@open-mercato/core 0.6.6-develop.6465.1.019f0fb26f → 0.6.6-develop.6471.1.9ab5bdd79a

package/dist/modules/auth/lib/setup-app.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/setup-app.ts"],
-  "sourcesContent": ["import { hash } from 'bcryptjs'\nimport { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { normalizeTenantId } from './tenantAccess'\nimport { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nconst DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const\nconst DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'\nconst DEFAULT_DERIVED_EMAIL_DOMAIN = DEMO_SUPERADMIN_EMAIL.split('@')[1] ?? 'acme.com'\n\nexport type EnsureRolesOptions = {\n  roleNames?: string[]\n  tenantId?: string\n}\n\nasync function ensureRolesInContext(\n  em: EntityManager,\n  roleNames: string[],\n  tenantId: string,\n) {\n  for (const name of roleNames) {\n    const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })\n    if (existing) continue\n    em.persist(em.create(Role, { name, tenantId, createdAt: new Date() }))\n  }\n}\n\nexport async function ensureRoles(em: EntityManager, options: EnsureRolesOptions = {}) {\n  const roleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const tenantId = normalizeTenantId(options.tenantId ?? null)\n  if (!tenantId) {\n    throw new Error('ensureRoles requires a tenantId \u2014 global roles are not supported')\n  }\n  await em.transactional(async (tem) => {\n    await ensureRolesInContext(tem, roleNames, tenantId)\n    await tem.flush()\n  })\n}\n\nasync function findRoleByName(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const normalizedTenant = normalizeTenantId(tenantId ?? null) ?? null\n  return findOneWithDecryption(em, Role, { name, tenantId: normalizedTenant }, {}, { tenantId: normalizedTenant, organizationId: null })\n}\n\nasync function findRoleByNameOrFail(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role> {\n  const role = await findRoleByName(em, name, tenantId)\n  if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`)\n  return role\n}\n\ntype PrimaryUserInput = {\n  email: string\n  password?: string\n  hashedPassword?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  displayName?: string | null\n  confirm?: boolean\n}\n\nconst DERIVED_EMAIL_ENV = {\n  admin: 'OM_INIT_ADMIN_EMAIL',\n  employee: 'OM_INIT_EMPLOYEE_EMAIL',\n} as const\n\nexport type DemoUserRole = 'superadmin' | 'admin' | 'employee'\nexport type DemoUserEmail = { role: DemoUserRole; email: string }\n\n/**\n * Returns the canonical list of demo user emails the setup path may have\n * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the\n * same way the derived-user seeding branch does, so the deactivation loop\n * never drifts from the seeding loop.\n *\n * Pure function \u2014 no side effects, safe to unit-test in isolation.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport function resolveDemoUserEmails(): DemoUserEmail[] {\n  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  return [\n    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },\n    { role: 'admin', email: adminEmail },\n    { role: 'employee', email: employeeEmail },\n  ]\n}\n\nexport type SetupInitialTenantOptions = {\n  orgName: string\n  primaryUser: PrimaryUserInput\n  roleNames?: string[]\n  includeDerivedUsers?: boolean\n  failIfUserExists?: boolean\n  primaryUserRoles?: string[]\n  includeSuperadminRole?: boolean\n  /** Optional list of enabled modules. When provided, module setup hooks are called. */\n  modules?: Module[]\n  /**\n   * Optional global slug to persist on the new Organization. When set, a\n   * pre-flight uniqueness check across all tenants throws OrgSlugExistsError\n   * on collision so scriptable callers can fail loudly instead of silently\n   * reusing or clobbering an existing organization.\n   */\n  orgSlug?: string\n  /**\n   * Opt-in flag that allows seeding the derived admin/employee accounts when\n   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.\n   *\n   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are\n   *   seeded with the well-known `'secret'` password so local dev workflows\n   *   (e.g. `mercato init`) stay predictable for developers.\n   * - In production: the fallback uses a randomly generated 96-bit password\n   *   (printed once by the CLI) so an operator who deliberately opts in still\n   *   avoids the historical hardcoded credential. When this flag is false/unset\n   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`\n   *   is thrown instead of silently seeding any account.\n   */\n  allowDemoDerivedPasswords?: boolean\n}\n\nexport class OrgSlugExistsError extends Error {\n  constructor(public readonly slug: string) {\n    super(`ORG_SLUG_EXISTS: an organization with slug \"${slug}\" already exists`)\n    this.name = 'OrgSlugExistsError'\n  }\n}\n\nexport class DerivedUserPasswordRequiredError extends Error {\n  constructor(public readonly missing: string[]) {\n    super(\n      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,\n    )\n    this.name = 'DerivedUserPasswordRequiredError'\n  }\n}\n\nexport type SetupInitialTenantResult = {\n  tenantId: string\n  organizationId: string\n  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>\n  reusedExistingUser: boolean\n}\n\nexport async function setupInitialTenant(\n  em: EntityManager,\n  options: SetupInitialTenantOptions,\n): Promise<SetupInitialTenantResult> {\n  const {\n    primaryUser,\n    includeDerivedUsers = true,\n    failIfUserExists = false,\n    primaryUserRoles,\n    includeSuperadminRole = true,\n  } = options\n  const primaryRolesInput = primaryUserRoles && primaryUserRoles.length ? primaryUserRoles : ['superadmin']\n  const primaryRoles = includeSuperadminRole\n    ? primaryRolesInput\n    : primaryRolesInput.filter((role) => role !== 'superadmin')\n  if (primaryRoles.length === 0) {\n    throw new Error('PRIMARY_ROLES_REQUIRED')\n  }\n  const defaultRoleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const resolvedRoleNames = includeSuperadminRole\n    ? defaultRoleNames\n    : defaultRoleNames.filter((role) => role !== 'superadmin')\n  const roleNames = Array.from(new Set([...resolvedRoleNames, ...primaryRoles]))\n  const resolvedModules = options.modules ?? tryGetModules()\n  const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)\n\n  const mainEmail = primaryUser.email\n  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })\n  if (existingUser && failIfUserExists) {\n    throw new Error('USER_EXISTS')\n  }\n\n  if (options.orgSlug) {\n    const slugConflict = await findOneWithDecryption(\n      em,\n      Organization,\n      { slug: options.orgSlug },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    if (slugConflict) {\n      throw new OrgSlugExistsError(options.orgSlug)\n    }\n  }\n\n  let tenantId: string | undefined\n  let organizationId: string | undefined\n  let reusedExistingUser = false\n  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []\n\n  await em.transactional(async (tem) => {\n    if (!existingUser) return\n    reusedExistingUser = true\n    tenantId = existingUser.tenantId ? String(existingUser.tenantId) : undefined\n    organizationId = existingUser.organizationId ? String(existingUser.organizationId) : undefined\n    const roleTenantId = normalizeTenantId(existingUser.tenantId ?? null) ?? null\n    if (!roleTenantId) {\n      throw new Error('Cannot reuse a user without a tenantId \u2014 global roles are not supported')\n    }\n\n    await ensureRolesInContext(tem, roleNames, roleTenantId)\n    await tem.flush()\n\n    const requiredRoleSet = new Set([...roleNames, ...primaryRoles])\n    const links = await findWithDecryption(\n      tem,\n      UserRole,\n      { user: existingUser },\n      { populate: ['role'] },\n      { tenantId: roleTenantId, organizationId: null },\n    )\n    const currentRoles = new Set(links.map((link) => link.role.name))\n    for (const roleName of requiredRoleSet) {\n      if (!currentRoles.has(roleName)) {\n        const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n        tem.persist(tem.create(UserRole, { user: existingUser, role, createdAt: new Date() }))\n      }\n    }\n    await tem.flush()\n    const roles = Array.from(new Set([...currentRoles, ...roleNames]))\n    userSnapshots.push({ user: existingUser, roles, created: false })\n  })\n\n  if (!existingUser) {\n    const baseUsers: Array<{\n      email: string\n      roles: string[]\n      name?: string | null\n      passwordHash?: string | null\n      generatedPassword?: string | null\n    }> = [\n      { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },\n    ]\n    if (includeDerivedUsers) {\n      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)\n      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)\n      const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')\n      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')\n      const isProduction = process.env.NODE_ENV === 'production'\n      const allowDemo = options.allowDemoDerivedPasswords === true\n      if (isProduction && !allowDemo) {\n        const missing: string[] = []\n        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')\n        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')\n        if (missing.length) {\n          throw new DerivedUserPasswordRequiredError(missing)\n        }\n      }\n      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so\n      // local dev workflows stay predictable (admin@/employee@ login with the\n      // documented demo password). In production we either have env-supplied\n      // values, or \u2014 for opt-in --include-demo-users flows \u2014 we generate a\n      // random one-time password and surface it via `generatedPassword` so the\n      // operator can capture it. Production callers without env vars and\n      // without the opt-in already threw above.\n      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd\n      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd\n      const adminPasswordHash = await hash(adminPasswordPlain, 10)\n      const employeePasswordHash = await hash(employeePasswordPlain, 10)\n      addUniqueBaseUser(baseUsers, {\n        email: adminEmail,\n        roles: ['admin'],\n        passwordHash: adminPasswordHash,\n        generatedPassword: envAdminPwd ? null : adminPasswordPlain,\n      })\n      addUniqueBaseUser(baseUsers, {\n        email: employeeEmail,\n        roles: ['employee'],\n        passwordHash: employeePasswordHash,\n        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,\n      })\n    }\n    const passwordHash = await resolvePasswordHash(primaryUser)\n\n    await em.transactional(async (tem) => {\n      const tenant = tem.create(Tenant, {\n        name: options.orgName,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(tenant)\n      await tem.flush()\n\n      const organization = tem.create(Organization, {\n        name: options.orgName,\n        slug: options.orgSlug ?? null,\n        tenant,\n        isActive: true,\n        depth: 0,\n        ancestorIds: [],\n        childIds: [],\n        descendantIds: [],\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(organization)\n      await tem.flush()\n\n      tenantId = String(tenant.id)\n      organizationId = String(organization.id)\n      const roleTenantId = tenantId\n\n      if (isTenantDataEncryptionEnabled()) {\n        try {\n          const kms = createKmsService()\n          if (kms.isHealthy()) {\n            if (isEncryptionDebugEnabled()) {\n              console.info('\uD83D\uDD11 [encryption][setup] provisioning tenant DEK', { tenantId: String(tenant.id) })\n            }\n            await kms.createTenantDek(String(tenant.id))\n            if (isEncryptionDebugEnabled()) {\n              console.info('\uD83D\uDD11 [encryption][setup] created tenant DEK during setup', { tenantId: String(tenant.id) })\n            }\n          } else {\n            if (isEncryptionDebugEnabled()) {\n              console.warn('\u26A0\uFE0F [encryption][setup] KMS not healthy, skipping tenant DEK creation', { tenantId: String(tenant.id) })\n            }\n          }\n        } catch (err) {\n          if (isEncryptionDebugEnabled()) {\n            console.warn('\u26A0\uFE0F [encryption][setup] Failed to create tenant DEK', err)\n          }\n        }\n      }\n\n      await ensureRolesInContext(tem, roleNames, roleTenantId)\n      await tem.flush()\n\n      if (isTenantDataEncryptionEnabled()) {\n        for (const spec of defaultEncryptionMaps) {\n          const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })\n          if (!existing) {\n            tem.persist(tem.create(EncryptionMap, {\n              entityId: spec.entityId,\n              tenantId: tenant.id,\n              organizationId: organization.id,\n              fieldsJson: spec.fields,\n              isActive: true,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            }))\n          } else {\n            existing.fieldsJson = spec.fields\n            existing.isActive = true\n          }\n        }\n        await tem.flush()\n      }\n    })\n\n    await em.transactional(async (tem) => {\n      if (!tenantId || !organizationId) return\n      const roleTenantId = tenantId\n      const encryptionService = isTenantDataEncryptionEnabled()\n        ? new TenantDataEncryptionService(tem as any, { kms: createKmsService() })\n        : null\n      if (encryptionService) {\n        await encryptionService.invalidateMap('auth:user', String(tenantId), String(organizationId))\n        await encryptionService.invalidateMap('auth:user', String(tenantId), null)\n      }\n\n      for (const base of baseUsers) {\n        const resolvedPasswordHash = base.passwordHash ?? passwordHash\n        let user = await findOneWithDecryption(tem, User, { email: base.email }, {}, { tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n        const confirm = primaryUser.confirm ?? true\n        const encryptedPayload = encryptionService\n          ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)\n          : { email: base.email, emailHash: computeEmailHash(base.email) }\n        if (user) {\n          user.passwordHash = resolvedPasswordHash\n          user.organizationId = organizationId\n          user.tenantId = tenantId\n          if (isTenantDataEncryptionEnabled()) {\n            user.email = encryptedPayload.email as any\n            user.emailHash = (encryptedPayload as any).emailHash ?? computeEmailHash(base.email)\n          }\n          if (base.name) user.name = base.name\n          if (confirm) user.isConfirmed = true\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })\n        } else {\n          user = tem.create(User, {\n            email: (encryptedPayload as any).email ?? base.email,\n            emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,\n            passwordHash: resolvedPasswordHash,\n            organizationId,\n            tenantId,\n            name: base.name ?? undefined,\n            isConfirmed: confirm,\n            createdAt: new Date(),\n          })\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })\n        }\n        await tem.flush()\n        for (const roleName of base.roles) {\n          const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })\n          if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))\n        }\n        await tem.flush()\n      }\n    })\n  }\n\n  if (!tenantId || !organizationId) {\n    throw new Error('SETUP_FAILED')\n  }\n\n  if (!reusedExistingUser) {\n    await rebuildHierarchyForTenant(em, tenantId)\n  }\n\n  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })\n  await deactivateDemoUsersIfSelfOnboardingEnabled(em)\n\n  // Call module onTenantCreated hooks\n  for (const mod of resolvedModules) {\n    if (mod.setup?.onTenantCreated) {\n      await mod.setup.onTenantCreated({ em, tenantId, organizationId })\n    }\n  }\n\n  return {\n    tenantId,\n    organizationId,\n    users: userSnapshots,\n    reusedExistingUser,\n  }\n}\n\nfunction resolvePrimaryName(input: PrimaryUserInput): string | null {\n  if (input.displayName && input.displayName.trim()) return input.displayName.trim()\n  const parts = [input.firstName, input.lastName].map((value) => value?.trim()).filter(Boolean)\n  if (parts.length) return parts.join(' ')\n  return null\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  const value = process.env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction addUniqueBaseUser(\n  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,\n  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },\n) {\n  if (!entry.email) return\n  const normalized = entry.email.toLowerCase()\n  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return\n  baseUsers.push(entry)\n}\n\n/**\n * Well-known demo password seeded for derived admin@/employee@ accounts in\n * non-production (`NODE_ENV !== 'production'`) when no env override is set.\n * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used\n * in production: the production branch either consumes env-supplied values or\n * falls back to `generateDerivedPassword()` so credentials remain non-guessable.\n */\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\n/**\n * Generate a 16-character base64url password (96 bits of entropy) for a derived\n * demo user in production when no env override is provided AND the caller\n * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the\n * `users[].generatedPassword` snapshot so CLI callers can print it to the\n * operator \u2014 there is no other recovery path for these credentials.\n */\nfunction generateDerivedPassword(): string {\n  return randomBytes(12).toString('base64url')\n}\n\nfunction isDemoModeEnabled(): boolean {\n  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  return parsed === false ? false : true\n}\n\nfunction shouldKeepDemoSuperadminDuringInit(): boolean {\n  if (process.env.OM_INIT_FLOW !== 'true') return false\n  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false\n  return isDemoModeEnabled()\n}\n\nasync function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {\n  if (typeof input.hashedPassword === 'string') return input.hashedPassword\n  if (input.password) return hash(input.password, 10)\n  return null\n}\n\nexport async function ensureDefaultRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n  options: { includeSuperadminRole?: boolean } = {},\n) {\n  const includeSuperadminRole = options.includeSuperadminRole ?? true\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const superadminRole = includeSuperadminRole ? await findRoleByName(em, 'superadmin', roleTenantId) : null\n  const adminRole = await findRoleByName(em, 'admin', roleTenantId)\n  const employeeRole = await findRoleByName(em, 'employee', roleTenantId)\n\n  // Merge features from all enabled modules' setup configs\n  const builtInRoles = ['superadmin', 'admin', 'employee'] as const\n  const superadminFeatures: string[] = []\n  const adminFeatures: string[] = []\n  const employeeFeatures: string[] = []\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of modules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)\n    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)\n    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)\n\n    // Collect features for custom roles (any key not in builtInRoles)\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if ((builtInRoles as readonly string[]).includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  console.log('\u2705 Seeded default role features', {\n    superadmin: superadminFeatures,\n    admin: adminFeatures,\n    employee: employeeFeatures,\n    ...(customRoleFeatures.size > 0\n      ? Object.fromEntries(customRoleFeatures)\n      : {}),\n  })\n\n  if (includeSuperadminRole && superadminRole) {\n    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })\n  }\n  if (adminRole) {\n    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)\n  }\n  if (employeeRole) {\n    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)\n  }\n\n  // Seed ACLs for custom roles defined by app modules.\n  // NOTE: Custom roles may not exist yet if they are created in seedDefaults\n  // (which runs after this function). In that case, use ensureCustomRoleAcls()\n  // after seedDefaults to pick them up.\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n    }\n  }\n}\n\n/**\n * Seed ACLs for custom roles defined in module defaultRoleFeatures.\n * Call this AFTER seedDefaults to pick up roles created by app modules.\n * Safe to call multiple times \u2014 ensureRoleAclFor merges features idempotently.\n */\nexport async function ensureCustomRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules?: Module[],\n): Promise<void> {\n  const resolvedModules = modules ?? tryGetModules()\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const builtInRoles = ['superadmin', 'admin', 'employee']\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of resolvedModules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if (builtInRoles.includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  if (customRoleFeatures.size === 0) return\n\n  let seeded = 0\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n      seeded++\n    }\n  }\n  if (seeded > 0) {\n    console.log(`\u2705 Seeded custom role ACLs (${seeded} roles)`)\n  }\n}\n\nasync function ensureRoleAclFor(\n  em: EntityManager,\n  role: Role,\n  tenantId: string,\n  features: string[],\n  options: { isSuperAdmin?: boolean } = {},\n) {\n  const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })\n  if (!existing) {\n    const acl = em.create(RoleAcl, {\n      role,\n      tenantId,\n      featuresJson: features,\n      isSuperAdmin: !!options.isSuperAdmin,\n      createdAt: new Date(),\n    })\n    await em.persist(acl).flush()\n    return\n  }\n  const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []\n  const merged = Array.from(new Set([...currentFeatures, ...features]))\n  const changed =\n    merged.length !== currentFeatures.length ||\n    merged.some((value, index) => value !== currentFeatures[index])\n  if (changed) existing.featuresJson = merged\n  if (options.isSuperAdmin && !existing.isSuperAdmin) {\n    existing.isSuperAdmin = true\n  }\n  if (changed || options.isSuperAdmin) {\n    await em.persist(existing).flush()\n  }\n}\n\n/**\n * Neutralizes every demo account the setup path may have seeded\n * (superadmin, admin, employee \u2014 honoring OM_INIT_*_EMAIL overrides)\n * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not\n * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.\n *\n * Each user is processed in its own try/catch so a single failure (e.g.\n * decryption error on a legacy row) does not skip the remaining accounts.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {\n  if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return\n  if (shouldKeepDemoSuperadminDuringInit()) return\n  for (const { role, email } of resolveDemoUserEmails()) {\n    try {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { email },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!user) continue\n      let dirty = false\n      if (user.passwordHash) {\n        user.passwordHash = null\n        dirty = true\n      }\n      if (user.isConfirmed !== false) {\n        user.isConfirmed = false\n        dirty = true\n      }\n      if (dirty) {\n        await em.persist(user).flush()\n      }\n    } catch (error) {\n      console.error(\n        `[auth.setup] failed to deactivate demo ${role} user (${email})`,\n        error,\n      )\n    }\n  }\n}\n\n/**\n * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}\n * because the helper now neutralizes admin/employee demo accounts in addition\n * to superadmin (security tracker finding #5). Kept as an internal alias to\n * avoid breaking any out-of-tree caller that imported the old name; will be\n * removed in a future major.\n */\nconst deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled\n\n/** Try to get modules from runtime registry; returns empty array if not yet registered. */\nfunction tryGetModules(): Module[] {\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,gCAA6C;AACtD,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAElC,MAAM,qBAAqB,CAAC,YAAY,SAAS,YAAY;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B,sBAAsB,MAAM,GAAG,EAAE,CAAC,KAAK;AAO5E,eAAe,qBACb,IACA,WACA,UACA;AACA,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACjH,QAAI,SAAU;AACd,OAAG,QAAQ,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,YAAY,IAAmB,UAA8B,CAAC,GAAG;AACrF,QAAM,YAAY,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AAC7D,QAAM,WAAW,kBAAkB,QAAQ,YAAY,IAAI;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,uEAAkE;AAAA,EACpF;AACA,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,qBAAqB,KAAK,WAAW,QAAQ;AACnD,UAAM,IAAI,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,eACb,IACA,MACA,UACsB;AACtB,QAAM,mBAAmB,kBAAkB,YAAY,IAAI,KAAK;AAChE,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,UAAU,iBAAiB,GAAG,CAAC,GAAG,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,CAAC;AACvI;AAEA,eAAe,qBACb,IACA,MACA,UACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,MAAM,QAAQ;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACnD,SAAO;AACT;AAYA,MAAM,oBAAoB;AAAA,EACxB,OAAO;AAAA,EACP,UAAU;AACZ;AAeO,SAAS,wBAAyC;AACvD,QAAM,aAAa,aAAa,kBAAkB,KAAK,KAAK,SAAS,4BAA4B;AACjG,QAAM,gBAAgB,aAAa,kBAAkB,QAAQ,KAAK,YAAY,4BAA4B;AAC1G,SAAO;AAAA,IACL,EAAE,MAAM,cAAc,OAAO,sBAAsB;AAAA,IACnD,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,IACnC,EAAE,MAAM,YAAY,OAAO,cAAc;AAAA,EAC3C;AACF;AAmCO,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAA4B,MAAc;AACxC,UAAM,+CAA+C,IAAI,kBAAkB;AADjD;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,yCAAyC,MAAM;AAAA,EAC1D,YAA4B,SAAmB;AAC7C;AAAA,MACE,2CAA2C,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/D;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,mBACpB,IACA,SACmC;AACnC,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA,wBAAwB;AAAA,EAC1B,IAAI;AACJ,QAAM,oBAAoB,oBAAoB,iBAAiB,SAAS,mBAAmB,CAAC,YAAY;AACxG,QAAM,eAAe,wBACjB,oBACA,kBAAkB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC5D,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,mBAAmB,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AACpE,QAAM,oBAAoB,wBACtB,mBACA,iBAAiB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC3D,QAAM,YAAY,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,mBAAmB,GAAG,YAAY,CAAC,CAAC;AAC7E,QAAM,kBAAkB,QAAQ,WAAW,cAAc;AACzD,QAAM,wBAAwB,yBAAyB,eAAe;AAEtE,QAAM,YAAY,YAAY;AAC9B,QAAM,eAAe,MAAM,sBAAsB,IAAI,MAAM,EAAE,OAAO,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC7H,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,QAAI,cAAc;AAChB,YAAM,IAAI,mBAAmB,QAAQ,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,qBAAqB;AACzB,QAAM,gBAA6G,CAAC;AAEpH,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,QAAI,CAAC,aAAc;AACnB,yBAAqB;AACrB,eAAW,aAAa,WAAW,OAAO,aAAa,QAAQ,IAAI;AACnE,qBAAiB,aAAa,iBAAiB,OAAO,aAAa,cAAc,IAAI;AACrF,UAAM,eAAe,kBAAkB,aAAa,YAAY,IAAI,KAAK;AACzE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,8EAAyE;AAAA,IAC3F;AAEA,UAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,UAAM,IAAI,MAAM;AAEhB,UAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAC/D,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,aAAa;AAAA,MACrB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,IACjD;AACA,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AAChE,eAAW,YAAY,iBAAiB;AACtC,UAAI,CAAC,aAAa,IAAI,QAAQ,GAAG;AAC/B,cAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,YAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,cAAc,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AACjE,kBAAc,KAAK,EAAE,MAAM,cAAc,OAAO,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,CAAC,cAAc;AACjB,UAAM,YAMD;AAAA,MACH,EAAE,OAAO,YAAY,OAAO,OAAO,cAAc,MAAM,mBAAmB,WAAW,EAAE;AAAA,IACzF;AACA,QAAI,qBAAqB;AACvB,YAAM,gBAAgB,aAAa,kBAAkB,KAAK;AAC1D,YAAM,mBAAmB,aAAa,kBAAkB,QAAQ;AAChE,YAAM,aAAa,iBAAiB,SAAS,4BAA4B;AACzE,YAAM,gBAAgB,oBAAoB,YAAY,4BAA4B;AAClF,YAAM,cAAc,aAAa,wBAAwB;AACzD,YAAM,iBAAiB,aAAa,2BAA2B;AAC/D,YAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,YAAM,YAAY,QAAQ,8BAA8B;AACxD,UAAI,gBAAgB,CAAC,WAAW;AAC9B,cAAM,UAAoB,CAAC;AAC3B,YAAI,CAAC,YAAa,SAAQ,KAAK,wBAAwB;AACvD,YAAI,CAAC,eAAgB,SAAQ,KAAK,2BAA2B;AAC7D,YAAI,QAAQ,QAAQ;AAClB,gBAAM,IAAI,iCAAiC,OAAO;AAAA,QACpD;AAAA,MACF;AAQA,YAAM,mBAAmB,eAAe,wBAAwB,IAAI;AACpE,YAAM,sBAAsB,eAAe,wBAAwB,IAAI;AACvE,YAAM,qBAAqB,eAAe;AAC1C,YAAM,wBAAwB,kBAAkB;AAChD,YAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE;AAC3D,YAAM,uBAAuB,MAAM,KAAK,uBAAuB,EAAE;AACjE,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,OAAO;AAAA,QACf,cAAc;AAAA,QACd,mBAAmB,cAAc,OAAO;AAAA,MAC1C,CAAC;AACD,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,UAAU;AAAA,QAClB,cAAc;AAAA,QACd,mBAAmB,iBAAiB,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,UAAM,eAAe,MAAM,oBAAoB,WAAW;AAE1D,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,QAChC,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,MAAM;AAClB,YAAM,IAAI,MAAM;AAEhB,YAAM,eAAe,IAAI,OAAO,cAAc;AAAA,QAC5C,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ,WAAW;AAAA,QACzB;AAAA,QACA,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,CAAC;AAAA,QACd,UAAU,CAAC;AAAA,QACX,eAAe,CAAC;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,YAAY;AACxB,YAAM,IAAI,MAAM;AAEhB,iBAAW,OAAO,OAAO,EAAE;AAC3B,uBAAiB,OAAO,aAAa,EAAE;AACvC,YAAM,eAAe;AAErB,UAAI,8BAA8B,GAAG;AACnC,YAAI;AACF,gBAAM,MAAM,iBAAiB;AAC7B,cAAI,IAAI,UAAU,GAAG;AACnB,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,yDAAkD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAChG;AACA,kBAAM,IAAI,gBAAgB,OAAO,OAAO,EAAE,CAAC;AAC3C,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,iEAA0D,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACxG;AAAA,UACF,OAAO;AACL,gBAAI,yBAAyB,GAAG;AAC9B,sBAAQ,KAAK,kFAAwE,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACtH;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,yBAAyB,GAAG;AAC9B,oBAAQ,KAAK,gEAAsD,GAAG;AAAA,UACxE;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,YAAM,IAAI,MAAM;AAEhB,UAAI,8BAA8B,GAAG;AACnC,mBAAW,QAAQ,uBAAuB;AACxC,gBAAM,WAAW,MAAM,sBAAsB,KAAK,eAAe,EAAE,UAAU,KAAK,UAAU,UAAU,OAAO,IAAI,gBAAgB,aAAa,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,gBAAgB,OAAO,aAAa,EAAE,EAAE,CAAC;AACjP,cAAI,CAAC,UAAU;AACb,gBAAI,QAAQ,IAAI,OAAO,eAAe;AAAA,cACpC,UAAU,KAAK;AAAA,cACf,UAAU,OAAO;AAAA,cACjB,gBAAgB,aAAa;AAAA,cAC7B,YAAY,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC,CAAC;AAAA,UACJ,OAAO;AACL,qBAAS,aAAa,KAAK;AAC3B,qBAAS,WAAW;AAAA,UACtB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,eAAe;AACrB,YAAM,oBAAoB,8BAA8B,IACpD,IAAI,4BAA4B,KAAY,EAAE,KAAK,iBAAiB,EAAE,CAAC,IACvE;AACJ,UAAI,mBAAmB;AACrB,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3F,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,IAAI;AAAA,MAC3E;AAEA,iBAAW,QAAQ,WAAW;AAC5B,cAAM,uBAAuB,KAAK,gBAAgB;AAClD,YAAI,OAAO,MAAM,sBAAsB,KAAK,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AACnJ,cAAM,UAAU,YAAY,WAAW;AACvC,cAAM,mBAAmB,oBACrB,MAAM,kBAAkB,qBAAqB,aAAa,EAAE,OAAO,KAAK,MAAM,GAAG,UAAU,cAAc,IACzG,EAAE,OAAO,KAAK,OAAO,WAAW,iBAAiB,KAAK,KAAK,EAAE;AACjE,YAAI,MAAM;AACR,eAAK,eAAe;AACpB,eAAK,iBAAiB;AACtB,eAAK,WAAW;AAChB,cAAI,8BAA8B,GAAG;AACnC,iBAAK,QAAQ,iBAAiB;AAC9B,iBAAK,YAAa,iBAAyB,aAAa,iBAAiB,KAAK,KAAK;AAAA,UACrF;AACA,cAAI,KAAK,KAAM,MAAK,OAAO,KAAK;AAChC,cAAI,QAAS,MAAK,cAAc;AAChC,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QACnH,OAAO;AACL,iBAAO,IAAI,OAAO,MAAM;AAAA,YACtB,OAAQ,iBAAyB,SAAS,KAAK;AAAA,YAC/C,WAAW,8BAA8B,IAAK,iBAAyB,aAAa,iBAAiB,KAAK,KAAK,IAAI;AAAA,YACnH,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA,MAAM,KAAK,QAAQ;AAAA,YACnB,aAAa;AAAA,YACb,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QAClH;AACA,cAAM,IAAI,MAAM;AAChB,mBAAW,YAAY,KAAK,OAAO;AACjC,gBAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,gBAAM,eAAe,MAAM,sBAAsB,KAAK,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,KAAK,CAAC;AACxI,cAAI,CAAC,aAAc,KAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,QAC5F;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,cAAc;AAAA,EAChC;AAEA,MAAI,CAAC,oBAAoB;AACvB,UAAM,0BAA0B,IAAI,QAAQ;AAAA,EAC9C;AAEA,QAAM,sBAAsB,IAAI,UAAU,iBAAiB,EAAE,sBAAsB,CAAC;AACpF,QAAM,2CAA2C,EAAE;AAGnD,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,OAAO,iBAAiB;AAC9B,YAAM,IAAI,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,MAAM,eAAe,MAAM,YAAY,KAAK,EAAG,QAAO,MAAM,YAAY,KAAK;AACjF,QAAM,QAAQ,CAAC,MAAM,WAAW,MAAM,QAAQ,EAAE,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F,MAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AACvC,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,kBACP,WACA,OACA;AACA,MAAI,CAAC,MAAM,MAAO;AAClB,QAAM,aAAa,MAAM,MAAM,YAAY;AAC3C,MAAI,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,YAAY,MAAM,UAAU,EAAG;AACvE,YAAU,KAAK,KAAK;AACtB;AASA,MAAM,wBAAwB;AAS9B,SAAS,0BAAkC;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AAC5D,SAAO,WAAW,QAAQ,QAAQ;AACpC;AAEA,SAAS,qCAA8C;AACrD,MAAI,QAAQ,IAAI,iBAAiB,OAAQ,QAAO;AAChD,MAAI,CAAC,aAAa,0BAA0B,EAAG,QAAO;AACtD,SAAO,kBAAkB;AAC3B;AAEA,eAAe,oBAAoB,OAAiD;AAClF,MAAI,OAAO,MAAM,mBAAmB,SAAU,QAAO,MAAM;AAC3D,MAAI,MAAM,SAAU,QAAO,KAAK,MAAM,UAAU,EAAE;AAClD,SAAO;AACT;AAEA,eAAsB,sBACpB,IACA,UACA,SACA,UAA+C,CAAC,GAChD;AACA,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,iBAAiB,wBAAwB,MAAM,eAAe,IAAI,cAAc,YAAY,IAAI;AACtG,QAAM,YAAY,MAAM,eAAe,IAAI,SAAS,YAAY;AAChE,QAAM,eAAe,MAAM,eAAe,IAAI,YAAY,YAAY;AAGtE,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAA+B,CAAC;AACtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,SAAS;AACzB,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,QAAI,aAAa,WAAY,oBAAmB,KAAK,GAAG,aAAa,UAAU;AAC/E,QAAI,aAAa,MAAO,eAAc,KAAK,GAAG,aAAa,KAAK;AAChE,QAAI,aAAa,SAAU,kBAAiB,KAAK,GAAG,aAAa,QAAQ;AAGzE,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAK,aAAmC,SAAS,QAAQ,EAAG;AAC5D,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,UAAQ,IAAI,uCAAkC;AAAA,IAC5C,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,GAAI,mBAAmB,OAAO,IAC1B,OAAO,YAAY,kBAAkB,IACrC,CAAC;AAAA,EACP,CAAC;AAED,MAAI,yBAAyB,gBAAgB;AAC3C,UAAM,iBAAiB,IAAI,gBAAgB,UAAU,oBAAoB,EAAE,cAAc,KAAK,CAAC;AAAA,EACjG;AACA,MAAI,WAAW;AACb,UAAM,iBAAiB,IAAI,WAAW,UAAU,aAAa;AAAA,EAC/D;AACA,MAAI,cAAc;AAChB,UAAM,iBAAiB,IAAI,cAAc,UAAU,gBAAgB;AAAA,EACrE;AAMA,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AAAA,IACrD;AAAA,EACF;AACF;AAOA,eAAsB,qBACpB,IACA,UACA,SACe;AACf,QAAM,kBAAkB,WAAW,cAAc;AACjD,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,iBAAiB;AACjC,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAI,aAAa,SAAS,QAAQ,EAAG;AACrC,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,mBAAmB,SAAS,EAAG;AAEnC,MAAI,SAAS;AACb,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,GAAG;AACd,YAAQ,IAAI,mCAA8B,MAAM,SAAS;AAAA,EAC3D;AACF;AAEA,eAAe,iBACb,IACA,MACA,UACA,UACA,UAAsC,CAAC,GACvC;AACA,QAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACpH,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,GAAG,OAAO,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc,CAAC,CAAC,QAAQ;AAAA,MACxB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,QAAQ,SAAS,YAAY,IAAI,SAAS,eAAe,CAAC;AACxF,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AACpE,QAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,MAAI,QAAS,UAAS,eAAe;AACrC,MAAI,QAAQ,gBAAgB,CAAC,SAAS,cAAc;AAClD,aAAS,eAAe;AAAA,EAC1B;AACA,MAAI,WAAW,QAAQ,cAAc;AACnC,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC;AACF;AAaA,eAAsB,2CAA2C,IAAmB;AAClF,MAAI,QAAQ,IAAI,oCAAoC,OAAQ;AAC5D,MAAI,mCAAmC,EAAG;AAC1C,aAAW,EAAE,MAAM,MAAM,KAAK,sBAAsB,GAAG;AACrD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,MAAM;AAAA,QACR,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,KAAM;AACX,UAAI,QAAQ;AACZ,UAAI,KAAK,cAAc;AACrB,aAAK,eAAe;AACpB,gBAAQ;AAAA,MACV;AACA,UAAI,KAAK,gBAAgB,OAAO;AAC9B,aAAK,cAAc;AACnB,gBAAQ;AAAA,MACV;AACA,UAAI,OAAO;AACT,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,0CAA0C,IAAI,UAAU,KAAK;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AASA,MAAM,kDAAkD;AAGxD,SAAS,gBAA0B;AACjC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { hash } from 'bcryptjs'\nimport { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { normalizeTenantId } from './tenantAccess'\nimport { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'setup' })\n\nconst DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const\nconst DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'\nconst DEFAULT_DERIVED_EMAIL_DOMAIN = DEMO_SUPERADMIN_EMAIL.split('@')[1] ?? 'acme.com'\n\nexport type EnsureRolesOptions = {\n  roleNames?: string[]\n  tenantId?: string\n}\n\nasync function ensureRolesInContext(\n  em: EntityManager,\n  roleNames: string[],\n  tenantId: string,\n) {\n  for (const name of roleNames) {\n    const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })\n    if (existing) continue\n    em.persist(em.create(Role, { name, tenantId, createdAt: new Date() }))\n  }\n}\n\nexport async function ensureRoles(em: EntityManager, options: EnsureRolesOptions = {}) {\n  const roleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const tenantId = normalizeTenantId(options.tenantId ?? null)\n  if (!tenantId) {\n    throw new Error('ensureRoles requires a tenantId \u2014 global roles are not supported')\n  }\n  await em.transactional(async (tem) => {\n    await ensureRolesInContext(tem, roleNames, tenantId)\n    await tem.flush()\n  })\n}\n\nasync function findRoleByName(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const normalizedTenant = normalizeTenantId(tenantId ?? null) ?? null\n  return findOneWithDecryption(em, Role, { name, tenantId: normalizedTenant }, {}, { tenantId: normalizedTenant, organizationId: null })\n}\n\nasync function findRoleByNameOrFail(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role> {\n  const role = await findRoleByName(em, name, tenantId)\n  if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`)\n  return role\n}\n\ntype PrimaryUserInput = {\n  email: string\n  password?: string\n  hashedPassword?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  displayName?: string | null\n  confirm?: boolean\n}\n\nconst DERIVED_EMAIL_ENV = {\n  admin: 'OM_INIT_ADMIN_EMAIL',\n  employee: 'OM_INIT_EMPLOYEE_EMAIL',\n} as const\n\nexport type DemoUserRole = 'superadmin' | 'admin' | 'employee'\nexport type DemoUserEmail = { role: DemoUserRole; email: string }\n\n/**\n * Returns the canonical list of demo user emails the setup path may have\n * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the\n * same way the derived-user seeding branch does, so the deactivation loop\n * never drifts from the seeding loop.\n *\n * Pure function \u2014 no side effects, safe to unit-test in isolation.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport function resolveDemoUserEmails(): DemoUserEmail[] {\n  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  return [\n    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },\n    { role: 'admin', email: adminEmail },\n    { role: 'employee', email: employeeEmail },\n  ]\n}\n\nexport type SetupInitialTenantOptions = {\n  orgName: string\n  primaryUser: PrimaryUserInput\n  roleNames?: string[]\n  includeDerivedUsers?: boolean\n  failIfUserExists?: boolean\n  primaryUserRoles?: string[]\n  includeSuperadminRole?: boolean\n  /** Optional list of enabled modules. When provided, module setup hooks are called. */\n  modules?: Module[]\n  /**\n   * Optional global slug to persist on the new Organization. When set, a\n   * pre-flight uniqueness check across all tenants throws OrgSlugExistsError\n   * on collision so scriptable callers can fail loudly instead of silently\n   * reusing or clobbering an existing organization.\n   */\n  orgSlug?: string\n  /**\n   * Opt-in flag that allows seeding the derived admin/employee accounts when\n   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.\n   *\n   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are\n   *   seeded with the well-known `'secret'` password so local dev workflows\n   *   (e.g. `mercato init`) stay predictable for developers.