACZ,QAAI;AACF,YAAM,kBAAkB,oBAAoB;AAC5C,gBAAU,IAAI,mBAAmB,eAAe;AAIhD,cAAQ,WAAW,EAAE,MAAM,CAAC,QAAQ;AAClC,gBAAQ,KAAK,4CAA6C,KAAe,WAAW,GAAG;AAAA,MACzF,CAAC;AACA,MAAC,WAAmB,aAAa,IAAI;AAGtC,UAAI,CAAE,WAAmB,eAAe,GAAG;AACzC,cAAM,WAAW,MAAM;AAAE,mBAAS,QAAQ,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QAAE;AAC5D,gBAAQ,KAAK,WAAW,QAAQ;AAChC,gBAAQ,KAAK,UAAU,QAAQ;AAC9B,QAAC,WAAmB,eAAe,IAAI;AAAA,MAC1C;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,KAAK,sDAAuD,KAAe,WAAW,GAAG;AAAA,IACnG;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,UAAU,WAA4B;AAI1D,MAAI,QAAa,sBAAsB;AACvC,MAAI,CAAC,OAAO;AACV,QAAI;AACF,cAAQ,mBAAmB;AAAA,IAC7B,SAAS,KAAU;AACjB,cAAQ,KAAK,yEAAyE,KAAK,WAAW,GAAG;AACzG,cAAQ,mBAAmB,EAAE,UAAU,SAAS,CAAC;AAAA,IACnD;AAAA,EACF;AACA,YAAU,SAAS,EAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;AAG5C,MAAI;AACJ,MAAI;AAEF,UAAM,cAAc,QAAQ,IAAI,kBAAkB,QAAQ,IAAI;AAC9D,UAAM,gBAAgB,gBAAgB,WAAW,gBAAgB,UAAU,UAAU;AACrF,eAAW,eAAe,EAAE,SAAS,UAAU,QAAQ,KAAK,SAAS,GAAU,cAAc,CAAC;AAAA,EAChG,SAAS,KAAU;AAEjB,YAAQ,KAAK,oEAAoE,KAAK,WAAW,GAAG;AACpG,QAAI;AACF,iBAAW,eAAe,EAAE,SAAS,UAAU,QAAQ,KAAK,SAAS,GAAU,eAAe,QAAQ,CAAC;AAAA,IACzG,QAAQ;AAEN,iBAAW;AAAA,QACT,MAAM,YAAY;AAAA,QAAC;AAAA,QACnB,IAAI,MAAM;AAAA,QAAC;AAAA,QACX,2BAA2B,MAAM;AAAA,QAAC;AAAA,QAClC,YAAY,aAAa,EAAE,SAAS,EAAE;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACA,YAAU,SAAS,EAAE,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAElD,oBAAkB,QAAQ;AAE1B,MAAI;AACF,QAAI,gBAAuB,CAAC;AAC5B,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,sCAAsC;AAC1E,sBAAgB,WAAW;AAAA,IAC7B,QAAQ;AAAA,IAAC;AACT,UAAM,OAAO,cAAc;AAAA,MAAQ,CAAC,OACjC,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC,gBAAkC;AAAA,QAC3D,GAAG;AAAA,QACH,UAAU,WAAW,YAAY,EAAE;AAAA,MACrC,EAAE;AAAA,IACJ;AACA,QAAI,KAAK,OAAQ,CAAC,UAAU,QAAgB,UAAU,EAAE,0BAA0B,IAAI;AAGtF,UAAM,WAAW,KAAK,OAAO,CAAC,MAAW,EAAE,SAAS,IAAI;AACxD,QAAI,SAAS,QAAQ;AACnB,UAAI;AACF,cAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,qDAAqD;AACtG;AAAA,UACE,SAAS,IAAI,CAAC,OAAY;AAAA,YACxB,UAAU,EAAE,OAAO,EAAE,OAAO,MAAM,MAAe,UAAU,EAAE,UAAU,IAAI,EAAE,GAAG;AAAA,YAChF,SAAS,EAAE;AAAA,UACb,EAAE;AAAA,QACJ;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,MAAM,0CAA0C,GAAG;AAAA,EAC7D;AAGA,QAAM,aAAa,iBAAiB;AACpC,YAAU,SAAS,EAAE,YAAY,QAAQ,UAAU,EAAE,CAAC;AACtD,MAAI;AACF,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,gBAAgB,MAAM;AAC1B,UAAI;AAAE,eAAO,UAAU,QAAQ,OAAO;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACvE,GAAG;AACH,UAAM,0BAA0B,IAAI,4BAA4B,IAAI,EAAE,OAAO,cAAc,KAAK,WAAW,CAAC;AAC5G,cAAU,SAAS,EAAE,yBAAyB,QAAQ,uBAAuB,EAAE,CAAC;AAChF,QAAI,8BAA8B,KAAK,WAAW,UAAU,GAAG;AAC7D,UAAI;AACF,2CAAmC,IAAI,uBAAuB;AAAA,MAChE,SAAS,KAAK;AACZ,gBAAQ,KAAK,mEAAoE,KAAe,WAAW,GAAG;AAAA,MAChH;AAAA,IACF,WAAW,8BAA8B,KAAK,CAAC,WAAW,UAAU,GAAG;AACrE,cAAQ,KAAK,sFAAsF;AAAA,IACrG;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,gEAAiE,KAAe,WAAW,GAAG;AAAA,EAC7G;AAIA,QAAM,qBAAqB,4BAA4B;AACvD,MAAI,oBAAoB;AACtB,cAAU,SAAS,EAAE,oBAAoB,QAAQ,kBAAkB,EAAE,CAAC;AAAA,EACxE;AAGA,MAAI;AAEF,UAAM,sBAAsB,uBAAuB;AACnD,yBAAqB,WAAkB,EAAE,eAAe,oBAAoB,CAAC;AAG7E,cAAU,SAAS;AAAA,MACjB,qBAAqB,QAAQ,mBAAmB;AAAA,IAClD,CAAC;AAID,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,eAAe;AACvD,UAAI,iBAAiB,UAAU;AAC7B,iBAAS,0BAA0B;AAAA,UACjC;AAAA,YACE,OAAO,qBAAqB;AAAA,YAC5B,YAAY,qBAAqB;AAAA,YACjC,SAAS,6BAA6B,aAAa;AAAA,UACrD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA+C,KAAe,WAAW,GAAG;AAAA,EAC3F;AACF;",
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport { asValue } from 'awilix'\nimport type { ModuleSubscriber } from '@open-mercato/shared/modules/registry'\nimport { createEventBus } from '@open-mercato/events/index'\nimport { setGlobalEventBus } from '@open-mercato/shared/modules/events'\nimport { createCacheService } from '@open-mercato/cache'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { registerTenantEncryptionSubscriber } from '@open-mercato/shared/lib/encryption/subscriber'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { getSearchModuleConfigs } from '@open-mercato/shared/modules/search'\nimport {\n  registerSearchModule,\n  createSearchDeleteSubscriber,\n  searchDeleteMetadata,\n} from '@open-mercato/search'\nimport { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport { readRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('core')\n\n// Use globalThis to survive tsx/webpack module duplication (same pattern as container.ts DI registrars)\nconst RL_GLOBAL_KEY = '__openMercatoRateLimiterService__'\nconst RL_SHUTDOWN_KEY = '__openMercatoRateLimiterShutdown__'\n\nconst CACHE_GLOBAL_KEY = '__openMercatoCacheService__'\nconst CACHE_SHUTDOWN_KEY = '__openMercatoCacheShutdown__'\n\n// Escape hatch: set OM_CACHE_SINGLETON=off to fall back to the legacy\n// per-request cache instance (e.g. to isolate a regression). Default ON.\nfunction isCacheSingletonEnabled(): boolean {\n  const raw = process.env.OM_CACHE_SINGLETON\n  if (raw === undefined) return true\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return true\n  return !(normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no')\n}\n\n/**\n * Process-wide cache service singleton, mirroring getCachedRateLimiterService.\n *\n * bootstrap() previously built a fresh cache per request container, so under\n * the default memory strategy every cross-request cache was a no-op (each\n * instance is process-local) and under sqlite each request leaked a native\n * handle. Reusing one instance is safe by construction: tenant scope resolves\n * per-call via AsyncLocalStorage (packages/cache/src/tenantContext.ts), so the\n * service holds no request-bound state.\n *\n * Returns null when disabled via the escape hatch or when creation fails, so\n * the caller falls back to a per-request instance.\n */\nexport function getCachedCacheService(): CacheStrategy | null {\n  if (!isCacheSingletonEnabled()) return null\n  let service = (globalThis as any)[CACHE_GLOBAL_KEY] as CacheStrategy | null ?? null\n  if (!service) {\n    try {\n      try {\n        service = createCacheService()\n      } catch (err) {\n        logger.warn('Cache service initialization failed; falling back to memory strategy', { err })\n        service = createCacheService({ strategy: 'memory' })\n      }\n      ;(globalThis as any)[CACHE_GLOBAL_KEY] = service\n\n      // Register shutdown hook once to close persistent handles (sqlite/redis) on process exit\n      if (!(globalThis as any)[CACHE_SHUTDOWN_KEY]) {\n        const shutdown = () => { service?.close?.().catch(() => {}) }\n        process.once('SIGTERM', shutdown)\n        process.once('SIGINT', shutdown)\n        ;(globalThis as any)[CACHE_SHUTDOWN_KEY] = true\n      }\n    } catch (err) {\n      logger.warn('Failed to create cache service', { component: 'cache', err })\n    }\n  }\n  return service\n}\n\nexport function getCachedRateLimiterService(): RateLimiterService | null {\n  let service = (globalThis as any)[RL_GLOBAL_KEY] as RateLimiterService | null ?? null\n  if (!service) {\n    try {\n      const rateLimitConfig = readRateLimitConfig()\n      service = new RateLimiterService(rateLimitConfig)\n      // Fire-and-forget async init (only needed for Redis strategy;\n      // memory strategy works synchronously, and Redis has an in-memory\n      // insurance limiter so the first few requests are still protected)\n      service.initialize().catch((err) => {\n        logger.warn('Async initialization failed', { component: 'ratelimit', err })\n      })\n      ;(globalThis as any)[RL_GLOBAL_KEY] = service\n\n      // Register shutdown hook once to disconnect Redis on process exit\n      if (!(globalThis as any)[RL_SHUTDOWN_KEY]) {\n        const shutdown = () => { service?.destroy().catch(() => {}) }\n        process.once('SIGTERM', shutdown)\n        process.once('SIGINT', shutdown)\n        ;(globalThis as any)[RL_SHUTDOWN_KEY] = true\n      }\n    } catch (err) {\n      logger.warn('Failed to create rate limiter service', { component: 'ratelimit', err })\n    }\n  }\n  return service\n}\n\nexport async function bootstrap(container: AwilixContainer) {\n  // Register the cache service. Prefer the process-wide singleton so caches\n  // survive across request containers; fall back to a per-request instance\n  // when the singleton is disabled or fails to build.\n  let cache: any = getCachedCacheService()\n  if (!cache) {\n    try {\n      cache = createCacheService()\n    } catch (err: any) {\n      logger.warn('Cache service initialization failed; falling back to memory strategy', { err })\n      cache = createCacheService({ strategy: 'memory' })\n    }\n  }\n  container.register({ cache: asValue(cache) })\n\n  // Create and register the DI-aware event bus\n  let eventBus: any\n  try {\n    // Support both QUEUE_STRATEGY and legacy EVENTS_STRATEGY env vars\n    const strategyEnv = process.env.QUEUE_STRATEGY || process.env.EVENTS_STRATEGY\n    const queueStrategy = strategyEnv === 'async' || strategyEnv === 'redis' ? 'async' : 'local'\n    eventBus = createEventBus({ resolve: container.resolve.bind(container) as any, queueStrategy })\n  } catch (err: any) {\n    // Fall back to local strategy to avoid breaking the app on misconfiguration\n    logger.warn('Event bus initialization failed; falling back to local strategy', { err })\n    try {\n      eventBus = createEventBus({ resolve: container.resolve.bind(container) as any, queueStrategy: 'local' })\n    } catch {\n      // In extreme cases, provide a no-op bus to avoid crashes\n      eventBus = {\n        emit: async () => {},\n        on: () => {},\n        registerModuleSubscribers: () => {},\n        clearQueue: async () => ({ removed: 0 }),\n      }\n    }\n  }\n  container.register({ eventBus: asValue(eventBus) })\n  // Wire the global event bus so createModuleEvents().emit works outside DI context\n  setGlobalEventBus(eventBus)\n  // Auto-register discovered module subscribers\n  try {\n    let loadedModules: any[] = []\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/i18n/server')\n      loadedModules = getModules()\n    } catch {}\n    const subs = loadedModules.flatMap((m) =>\n      (m.subscribers || []).map((subscriber: ModuleSubscriber) => ({\n        ...subscriber,\n        moduleId: subscriber.moduleId ?? m.id,\n      })),\n    )\n    if (subs.length) (container.resolve as any)('eventBus').registerModuleSubscribers(subs)\n\n    // Extract sync subscribers and register in the sync-subscriber-store\n    const syncSubs = subs.filter((s: any) => s.sync === true)\n    if (syncSubs.length) {\n      try {\n        const { registerSyncSubscribers } = await import('@open-mercato/shared/lib/crud/sync-subscriber-store')\n        registerSyncSubscribers(\n          syncSubs.map((s: any) => ({\n            metadata: { event: s.event, sync: true as const, priority: s.priority, id: s.id },\n            handler: s.handler,\n          })),\n        )\n      } catch {\n        // sync-subscriber-store may not be available\n      }\n    }\n  } catch (err) {\n    logger.error(\"Failed to register module subscribers:\", { err });\n  }\n\n  // KMS + tenant encryption\n  const kmsService = createKmsService()\n  container.register({ kmsService: asValue(kmsService) })\n  try {\n    const em = container.resolve('em') as EntityManager\n    const cacheService = (() => {\n      try { return container.resolve('cache') as any } catch { return null }\n    })()\n    const tenantEncryptionService = new TenantDataEncryptionService(em, { cache: cacheService, kms: kmsService })\n    container.register({ tenantEncryptionService: asValue(tenantEncryptionService) })\n    if (isTenantDataEncryptionEnabled() && kmsService.isHealthy()) {\n      try {\n        registerTenantEncryptionSubscriber(em, tenantEncryptionService)\n      } catch (err) {\n        logger.warn('Failed to register MikroORM encryption subscriber', { component: 'encryption', err })\n      }\n    } else if (isTenantDataEncryptionEnabled() && !kmsService.isHealthy()) {\n      logger.warn('Vault/KMS unhealthy - tenant data encryption is disabled until recovery', { component: 'encryption' })\n    }\n  } catch (err) {\n    logger.warn('Failed to initialize tenant encryption service', { component: 'encryption', err })\n  }\n\n  // Register rate limiter service (singleton via globalThis \u2014 reused across request containers)\n  // getCachedRateLimiterService() never throws; returns null on failure\n  const rateLimiterService = getCachedRateLimiterService()\n  if (rateLimiterService) {\n    container.register({ rateLimiterService: asValue(rateLimiterService) })\n  }\n\n  // Register search module\n  try {\n    // Get configs from global registry (registered during app bootstrap)\n    const searchModuleConfigs = getSearchModuleConfigs()\n    registerSearchModule(container as any, { moduleConfigs: searchModuleConfigs })\n\n    // Register searchModuleConfigs in container so status API can access vector-enabled entities\n    container.register({\n      searchModuleConfigs: asValue(searchModuleConfigs),\n    })\n\n    // Register search delete event subscriber\n    // Note: search.index_record is now handled by auto-discovered fulltext_upsert.ts subscriber\n    try {\n      const searchIndexer = container.resolve('searchIndexer') as any\n      if (searchIndexer && eventBus) {\n        eventBus.registerModuleSubscribers([\n          {\n            event: searchDeleteMetadata.event,\n            persistent: searchDeleteMetadata.persistent,\n            handler: createSearchDeleteSubscriber(searchIndexer),\n          },\n        ])\n      }\n    } catch {\n      // searchIndexer may not be available\n    }\n  } catch (err) {\n    logger.warn('Failed to register search module', { component: 'search', err })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,eAAe;AAExB,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AAEnC,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,0CAA0C;AACnD,SAAS,qCAAqC;AAC9C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AAEpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM;AAGlC,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AAExB,MAAM,mBAAmB;AACzB,MAAM,qBAAqB;AAI3B,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,SAAO,EAAE,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe;AAClG;AAeO,SAAS,wBAA8C;AAC5D,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,MAAI,UAAW,WAAmB,gBAAgB,KAA6B;AAC/E,MAAI,CAAC,SAAS;AACZ,QAAI;AACF,UAAI;AACF,kBAAU,mBAAmB;AAAA,MAC/B,SAAS,KAAK;AACZ,eAAO,KAAK,wEAAwE,EAAE,IAAI,CAAC;AAC3F,kBAAU,mBAAmB,EAAE,UAAU,SAAS,CAAC;AAAA,MACrD;AACA;AAAC,MAAC,WAAmB,gBAAgB,IAAI;AAGzC,UAAI,CAAE,WAAmB,kBAAkB,GAAG;AAC5C,cAAM,WAAW,MAAM;AAAE,mBAAS,QAAQ,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QAAE;AAC5D,gBAAQ,KAAK,WAAW,QAAQ;AAChC,gBAAQ,KAAK,UAAU,QAAQ;AAC9B,QAAC,WAAmB,kBAAkB,IAAI;AAAA,MAC7C;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,kCAAkC,EAAE,WAAW,SAAS,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,8BAAyD;AACvE,MAAI,UAAW,WAAmB,aAAa,KAAkC;AACjF,MAAI,CAAC,SAAS;AACZ,QAAI;AACF,YAAM,kBAAkB,oBAAoB;AAC5C,gBAAU,IAAI,mBAAmB,eAAe;AAIhD,cAAQ,WAAW,EAAE,MAAM,CAAC,QAAQ;AAClC,eAAO,KAAK,+BAA+B,EAAE,WAAW,aAAa,IAAI,CAAC;AAAA,MAC5E,CAAC;AACA,MAAC,WAAmB,aAAa,IAAI;AAGtC,UAAI,CAAE,WAAmB,eAAe,GAAG;AACzC,cAAM,WAAW,MAAM;AAAE,mBAAS,QAAQ,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QAAE;AAC5D,gBAAQ,KAAK,WAAW,QAAQ;AAChC,gBAAQ,KAAK,UAAU,QAAQ;AAC9B,QAAC,WAAmB,eAAe,IAAI;AAAA,MAC1C;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,yCAAyC,EAAE,WAAW,aAAa,IAAI,CAAC;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,UAAU,WAA4B;AAI1D,MAAI,QAAa,sBAAsB;AACvC,MAAI,CAAC,OAAO;AACV,QAAI;AACF,cAAQ,mBAAmB;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,KAAK,wEAAwE,EAAE,IAAI,CAAC;AAC3F,cAAQ,mBAAmB,EAAE,UAAU,SAAS,CAAC;AAAA,IACnD;AAAA,EACF;AACA,YAAU,SAAS,EAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;AAG5C,MAAI;AACJ,MAAI;AAEF,UAAM,cAAc,QAAQ,IAAI,kBAAkB,QAAQ,IAAI;AAC9D,UAAM,gBAAgB,gBAAgB,WAAW,gBAAgB,UAAU,UAAU;AACrF,eAAW,eAAe,EAAE,SAAS,UAAU,QAAQ,KAAK,SAAS,GAAU,cAAc,CAAC;AAAA,EAChG,SAAS,KAAU;AAEjB,WAAO,KAAK,mEAAmE,EAAE,IAAI,CAAC;AACtF,QAAI;AACF,iBAAW,eAAe,EAAE,SAAS,UAAU,QAAQ,KAAK,SAAS,GAAU,eAAe,QAAQ,CAAC;AAAA,IACzG,QAAQ;AAEN,iBAAW;AAAA,QACT,MAAM,YAAY;AAAA,QAAC;AAAA,QACnB,IAAI,MAAM;AAAA,QAAC;AAAA,QACX,2BAA2B,MAAM;AAAA,QAAC;AAAA,QAClC,YAAY,aAAa,EAAE,SAAS,EAAE;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACA,YAAU,SAAS,EAAE,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAElD,oBAAkB,QAAQ;AAE1B,MAAI;AACF,QAAI,gBAAuB,CAAC;AAC5B,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,sCAAsC;AAC1E,sBAAgB,WAAW;AAAA,IAC7B,QAAQ;AAAA,IAAC;AACT,UAAM,OAAO,cAAc;AAAA,MAAQ,CAAC,OACjC,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC,gBAAkC;AAAA,QAC3D,GAAG;AAAA,QACH,UAAU,WAAW,YAAY,EAAE;AAAA,MACrC,EAAE;AAAA,IACJ;AACA,QAAI,KAAK,OAAQ,CAAC,UAAU,QAAgB,UAAU,EAAE,0BAA0B,IAAI;AAGtF,UAAM,WAAW,KAAK,OAAO,CAAC,MAAW,EAAE,SAAS,IAAI;AACxD,QAAI,SAAS,QAAQ;AACnB,UAAI;AACF,cAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,qDAAqD;AACtG;AAAA,UACE,SAAS,IAAI,CAAC,OAAY;AAAA,YACxB,UAAU,EAAE,OAAO,EAAE,OAAO,MAAM,MAAe,UAAU,EAAE,UAAU,IAAI,EAAE,GAAG;AAAA,YAChF,SAAS,EAAE;AAAA,UACb,EAAE;AAAA,QACJ;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAAA,EAChE;AAGA,QAAM,aAAa,iBAAiB;AACpC,YAAU,SAAS,EAAE,YAAY,QAAQ,UAAU,EAAE,CAAC;AACtD,MAAI;AACF,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,gBAAgB,MAAM;AAC1B,UAAI;AAAE,eAAO,UAAU,QAAQ,OAAO;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACvE,GAAG;AACH,UAAM,0BAA0B,IAAI,4BAA4B,IAAI,EAAE,OAAO,cAAc,KAAK,WAAW,CAAC;AAC5G,cAAU,SAAS,EAAE,yBAAyB,QAAQ,uBAAuB,EAAE,CAAC;AAChF,QAAI,8BAA8B,KAAK,WAAW,UAAU,GAAG;AAC7D,UAAI;AACF,2CAAmC,IAAI,uBAAuB;AAAA,MAChE,SAAS,KAAK;AACZ,eAAO,KAAK,qDAAqD,EAAE,WAAW,cAAc,IAAI,CAAC;AAAA,MACnG;AAAA,IACF,WAAW,8BAA8B,KAAK,CAAC,WAAW,UAAU,GAAG;AACrE,aAAO,KAAK,2EAA2E,EAAE,WAAW,aAAa,CAAC;AAAA,IACpH;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,kDAAkD,EAAE,WAAW,cAAc,IAAI,CAAC;AAAA,EAChG;AAIA,QAAM,qBAAqB,4BAA4B;AACvD,MAAI,oBAAoB;AACtB,cAAU,SAAS,EAAE,oBAAoB,QAAQ,kBAAkB,EAAE,CAAC;AAAA,EACxE;AAGA,MAAI;AAEF,UAAM,sBAAsB,uBAAuB;AACnD,yBAAqB,WAAkB,EAAE,eAAe,oBAAoB,CAAC;AAG7E,cAAU,SAAS;AAAA,MACjB,qBAAqB,QAAQ,mBAAmB;AAAA,IAClD,CAAC;AAID,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,eAAe;AACvD,UAAI,iBAAiB,UAAU;AAC7B,iBAAS,0BAA0B;AAAA,UACjC;AAAA,YACE,OAAO,qBAAqB;AAAA,YAC5B,YAAY,qBAAqB;AAAA,YACjC,SAAS,6BAA6B,aAAa;AAAA,UACrD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,oCAAoC,EAAE,WAAW,UAAU,IAAI,CAAC;AAAA,EAC9E;AACF;",