\n   * - In production: the fallback uses a randomly generated 96-bit password\n   *   (printed once by the CLI) so an operator who deliberately opts in still\n   *   avoids the historical hardcoded credential. When this flag is false/unset\n   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`\n   *   is thrown instead of silently seeding any account.\n   */\n  allowDemoDerivedPasswords?: boolean\n}\n\nexport class OrgSlugExistsError extends Error {\n  constructor(public readonly slug: string) {\n    super(`ORG_SLUG_EXISTS: an organization with slug \"${slug}\" already exists`)\n    this.name = 'OrgSlugExistsError'\n  }\n}\n\nexport class DerivedUserPasswordRequiredError extends Error {\n  constructor(public readonly missing: string[]) {\n    super(\n      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,\n    )\n    this.name = 'DerivedUserPasswordRequiredError'\n  }\n}\n\nexport type SetupInitialTenantResult = {\n  tenantId: string\n  organizationId: string\n  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>\n  reusedExistingUser: boolean\n}\n\nexport async function setupInitialTenant(\n  em: EntityManager,\n  options: SetupInitialTenantOptions,\n): Promise<SetupInitialTenantResult> {\n  const {\n    primaryUser,\n    includeDerivedUsers = true,\n    failIfUserExists = false,\n    primaryUserRoles,\n    includeSuperadminRole = true,\n  } = options\n  const primaryRolesInput = primaryUserRoles && primaryUserRoles.length ? primaryUserRoles : ['superadmin']\n  const primaryRoles = includeSuperadminRole\n    ? primaryRolesInput\n    : primaryRolesInput.filter((role) => role !== 'superadmin')\n  if (primaryRoles.length === 0) {\n    throw new Error('PRIMARY_ROLES_REQUIRED')\n  }\n  const defaultRoleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const resolvedRoleNames = includeSuperadminRole\n    ? defaultRoleNames\n    : defaultRoleNames.filter((role) => role !== 'superadmin')\n  const roleNames = Array.from(new Set([...resolvedRoleNames, ...primaryRoles]))\n  const resolvedModules = options.modules ?? tryGetModules()\n  const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)\n\n  const mainEmail = primaryUser.email\n  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })\n  if (existingUser && failIfUserExists) {\n    throw new Error('USER_EXISTS')\n  }\n\n  if (options.orgSlug) {\n    const slugConflict = await findOneWithDecryption(\n      em,\n      Organization,\n      { slug: options.orgSlug },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    if (slugConflict) {\n      throw new OrgSlugExistsError(options.orgSlug)\n    }\n  }\n\n  let tenantId: string | undefined\n  let organizationId: string | undefined\n  let reusedExistingUser = false\n  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []\n\n  await em.transactional(async (tem) => {\n    if (!existingUser) return\n    reusedExistingUser = true\n    tenantId = existingUser.tenantId ? String(existingUser.tenantId) : undefined\n    organizationId = existingUser.organizationId ? String(existingUser.organizationId) : undefined\n    const roleTenantId = normalizeTenantId(existingUser.tenantId ?? null) ?? null\n    if (!roleTenantId) {\n      throw new Error('Cannot reuse a user without a tenantId \u2014 global roles are not supported')\n    }\n\n    await ensureRolesInContext(tem, roleNames, roleTenantId)\n    await tem.flush()\n\n    const requiredRoleSet = new Set([...roleNames, ...primaryRoles])\n    const links = await findWithDecryption(\n      tem,\n      UserRole,\n      { user: existingUser },\n      { populate: ['role'] },\n      { tenantId: roleTenantId, organizationId: null },\n    )\n    const currentRoles = new Set(links.map((link) => link.role.name))\n    for (const roleName of requiredRoleSet) {\n      if (!currentRoles.has(roleName)) {\n        const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n        tem.persist(tem.create(UserRole, { user: existingUser, role, createdAt: new Date() }))\n      }\n    }\n    await tem.flush()\n    const roles = Array.from(new Set([...currentRoles, ...roleNames]))\n    userSnapshots.push({ user: existingUser, roles, created: false })\n  })\n\n  if (!existingUser) {\n    const baseUsers: Array<{\n      email: string\n      roles: string[]\n      name?: string | null\n      passwordHash?: string | null\n      generatedPassword?: string | null\n    }> = [\n      { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },\n    ]\n    if (includeDerivedUsers) {\n      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)\n      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)\n      const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')\n      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')\n      const isProduction = process.env.NODE_ENV === 'production'\n      const allowDemo = options.allowDemoDerivedPasswords === true\n      if (isProduction && !allowDemo) {\n        const missing: string[] = []\n        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')\n        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')\n        if (missing.length) {\n          throw new DerivedUserPasswordRequiredError(missing)\n        }\n      }\n      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so\n      // local dev workflows stay predictable (admin@/employee@ login with the\n      // documented demo password). In production we either have env-supplied\n      // values, or \u2014 for opt-in --include-demo-users flows \u2014 we generate a\n      // random one-time password and surface it via `generatedPassword` so the\n      // operator can capture it. Production callers without env vars and\n      // without the opt-in already threw above.\n      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd\n      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd\n      const adminPasswordHash = await hash(adminPasswordPlain, 10)\n      const employeePasswordHash = await hash(employeePasswordPlain, 10)\n      addUniqueBaseUser(baseUsers, {\n        email: adminEmail,\n        roles: ['admin'],\n        passwordHash: adminPasswordHash,\n        generatedPassword: envAdminPwd ? null : adminPasswordPlain,\n      })\n      addUniqueBaseUser(baseUsers, {\n        email: employeeEmail,\n        roles: ['employee'],\n        passwordHash: employeePasswordHash,\n        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,\n      })\n    }\n    const passwordHash = await resolvePasswordHash(primaryUser)\n\n    await em.transactional(async (tem) => {\n      const tenant = tem.create(Tenant, {\n        name: options.orgName,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(tenant)\n      await tem.flush()\n\n      const organization = tem.create(Organization, {\n        name: options.orgName,\n        slug: options.orgSlug ?? null,\n        tenant,\n        isActive: true,\n        depth: 0,\n        ancestorIds: [],\n        childIds: [],\n        descendantIds: [],\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(organization)\n      await tem.flush()\n\n      tenantId = String(tenant.id)\n      organizationId = String(organization.id)\n      const roleTenantId = tenantId\n\n      if (isTenantDataEncryptionEnabled()) {\n        try {\n          const kms = createKmsService()\n          if (kms.isHealthy()) {\n            if (isEncryptionDebugEnabled()) {\n              logger.info('Provisioning tenant DEK', { tenantId: String(tenant.id) })\n            }\n            await kms.createTenantDek(String(tenant.id))\n            if (isEncryptionDebugEnabled()) {\n              logger.info('Created tenant DEK during setup', { tenantId: String(tenant.id) })\n            }\n          } else {\n            if (isEncryptionDebugEnabled()) {\n              logger.warn('KMS not healthy, skipping tenant DEK creation', { tenantId: String(tenant.id) })\n            }\n          }\n        } catch (err) {\n          if (isEncryptionDebugEnabled()) {\n            logger.warn('Failed to create tenant DEK', { err })\n          }\n        }\n      }\n\n      await ensureRolesInContext(tem, roleNames, roleTenantId)\n      await tem.flush()\n\n      if (isTenantDataEncryptionEnabled()) {\n        for (const spec of defaultEncryptionMaps) {\n          const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })\n          if (!existing) {\n            tem.persist(tem.create(EncryptionMap, {\n              entityId: spec.entityId,\n              tenantId: tenant.id,\n              organizationId: organization.id,\n              fieldsJson: spec.fields,\n              isActive: true,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            }))\n          } else {\n            existing.fieldsJson = spec.fields\n            existing.isActive = true\n          }\n        }\n        await tem.flush()\n      }\n    })\n\n    await em.transactional(async (tem) => {\n      if (!tenantId || !organizationId) return\n      const roleTenantId = tenantId\n      const encryptionService = isTenantDataEncryptionEnabled()\n        ? new TenantDataEncryptionService(tem as any, { kms: createKmsService() })\n        : null\n      if (encryptionService) {\n        await encryptionService.invalidateMap('auth:user', String(tenantId), String(organizationId))\n        await encryptionService.invalidateMap('auth:user', String(tenantId), null)\n      }\n\n      for (const base of baseUsers) {\n        const resolvedPasswordHash = base.passwordHash ?? passwordHash\n        let user = await findOneWithDecryption(tem, User, { email: base.email }, {}, { tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n        const confirm = primaryUser.confirm ?? true\n        const encryptedPayload = encryptionService\n          ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)\n          : { email: base.email, emailHash: computeEmailHash(base.email) }\n        if (user) {\n          user.passwordHash = resolvedPasswordHash\n          user.organizationId = organizationId\n          user.tenantId = tenantId\n          if (isTenantDataEncryptionEnabled()) {\n            user.email = encryptedPayload.email as any\n            user.emailHash = (encryptedPayload as any).emailHash ?? computeEmailHash(base.email)\n          }\n          if (base.name) user.name = base.name\n          if (confirm) user.isConfirmed = true\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })\n        } else {\n          user = tem.create(User, {\n            email: (encryptedPayload as any).email ?? base.email,\n            emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,\n            passwordHash: resolvedPasswordHash,\n            organizationId,\n            tenantId,\n            name: base.name ?? undefined,\n            isConfirmed: confirm,\n            createdAt: new Date(),\n          })\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })\n        }\n        await tem.flush()\n        for (const roleName of base.roles) {\n          const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })\n          if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))\n        }\n        await tem.flush()\n      }\n    })\n  }\n\n  if (!tenantId || !organizationId) {\n    throw new Error('SETUP_FAILED')\n  }\n\n  if (!reusedExistingUser) {\n    await rebuildHierarchyForTenant(em, tenantId)\n  }\n\n  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })\n  await deactivateDemoUsersIfSelfOnboardingEnabled(em)\n\n  // Call module onTenantCreated hooks\n  for (const mod of resolvedModules) {\n    if (mod.setup?.onTenantCreated) {\n      await mod.setup.onTenantCreated({ em, tenantId, organizationId })\n    }\n  }\n\n  return {\n    tenantId,\n    organizationId,\n    users: userSnapshots,\n    reusedExistingUser,\n  }\n}\n\nfunction resolvePrimaryName(input: PrimaryUserInput): string | null {\n  if (input.displayName && input.displayName.trim()) return input.displayName.trim()\n  const parts = [input.firstName, input.lastName].map((value) => value?.trim()).filter(Boolean)\n  if (parts.length) return parts.join(' ')\n  return null\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  const value = process.env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction addUniqueBaseUser(\n  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,\n  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },\n) {\n  if (!entry.email) return\n  const normalized = entry.email.toLowerCase()\n  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return\n  baseUsers.push(entry)\n}\n\n/**\n * Well-known demo password seeded for derived admin@/employee@ accounts in\n * non-production (`NODE_ENV !== 'production'`) when no env override is set.\n * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used\n * in production: the production branch either consumes env-supplied values or\n * falls back to `generateDerivedPassword()` so credentials remain non-guessable.\n */\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\n/**\n * Generate a 16-character base64url password (96 bits of entropy) for a derived\n * demo user in production when no env override is provided AND the caller\n * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the\n * `users[].generatedPassword` snapshot so CLI callers can print it to the\n * operator \u2014 there is no other recovery path for these credentials.