   "names": []
 }

package/dist/helpers/integration/auth.js

@@ -120,96 +120,162 @@ async function recoverGenericErrorPageIfPresent(page) {
   }
   await dismissGlobalNoticesIfPresent(page);
 }
-async function login(page, role = "admin") {
-  const creds = DEFAULT_CREDENTIALS[role];
-  const loginReadySelector = 'form[data-auth-ready="1"]';
-  const hasBackendUrl = () => /\/backend(?:\/.*)?$/.test(page.url());
-  const waitForBackend = async (timeout) => {
-    try {
-      await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
-      return true;
-    } catch {
-      return hasBackendUrl();
-    }
-  };
-  await acknowledgeGlobalNotices(page);
-  const apiLoginForm = new URLSearchParams();
-  apiLoginForm.set("email", creds.email);
-  apiLoginForm.set("password", creds.password);
-  let apiLoginResponse = null;
-  for (let retry = 0; retry < 4; retry += 1) {
-    apiLoginResponse = await page.request.post("/api/auth/login", {
-      headers: {
-        "content-type": "application/x-www-form-urlencoded"
-      },
-      data: apiLoginForm.toString()
-    }).catch(() => null);
-    if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
-    await new Promise((resolve2) => setTimeout(resolve2, 1e3 * 2 ** retry));
+function toPathOnly(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return "[unparseable-url]";
+  }
+}
+function toRedactedLocation(rawLocation) {
+  if (!rawLocation) return null;
+  try {
+    const url = new URL(rawLocation, "http://integration.local");
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return "[unparseable-location]";
   }
-  if (apiLoginResponse?.ok()) {
-    const apiLoginBody = await apiLoginResponse.json().catch(() => null);
-    const claims = typeof apiLoginBody?.token === "string" ? decodeJwtClaims(apiLoginBody.token) : null;
-    const baseUrl = process.env.BASE_URL || "http://localhost:3000";
-    const cookies = [];
-    if (claims?.tenantId) {
-      cookies.push({
-        name: "om_selected_tenant",
-        value: claims.tenantId,
-        url: baseUrl,
-        sameSite: "Lax"
+}
+function createAuthNavigationTrace(page) {
+  const entries = [];
+  const onResponse = (response) => {
+    const path = toPathOnly(response.url());
+    if (path === "/backend" || path.startsWith("/api/auth/session/refresh")) {
+      entries.push({
+        path,
+        status: response.status(),
+        location: toRedactedLocation(response.headers().location)
       });
     }
-    if (claims?.orgId) {
-      cookies.push({
-        name: "om_selected_org",
-        value: claims.orgId,
-        url: baseUrl,
-        sameSite: "Lax"
+  };
+  page.on("response", onResponse);
+  return {
+    entries,
+    stop: () => page.off("response", onResponse)
+  };
+}
+async function formatLoginDiagnostics(page, role, entries) {
+  const cookieNames = Array.from(
+    new Set((await page.context().cookies()).map((cookie) => cookie.name))
+  ).sort((left, right) => left.localeCompare(right));
+  const traceLines = entries.length ? entries.map((entry) => {
+    const location = entry.location ? ` -> ${entry.location}` : "";
+    return `${entry.status} ${entry.path}${location}`;
+  }) : ["none"];
+  return [
+    `Login diagnostics for role "${role}":`,
+    `current URL: ${toPathOnly(page.url())}`,
+    `browser cookie names: ${cookieNames.length ? cookieNames.join(", ") : "none"}`,
+    "backend/refresh trace:",
+    ...traceLines
+  ].join("\n");
+}
+async function throwLoginErrorWithDiagnostics(page, role, entries, error) {
+  const message = error instanceof Error ? error.message : String(error);
+  throw new Error([
+    `Login did not reach backend for role: ${role}.`,
+    await formatLoginDiagnostics(page, role, entries),
+    `Original error: ${message}`
+  ].join("\n"));
+}
+async function login(page, role = "admin") {
+  const authTrace = createAuthNavigationTrace(page);
+  try {
+    const creds = DEFAULT_CREDENTIALS[role];
+    const loginReadySelector = 'form[data-auth-ready="1"]';
+    const hasBackendUrl = () => /\/backend(?:\/.*)?$/.test(page.url());
+    const waitForBackend = async (timeout) => {
+      try {
+        await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
+        return true;
+      } catch {
+        return hasBackendUrl();
+      }
+    };
+    await acknowledgeGlobalNotices(page);
+    const apiLoginForm = new URLSearchParams();
+    apiLoginForm.set("email", creds.email);
+    apiLoginForm.set("password", creds.password);
+    let apiLoginResponse = null;
+    for (let retry = 0; retry < 4; retry += 1) {
+      apiLoginResponse = await page.request.post("/api/auth/login", {
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        data: apiLoginForm.toString()
+      }).catch(() => null);
+      if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
+      await new Promise((resolve2) => setTimeout(resolve2, 1e3 * 2 ** retry));
+    }
+    if (apiLoginResponse?.ok()) {
+      const apiLoginBody = await apiLoginResponse.json().catch(() => null);
+      const claims = typeof apiLoginBody?.token === "string" ? decodeJwtClaims(apiLoginBody.token) : null;
+      const baseUrl = process.env.BASE_URL || "http://localhost:3000";
+      const cookies = [];
+      if (claims?.tenantId) {
+        cookies.push({
+          name: "om_selected_tenant",
+          value: claims.tenantId,
+          url: baseUrl,
+          sameSite: "Lax"
+        });
+      }
+      if (claims?.orgId) {
+        cookies.push({
+          name: "om_selected_org",
+          value: claims.orgId,
+          url: baseUrl,
+          sameSite: "Lax"
+        });
+      }
+      if (cookies.length > 0) {
+        await page.context().addCookies(cookies);
+      }
+      await page.goto("/backend", { waitUntil: "domcontentloaded" });
+      if (await waitForBackend(8e3)) return;
+    }
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      await page.goto("/login", { waitUntil: "domcontentloaded" });
+      await dismissGlobalNoticesIfPresent(page);
+      await recoverClientSideErrorPageIfPresent(page);
+      await recoverGenericErrorPageIfPresent(page);
+      await page.waitForSelector(loginReadySelector, { state: "visible", timeout: 3e3 }).catch(() => null);
+      if (await page.getByLabel("Email").isVisible().catch(() => false)) break;
+      if (attempt === 3) {
+        throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+      }
+    }
+    await page.getByLabel("Email").fill(creds.email);
+    const passwordInput = page.getByLabel("Password", { exact: true }).first();
+    if (await passwordInput.isVisible().catch(() => false)) {
+      await passwordInput.fill(creds.password);
+      await passwordInput.press("Enter");
+    } else {
+      const submitButton = page.getByRole("button", { name: /login|sign in|continue with sso/i }).first();
+      await submitButton.click();
+    }
+    if (await waitForBackend(7e3)) return;
+    const loginForm = page.locator("form").first();
+    if (await loginForm.isVisible().catch(() => false)) {
+      await loginForm.evaluate((element) => {
+        const form = element;
+        form.requestSubmit();
+      }).catch(() => {
       });
     }
-    if (cookies.length > 0) {
-      await page.context().addCookies(cookies);
+    if (await waitForBackend(5e3)) return;
+    const loginButton = page.getByRole("button", { name: /login|sign in|continue with sso/i }).first();
+    if (await loginButton.isVisible().catch(() => false)) {
+      await loginButton.click({ force: true });
     }
-    await page.goto("/backend", { waitUntil: "domcontentloaded" });
     if (await waitForBackend(8e3)) return;
+    throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+  } catch (error) {
+    await throwLoginErrorWithDiagnostics(page, role, authTrace.entries, error);
+  } finally {
+    authTrace.stop();
   }
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    await page.goto("/login", { waitUntil: "domcontentloaded" });
-    await dismissGlobalNoticesIfPresent(page);
-    await recoverClientSideErrorPageIfPresent(page);
-    await recoverGenericErrorPageIfPresent(page);
-    await page.waitForSelector(loginReadySelector, { state: "visible", timeout: 3e3 }).catch(() => null);
-    if (await page.getByLabel("Email").isVisible().catch(() => false)) break;
-    if (attempt === 3) {
-      throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
-    }
-  }
-  await page.getByLabel("Email").fill(creds.email);
-  const passwordInput = page.getByLabel("Password", { exact: true }).first();
-  if (await passwordInput.isVisible().catch(() => false)) {
-    await passwordInput.fill(creds.password);
-    await passwordInput.press("Enter");
-  } else {
-    const submitButton = page.getByRole("button", { name: /login|sign in|continue with sso/i }).first();
-    await submitButton.click();
-  }
-  if (await waitForBackend(7e3)) return;
-  const loginForm = page.locator("form").first();
-  if (await loginForm.isVisible().catch(() => false)) {
-    await loginForm.evaluate((element) => {
-      const form = element;
-      form.requestSubmit();
-    }).catch(() => {
-    });
-  }
-  if (await waitForBackend(5e3)) return;
-  const loginButton = page.getByRole("button", { name: /login|sign in|continue with sso/i }).first();
-  if (await loginButton.isVisible().catch(() => false)) {
-    await loginButton.click({ force: true });
-  }
-  if (await waitForBackend(8e3)) return;
-  throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
 }
 export {
   DEFAULT_CREDENTIALS,

package/dist/helpers/integration/auth.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/auth.ts"],
-  "sourcesContent": ["import { type Page } from '@playwright/test';\nimport { readFileSync } from 'fs';\nimport { resolve } from 'path';\n\nfunction loadEnvFileContent(): string | null {\n  const candidatePaths = [\n    resolve(process.cwd(), 'apps/mercato/.env'),\n    resolve(process.cwd(), '.env'),\n  ];\n\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      if (content.trim().length > 0) {\n        return content;\n      }\n    } catch {\n      continue;\n    }\n  }\n\n  return null;\n}\n\nfunction loadEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const content = loadEnvFileContent();\n  if (!content) return undefined;\n  const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n  return match?.[1]?.trim();\n}\n\nexport const DEFAULT_CREDENTIALS: Record<string, { email: string; password: string }> = {\n  superadmin: {\n    email: loadEnvValue('OM_INIT_SUPERADMIN_EMAIL') || 'superadmin@acme.com',\n    password: loadEnvValue('OM_INIT_SUPERADMIN_PASSWORD') || 'secret',\n  },\n  admin: { email: 'admin@acme.com', password: 'secret' },\n  employee: { email: 'employee@acme.com', password: 'secret' },\n};\n\nexport type Role = 'superadmin' | 'admin' | 'employee';\n\nfunction decodeJwtClaims(token: string): { tenantId?: string; orgId?: string | null } | null {\n  const parts = token.split('.');\n  if (parts.length < 2) return null;\n  try {\n    const normalized = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');\n    const payload = JSON.parse(Buffer.from(padded, 'base64').toString('utf8')) as {\n      tenantId?: string;\n      orgId?: string | null;\n    };\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\nasync function acknowledgeGlobalNotices(page: Page): Promise<void> {\n  const baseUrl = process.env.BASE_URL || 'http://localhost:3000';\n  await page.context().addCookies([\n    {\n      name: 'om_demo_notice_ack',\n      value: 'ack',\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n    {\n      name: 'om_cookie_notice_ack',\n      value: 'ack',\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n    {\n      name: 'om_feedback_suppress',\n      value: '1',\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n    {\n      name: 'om_feedback_shown',\n      value: new Date().toISOString().slice(0, 10),\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n  ]);\n}\n\nasync function dismissGlobalNoticesIfPresent(page: Page): Promise<void> {\n  const cookieAcceptButton = page.getByRole('button', { name: /accept cookies/i }).first();\n  if (await cookieAcceptButton.isVisible().catch(() => false)) {\n    await cookieAcceptButton.click();\n  }\n\n  const demoNotice = page.getByText(/this instance is provided for demo purposes only/i).first();\n  if (await demoNotice.isVisible().catch(() => false)) {\n    const noticeContainer = demoNotice.locator('xpath=ancestor::div[contains(@class,\"pointer-events-auto\")]').first();\n    const dismissButton = noticeContainer.locator('button').first();\n    if (await dismissButton.isVisible().catch(() => false)) {\n      await dismissButton.click();\n    }\n  }\n\n  const feedbackDialog = page.getByRole('dialog', { name: /Talk to Open Mercato team/i }).first();\n  if (await feedbackDialog.isVisible().catch(() => false)) {\n    const closeButton = feedbackDialog.getByRole('button', { name: /close/i }).first();\n    if (await closeButton.isVisible().catch(() => false)) {\n      await closeButton.click().catch(() => {});\n    } else {\n      await page.keyboard.press('Escape').catch(() => {});\n    }\n  }\n}\n\nasync function recoverClientSideErrorPageIfPresent(page: Page): Promise<void> {\n  const clientErrorHeading = page\n    .getByRole('heading', { name: /Application error: a client-side exception has occurred/i })\n    .first();\n  if (!(await clientErrorHeading.isVisible().catch(() => false))) return;\n  await page.reload({ waitUntil: 'domcontentloaded' });\n  await dismissGlobalNoticesIfPresent(page);\n}\n\nasync function recoverGenericErrorPageIfPresent(page: Page): Promise<void> {\n  const errorHeading = page.getByRole('heading', { name: /^Something went wrong$/i }).first();\n  if (!(await errorHeading.isVisible().catch(() => false))) return;\n  const retryButton = page.getByRole('button', { name: /Try again/i }).first();\n  if (await retryButton.isVisible().catch(() => false)) {\n    await retryButton.click().catch(() => {});\n    await page.waitForLoadState('domcontentloaded').catch(() => {});\n    await page.waitForTimeout(500).catch(() => {});\n  } else {\n    await page.reload({ waitUntil: 'domcontentloaded' });\n  }\n  await dismissGlobalNoticesIfPresent(page);\n}\n\nexport async function login(page: Page, role: Role = 'admin'): Promise<void> {\n  const creds = DEFAULT_CREDENTIALS[role];\n  const loginReadySelector = 'form[data-auth-ready=\"1\"]';\n  const hasBackendUrl = (): boolean => /\\/backend(?:\\/.*)?$/.test(page.url());\n  const waitForBackend = async (timeout: number): Promise<boolean> => {\n    try {\n      await page.waitForURL(/\\/backend(?:\\/.*)?$/, { timeout });\n      return true;\n    } catch {\n      return hasBackendUrl();\n    }\n  };\n\n  await acknowledgeGlobalNotices(page);\n  const apiLoginForm = new URLSearchParams();\n  apiLoginForm.set('email', creds.email);\n  apiLoginForm.set('password', creds.password);\n  // Retry-on-429 against the auth rate limit (5/60s per email). Capped\n  // exponential backoff: 1s, 2s, 4s \u2014 worst-case ~7s.\n  let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;\n  for (let retry = 0; retry < 4; retry += 1) {\n    apiLoginResponse = await page.request.post('/api/auth/login', {\n      headers: {\n        'content-type': 'application/x-www-form-urlencoded',\n      },\n      data: apiLoginForm.toString(),\n    }).catch(() => null);\n    if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;\n    await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));\n  }\n  if (apiLoginResponse?.ok()) {\n    const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;\n    const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;\n    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';\n    const cookies = [];\n    if (claims?.tenantId) {\n      cookies.push({\n        name: 'om_selected_tenant',\n        value: claims.tenantId,\n        url: baseUrl,\n        sameSite: 'Lax' as const,\n      });\n    }\n    if (claims?.orgId) {\n      cookies.push({\n        name: 'om_selected_org',\n        value: claims.orgId,\n        url: baseUrl,\n        sameSite: 'Lax' as const,\n      });\n    }\n    if (cookies.length > 0) {\n      await page.context().addCookies(cookies);\n    }\n    await page.goto('/backend', { waitUntil: 'domcontentloaded' });\n    if (await waitForBackend(8_000)) return;\n  }\n\n  for (let attempt = 0; attempt < 4; attempt += 1) {\n    await page.goto('/login', { waitUntil: 'domcontentloaded' });\n    await dismissGlobalNoticesIfPresent(page);\n    await recoverClientSideErrorPageIfPresent(page);\n    await recoverGenericErrorPageIfPresent(page);\n    await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);\n    if (await page.getByLabel('Email').isVisible().catch(() => false)) break;\n    if (attempt === 3) {\n      throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);\n    }\n  }\n  await page.getByLabel('Email').fill(creds.email);\n\n  const passwordInput = page.getByLabel('Password', { exact: true }).first();\n  if (await passwordInput.isVisible().catch(() => false)) {\n    await passwordInput.fill(creds.password);\n    await passwordInput.press('Enter');\n  } else {\n    const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();\n    await submitButton.click();\n  }\n\n  if (await waitForBackend(7_000)) return;\n\n  const loginForm = page.locator('form').first();\n  if (await loginForm.isVisible().catch(() => false)) {\n    await loginForm.evaluate((element) => {\n      const form = element as HTMLFormElement\n      form.requestSubmit()\n    }).catch(() => {})\n  }\n  if (await waitForBackend(5_000)) return;\n\n  const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();\n  if (await loginButton.isVisible().catch(() => false)) {\n    await loginButton.click({ force: true });\n  }\n  if (await waitForBackend(8_000)) return;\n\n  throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AAExB,SAAS,qBAAoC;AAC3C,QAAM,iBAAiB;AAAA,IACrB,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC1C,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EAC/B;AAEA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,UAAI,QAAQ,KAAK,EAAE,SAAS,GAAG;AAC7B,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,UAAU,mBAAmB;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,SAAO,QAAQ,CAAC,GAAG,KAAK;AAC1B;AAEO,MAAM,sBAA2E;AAAA,EACtF,YAAY;AAAA,IACV,OAAO,aAAa,0BAA0B,KAAK;AAAA,IACnD,UAAU,aAAa,6BAA6B,KAAK;AAAA,EAC3D;AAAA,EACA,OAAO,EAAE,OAAO,kBAAkB,UAAU,SAAS;AAAA,EACrD,UAAU,EAAE,OAAO,qBAAqB,UAAU,SAAS;AAC7D;AAIA,SAAS,gBAAgB,OAAoE;AAC3F,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI;AACF,UAAM,aAAa,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAChE,UAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AAIzE,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,yBAAyB,MAA2B;AACjE,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM,KAAK,QAAQ,EAAE,WAAW;AAAA,IAC9B;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,QAAO,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,MAC3C,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACH;AAEA,eAAe,8BAA8B,MAA2B;AACtE,QAAM,qBAAqB,KAAK,UAAU,UAAU,EAAE,MAAM,kBAAkB,CAAC,EAAE,MAAM;AACvF,MAAI,MAAM,mBAAmB,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AAC3D,UAAM,mBAAmB,MAAM;AAAA,EACjC;AAEA,QAAM,aAAa,KAAK,UAAU,mDAAmD,EAAE,MAAM;AAC7F,MAAI,MAAM,WAAW,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACnD,UAAM,kBAAkB,WAAW,QAAQ,6DAA6D,EAAE,MAAM;AAChH,UAAM,gBAAgB,gBAAgB,QAAQ,QAAQ,EAAE,MAAM;AAC9D,QAAI,MAAM,cAAc,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACtD,YAAM,cAAc,MAAM;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,iBAAiB,KAAK,UAAU,UAAU,EAAE,MAAM,6BAA6B,CAAC,EAAE,MAAM;AAC9F,MAAI,MAAM,eAAe,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACvD,UAAM,cAAc,eAAe,UAAU,UAAU,EAAE,MAAM,SAAS,CAAC,EAAE,MAAM;AACjF,QAAI,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACpD,YAAM,YAAY,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC1C,OAAO;AACL,YAAM,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,oCAAoC,MAA2B;AAC5E,QAAM,qBAAqB,KACxB,UAAU,WAAW,EAAE,MAAM,2DAA2D,CAAC,EACzF,MAAM;AACT,MAAI,CAAE,MAAM,mBAAmB,UAAU,EAAE,MAAM,MAAM,KAAK,EAAI;AAChE,QAAM,KAAK,OAAO,EAAE,WAAW,mBAAmB,CAAC;AACnD,QAAM,8BAA8B,IAAI;AAC1C;AAEA,eAAe,iCAAiC,MAA2B;AACzE,QAAM,eAAe,KAAK,UAAU,WAAW,EAAE,MAAM,0BAA0B,CAAC,EAAE,MAAM;AAC1F,MAAI,CAAE,MAAM,aAAa,UAAU,EAAE,MAAM,MAAM,KAAK,EAAI;AAC1D,QAAM,cAAc,KAAK,UAAU,UAAU,EAAE,MAAM,aAAa,CAAC,EAAE,MAAM;AAC3E,MAAI,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACpD,UAAM,YAAY,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACxC,UAAM,KAAK,iBAAiB,kBAAkB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC9D,UAAM,KAAK,eAAe,GAAG,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC/C,OAAO;AACL,UAAM,KAAK,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,EACrD;AACA,QAAM,8BAA8B,IAAI;AAC1C;AAEA,eAAsB,MAAM,MAAY,OAAa,SAAwB;AAC3E,QAAM,QAAQ,oBAAoB,IAAI;AACtC,QAAM,qBAAqB;AAC3B,QAAM,gBAAgB,MAAe,sBAAsB,KAAK,KAAK,IAAI,CAAC;AAC1E,QAAM,iBAAiB,OAAO,YAAsC;AAClE,QAAI;AACF,YAAM,KAAK,WAAW,uBAAuB,EAAE,QAAQ,CAAC;AACxD,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,yBAAyB,IAAI;AACnC,QAAM,eAAe,IAAI,gBAAgB;AACzC,eAAa,IAAI,SAAS,MAAM,KAAK;AACrC,eAAa,IAAI,YAAY,MAAM,QAAQ;AAG3C,MAAI,mBAAyE;AAC7E,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,uBAAmB,MAAM,KAAK,QAAQ,KAAK,mBAAmB;AAAA,MAC5D,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,aAAa,SAAS;AAAA,IAC9B,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,QAAI,CAAC,oBAAoB,iBAAiB,OAAO,MAAM,IAAK;AAC5D,UAAM,IAAI,QAAQ,CAACA,aAAY,WAAWA,UAAS,MAAO,KAAK,KAAK,CAAC;AAAA,EACvE;AACA,MAAI,kBAAkB,GAAG,GAAG;AAC1B,UAAM,eAAgB,MAAM,iBAAiB,KAAK,EAAE,MAAM,MAAM,IAAI;AACpE,UAAM,SAAS,OAAO,cAAc,UAAU,WAAW,gBAAgB,aAAa,KAAK,IAAI;AAC/F,UAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,UAAM,UAAU,CAAC;AACjB,QAAI,QAAQ,UAAU;AACpB,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,OAAO,OAAO;AAAA,QACd,KAAK;AAAA,QACL,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,OAAO;AACjB,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,OAAO,OAAO;AAAA,QACd,KAAK;AAAA,QACL,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK,QAAQ,EAAE,WAAW,OAAO;AAAA,IACzC;AACA,UAAM,KAAK,KAAK,YAAY,EAAE,WAAW,mBAAmB,CAAC;AAC7D,QAAI,MAAM,eAAe,GAAK,EAAG;AAAA,EACnC;AAEA,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,KAAK,KAAK,UAAU,EAAE,WAAW,mBAAmB,CAAC;AAC3D,UAAM,8BAA8B,IAAI;AACxC,UAAM,oCAAoC,IAAI;AAC9C,UAAM,iCAAiC,IAAI;AAC3C,UAAM,KAAK,gBAAgB,oBAAoB,EAAE,OAAO,WAAW,SAAS,IAAM,CAAC,EAAE,MAAM,MAAM,IAAI;AACrG,QAAI,MAAM,KAAK,WAAW,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAG;AACnE,QAAI,YAAY,GAAG;AACjB,YAAM,IAAI,MAAM,uCAAuC,IAAI,kBAAkB,KAAK,IAAI,CAAC,EAAE;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,KAAK,WAAW,OAAO,EAAE,KAAK,MAAM,KAAK;AAE/C,QAAM,gBAAgB,KAAK,WAAW,YAAY,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM;AACzE,MAAI,MAAM,cAAc,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACtD,UAAM,cAAc,KAAK,MAAM,QAAQ;AACvC,UAAM,cAAc,MAAM,OAAO;AAAA,EACnC,OAAO;AACL,UAAM,eAAe,KAAK,UAAU,UAAU,EAAE,MAAM,mCAAmC,CAAC,EAAE,MAAM;AAClG,UAAM,aAAa,MAAM;AAAA,EAC3B;AAEA,MAAI,MAAM,eAAe,GAAK,EAAG;AAEjC,QAAM,YAAY,KAAK,QAAQ,MAAM,EAAE,MAAM;AAC7C,MAAI,MAAM,UAAU,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AAClD,UAAM,UAAU,SAAS,CAAC,YAAY;AACpC,YAAM,OAAO;AACb,WAAK,cAAc;AAAA,IACrB,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACnB;AACA,MAAI,MAAM,eAAe,GAAK,EAAG;AAEjC,QAAM,cAAc,KAAK,UAAU,UAAU,EAAE,MAAM,mCAAmC,CAAC,EAAE,MAAM;AACjG,MAAI,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACpD,UAAM,YAAY,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EACzC;AACA,MAAI,MAAM,eAAe,GAAK,EAAG;AAEjC,QAAM,IAAI,MAAM,yCAAyC,IAAI,kBAAkB,KAAK,IAAI,CAAC,EAAE;AAC7F;",
+  "sourcesContent": ["import { type Page, type Response } from '@playwright/test';\nimport { readFileSync } from 'fs';\nimport { resolve } from 'path';\n\nfunction loadEnvFileContent(): string | null {\n  const candidatePaths = [\n    resolve(process.cwd(), 'apps/mercato/.env'),\n    resolve(process.cwd(), '.env'),\n  ];\n\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      if (content.trim().length > 0) {\n        return content;\n      }\n    } catch {\n      continue;\n    }\n  }\n\n  return null;\n}\n\nfunction loadEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const content = loadEnvFileContent();\n  if (!content) return undefined;\n  const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n  return match?.[1]?.trim();\n}\n\nexport const DEFAULT_CREDENTIALS: Record<string, { email: string; password: string }> = {\n  superadmin: {\n    email: loadEnvValue('OM_INIT_SUPERADMIN_EMAIL') || 'superadmin@acme.com',\n    password: loadEnvValue('OM_INIT_SUPERADMIN_PASSWORD') || 'secret',\n  },\n  admin: { email: 'admin@acme.com', password: 'secret' },\n  employee: { email: 'employee@acme.com', password: 'secret' },\n};\n\nexport type Role = 'superadmin' | 'admin' | 'employee';\n\nfunction decodeJwtClaims(token: string): { tenantId?: string; orgId?: string | null } | null {\n  const parts = token.split('.');\n  if (parts.length < 2) return null;\n  try {\n    const normalized = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');\n    const payload = JSON.parse(Buffer.from(padded, 'base64').toString('utf8')) as {\n      tenantId?: string;\n      orgId?: string | null;\n    };\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\nasync function acknowledgeGlobalNotices(page: Page): Promise<void> {\n  const baseUrl = process.env.BASE_URL || 'http://localhost:3000';\n  await page.context().addCookies([\n    {\n      name: 'om_demo_notice_ack',\n      value: 'ack',\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n    {\n      name: 'om_cookie_notice_ack',\n      value: 'ack',\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n    {\n      name: 'om_feedback_suppress',\n      value: '1',\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n    {\n      name: 'om_feedback_shown',\n      value: new Date().toISOString().slice(0, 10),\n      url: baseUrl,\n      sameSite: 'Lax',\n    },\n  ]);\n}\n\nasync function dismissGlobalNoticesIfPresent(page: Page): Promise<void> {\n  const cookieAcceptButton = page.getByRole('button', { name: /accept cookies/i }).first();\n  if (await cookieAcceptButton.isVisible().catch(() => false)) {\n    await cookieAcceptButton.click();\n  }\n\n  const demoNotice = page.getByText(/this instance is provided for demo purposes only/i).first();\n  if (await demoNotice.isVisible().catch(() => false)) {\n    const noticeContainer = demoNotice.locator('xpath=ancestor::div[contains(@class,\"pointer-events-auto\")]').first();\n    const dismissButton = noticeContainer.locator('button').first();\n    if (await dismissButton.isVisible().catch(() => false)) {\n      await dismissButton.click();\n    }\n  }\n\n  const feedbackDialog = page.getByRole('dialog', { name: /Talk to Open Mercato team/i }).first();\n  if (await feedbackDialog.isVisible().catch(() => false)) {\n    const closeButton = feedbackDialog.getByRole('button', { name: /close/i }).first();\n    if (await closeButton.isVisible().catch(() => false)) {\n      await closeButton.click().catch(() => {});\n    } else {\n      await page.keyboard.press('Escape').catch(() => {});\n    }\n  }\n}\n\nasync function recoverClientSideErrorPageIfPresent(page: Page): Promise<void> {\n  const clientErrorHeading = page\n    .getByRole('heading', { name: /Application error: a client-side exception has occurred/i })\n    .first();\n  if (!