\n */\nfunction generateDerivedPassword(): string {\n  return randomBytes(12).toString('base64url')\n}\n\nfunction isDemoModeEnabled(): boolean {\n  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  return parsed === false ? false : true\n}\n\nfunction shouldKeepDemoSuperadminDuringInit(): boolean {\n  if (process.env.OM_INIT_FLOW !== 'true') return false\n  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false\n  return isDemoModeEnabled()\n}\n\nasync function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {\n  if (typeof input.hashedPassword === 'string') return input.hashedPassword\n  if (input.password) return hash(input.password, 10)\n  return null\n}\n\nexport async function ensureDefaultRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n  options: { includeSuperadminRole?: boolean } = {},\n) {\n  const includeSuperadminRole = options.includeSuperadminRole ?? true\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const superadminRole = includeSuperadminRole ? await findRoleByName(em, 'superadmin', roleTenantId) : null\n  const adminRole = await findRoleByName(em, 'admin', roleTenantId)\n  const employeeRole = await findRoleByName(em, 'employee', roleTenantId)\n\n  // Merge features from all enabled modules' setup configs\n  const builtInRoles = ['superadmin', 'admin', 'employee'] as const\n  const superadminFeatures: string[] = []\n  const adminFeatures: string[] = []\n  const employeeFeatures: string[] = []\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of modules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)\n    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)\n    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)\n\n    // Collect features for custom roles (any key not in builtInRoles)\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if ((builtInRoles as readonly string[]).includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  logger.info('Seeded default role features', {\n    superadmin: superadminFeatures,\n    admin: adminFeatures,\n    employee: employeeFeatures,\n    ...(customRoleFeatures.size > 0\n      ? Object.fromEntries(customRoleFeatures)\n      : {}),\n  })\n\n  if (includeSuperadminRole && superadminRole) {\n    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })\n  }\n  if (adminRole) {\n    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)\n  }\n  if (employeeRole) {\n    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)\n  }\n\n  // Seed ACLs for custom roles defined by app modules.\n  // NOTE: Custom roles may not exist yet if they are created in seedDefaults\n  // (which runs after this function). In that case, use ensureCustomRoleAcls()\n  // after seedDefaults to pick them up.\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n    }\n  }\n}\n\n/**\n * Seed ACLs for custom roles defined in module defaultRoleFeatures.\n * Call this AFTER seedDefaults to pick up roles created by app modules.\n * Safe to call multiple times \u2014 ensureRoleAclFor merges features idempotently.\n */\nexport async function ensureCustomRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules?: Module[],\n): Promise<void> {\n  const resolvedModules = modules ?? tryGetModules()\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const builtInRoles = ['superadmin', 'admin', 'employee']\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of resolvedModules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if (builtInRoles.includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  if (customRoleFeatures.size === 0) return\n\n  let seeded = 0\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n      seeded++\n    }\n  }\n  if (seeded > 0) {\n    logger.info('Seeded custom role ACLs', { seeded })\n  }\n}\n\nasync function ensureRoleAclFor(\n  em: EntityManager,\n  role: Role,\n  tenantId: string,\n  features: string[],\n  options: { isSuperAdmin?: boolean } = {},\n) {\n  const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })\n  if (!existing) {\n    const acl = em.create(RoleAcl, {\n      role,\n      tenantId,\n      featuresJson: features,\n      isSuperAdmin: !!options.isSuperAdmin,\n      createdAt: new Date(),\n    })\n    await em.persist(acl).flush()\n    return\n  }\n  const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []\n  const merged = Array.from(new Set([...currentFeatures, ...features]))\n  const changed =\n    merged.length !== currentFeatures.length ||\n    merged.some((value, index) => value !== currentFeatures[index])\n  if (changed) existing.featuresJson = merged\n  if (options.isSuperAdmin && !existing.isSuperAdmin) {\n    existing.isSuperAdmin = true\n  }\n  if (changed || options.isSuperAdmin) {\n    await em.persist(existing).flush()\n  }\n}\n\n/**\n * Neutralizes every demo account the setup path may have seeded\n * (superadmin, admin, employee \u2014 honoring OM_INIT_*_EMAIL overrides)\n * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not\n * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.\n *\n * Each user is processed in its own try/catch so a single failure (e.g.\n * decryption error on a legacy row) does not skip the remaining accounts.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {\n  if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return\n  if (shouldKeepDemoSuperadminDuringInit()) return\n  for (const { role, email } of resolveDemoUserEmails()) {\n    try {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { email },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!user) continue\n      let dirty = false\n      if (user.passwordHash) {\n        user.passwordHash = null\n        dirty = true\n      }\n      if (user.isConfirmed !== false) {\n        user.isConfirmed = false\n        dirty = true\n      }\n      if (dirty) {\n        await em.persist(user).flush()\n      }\n    } catch (error) {\n      logger.error('Failed to deactivate demo user', { role, email, err: error })\n    }\n  }\n}\n\n/**\n * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}\n * because the helper now neutralizes admin/employee demo accounts in addition\n * to superadmin (security tracker finding #5). Kept as an internal alias to\n * avoid breaking any out-of-tree caller that imported the old name; will be\n * removed in a future major.\n */\nconst deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled\n\n/** Try to get modules from runtime registry; returns empty array if not yet registered. */\nfunction tryGetModules(): Module[] {\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,gCAA6C;AACtD,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEhE,MAAM,qBAAqB,CAAC,YAAY,SAAS,YAAY;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B,sBAAsB,MAAM,GAAG,EAAE,CAAC,KAAK;AAO5E,eAAe,qBACb,IACA,WACA,UACA;AACA,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACjH,QAAI,SAAU;AACd,OAAG,QAAQ,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACvE;AACF;AAEA,eAAsB,YAAY,IAAmB,UAA8B,CAAC,GAAG;AACrF,QAAM,YAAY,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AAC7D,QAAM,WAAW,kBAAkB,QAAQ,YAAY,IAAI;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,uEAAkE;AAAA,EACpF;AACA,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,qBAAqB,KAAK,WAAW,QAAQ;AACnD,UAAM,IAAI,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,eACb,IACA,MACA,UACsB;AACtB,QAAM,mBAAmB,kBAAkB,YAAY,IAAI,KAAK;AAChE,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,UAAU,iBAAiB,GAAG,CAAC,GAAG,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,CAAC;AACvI;AAEA,eAAe,qBACb,IACA,MACA,UACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,MAAM,QAAQ;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACnD,SAAO;AACT;AAYA,MAAM,oBAAoB;AAAA,EACxB,OAAO;AAAA,EACP,UAAU;AACZ;AAeO,SAAS,wBAAyC;AACvD,QAAM,aAAa,aAAa,kBAAkB,KAAK,KAAK,SAAS,4BAA4B;AACjG,QAAM,gBAAgB,aAAa,kBAAkB,QAAQ,KAAK,YAAY,4BAA4B;AAC1G,SAAO;AAAA,IACL,EAAE,MAAM,cAAc,OAAO,sBAAsB;AAAA,IACnD,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,IACnC,EAAE,MAAM,YAAY,OAAO,cAAc;AAAA,EAC3C;AACF;AAmCO,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAA4B,MAAc;AACxC,UAAM,+CAA+C,IAAI,kBAAkB;AADjD;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,yCAAyC,MAAM;AAAA,EAC1D,YAA4B,SAAmB;AAC7C;AAAA,MACE,2CAA2C,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/D;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,mBACpB,IACA,SACmC;AACnC,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA,wBAAwB;AAAA,EAC1B,IAAI;AACJ,QAAM,oBAAoB,oBAAoB,iBAAiB,SAAS,mBAAmB,CAAC,YAAY;AACxG,QAAM,eAAe,wBACjB,oBACA,kBAAkB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC5D,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,mBAAmB,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AACpE,QAAM,oBAAoB,wBACtB,mBACA,iBAAiB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC3D,QAAM,YAAY,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,mBAAmB,GAAG,YAAY,CAAC,CAAC;AAC7E,QAAM,kBAAkB,QAAQ,WAAW,cAAc;AACzD,QAAM,wBAAwB,yBAAyB,eAAe;AAEtE,QAAM,YAAY,YAAY;AAC9B,QAAM,eAAe,MAAM,sBAAsB,IAAI,MAAM,EAAE,OAAO,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC7H,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,QAAI,cAAc;AAChB,YAAM,IAAI,mBAAmB,QAAQ,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,qBAAqB;AACzB,QAAM,gBAA6G,CAAC;AAEpH,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,QAAI,CAAC,aAAc;AACnB,yBAAqB;AACrB,eAAW,aAAa,WAAW,OAAO,aAAa,QAAQ,IAAI;AACnE,qBAAiB,aAAa,iBAAiB,OAAO,aAAa,cAAc,IAAI;AACrF,UAAM,eAAe,kBAAkB,aAAa,YAAY,IAAI,KAAK;AACzE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,8EAAyE;AAAA,IAC3F;AAEA,UAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,UAAM,IAAI,MAAM;AAEhB,UAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAC/D,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,aAAa;AAAA,MACrB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,IACjD;AACA,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AAChE,eAAW,YAAY,iBAAiB;AACtC,UAAI,CAAC,aAAa,IAAI,QAAQ,GAAG;AAC/B,cAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,YAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,cAAc,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AACjE,kBAAc,KAAK,EAAE,MAAM,cAAc,OAAO,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,CAAC,cAAc;AACjB,UAAM,YAMD;AAAA,MACH,EAAE,OAAO,YAAY,OAAO,OAAO,cAAc,MAAM,mBAAmB,WAAW,EAAE;AAAA,IACzF;AACA,QAAI,qBAAqB;AACvB,YAAM,gBAAgB,aAAa,kBAAkB,KAAK;AAC1D,YAAM,mBAAmB,aAAa,kBAAkB,QAAQ;AAChE,YAAM,aAAa,iBAAiB,SAAS,4BAA4B;AACzE,YAAM,gBAAgB,oBAAoB,YAAY,4BAA4B;AAClF,YAAM,cAAc,aAAa,wBAAwB;AACzD,YAAM,iBAAiB,aAAa,2BAA2B;AAC/D,YAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,YAAM,YAAY,QAAQ,8BAA8B;AACxD,UAAI,gBAAgB,CAAC,WAAW;AAC9B,cAAM,UAAoB,CAAC;AAC3B,YAAI,CAAC,YAAa,SAAQ,KAAK,wBAAwB;AACvD,YAAI,CAAC,eAAgB,SAAQ,KAAK,2BAA2B;AAC7D,YAAI,QAAQ,QAAQ;AAClB,gBAAM,IAAI,iCAAiC,OAAO;AAAA,QACpD;AAAA,MACF;AAQA,YAAM,mBAAmB,eAAe,wBAAwB,IAAI;AACpE,YAAM,sBAAsB,eAAe,wBAAwB,IAAI;AACvE,YAAM,qBAAqB,eAAe;AAC1C,YAAM,wBAAwB,kBAAkB;AAChD,YAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE;AAC3D,YAAM,uBAAuB,MAAM,KAAK,uBAAuB,EAAE;AACjE,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,OAAO;AAAA,QACf,cAAc;AAAA,QACd,mBAAmB,cAAc,OAAO;AAAA,MAC1C,CAAC;AACD,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,UAAU;AAAA,QAClB,cAAc;AAAA,QACd,mBAAmB,iBAAiB,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,UAAM,eAAe,MAAM,oBAAoB,WAAW;AAE1D,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,QAChC,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,MAAM;AAClB,YAAM,IAAI,MAAM;AAEhB,YAAM,eAAe,IAAI,OAAO,cAAc;AAAA,QAC5C,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ,WAAW;AAAA,QACzB;AAAA,QACA,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,CAAC;AAAA,QACd,UAAU,CAAC;AAAA,QACX,eAAe,CAAC;AAAA,QAChB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,YAAY;AACxB,YAAM,IAAI,MAAM;AAEhB,iBAAW,OAAO,OAAO,EAAE;AAC3B,uBAAiB,OAAO,aAAa,EAAE;AACvC,YAAM,eAAe;AAErB,UAAI,8BAA8B,GAAG;AACnC,YAAI;AACF,gBAAM,MAAM,iBAAiB;AAC7B,cAAI,IAAI,UAAU,GAAG;AACnB,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,2BAA2B,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACxE;AACA,kBAAM,IAAI,gBAAgB,OAAO,OAAO,EAAE,CAAC;AAC3C,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,mCAAmC,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAChF;AAAA,UACF,OAAO;AACL,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,iDAAiD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAC9F;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,yBAAyB,GAAG;AAC9B,mBAAO,KAAK,+BAA+B,EAAE,IAAI,CAAC;AAAA,UACpD;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,YAAM,IAAI,MAAM;AAEhB,UAAI,8BAA8B,GAAG;AACnC,mBAAW,QAAQ,uBAAuB;AACxC,gBAAM,WAAW,MAAM,sBAAsB,KAAK,eAAe,EAAE,UAAU,KAAK,UAAU,UAAU,OAAO,IAAI,gBAAgB,aAAa,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,gBAAgB,OAAO,aAAa,EAAE,EAAE,CAAC;AACjP,cAAI,CAAC,UAAU;AACb,gBAAI,QAAQ,IAAI,OAAO,eAAe;AAAA,cACpC,UAAU,KAAK;AAAA,cACf,UAAU,OAAO;AAAA,cACjB,gBAAgB,aAAa;AAAA,cAC7B,YAAY,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC,CAAC;AAAA,UACJ,OAAO;AACL,qBAAS,aAAa,KAAK;AAC3B,qBAAS,WAAW;AAAA,UACtB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,eAAe;AACrB,YAAM,oBAAoB,8BAA8B,IACpD,IAAI,4BAA4B,KAAY,EAAE,KAAK,iBAAiB,EAAE,CAAC,IACvE;AACJ,UAAI,mBAAmB;AACrB,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3F,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