(await clientErrorHeading.isVisible().catch(() => false))) return;\n  await page.reload({ waitUntil: 'domcontentloaded' });\n  await dismissGlobalNoticesIfPresent(page);\n}\n\nasync function recoverGenericErrorPageIfPresent(page: Page): Promise<void> {\n  const errorHeading = page.getByRole('heading', { name: /^Something went wrong$/i }).first();\n  if (!(await errorHeading.isVisible().catch(() => false))) return;\n  const retryButton = page.getByRole('button', { name: /Try again/i }).first();\n  if (await retryButton.isVisible().catch(() => false)) {\n    await retryButton.click().catch(() => {});\n    await page.waitForLoadState('domcontentloaded').catch(() => {});\n    await page.waitForTimeout(500).catch(() => {});\n  } else {\n    await page.reload({ waitUntil: 'domcontentloaded' });\n  }\n  await dismissGlobalNoticesIfPresent(page);\n}\n\ntype AuthNavigationTraceEntry = {\n  path: string;\n  status: number;\n  location: string | null;\n};\n\nfunction toPathOnly(rawUrl: string): string {\n  try {\n    const url = new URL(rawUrl);\n    return `${url.pathname}${url.search}`;\n  } catch {\n    return '[unparseable-url]';\n  }\n}\n\nfunction toRedactedLocation(rawLocation: string | undefined): string | null {\n  if (!rawLocation) return null;\n  try {\n    const url = new URL(rawLocation, 'http://integration.local');\n    return `${url.pathname}${url.search}`;\n  } catch {\n    return '[unparseable-location]';\n  }\n}\n\nfunction createAuthNavigationTrace(page: Page): {\n  entries: AuthNavigationTraceEntry[];\n  stop: () => void;\n} {\n  const entries: AuthNavigationTraceEntry[] = [];\n  const onResponse = (response: Response) => {\n    const path = toPathOnly(response.url());\n    if (path === '/backend' || path.startsWith('/api/auth/session/refresh')) {\n      entries.push({\n        path,\n        status: response.status(),\n        location: toRedactedLocation(response.headers().location),\n      });\n    }\n  };\n  page.on('response', onResponse);\n  return {\n    entries,\n    stop: () => page.off('response', onResponse),\n  };\n}\n\nasync function formatLoginDiagnostics(\n  page: Page,\n  role: Role,\n  entries: AuthNavigationTraceEntry[],\n): Promise<string> {\n  const cookieNames = Array.from(\n    new Set((await page.context().cookies()).map((cookie) => cookie.name)),\n  ).sort((left, right) => left.localeCompare(right));\n  const traceLines = entries.length\n    ? entries.map((entry) => {\n      const location = entry.location ? ` -> ${entry.location}` : '';\n      return `${entry.status} ${entry.path}${location}`;\n    })\n    : ['none'];\n\n  return [\n    `Login diagnostics for role \"${role}\":`,\n    `current URL: ${toPathOnly(page.url())}`,\n    `browser cookie names: ${cookieNames.length ? cookieNames.join(', ') : 'none'}`,\n    'backend/refresh trace:',\n    ...traceLines,\n  ].join('\\n');\n}\n\nasync function throwLoginErrorWithDiagnostics(\n  page: Page,\n  role: Role,\n  entries: AuthNavigationTraceEntry[],\n  error: unknown,\n): Promise<never> {\n  const message = error instanceof Error ? error.message : String(error);\n  throw new Error([\n    `Login did not reach backend for role: ${role}.`,\n    await formatLoginDiagnostics(page, role, entries),\n    `Original error: ${message}`,\n  ].join('\\n'));\n}\n\nexport async function login(page: Page, role: Role = 'admin'): Promise<void> {\n  const authTrace = createAuthNavigationTrace(page);\n  try {\n    const creds = DEFAULT_CREDENTIALS[role];\n    const loginReadySelector = 'form[data-auth-ready=\"1\"]';\n    const hasBackendUrl = (): boolean => /\\/backend(?:\\/.*)?$/.test(page.url());\n    const waitForBackend = async (timeout: number): Promise<boolean> => {\n      try {\n        await page.waitForURL(/\\/backend(?:\\/.*)?$/, { timeout });\n        return true;\n      } catch {\n        return hasBackendUrl();\n      }\n    };\n\n    await acknowledgeGlobalNotices(page);\n    const apiLoginForm = new URLSearchParams();\n    apiLoginForm.set('email', creds.email);\n    apiLoginForm.set('password', creds.password);\n    // Retry-on-429 against the auth rate limit (5/60s per email). Capped\n    // exponential backoff: 1s, 2s, 4s \u2014 worst-case ~7s.\n    let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;\n    for (let retry = 0; retry < 4; retry += 1) {\n      apiLoginResponse = await page.request.post('/api/auth/login', {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: apiLoginForm.toString(),\n      }).catch(() => null);\n      if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;\n      await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));\n    }\n    if (apiLoginResponse?.ok()) {\n      const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;\n      const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;\n      const baseUrl = process.env.BASE_URL || 'http://localhost:3000';\n      const cookies = [];\n      if (claims?.tenantId) {\n        cookies.push({\n          name: 'om_selected_tenant',\n          value: claims.tenantId,\n          url: baseUrl,\n          sameSite: 'Lax' as const,\n        });\n      }\n      if (claims?.orgId) {\n        cookies.push({\n          name: 'om_selected_org',\n          value: claims.orgId,\n          url: baseUrl,\n          sameSite: 'Lax' as const,\n        });\n      }\n      if (cookies.length > 0) {\n        await page.context().addCookies(cookies);\n      }\n      await page.goto('/backend', { waitUntil: 'domcontentloaded' });\n      if (await waitForBackend(8_000)) return;\n    }\n\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      await page.goto('/login', { waitUntil: 'domcontentloaded' });\n      await dismissGlobalNoticesIfPresent(page);\n      await recoverClientSideErrorPageIfPresent(page);\n      await recoverGenericErrorPageIfPresent(page);\n      await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);\n      if (await page.getByLabel('Email').isVisible().catch(() => false)) break;\n      if (attempt === 3) {\n        throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);\n      }\n    }\n    await page.getByLabel('Email').fill(creds.email);\n\n    const passwordInput = page.getByLabel('Password', { exact: true }).first();\n    if (await passwordInput.isVisible().catch(() => false)) {\n      await passwordInput.fill(creds.password);\n      await passwordInput.press('Enter');\n    } else {\n      const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();\n      await submitButton.click();\n    }\n\n    if (await waitForBackend(7_000)) return;\n\n    const loginForm = page.locator('form').first();\n    if (await loginForm.isVisible().catch(() => false)) {\n      await loginForm.evaluate((element) => {\n        const form = element as HTMLFormElement\n        form.requestSubmit()\n      }).catch(() => {})\n    }\n    if (await waitForBackend(5_000)) return;\n\n    const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();\n    if (await loginButton.isVisible().catch(() => false)) {\n      await loginButton.click({ force: true });\n    }\n    if (await waitForBackend(8_000)) return;\n\n    throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);\n  } catch (error) {\n    await throwLoginErrorWithDiagnostics(page, role, authTrace.entries, error);\n  } finally {\n    authTrace.stop();\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AAExB,SAAS,qBAAoC;AAC3C,QAAM,iBAAiB;AAAA,IACrB,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC1C,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EAC/B;AAEA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,UAAI,QAAQ,KAAK,EAAE,SAAS,GAAG;AAC7B,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,UAAU,mBAAmB;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,SAAO,QAAQ,CAAC,GAAG,KAAK;AAC1B;AAEO,MAAM,sBAA2E;AAAA,EACtF,YAAY;AAAA,IACV,OAAO,aAAa,0BAA0B,KAAK;AAAA,IACnD,UAAU,aAAa,6BAA6B,KAAK;AAAA,EAC3D;AAAA,EACA,OAAO,EAAE,OAAO,kBAAkB,UAAU,SAAS;AAAA,EACrD,UAAU,EAAE,OAAO,qBAAqB,UAAU,SAAS;AAC7D;AAIA,SAAS,gBAAgB,OAAoE;AAC3F,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI;AACF,UAAM,aAAa,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAChE,UAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AAIzE,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,yBAAyB,MAA2B;AACjE,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,QAAM,KAAK,QAAQ,EAAE,WAAW;AAAA,IAC9B;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,QAAO,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,MAC3C,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACH;AAEA,eAAe,8BAA8B,MAA2B;AACtE,QAAM,qBAAqB,KAAK,UAAU,UAAU,EAAE,MAAM,kBAAkB,CAAC,EAAE,MAAM;AACvF,MAAI,MAAM,mBAAmB,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AAC3D,UAAM,mBAAmB,MAAM;AAAA,EACjC;AAEA,QAAM,aAAa,KAAK,UAAU,mDAAmD,EAAE,MAAM;AAC7F,MAAI,MAAM,WAAW,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACnD,UAAM,kBAAkB,WAAW,QAAQ,6DAA6D,EAAE,MAAM;AAChH,UAAM,gBAAgB,gBAAgB,QAAQ,QAAQ,EAAE,MAAM;AAC9D,QAAI,MAAM,cAAc,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACtD,YAAM,cAAc,MAAM;AAAA,IAC5B;AAAA,EACF;AAEA,QAAM,iBAAiB,KAAK,UAAU,UAAU,EAAE,MAAM,6BAA6B,CAAC,EAAE,MAAM;AAC9F,MAAI,MAAM,eAAe,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACvD,UAAM,cAAc,eAAe,UAAU,UAAU,EAAE,MAAM,SAAS,CAAC,EAAE,MAAM;AACjF,QAAI,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACpD,YAAM,YAAY,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC1C,OAAO;AACL,YAAM,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,oCAAoC,MAA2B;AAC5E,QAAM,qBAAqB,KACxB,UAAU,WAAW,EAAE,MAAM,2DAA2D,CAAC,EACzF,MAAM;AACT,MAAI,CAAE,MAAM,mBAAmB,UAAU,EAAE,MAAM,MAAM,KAAK,EAAI;AAChE,QAAM,KAAK,OAAO,EAAE,WAAW,mBAAmB,CAAC;AACnD,QAAM,8BAA8B,IAAI;AAC1C;AAEA,eAAe,iCAAiC,MAA2B;AACzE,QAAM,eAAe,KAAK,UAAU,WAAW,EAAE,MAAM,0BAA0B,CAAC,EAAE,MAAM;AAC1F,MAAI,CAAE,MAAM,aAAa,UAAU,EAAE,MAAM,MAAM,KAAK,EAAI;AAC1D,QAAM,cAAc,KAAK,UAAU,UAAU,EAAE,MAAM,aAAa,CAAC,EAAE,MAAM;AAC3E,MAAI,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACpD,UAAM,YAAY,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACxC,UAAM,KAAK,iBAAiB,kBAAkB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC9D,UAAM,KAAK,eAAe,GAAG,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC/C,OAAO;AACL,UAAM,KAAK,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,EACrD;AACA,QAAM,8BAA8B,IAAI;AAC1C;AAQA,SAAS,WAAW,QAAwB;AAC1C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,WAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,aAAgD;AAC1E,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,aAAa,0BAA0B;AAC3D,WAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,MAGjC;AACA,QAAM,UAAsC,CAAC;AAC7C,QAAM,aAAa,CAAC,aAAuB;AACzC,UAAM,OAAO,WAAW,SAAS,IAAI,CAAC;AACtC,QAAI,SAAS,cAAc,KAAK,WAAW,2BAA2B,GAAG;AACvE,cAAQ,KAAK;AAAA,QACX;AAAA,QACA,QAAQ,SAAS,OAAO;AAAA,QACxB,UAAU,mBAAmB,SAAS,QAAQ,EAAE,QAAQ;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AACA,OAAK,GAAG,YAAY,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,KAAK,IAAI,YAAY,UAAU;AAAA,EAC7C;AACF;AAEA,eAAe,uBACb,MACA,MACA,SACiB;AACjB,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI,KAAK,MAAM,KAAK,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AAAA,EACvE,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACjD,QAAM,aAAa,QAAQ,SACvB,QAAQ,IAAI,CAAC,UAAU;AACvB,UAAM,WAAW,MAAM,WAAW,OAAO,MAAM,QAAQ,KAAK;AAC5D,WAAO,GAAG,MAAM,MAAM,IAAI,MAAM,IAAI,GAAG,QAAQ;AAAA,EACjD,CAAC,IACC,CAAC,MAAM;AAEX,SAAO;AAAA,IACL,+BAA+B,IAAI;AAAA,IACnC,gBAAgB,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,IACtC,yBAAyB,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,MAAM;AAAA,IAC7E;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEA,eAAe,+BACb,MACA,MACA,SACA,OACgB;AAChB,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,IAAI,MAAM;AAAA,IACd,yCAAyC,IAAI;AAAA,IAC7C,MAAM,uBAAuB,MAAM,MAAM,OAAO;AAAA,IAChD,mBAAmB,OAAO;AAAA,EAC5B,EAAE,KAAK,IAAI,CAAC;AACd;AAEA,eAAsB,MAAM,MAAY,OAAa,SAAwB;AAC3E,QAAM,YAAY,0BAA0B,IAAI;AAChD,MAAI;AACF,UAAM,QAAQ,oBAAoB,IAAI;AACtC,UAAM,qBAAqB;AAC3B,UAAM,gBAAgB,MAAe,sBAAsB,KAAK,KAAK,IAAI,CAAC;AAC1E,UAAM,iBAAiB,OAAO,YAAsC;AAClE,UAAI;AACF,cAAM,KAAK,WAAW,uBAAuB,EAAE,QAAQ,CAAC;AACxD,eAAO;AAAA,MACT,QAAQ;AACN,eAAO,cAAc;AAAA,MACvB;AAAA,IACF;AAEA,UAAM,yBAAyB,IAAI;AACnC,UAAM,eAAe,IAAI,gBAAgB;AACzC,iBAAa,IAAI,SAAS,MAAM,KAAK;AACrC,iBAAa,IAAI,YAAY,MAAM,QAAQ;AAG3C,QAAI,mBAAyE;AAC7E,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,yBAAmB,MAAM,KAAK,QAAQ,KAAK,mBAAmB;AAAA,QAC5D,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,aAAa,SAAS;AAAA,MAC9B,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,UAAI,CAAC,oBAAoB,iBAAiB,OAAO,MAAM,IAAK;AAC5D,YAAM,IAAI,QAAQ,CAACA,aAAY,WAAWA,UAAS,MAAO,KAAK,KAAK,CAAC;AAAA,IACvE;AACA,QAAI,kBAAkB,GAAG,GAAG;AAC1B,YAAM,eAAgB,MAAM,iBAAiB,KAAK,EAAE,MAAM,MAAM,IAAI;AACpE,YAAM,SAAS,OAAO,cAAc,UAAU,WAAW,gBAAgB,aAAa,KAAK,IAAI;AAC/F,YAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,YAAM,UAAU,CAAC;AACjB,UAAI,QAAQ,UAAU;AACpB,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,OAAO,OAAO;AAAA,UACd,KAAK;AAAA,UACL,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,OAAO;AACjB,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,OAAO,OAAO;AAAA,UACd,KAAK;AAAA,UACL,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,KAAK,QAAQ,EAAE,WAAW,OAAO;AAAA,MACzC;AACA,YAAM,KAAK,KAAK,YAAY,EAAE,WAAW,mBAAmB,CAAC;AAC7D,UAAI,MAAM,eAAe,GAAK,EAAG;AAAA,IACnC;AAEA,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAM,KAAK,KAAK,UAAU,EAAE,WAAW,mBAAmB,CAAC;AAC3D,YAAM,8BAA8B,IAAI;AACxC,YAAM,oCAAoC,IAAI;AAC9C,YAAM,iCAAiC,IAAI;AAC3C,YAAM,KAAK,gBAAgB,oBAAoB,EAAE,OAAO,WAAW,SAAS,IAAM,CAAC,EAAE,MAAM,MAAM,IAAI;AACrG,UAAI,MAAM,KAAK,WAAW,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAG;AACnE,UAAI,YAAY,GAAG;AACjB,cAAM,IAAI,MAAM,uCAAuC,IAAI,kBAAkB,KAAK,IAAI,CAAC,EAAE;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,KAAK,WAAW,OAAO,EAAE,KAAK,MAAM,KAAK;AAE/C,UAAM,gBAAgB,KAAK,WAAW,YAAY,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM;AACzE,QAAI,MAAM,cAAc,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACtD,YAAM,cAAc,KAAK,MAAM,QAAQ;AACvC,YAAM,cAAc,MAAM,OAAO;AAAA,IACnC,OAAO;AACL,YAAM,eAAe,KAAK,UAAU,UAAU,EAAE,MAAM,mCAAmC,CAAC,EAAE,MAAM;AAClG,YAAM,aAAa,MAAM;AAAA,IAC3B;AAEA,QAAI,MAAM,eAAe,GAAK,EAAG;AAEjC,UAAM,YAAY,KAAK,QAAQ,MAAM,EAAE,MAAM;AAC7C,QAAI,MAAM,UAAU,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AAClD,YAAM,UAAU,SAAS,CAAC,YAAY;AACpC,cAAM,OAAO;AACb,aAAK,cAAc;AAAA,MACrB,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACnB;AACA,QAAI,MAAM,eAAe,GAAK,EAAG;AAEjC,UAAM,cAAc,KAAK,UAAU,UAAU,EAAE,MAAM,mCAAmC,CAAC,EAAE,MAAM;AACjG,QAAI,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACpD,YAAM,YAAY,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,IACzC;AACA,QAAI,MAAM,eAAe,GAAK,EAAG;AAEjC,UAAM,IAAI,MAAM,yCAAyC,IAAI,kBAAkB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7F,SAAS,OAAO;AACd,UAAM,+BAA+B,MAAM,MAAM,UAAU,SAAS,KAAK;AAAA,EAC3E,UAAE;AACA,cAAU,KAAK;AAAA,EACjB;AACF;",
   "names": ["resolve"]
 }

package/dist/helpers/integration/queue-runner.js

@@ -51,7 +51,8 @@ async function runQueueDrainFromEnv() {
     jobLimit,
     queueBaseDir: process.env.QUEUE_BASE_DIR
   });
-  console.log(JSON.stringify({ processed }));
+  process.stdout.write(`${JSON.stringify({ processed })}
+`);
 }
 const currentFile = fileURLToPath(import.meta.url);
 const invokedFile = process.argv[1] ? path.resolve(process.argv[1]) : null;
@@ -59,7 +60,8 @@ if (invokedFile === currentFile) {
   runQueueDrainFromEnv().then(() => {
     process.exit(0);
   }).catch((error) => {
-    console.error(error);
+    process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}
+`);
     process.exit(1);
   });
 }

package/dist/helpers/integration/queue-runner.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/queue-runner.ts"],
-  "sourcesContent": ["import path from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { bootstrapFromAppRoot } from '@open-mercato/shared/lib/bootstrap/dynamicLoader'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { createQueue } from '@open-mercato/queue'\n\nexport type QueueDrainRunnerOptions = {\n  appRoot: string\n  jobLimit: number\n  queueBaseDir?: string\n}\n\ntype BootstrapData = Awaited<ReturnType<typeof bootstrapFromAppRoot>>\n\nconst bootstrapCache = new Map<string, Promise<BootstrapData>>()\n\nfunction getBootstrapData(appRoot: string): Promise<BootstrapData> {\n  const resolvedAppRoot = path.resolve(appRoot)\n  const cached = bootstrapCache.get(resolvedAppRoot)\n  if (cached) return cached\n  const promise = bootstrapFromAppRoot(resolvedAppRoot)\n  bootstrapCache.set(resolvedAppRoot, promise)\n  return promise\n}\n\nexport async function drainQueueFromAppRoot(\n  queueName: string,\n  options: QueueDrainRunnerOptions,\n): Promise<number> {\n  const data = await getBootstrapData(options.appRoot)\n  const worker = data.modules\n    .flatMap((module) => module.workers ?? [])\n    .find((entry) => entry.queue === queueName)\n  if (!worker) return 0\n\n  const container = await createRequestContainer()\n  const queue = createQueue(queueName, 'local', {\n    baseDir: path.resolve(\n      options.queueBaseDir?.trim()\n      || process.env.QUEUE_BASE_DIR?.trim()\n      || path.resolve(options.appRoot, '.mercato/queue'),\n    ),\n    concurrency: 1,\n  })\n  const resolve = <T = unknown>(name: string): T => container.resolve(name) as T\n\n  try {\n    let processedJobs = 0\n    while (true) {\n      const result = await queue.process(\n        async (job, ctx) => {\n          await Promise.resolve(worker.handler(job, { ...ctx, resolve }))\n        },\n        { limit: options.jobLimit },\n      )\n      const handled = result.processed + result.failed\n      processedJobs += handled\n      if (handled === 0) return processedJobs\n    }\n  } finally {\n    await queue.close()\n  }\n}\n\nexport async function runQueueDrainFromEnv(): Promise<void> {\n  const queueName = process.env.OM_INTEGRATION_QUEUE_NAME?.trim()\n  const appRoot = process.env.OM_INTEGRATION_APP_ROOT?.trim()\n  const jobLimit = Number.parseInt(process.env.OM_INTEGRATION_QUEUE_JOB_LIMIT || '100', 10) || 100\n  if (!queueName || !appRoot) throw new Error('Missing queue drain environment')\n\n  const processed = await drainQueueFromAppRoot(queueName, {\n    appRoot: path.resolve(appRoot),\n    jobLimit,\n    queueBaseDir: process.env.QUEUE_BASE_DIR,\n  })\n  console.log(JSON.stringify({ processed }))\n}\n\nconst currentFile = fileURLToPath(import.meta.url)\nconst invokedFile = process.argv[1] ? path.resolve(process.argv[1]) : null\n\nif (invokedFile === currentFile) {\n  runQueueDrainFromEnv()\n    .then(() => {\n      process.exit(0)\n    })\n    .catch((error) => {\n      console.error(error)\n      process.exit(1)\n    })\n}\n"],