,IAAI;AAAA,MAC3E;AAEA,iBAAW,QAAQ,WAAW;AAC5B,cAAM,uBAAuB,KAAK,gBAAgB;AAClD,YAAI,OAAO,MAAM,sBAAsB,KAAK,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AACnJ,cAAM,UAAU,YAAY,WAAW;AACvC,cAAM,mBAAmB,oBACrB,MAAM,kBAAkB,qBAAqB,aAAa,EAAE,OAAO,KAAK,MAAM,GAAG,UAAU,cAAc,IACzG,EAAE,OAAO,KAAK,OAAO,WAAW,iBAAiB,KAAK,KAAK,EAAE;AACjE,YAAI,MAAM;AACR,eAAK,eAAe;AACpB,eAAK,iBAAiB;AACtB,eAAK,WAAW;AAChB,cAAI,8BAA8B,GAAG;AACnC,iBAAK,QAAQ,iBAAiB;AAC9B,iBAAK,YAAa,iBAAyB,aAAa,iBAAiB,KAAK,KAAK;AAAA,UACrF;AACA,cAAI,KAAK,KAAM,MAAK,OAAO,KAAK;AAChC,cAAI,QAAS,MAAK,cAAc;AAChC,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QACnH,OAAO;AACL,iBAAO,IAAI,OAAO,MAAM;AAAA,YACtB,OAAQ,iBAAyB,SAAS,KAAK;AAAA,YAC/C,WAAW,8BAA8B,IAAK,iBAAyB,aAAa,iBAAiB,KAAK,KAAK,IAAI;AAAA,YACnH,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA,MAAM,KAAK,QAAQ;AAAA,YACnB,aAAa;AAAA,YACb,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QAClH;AACA,cAAM,IAAI,MAAM;AAChB,mBAAW,YAAY,KAAK,OAAO;AACjC,gBAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,gBAAM,eAAe,MAAM,sBAAsB,KAAK,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,KAAK,CAAC;AACxI,cAAI,CAAC,aAAc,KAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,QAC5F;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,cAAc;AAAA,EAChC;AAEA,MAAI,CAAC,oBAAoB;AACvB,UAAM,0BAA0B,IAAI,QAAQ;AAAA,EAC9C;AAEA,QAAM,sBAAsB,IAAI,UAAU,iBAAiB,EAAE,sBAAsB,CAAC;AACpF,QAAM,2CAA2C,EAAE;AAGnD,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,OAAO,iBAAiB;AAC9B,YAAM,IAAI,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,MAAM,eAAe,MAAM,YAAY,KAAK,EAAG,QAAO,MAAM,YAAY,KAAK;AACjF,QAAM,QAAQ,CAAC,MAAM,WAAW,MAAM,QAAQ,EAAE,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F,MAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AACvC,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,kBACP,WACA,OACA;AACA,MAAI,CAAC,MAAM,MAAO;AAClB,QAAM,aAAa,MAAM,MAAM,YAAY;AAC3C,MAAI,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,YAAY,MAAM,UAAU,EAAG;AACvE,YAAU,KAAK,KAAK;AACtB;AASA,MAAM,wBAAwB;AAS9B,SAAS,0BAAkC;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AAC5D,SAAO,WAAW,QAAQ,QAAQ;AACpC;AAEA,SAAS,qCAA8C;AACrD,MAAI,QAAQ,IAAI,iBAAiB,OAAQ,QAAO;AAChD,MAAI,CAAC,aAAa,0BAA0B,EAAG,QAAO;AACtD,SAAO,kBAAkB;AAC3B;AAEA,eAAe,oBAAoB,OAAiD;AAClF,MAAI,OAAO,MAAM,mBAAmB,SAAU,QAAO,MAAM;AAC3D,MAAI,MAAM,SAAU,QAAO,KAAK,MAAM,UAAU,EAAE;AAClD,SAAO;AACT;AAEA,eAAsB,sBACpB,IACA,UACA,SACA,UAA+C,CAAC,GAChD;AACA,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,iBAAiB,wBAAwB,MAAM,eAAe,IAAI,cAAc,YAAY,IAAI;AACtG,QAAM,YAAY,MAAM,eAAe,IAAI,SAAS,YAAY;AAChE,QAAM,eAAe,MAAM,eAAe,IAAI,YAAY,YAAY;AAGtE,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAA+B,CAAC;AACtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,SAAS;AACzB,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,QAAI,aAAa,WAAY,oBAAmB,KAAK,GAAG,aAAa,UAAU;AAC/E,QAAI,aAAa,MAAO,eAAc,KAAK,GAAG,aAAa,KAAK;AAChE,QAAI,aAAa,SAAU,kBAAiB,KAAK,GAAG,aAAa,QAAQ;AAGzE,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAK,aAAmC,SAAS,QAAQ,EAAG;AAC5D,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,SAAO,KAAK,gCAAgC;AAAA,IAC1C,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,GAAI,mBAAmB,OAAO,IAC1B,OAAO,YAAY,kBAAkB,IACrC,CAAC;AAAA,EACP,CAAC;AAED,MAAI,yBAAyB,gBAAgB;AAC3C,UAAM,iBAAiB,IAAI,gBAAgB,UAAU,oBAAoB,EAAE,cAAc,KAAK,CAAC;AAAA,EACjG;AACA,MAAI,WAAW;AACb,UAAM,iBAAiB,IAAI,WAAW,UAAU,aAAa;AAAA,EAC/D;AACA,MAAI,cAAc;AAChB,UAAM,iBAAiB,IAAI,cAAc,UAAU,gBAAgB;AAAA,EACrE;AAMA,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AAAA,IACrD;AAAA,EACF;AACF;AAOA,eAAsB,qBACpB,IACA,UACA,SACe;AACf,QAAM,kBAAkB,WAAW,cAAc;AACjD,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,iBAAiB;AACjC,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAI,aAAa,SAAS,QAAQ,EAAG;AACrC,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,mBAAmB,SAAS,EAAG;AAEnC,MAAI,SAAS;AACb,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,GAAG;AACd,WAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACnD;AACF;AAEA,eAAe,iBACb,IACA,MACA,UACA,UACA,UAAsC,CAAC,GACvC;AACA,QAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACpH,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,GAAG,OAAO,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc,CAAC,CAAC,QAAQ;AAAA,MACxB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,QAAQ,SAAS,YAAY,IAAI,SAAS,eAAe,CAAC;AACxF,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AACpE,QAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,MAAI,QAAS,UAAS,eAAe;AACrC,MAAI,QAAQ,gBAAgB,CAAC,SAAS,cAAc;AAClD,aAAS,eAAe;AAAA,EAC1B;AACA,MAAI,WAAW,QAAQ,cAAc;AACnC,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC;AACF;AAaA,eAAsB,2CAA2C,IAAmB;AAClF,MAAI,QAAQ,IAAI,oCAAoC,OAAQ;AAC5D,MAAI,mCAAmC,EAAG;AAC1C,aAAW,EAAE,MAAM,MAAM,KAAK,sBAAsB,GAAG;AACrD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,MAAM;AAAA,QACR,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,KAAM;AACX,UAAI,QAAQ;AACZ,UAAI,KAAK,cAAc;AACrB,aAAK,eAAe;AACpB,gBAAQ;AAAA,MACV;AACA,UAAI,KAAK,gBAAgB,OAAO;AAC9B,aAAK,cAAc;AACnB,gBAAQ;AAAA,MACV;AACA,UAAI,OAAO;AACT,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,aAAO,MAAM,kCAAkC,EAAE,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,IAC5E;AAAA,EACF;AACF;AASA,MAAM,kDAAkD;AAGxD,SAAS,gBAA0B;AACjC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/auth/lib/tenantAccess.js

@@ -1,4 +1,6 @@
 import { forbidden } from "@open-mercato/shared/lib/crud/errors";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("auth").child({ component: "tenant-access" });
 const SUPER_ADMIN_SYMBOL = /* @__PURE__ */ Symbol.for("auth.tenantGuard.isSuperAdmin");
 function normalizeTenantId(value) {
   if (value === void 0) return void 0;
@@ -32,7 +34,7 @@ async function resolveIsSuperAdmin(ctx) {
     cacheStore[SUPER_ADMIN_SYMBOL] = value;
     return value;
   } catch (error) {
-    console.error("auth.tenantGuard: failed to resolve rbac", error);
+    logger.error("Failed to resolve rbac", { err: error });
     cacheStore[SUPER_ADMIN_SYMBOL] = false;
     return false;
   }

package/dist/modules/auth/lib/tenantAccess.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/tenantAccess.ts"],
-  "sourcesContent": ["import { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\ntype TenantGuardCtx = {\n  auth: {\n    sub?: string | null\n    tenantId?: string | null\n    orgId?: string | null\n    roles?: string[]\n    isSuperAdmin?: boolean\n  } | null\n  container: { resolve<T = unknown>(name: string): T }\n}\n\nconst SUPER_ADMIN_SYMBOL = Symbol.for('auth.tenantGuard.isSuperAdmin')\n\nexport function normalizeTenantId(value: unknown): string | null | undefined {\n  if (value === undefined) return undefined\n  if (value === null) return null\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n  return null\n}\n\nexport async function resolveIsSuperAdmin(ctx: TenantGuardCtx): Promise<boolean> {\n  const cacheStore = ctx as { [SUPER_ADMIN_SYMBOL]?: boolean }\n  const cached = cacheStore[SUPER_ADMIN_SYMBOL]\n  if (typeof cached === 'boolean') return cached\n  const auth = ctx.auth\n  if (!auth?.sub) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n  if (auth.isSuperAdmin === true) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = true\n    return true\n  }\n  try {\n    const rbac = (ctx.container.resolve('rbacService') as RbacService)\n    const acl = await rbac.loadAcl(auth.sub, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    })\n    const value = !!acl?.isSuperAdmin\n    cacheStore[SUPER_ADMIN_SYMBOL] = value\n    return value\n  } catch (error) {\n    console.error('auth.tenantGuard: failed to resolve rbac', error)\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n}\n\nexport async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unknown): Promise<string | null> {\n  const normalized = normalizeTenantId(requested)\n  const actorTenant = normalizeTenantId(ctx.auth?.tenantId ?? null) ?? null\n  const isSuperAdmin = await resolveIsSuperAdmin(ctx)\n\n  if (isSuperAdmin) {\n    if (normalized === undefined) return actorTenant\n    return normalized ?? null\n  }\n\n  if (!actorTenant) {\n    if (normalized && normalized !== null) {\n      throw forbidden('Not authorized to target this tenant.')\n    }\n    return actorTenant\n  }\n\n  if (normalized === undefined) return actorTenant\n  if (normalized === actorTenant) return actorTenant\n  throw forbidden('Not authorized to target this tenant.')\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiB;AAc1B,MAAM,qBAAqB,uBAAO,IAAI,+BAA+B;AAE9D,SAAS,kBAAkB,OAA2C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AACA,SAAO;AACT;AAEA,eAAsB,oBAAoB,KAAuC;AAC/E,QAAM,aAAa;AACnB,QAAM,SAAS,WAAW,kBAAkB;AAC5C,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,MAAM,KAAK;AACd,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,iBAAiB,MAAM;AAC9B,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC,CAAC;AACD,UAAM,QAAQ,CAAC,CAAC,KAAK;AACrB,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,MAAM,4CAA4C,KAAK;AAC/D,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,KAAqB,WAA4C;AAC5G,QAAM,aAAa,kBAAkB,SAAS;AAC9C,QAAM,cAAc,kBAAkB,IAAI,MAAM,YAAY,IAAI,KAAK;AACrE,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAElD,MAAI,cAAc;AAChB,QAAI,eAAe,OAAW,QAAO;AACrC,WAAO,cAAc;AAAA,EACvB;AAEA,MAAI,CAAC,aAAa;AAChB,QAAI,cAAc,eAAe,MAAM;AACrC,YAAM,UAAU,uCAAuC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,OAAW,QAAO;AACrC,MAAI,eAAe,YAAa,QAAO;AACvC,QAAM,UAAU,uCAAuC;AACzD;",
+  "sourcesContent": ["import { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'tenant-access' })\n\ntype TenantGuardCtx = {\n  auth: {\n    sub?: string | null\n    tenantId?: string | null\n    orgId?: string | null\n    roles?: string[]\n    isSuperAdmin?: boolean\n  } | null\n  container: { resolve<T = unknown>(name: string): T }\n}\n\nconst SUPER_ADMIN_SYMBOL = Symbol.for('auth.tenantGuard.isSuperAdmin')\n\nexport function normalizeTenantId(value: unknown): string | null | undefined {\n  if (value === undefined) return undefined\n  if (value === null) return null\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n  return null\n}\n\nexport async function resolveIsSuperAdmin(ctx: TenantGuardCtx): Promise<boolean> {\n  const cacheStore = ctx as { [SUPER_ADMIN_SYMBOL]?: boolean }\n  const cached = cacheStore[SUPER_ADMIN_SYMBOL]\n  if (typeof cached === 'boolean') return cached\n  const auth = ctx.auth\n  if (!auth?.sub) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n  if (auth.isSuperAdmin === true) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = true\n    return true\n  }\n  try {\n    const rbac = (ctx.container.resolve('rbacService') as RbacService)\n    const acl = await rbac.loadAcl(auth.sub, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    })\n    const value = !!acl?.isSuperAdmin\n    cacheStore[SUPER_ADMIN_SYMBOL] = value\n    return value\n  } catch (error) {\n    logger.error('Failed to resolve rbac', { err: error })\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n}\n\nexport async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unknown): Promise<string | null> {\n  const normalized = normalizeTenantId(requested)\n  const actorTenant = normalizeTenantId(ctx.auth?.tenantId ?? null) ?? null\n  const isSuperAdmin = await resolveIsSuperAdmin(ctx)\n\n  if (isSuperAdmin) {\n    if (normalized === undefined) return actorTenant\n    return normalized ?? null\n  }\n\n  if (!actorTenant) {\n    if (normalized && normalized !== null) {\n      throw forbidden('Not authorized to target this tenant.')\n    }\n    return actorTenant\n  }\n\n  if (normalized === undefined) return actorTenant\n  if (normalized === actorTenant) return actorTenant\n  throw forbidden('Not authorized to target this tenant.')\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAE1B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAaxE,MAAM,qBAAqB,uBAAO,IAAI,+BAA+B;AAE9D,SAAS,kBAAkB,OAA2C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AACA,SAAO;AACT;AAEA,eAAsB,oBAAoB,KAAuC;AAC/E,QAAM,aAAa;AACnB,QAAM,SAAS,WAAW,kBAAkB;AAC5C,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,MAAM,KAAK;AACd,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,iBAAiB,MAAM;AAC9B,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC,CAAC;AACD,UAAM,QAAQ,CAAC,CAAC,KAAK;AACrB,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,KAAqB,WAA4C;AAC5G,QAAM,aAAa,kBAAkB,SAAS;AAC9C,QAAM,cAAc,kBAAkB,IAAI,MAAM,YAAY,IAAI,KAAK;AACrE,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAElD,MAAI,cAAc;AAChB,QAAI,eAAe,OAAW,QAAO;AACrC,WAAO,cAAc;AAAA,EACvB;AAEA,MAAI,CAAC,aAAa;AAChB,QAAI,cAAc,eAAe,MAAM;AACrC,YAAM,UAAU,uCAAuC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,OAAW,QAAO;AACrC,MAAI,eAAe,YAAa,QAAO;AACvC,QAAM,UAAU,uCAAuC;AACzD;",
   "names": []
 }

package/dist/modules/auth/lib/tokenHash.js

@@ -1,4 +1,6 @@
 import { createHmac, randomBytes } from "node:crypto";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("auth").child({ component: "token-hash" });
 const DEV_ONLY_SECRET = "om-auth-token-dev-only-secret";
 let missingSecretWarned = false;
 function resolveTokenSecret() {
@@ -11,9 +13,7 @@ function resolveTokenSecret() {
     }
     if (!missingSecretWarned) {
       missingSecretWarned = true;
-      console.warn(
-        "[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 using insecure dev-only default. Set a secret before deploying to production."
-      );
+      logger.warn("No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 using insecure dev-only default. Set a secret before deploying to production.");
     }
     return DEV_ONLY_SECRET;
   }

package/dist/modules/auth/lib/tokenHash.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/tokenHash.ts"],
-  "sourcesContent": ["import { createHmac, randomBytes } from 'node:crypto'\n\nconst DEV_ONLY_SECRET = 'om-auth-token-dev-only-secret'\nlet missingSecretWarned = false\n\nfunction resolveTokenSecret(): string {\n  const secret =\n    process.env.AUTH_TOKEN_SECRET ||\n    process.env.AUTH_SECRET ||\n    process.env.NEXTAUTH_SECRET ||\n    process.env.JWT_SECRET\n  if (!secret) {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error(\n        '[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set. ' +\n        'Refusing to start in production without a token hashing secret.',\n      )\n    }\n    if (!missingSecretWarned) {\n      missingSecretWarned = true\n      console.warn(\n        '[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 ' +\n        'using insecure dev-only default. Set a secret before deploying to production.',\n      )\n    }\n    return DEV_ONLY_SECRET\n  }\n  return secret\n}\n\nexport function generateAuthToken(): string {\n  return randomBytes(32).toString('hex')\n}\n\nexport function hashAuthToken(rawToken: string): string {\n  return createHmac('sha256', resolveTokenSecret()).update(rawToken).digest('hex')\n}\n\n"],
-  "mappings": "AAAA,SAAS,YAAY,mBAAmB;AAExC,MAAM,kBAAkB;AACxB,IAAI,sBAAsB;AAE1B,SAAS,qBAA6B;AACpC,QAAM,SACJ,QAAQ,IAAI,qBACZ,QAAQ,IAAI,eACZ,QAAQ,IAAI,mBACZ,QAAQ,IAAI;AACd,MAAI,CAAC,QAAQ;AACX,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB;AACxB,4BAAsB;AACtB,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,oBAA4B;AAC1C,SAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAEO,SAAS,cAAc,UAA0B;AACtD,SAAO,WAAW,UAAU,mBAAmB,CAAC,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AACjF;",
+  "sourcesContent": ["import { createHmac, randomBytes } from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'token-hash' })\n\nconst DEV_ONLY_SECRET = 'om-auth-token-dev-only-secret'\nlet missingSecretWarned = false\n\nfunction resolveTokenSecret(): string {\n  const secret =\n    process.env.AUTH_TOKEN_SECRET ||\n    process.env.AUTH_SECRET ||\n    process.env.NEXTAUTH_SECRET ||\n    process.env.JWT_SECRET\n  if (!secret) {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error(\n        '[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set. ' +\n        'Refusing to start in production without a token hashing secret.',\n      )\n    }\n    if (!missingSecretWarned) {\n      missingSecretWarned = true\n      logger.warn('No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 using insecure dev-only default. Set a secret before deploying to production.')\n    }\n    return DEV_ONLY_SECRET\n  }\n  return secret\n}\n\nexport function generateAuthToken(): string {\n  return randomBytes(32).toString('hex')\n}\n\nexport function hashAuthToken(rawToken: string): string {\n  return createHmac('sha256', resolveTokenSecret()).update(rawToken).digest('hex')\n}\n\n"],
+  "mappings": "AAAA,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAErE,MAAM,kBAAkB;AACxB,IAAI,sBAAsB;AAE1B,SAAS,qBAA6B;AACpC,QAAM,SACJ,QAAQ,IAAI,qBACZ,QAAQ,IAAI,eACZ,QAAQ,IAAI,mBACZ,QAAQ,IAAI;AACd,MAAI,CAAC,QAAQ;AACX,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB;AACxB,4BAAsB;AACtB,aAAO,KAAK,sJAAiJ;AAAA,IAC/J;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,oBAA4B;AAC1C,SAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAEO,SAAS,cAAc,UAA0B;AACtD,SAAO,WAAW,UAAU,mBAAmB,CAAC,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AACjF;",
   "names": []
 }

package/dist/modules/business_rules/api/rules/route.js

@@ -18,6 +18,8 @@ import {
   invalidateBusinessRuleDiscoveryCache,
   resolveBusinessRuleDiscoveryCache
 } from "../../lib/rule-engine.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("business_rules").child({ component: "rules-api" });
 const querySchema = z.looseObject({
   id: z.uuid().optional(),
   page: z.coerce.number().min(1).default(1),
@@ -189,7 +191,7 @@ async function POST(req) {
     await em.persist(rule).flush();
     await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId);
   } catch (error) {
-    console.error("[business_rules.rules] Failed to persist new rule:", error);
+    logger.error("Failed to persist new rule", { err: error });
     return NextResponse.json(
       { error: t("business_rules.errors.createFailed") },
       { status: 500 }
@@ -255,7 +257,7 @@ async function PUT(req) {
     await em.persist(rule).flush();
     await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId);
   } catch (error) {
-    console.error("[business_rules.rules] Failed to persist rule update:", error);
+    logger.error("Failed to persist rule update", { err: error });
     return NextResponse.json(
       { error: t("business_rules.errors.updateFailed") },
       { status: 500 }

package/dist/modules/business_rules/api/rules/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/business_rules/api/rules/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { BusinessRule } from '../../data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport {\n  createBusinessRuleSchema,\n  updateBusinessRuleSchema,\n  createLocalizedBusinessRuleSchema,\n  createLocalizedUpdateBusinessRuleSchema,\n  businessRuleFilterSchema,\n  ruleTypeSchema,\n} from '../../data/validators'\nimport {\n  invalidateBusinessRuleDiscoveryCache,\n  resolveBusinessRuleDiscoveryCache,\n} from '../../lib/rule-engine'\n\nconst querySchema = z.looseObject({\n  id: z.uuid().optional(),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  ruleId: z.string().optional(),\n  ruleType: ruleTypeSchema.optional(),\n  entityType: z.string().optional(),\n  eventType: z.string().optional(),\n  enabled: z.coerce.boolean().optional(),\n  ruleCategory: z.string().optional(),\n  sortField: z.string().optional(),\n  sortDir: z.enum(['asc', 'desc']).optional().default('desc'),\n})\n\nconst ruleListItemSchema = z.object({\n  id: z.string().uuid(),\n  ruleId: z.string(),\n  ruleName: z.string(),\n  description: z.string().nullable(),\n  ruleType: ruleTypeSchema,\n  ruleCategory: z.string().nullable(),\n  entityType: z.string(),\n  eventType: z.string().nullable(),\n  enabled: z.boolean(),\n  priority: z.number(),\n  version: z.number(),\n  effectiveFrom: z.string().nullable(),\n  effectiveTo: z.string().nullable(),\n  tenantId: z.string().uuid(),\n  organizationId: z.string().uuid(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst ruleListResponseSchema = z.object({\n  items: z.array(ruleListItemSchema),\n  total: z.number().int().nonnegative(),\n  totalPages: z.number().int().positive(),\n})\n\nconst ruleCreateResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst okResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst errorResponseSchema = z.object({\n  error: z.string(),\n})\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['business_rules.view'] },\n  POST: { requireAuth: true, requireFeatures: ['business_rules.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['business_rules.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['business_rules.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = querySchema.safeParse({\n    id: url.searchParams.get('id') || undefined,\n    page: url.searchParams.get('page') || undefined,\n    pageSize: url.searchParams.get('pageSize') || undefined,\n    search: url.searchParams.get('search') || undefined,\n    ruleId: url.searchParams.get('ruleId') || undefined,\n    ruleType: url.searchParams.get('ruleType') || undefined,\n    entityType: url.searchParams.get('entityType') || undefined,\n    eventType: url.searchParams.get('eventType') || undefined,\n    enabled: url.searchParams.get('enabled') || undefined,\n    ruleCategory: url.searchParams.get('ruleCategory') || undefined,\n    sortField: url.searchParams.get('sortField') || undefined,\n    sortDir: url.searchParams.get('sortDir') || undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n\n  const { id, page, pageSize, search, ruleId, ruleType, entityType, eventType, enabled, ruleCategory, sortField, sortDir } = parsed.data\n\n  const filters: Record<string, any> = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  }\n\n  if (id) filters.id = id\n  if (ruleId) filters.ruleId = { $ilike: `%${escapeLikePattern(ruleId)}%` }\n  if (search) filters.ruleName = { $ilike: `%${escapeLikePattern(search)}%` }\n  if (ruleType) filters.ruleType = ruleType\n  if (entityType) filters.entityType = entityType\n  if (eventType) filters.eventType = eventType\n  if (enabled !== undefined) filters.enabled = enabled\n  if (ruleCategory) filters.ruleCategory = ruleCategory\n\n  const sortFieldMap: Record<string, string> = {\n    ruleId: 'ruleId',\n    ruleName: 'ruleName',\n    ruleType: 'ruleType',\n    entityType: 'entityType',\n    priority: 'priority',\n    createdAt: 'createdAt',\n    updatedAt: 'updatedAt',\n  }\n\n  const orderByField = sortField && sortFieldMap[sortField] ? sortFieldMap[sortField] : 'priority'\n  const orderBy = { [orderByField]: sortDir, ruleId: 'asc' as const }\n\n  const [rows, count] = await em.findAndCount(\n    BusinessRule,\n    filters,\n    {\n      limit: pageSize,\n      offset: (page - 1) * pageSize,\n      orderBy,\n    }\n  )\n\n  const items = rows.map((rule) => ({\n    id: rule.id,\n    ruleId: rule.ruleId,\n    ruleName: rule.ruleName,\n    description: rule.description ?? null,\n    ruleType: rule.ruleType,\n    ruleCategory: rule.ruleCategory ?? null,\n    entityType: rule.entityType,\n    eventType: rule.eventType ?? null,\n    enabled: rule.enabled,\n    priority: rule.priority,\n    version: rule.version,\n    effectiveFrom: rule.effectiveFrom ? rule.effectiveFrom.toISOString() : null,\n    effectiveTo: rule.effectiveTo ? rule.effectiveTo.toISOString() : null,\n    tenantId: rule.tenantId,\n    organizationId: rule.organizationId,\n    createdAt: rule.createdAt.toISOString(),\n    updatedAt: rule.updatedAt.toISOString(),\n  }))\n\n  const totalPages = Math.max(1, Math.ceil(count / pageSize))\n\n  return NextResponse.json({ items, total: count, totalPages })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const cache = resolveBusinessRuleDiscoveryCache(container.resolve.bind(container))\n\n  let body: any\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  const payload = {\n    ...body,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    createdBy: auth.sub ?? auth.email ?? null,\n  }\n\n  const { t } = await resolveTranslations()\n  const schema = createLocalizedBusinessRuleSchema(t)\n  const parsed = schema.safeParse(payload)\n  if (!parsed.success) {\n    const errors = parsed.error.issues.map(e => `${e.path.join('.')}: ${e.message}`)\n    return NextResponse.json({ error: `Validation failed: ${errors.join(', ')}` }, { status: 400 })\n  }\n\n  const data = {\n    ...parsed.data,\n    conditionExpression: parsed.data.conditionExpression ?? null,\n  }\n\n  const rule = em.create(BusinessRule, data)\n\n  try {\n    await em.persist(rule).flush()\n    await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)\n  } catch (error) {\n    console.error('[business_rules.rules] Failed to persist new rule:', error)\n    return NextResponse.json(\n      { error: t('business_rules.errors.createFailed') },\n      { status: 500 },\n    )\n  }\n\n  return NextResponse.json({ id: rule.id }, { status: 201 })\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const cache = resolveBusinessRuleDiscoveryCache(container.resolve.bind(container))\n\n  let body: any\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  if (!body.id) {\n    return NextResponse.json({ error: 'Rule id is required' }, { status: 400 })\n  }\n\n  const payload = {\n    ...body,\n    updatedBy: auth.sub ?? auth.email ?? null,\n  }\n  delete (payload as Record<string, unknown>).tenantId\n  delete (payload as Record<string, unknown>).organizationId\n  delete (payload as Record<string, unknown>).createdBy\n\n  const { t } = await resolveTranslations()\n  const schema = createLocalizedUpdateBusinessRuleSchema(t)\n  const parsed = schema.safeParse(payload)\n  if (!parsed.success) {\n    const errors = parsed.error.issues.map(e => `${e.path.join('.')}: ${e.message}`)\n    return NextResponse.json({ error: `Validation failed: ${errors.join(', ')}` }, { status: 400 })\n  }\n\n  const rule = await em.findOne(BusinessRule, {\n    id: parsed.data.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n\n  if (!rule) {\n    return NextResponse.json({ error: 'Rule not found' }, { status: 404 })\n  }\n\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'business_rules.rule',\n      resourceId: rule.id,\n      current: rule.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  em.assign(rule, parsed.data)\n\n  try {\n    await em.persist(rule).flush()\n    await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)\n  } catch (error) {\n    console.error('[business_rules.rules] Failed to persist rule update:', error)\n    return NextResponse.json(\n      { error: t('business_rules.errors.updateFailed') },\n      { status: 500 },\n    )\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id')\n\n  if (!id) {\n    return NextResponse.json({ error: 'Rule id is required' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const cache = resolveBusinessRuleDiscoveryCache(container.resolve.bind(container))\n\n  const rule = await em.findOne(BusinessRule, {\n    id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n\n  if (!rule) {\n    return NextResponse.json({ error: 'Rule not found' }, { status: 404 })\n  }\n\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'business_rules.rule',\n      resourceId: rule.id,\n      current: rule.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  rule.deletedAt = new Date()\n  await em.persist(rule).flush()\n  await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)\n\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Business Rules',\n  summary: 'Business rule management',\n  methods: {\n    GET: {\n      summary: 'List business rules',\n      description: 'Returns business rules for the current tenant and organization with filtering and pagination.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'Business rules collection', schema: ruleListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create business rule',\n      description: 'Creates a new business rule for the current tenant and organization.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createBusinessRuleSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Business rule created',\n          schema: ruleCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update business rule',\n      description: 'Updates an existing business rule.