-  "mappings": "AAAA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,mBAAmB;AAU5B,MAAM,iBAAiB,oBAAI,IAAoC;AAE/D,SAAS,iBAAiB,SAAyC;AACjE,QAAM,kBAAkB,KAAK,QAAQ,OAAO;AAC5C,QAAM,SAAS,eAAe,IAAI,eAAe;AACjD,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,qBAAqB,eAAe;AACpD,iBAAe,IAAI,iBAAiB,OAAO;AAC3C,SAAO;AACT;AAEA,eAAsB,sBACpB,WACA,SACiB;AACjB,QAAM,OAAO,MAAM,iBAAiB,QAAQ,OAAO;AACnD,QAAM,SAAS,KAAK,QACjB,QAAQ,CAAC,WAAW,OAAO,WAAW,CAAC,CAAC,EACxC,KAAK,CAAC,UAAU,MAAM,UAAU,SAAS;AAC5C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,YAAY,WAAW,SAAS;AAAA,IAC5C,SAAS,KAAK;AAAA,MACZ,QAAQ,cAAc,KAAK,KACxB,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,QAAQ,SAAS,gBAAgB;AAAA,IACnD;AAAA,IACA,aAAa;AAAA,EACf,CAAC;AACD,QAAM,UAAU,CAAc,SAAoB,UAAU,QAAQ,IAAI;AAExE,MAAI;AACF,QAAI,gBAAgB;AACpB,WAAO,MAAM;AACX,YAAM,SAAS,MAAM,MAAM;AAAA,QACzB,OAAO,KAAK,QAAQ;AAClB,gBAAM,QAAQ,QAAQ,OAAO,QAAQ,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AAAA,QAChE;AAAA,QACA,EAAE,OAAO,QAAQ,SAAS;AAAA,MAC5B;AACA,YAAM,UAAU,OAAO,YAAY,OAAO;AAC1C,uBAAiB;AACjB,UAAI,YAAY,EAAG,QAAO;AAAA,IAC5B;AAAA,EACF,UAAE;AACA,UAAM,MAAM,MAAM;AAAA,EACpB;AACF;AAEA,eAAsB,uBAAsC;AAC1D,QAAM,YAAY,QAAQ,IAAI,2BAA2B,KAAK;AAC9D,QAAM,UAAU,QAAQ,IAAI,yBAAyB,KAAK;AAC1D,QAAM,WAAW,OAAO,SAAS,QAAQ,IAAI,kCAAkC,OAAO,EAAE,KAAK;AAC7F,MAAI,CAAC,aAAa,CAAC,QAAS,OAAM,IAAI,MAAM,iCAAiC;AAE7E,QAAM,YAAY,MAAM,sBAAsB,WAAW;AAAA,IACvD,SAAS,KAAK,QAAQ,OAAO;AAAA,IAC7B;AAAA,IACA,cAAc,QAAQ,IAAI;AAAA,EAC5B,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,EAAE,UAAU,CAAC,CAAC;AAC3C;AAEA,MAAM,cAAc,cAAc,YAAY,GAAG;AACjD,MAAM,cAAc,QAAQ,KAAK,CAAC,IAAI,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,IAAI;AAEtE,IAAI,gBAAgB,aAAa;AAC/B,uBAAqB,EAClB,KAAK,MAAM;AACV,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,YAAQ,MAAM,KAAK;AACnB,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;",
+  "sourcesContent": ["import path from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { bootstrapFromAppRoot } from '@open-mercato/shared/lib/bootstrap/dynamicLoader'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { createQueue } from '@open-mercato/queue'\n\nexport type QueueDrainRunnerOptions = {\n  appRoot: string\n  jobLimit: number\n  queueBaseDir?: string\n}\n\ntype BootstrapData = Awaited<ReturnType<typeof bootstrapFromAppRoot>>\n\nconst bootstrapCache = new Map<string, Promise<BootstrapData>>()\n\nfunction getBootstrapData(appRoot: string): Promise<BootstrapData> {\n  const resolvedAppRoot = path.resolve(appRoot)\n  const cached = bootstrapCache.get(resolvedAppRoot)\n  if (cached) return cached\n  const promise = bootstrapFromAppRoot(resolvedAppRoot)\n  bootstrapCache.set(resolvedAppRoot, promise)\n  return promise\n}\n\nexport async function drainQueueFromAppRoot(\n  queueName: string,\n  options: QueueDrainRunnerOptions,\n): Promise<number> {\n  const data = await getBootstrapData(options.appRoot)\n  const worker = data.modules\n    .flatMap((module) => module.workers ?? [])\n    .find((entry) => entry.queue === queueName)\n  if (!worker) return 0\n\n  const container = await createRequestContainer()\n  const queue = createQueue(queueName, 'local', {\n    baseDir: path.resolve(\n      options.queueBaseDir?.trim()\n      || process.env.QUEUE_BASE_DIR?.trim()\n      || path.resolve(options.appRoot, '.mercato/queue'),\n    ),\n    concurrency: 1,\n  })\n  const resolve = <T = unknown>(name: string): T => container.resolve(name) as T\n\n  try {\n    let processedJobs = 0\n    while (true) {\n      const result = await queue.process(\n        async (job, ctx) => {\n          await Promise.resolve(worker.handler(job, { ...ctx, resolve }))\n        },\n        { limit: options.jobLimit },\n      )\n      const handled = result.processed + result.failed\n      processedJobs += handled\n      if (handled === 0) return processedJobs\n    }\n  } finally {\n    await queue.close()\n  }\n}\n\nexport async function runQueueDrainFromEnv(): Promise<void> {\n  const queueName = process.env.OM_INTEGRATION_QUEUE_NAME?.trim()\n  const appRoot = process.env.OM_INTEGRATION_APP_ROOT?.trim()\n  const jobLimit = Number.parseInt(process.env.OM_INTEGRATION_QUEUE_JOB_LIMIT || '100', 10) || 100\n  if (!queueName || !appRoot) throw new Error('Missing queue drain environment')\n\n  const processed = await drainQueueFromAppRoot(queueName, {\n    appRoot: path.resolve(appRoot),\n    jobLimit,\n    queueBaseDir: process.env.QUEUE_BASE_DIR,\n  })\n  process.stdout.write(`${JSON.stringify({ processed })}\\n`)\n}\n\nconst currentFile = fileURLToPath(import.meta.url)\nconst invokedFile = process.argv[1] ? path.resolve(process.argv[1]) : null\n\nif (invokedFile === currentFile) {\n  runQueueDrainFromEnv()\n    .then(() => {\n      process.exit(0)\n    })\n    .catch((error) => {\n      process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\\n`)\n      process.exit(1)\n    })\n}\n"],
+  "mappings": "AAAA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,mBAAmB;AAU5B,MAAM,iBAAiB,oBAAI,IAAoC;AAE/D,SAAS,iBAAiB,SAAyC;AACjE,QAAM,kBAAkB,KAAK,QAAQ,OAAO;AAC5C,QAAM,SAAS,eAAe,IAAI,eAAe;AACjD,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,qBAAqB,eAAe;AACpD,iBAAe,IAAI,iBAAiB,OAAO;AAC3C,SAAO;AACT;AAEA,eAAsB,sBACpB,WACA,SACiB;AACjB,QAAM,OAAO,MAAM,iBAAiB,QAAQ,OAAO;AACnD,QAAM,SAAS,KAAK,QACjB,QAAQ,CAAC,WAAW,OAAO,WAAW,CAAC,CAAC,EACxC,KAAK,CAAC,UAAU,MAAM,UAAU,SAAS;AAC5C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,YAAY,WAAW,SAAS;AAAA,IAC5C,SAAS,KAAK;AAAA,MACZ,QAAQ,cAAc,KAAK,KACxB,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,QAAQ,SAAS,gBAAgB;AAAA,IACnD;AAAA,IACA,aAAa;AAAA,EACf,CAAC;AACD,QAAM,UAAU,CAAc,SAAoB,UAAU,QAAQ,IAAI;AAExE,MAAI;AACF,QAAI,gBAAgB;AACpB,WAAO,MAAM;AACX,YAAM,SAAS,MAAM,MAAM;AAAA,QACzB,OAAO,KAAK,QAAQ;AAClB,gBAAM,QAAQ,QAAQ,OAAO,QAAQ,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AAAA,QAChE;AAAA,QACA,EAAE,OAAO,QAAQ,SAAS;AAAA,MAC5B;AACA,YAAM,UAAU,OAAO,YAAY,OAAO;AAC1C,uBAAiB;AACjB,UAAI,YAAY,EAAG,QAAO;AAAA,IAC5B;AAAA,EACF,UAAE;AACA,UAAM,MAAM,MAAM;AAAA,EACpB;AACF;AAEA,eAAsB,uBAAsC;AAC1D,QAAM,YAAY,QAAQ,IAAI,2BAA2B,KAAK;AAC9D,QAAM,UAAU,QAAQ,IAAI,yBAAyB,KAAK;AAC1D,QAAM,WAAW,OAAO,SAAS,QAAQ,IAAI,kCAAkC,OAAO,EAAE,KAAK;AAC7F,MAAI,CAAC,aAAa,CAAC,QAAS,OAAM,IAAI,MAAM,iCAAiC;AAE7E,QAAM,YAAY,MAAM,sBAAsB,WAAW;AAAA,IACvD,SAAS,KAAK,QAAQ,OAAO;AAAA,IAC7B;AAAA,IACA,cAAc,QAAQ,IAAI;AAAA,EAC5B,CAAC;AACD,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,EAAE,UAAU,CAAC,CAAC;AAAA,CAAI;AAC3D;AAEA,MAAM,cAAc,cAAc,YAAY,GAAG;AACjD,MAAM,cAAc,QAAQ,KAAK,CAAC,IAAI,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,IAAI;AAEtE,IAAI,gBAAgB,aAAa;AAC/B,uBAAqB,EAClB,KAAK,MAAM;AACV,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,YAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,SAAS,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AACjG,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;",
   "names": []
 }

package/dist/modules/api_keys/services/apiKeyService.js

@@ -5,6 +5,8 @@ import { createKmsService } from "@open-mercato/shared/lib/encryption/kms";
 import { encryptWithAesGcm, decryptWithAesGcm } from "@open-mercato/shared/lib/encryption/aes";
 import { getSharedApiKeyAuthCache } from "@open-mercato/shared/lib/auth/apiKeyAuthCache";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("api_keys").child({ component: "api-key-service" });
 const BCRYPT_COST = 10;
 async function encryptSessionSecret(secret, tenantId) {
   if (!tenantId) return null;
@@ -151,12 +153,12 @@ async function findSessionApiKeyWithSecret(em, sessionToken) {
   const record = await findApiKeyBySessionToken(em, sessionToken);
   if (!record) return null;
   if (!record.sessionSecretEncrypted) {
-    console.warn("[ApiKeyService] Session key has no encrypted secret:", sessionToken.slice(0, 12));
+    logger.warn("Session key has no encrypted secret", { apiKeyId: record.id });
     return null;
   }
   const secret = await decryptSessionSecret(record.sessionSecretEncrypted, record.tenantId ?? null);
   if (!secret) {
-    console.warn("[ApiKeyService] Failed to decrypt session secret:", sessionToken.slice(0, 12));
+    logger.warn("Failed to decrypt session secret", { apiKeyId: record.id });
     return null;
   }
   return { key: record, secret };
@@ -187,7 +189,7 @@ async function withOnetimeApiKey(em, input, fn) {
       await em.persist(record).flush();
       getSharedApiKeyAuthCache().invalidateByKeyId(record.id);
     } catch (error) {
-      console.error("[withOnetimeApiKey] Failed to soft-delete one-time API key:", error);
+      logger.error("Failed to soft-delete one-time API key", { err: error });
     }
   }
 }