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateBusinessRuleSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Business rule updated',\n          schema: okResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 404, description: 'Business rule not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete business rule',\n      description: 'Soft deletes a business rule by identifier.',\n      query: z.object({ id: z.string().uuid().describe('Business rule identifier') }),\n      responses: [\n        { status: 200, description: 'Business rule deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid identifier', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 404, description: 'Business rule not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,8CAA8C;AACvD,SAAS,oBAAoB;AAE7B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,cAAc,EAAE,YAAY;AAAA,EAChC,IAAI,EAAE,KAAK,EAAE,SAAS;AAAA,EACtB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,UAAU,eAAe,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,MAAM;AAC5D,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO;AAAA,EACrB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,OAAO;AAAA,EAClB,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEO,MAAM,WAAW;AAExB,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,YAAY,UAAU;AAAA,IACnC,IAAI,IAAI,aAAa,IAAI,IAAI,KAAK;AAAA,IAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,IACtD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,EAC9C,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,EAAE,IAAI,MAAM,UAAU,QAAQ,QAAQ,UAAU,YAAY,WAAW,SAAS,cAAc,WAAW,QAAQ,IAAI,OAAO;AAElI,QAAM,UAA+B;AAAA,IACnC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb;AAEA,MAAI,GAAI,SAAQ,KAAK;AACrB,MAAI,OAAQ,SAAQ,SAAS,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI;AACxE,MAAI,OAAQ,SAAQ,WAAW,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI;AAC1E,MAAI,SAAU,SAAQ,WAAW;AACjC,MAAI,WAAY,SAAQ,aAAa;AACrC,MAAI,UAAW,SAAQ,YAAY;AACnC,MAAI,YAAY,OAAW,SAAQ,UAAU;AAC7C,MAAI,aAAc,SAAQ,eAAe;AAEzC,QAAM,eAAuC;AAAA,IAC3C,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AAEA,QAAM,eAAe,aAAa,aAAa,SAAS,IAAI,aAAa,SAAS,IAAI;AACtF,QAAM,UAAU,EAAE,CAAC,YAAY,GAAG,SAAS,QAAQ,MAAe;AAElE,QAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,SAAS,OAAO,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,KAAK,IAAI,CAAC,UAAU;AAAA,IAChC,IAAI,KAAK;AAAA,IACT,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,aAAa,KAAK,eAAe;AAAA,IACjC,UAAU,KAAK;AAAA,IACf,cAAc,KAAK,gBAAgB;AAAA,IACnC,YAAY,KAAK;AAAA,IACjB,WAAW,KAAK,aAAa;AAAA,IAC7B,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,eAAe,KAAK,gBAAgB,KAAK,cAAc,YAAY,IAAI;AAAA,IACvE,aAAa,KAAK,cAAc,KAAK,YAAY,YAAY,IAAI;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK,UAAU,YAAY;AAAA,IACtC,WAAW,KAAK,UAAU,YAAY;AAAA,EACxC,EAAE;AAEF,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAE1D,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,WAAW,CAAC;AAC9D;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,kCAAkC,UAAU,QAAQ,KAAK,SAAS,CAAC;AAEjF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK,OAAO,KAAK,SAAS;AAAA,EACvC;AAEA,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,SAAS,kCAAkC,CAAC;AAClD,QAAM,SAAS,OAAO,UAAU,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,OAAK,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,OAAO,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,OAAO;AAAA,IACX,GAAG,OAAO;AAAA,IACV,qBAAqB,OAAO,KAAK,uBAAuB;AAAA,EAC1D;AAEA,QAAM,OAAO,GAAG,OAAO,cAAc,IAAI;AAEzC,MAAI;AACF,UAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,UAAM,qCAAqC,OAAO,KAAK,UAAU,KAAK,cAAc;AAAA,EACtF,SAAS,OAAO;AACd,YAAQ,MAAM,sDAAsD,KAAK;AACzE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,EAAE,oCAAoC,EAAE;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3D;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,kCAAkC,UAAU,QAAQ,KAAK,SAAS,CAAC;AAEjF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,WAAW,KAAK,OAAO,KAAK,SAAS;AAAA,EACvC;AACA,SAAQ,QAAoC;AAC5C,SAAQ,QAAoC;AAC5C,SAAQ,QAAoC;AAE5C,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,SAAS,wCAAwC,CAAC;AACxD,QAAM,SAAS,OAAO,UAAU,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,OAAK,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,OAAO,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,KAAG,OAAO,MAAM,OAAO,IAAI;AAE3B,MAAI;AACF,UAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,UAAM,qCAAqC,OAAO,KAAK,UAAU,KAAK,cAAc;AAAA,EACtF,SAAS,OAAO;AACd,YAAQ,MAAM,yDAAyD,KAAK;AAC5E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,EAAE,oCAAoC,EAAE;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI;AAEpC,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,kCAAkC,UAAU,QAAQ,KAAK,SAAS,CAAC;AAEjF,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,OAAK,YAAY,oBAAI,KAAK;AAC1B,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,QAAM,qCAAqC,OAAO,KAAK,UAAU,KAAK,cAAc;AAEpF,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,uBAAuB;AAAA,MAC1F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,MACrF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;AAAA,MAC9E,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,iBAAiB;AAAA,MAChF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { BusinessRule } from '../../data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport {\n  createBusinessRuleSchema,\n  updateBusinessRuleSchema,\n  createLocalizedBusinessRuleSchema,\n  createLocalizedUpdateBusinessRuleSchema,\n  businessRuleFilterSchema,\n  ruleTypeSchema,\n} from '../../data/validators'\nimport {\n  invalidateBusinessRuleDiscoveryCache,\n  resolveBusinessRuleDiscoveryCache,\n} from '../../lib/rule-engine'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('business_rules').child({ component: 'rules-api' })\n\nconst querySchema = z.looseObject({\n  id: z.uuid().optional(),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  ruleId: z.string().optional(),\n  ruleType: ruleTypeSchema.optional(),\n  entityType: z.string().optional(),\n  eventType: z.string().optional(),\n  enabled: z.coerce.boolean().optional(),\n  ruleCategory: z.string().optional(),\n  sortField: z.string().optional(),\n  sortDir: z.enum(['asc', 'desc']).optional().default('desc'),\n})\n\nconst ruleListItemSchema = z.object({\n  id: z.string().uuid(),\n  ruleId: z.string(),\n  ruleName: z.string(),\n  description: z.string().nullable(),\n  ruleType: ruleTypeSchema,\n  ruleCategory: z.string().nullable(),\n  entityType: z.string(),\n  eventType: z.string().nullable(),\n  enabled: z.boolean(),\n  priority: z.number(),\n  version: z.number(),\n  effectiveFrom: z.string().nullable(),\n  effectiveTo: z.string().nullable(),\n  tenantId: z.string().uuid(),\n  organizationId: z.string().uuid(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst ruleListResponseSchema = z.object({\n  items: z.array(ruleListItemSchema),\n  total: z.number().int().nonnegative(),\n  totalPages: z.number().int().positive(),\n})\n\nconst ruleCreateResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst okResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst errorResponseSchema = z.object({\n  error: z.string(),\n})\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['business_rules.view'] },\n  POST: { requireAuth: true, requireFeatures: ['business_rules.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['business_rules.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['business_rules.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = querySchema.safeParse({\n    id: url.searchParams.get('id') || undefined,\n    page: url.searchParams.get('page') || undefined,\n    pageSize: url.searchParams.get('pageSize') || undefined,\n    search: url.searchParams.get('search') || undefined,\n    ruleId: url.searchParams.get('ruleId') || undefined,\n    ruleType: url.searchParams.get('ruleType') || undefined,\n    entityType: url.searchParams.get('entityType') || undefined,\n    eventType: url.searchParams.get('eventType') || undefined,\n    enabled: url.searchParams.get('enabled') || undefined,\n    ruleCategory: url.searchParams.get('ruleCategory') || undefined,\n    sortField: url.searchParams.get('sortField') || undefined,\n    sortDir: url.searchParams.get('sortDir') || undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n\n  const { id, page, pageSize, search, ruleId, ruleType, entityType, eventType, enabled, ruleCategory, sortField, sortDir } = parsed.data\n\n  const filters: Record<string, any> = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  }\n\n  if (id) filters.id = id\n  if (ruleId) filters.ruleId = { $ilike: `%${escapeLikePattern(ruleId)}%` }\n  if (search) filters.ruleName = { $ilike: `%${escapeLikePattern(search)}%` }\n  if (ruleType) filters.ruleType = ruleType\n  if (entityType) filters.entityType = entityType\n  if (eventType) filters.eventType = eventType\n  if (enabled !== undefined) filters.enabled = enabled\n  if (ruleCategory) filters.ruleCategory = ruleCategory\n\n  const sortFieldMap: Record<string, string> = {\n    ruleId: 'ruleId',\n    ruleName: 'ruleName',\n    ruleType: 'ruleType',\n    entityType: 'entityType',\n    priority: 'priority',\n    createdAt: 'createdAt',\n    updatedAt: 'updatedAt',\n  }\n\n  const orderByField = sortField && sortFieldMap[sortField] ? sortFieldMap[sortField] : 'priority'\n  const orderBy = { [orderByField]: sortDir, ruleId: 'asc' as const }\n\n  const [rows, count] = await em.findAndCount(\n    BusinessRule,\n    filters,\n    {\n      limit: pageSize,\n      offset: (page - 1) * pageSize,\n      orderBy,\n    }\n  )\n\n  const items = rows.map((rule) => ({\n    id: rule.id,\n    ruleId: rule.ruleId,\n    ruleName: rule.ruleName,\n    description: rule.description ?? null,\n    ruleType: rule.ruleType,\n    ruleCategory: rule.ruleCategory ?? null,\n    entityType: rule.entityType,\n    eventType: rule.eventType ?? null,\n    enabled: rule.enabled,\n    priority: rule.priority,\n    version: rule.version,\n    effectiveFrom: rule.effectiveFrom ? rule.effectiveFrom.toISOString() : null,\n    effectiveTo: rule.effectiveTo ? rule.effectiveTo.toISOString() : null,\n    tenantId: rule.tenantId,\n    organizationId: rule.organizationId,\n    createdAt: rule.createdAt.toISOString(),\n    updatedAt: rule.updatedAt.toISOString(),\n  }))\n\n  const totalPages = Math.max(1, Math.ceil(count / pageSize))\n\n  return NextResponse.json({ items, total: count, totalPages })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const cache = resolveBusinessRuleDiscoveryCache(container.resolve.bind(container))\n\n  let body: any\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  const payload = {\n    ...body,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    createdBy: auth.sub ?? auth.email ?? null,\n  }\n\n  const { t } = await resolveTranslations()\n  const schema = createLocalizedBusinessRuleSchema(t)\n  const parsed = schema.safeParse(payload)\n  if (!parsed.success) {\n    const errors = parsed.error.issues.map(e => `${e.path.join('.')}: ${e.message}`)\n    return NextResponse.json({ error: `Validation failed: ${errors.join(', ')}` }, { status: 400 })\n  }\n\n  const data = {\n    ...parsed.data,\n    conditionExpression: parsed.data.conditionExpression ?? null,\n  }\n\n  const rule = em.create(BusinessRule, data)\n\n  try {\n    await em.persist(rule).flush()\n    await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)\n  } catch (error) {\n    logger.error('Failed to persist new rule', { err: error })\n    return NextResponse.json(\n      { error: t('business_rules.errors.createFailed') },\n      { status: 500 },\n    )\n  }\n\n  return NextResponse.json({ id: rule.id }, { status: 201 })\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const cache = resolveBusinessRuleDiscoveryCache(container.resolve.bind(container))\n\n  let body: any\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  if (!body.id) {\n    return NextResponse.json({ error: 'Rule id is required' }, { status: 400 })\n  }\n\n  const payload = {\n    ...body,\n    updatedBy: auth.sub ?? auth.email ?? null,\n  }\n  delete (payload as Record<string, unknown>).tenantId\n  delete (payload as Record<string, unknown>).organizationId\n  delete (payload as Record<string, unknown>).createdBy\n\n  const { t } = await resolveTranslations()\n  const schema = createLocalizedUpdateBusinessRuleSchema(t)\n  const parsed = schema.safeParse(payload)\n  if (!parsed.success) {\n    const errors = parsed.error.issues.map(e => `${e.path.join('.')}: ${e.message}`)\n    return NextResponse.json({ error: `Validation failed: ${errors.join(', ')}` }, { status: 400 })\n  }\n\n  const rule = await em.findOne(BusinessRule, {\n    id: parsed.data.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n\n  if (!rule) {\n    return NextResponse.json({ error: 'Rule not found' }, { status: 404 })\n  }\n\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'business_rules.rule',\n      resourceId: rule.id,\n      current: rule.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  em.assign(rule, parsed.data)\n\n  try {\n    await em.persist(rule).flush()\n    await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)\n  } catch (error) {\n    logger.error('Failed to persist rule update', { err: error })\n    return NextResponse.json(\n      { error: t('business_rules.errors.updateFailed') },\n      { status: 500 },\n    )\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id')\n\n  if (!id) {\n    return NextResponse.json({ error: 'Rule id is required' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const cache = resolveBusinessRuleDiscoveryCache(container.resolve.bind(container))\n\n  const rule = await em.findOne(BusinessRule, {\n    id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n\n  if (!rule) {\n    return NextResponse.json({ error: 'Rule not found' }, { status: 404 })\n  }\n\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'business_rules.rule',\n      resourceId: rule.id,\n      current: rule.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  rule.deletedAt = new Date()\n  await em.persist(rule).flush()\n  await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)\n\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Business Rules',\n  summary: 'Business rule management',\n  methods: {\n    GET: {\n      summary: 'List business rules',\n      description: 'Returns business rules for the current tenant and organization with filtering and pagination.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'Business rules collection', schema: ruleListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create business rule',\n      description: 'Creates a new business rule for the current tenant and organization.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createBusinessRuleSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Business rule created',\n          schema: ruleCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update business rule',\n      description: 'Updates an existing business rule.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateBusinessRuleSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Business rule updated',\n          schema: okResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 404, description: 'Business rule not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete business rule',\n      description: 'Soft deletes a business rule by identifier.',\n      query: z.object({ id: z.string().uuid().describe('Business rule identifier') }),\n      responses: [\n        { status: 200, description: 'Business rule deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid identifier', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 404, description: 'Business rule not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,8CAA8C;AACvD,SAAS,oBAAoB;AAE7B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC;AAE9E,MAAM,cAAc,EAAE,YAAY;AAAA,EAChC,IAAI,EAAE,KAAK,EAAE,SAAS;AAAA,EACtB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,UAAU,eAAe,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,MAAM;AAC5D,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO;AAAA,EACrB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,OAAO;AAAA,EAClB,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEO,MAAM,WAAW;AAExB,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,YAAY,UAAU;AAAA,IACnC,IAAI,IAAI,aAAa,IAAI,IAAI,KAAK;AAAA,IAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,IACtD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,EAC9C,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,EAAE,IAAI,MAAM,UAAU,QAAQ,QAAQ,UAAU,YAAY,WAAW,SAAS,cAAc,WAAW,QAAQ,IAAI,OAAO;AAElI,QAAM,UAA+B;AAAA,IACnC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb;AAEA,MAAI,GAAI,SAAQ,KAAK;AACrB,MAAI,OAAQ,SAAQ,SAAS,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI;AACxE,MAAI,OAAQ,SAAQ,WAAW,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI;AAC1E,MAAI,SAAU,SAAQ,WAAW;AACjC,MAAI,WAAY,SAAQ,aAAa;AACrC,MAAI,UAAW,SAAQ,YAAY;AACnC,MAAI,YAAY,OAAW,SAAQ,UAAU;AAC7C,MAAI,aAAc,SAAQ,eAAe;AAEzC,QAAM,eAAuC;AAAA,IAC3C,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AAEA,QAAM,eAAe,aAAa,aAAa,SAAS,IAAI,aAAa,SAAS,IAAI;AACtF,QAAM,UAAU,EAAE,CAAC,YAAY,GAAG,SAAS,QAAQ,MAAe;AAElE,QAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,SAAS,OAAO,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,KAAK,IAAI,CAAC,UAAU;AAAA,IAChC,IAAI,KAAK;AAAA,IACT,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,aAAa,KAAK,eAAe;AAAA,IACjC,UAAU,KAAK;AAAA,IACf,cAAc,KAAK,gBAAgB;AAAA,IACnC,YAAY,KAAK;AAAA,IACjB,WAAW,KAAK,aAAa;AAAA,IAC7B,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,eAAe,KAAK,gBAAgB,KAAK,cAAc,YAAY,IAAI;AAAA,IACvE,aAAa,KAAK,cAAc,KAAK,YAAY,YAAY,IAAI;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK,UAAU,YAAY;AAAA,IACtC,WAAW,KAAK,UAAU,YAAY;AAAA,EACxC,EAAE;AAEF,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAE1D,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,WAAW,CAAC;AAC9D;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,kCAAkC,UAAU,QAAQ,KAAK,SAAS,CAAC;AAEjF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK,OAAO,KAAK,SAAS;AAAA,EACvC;AAEA,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,SAAS,kCAAkC,CAAC;AAClD,QAAM,SAAS,OAAO,UAAU,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,OAAK,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,OAAO,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,OAAO;AAAA,IACX,GAAG,OAAO;AAAA,IACV,qBAAqB,OAAO,KAAK,uBAAuB;AAAA,EAC1D;AAEA,QAAM,OAAO,GAAG,OAAO,cAAc,IAAI;AAEzC,MAAI;AACF,UAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,UAAM,qCAAqC,OAAO,KAAK,UAAU,KAAK,cAAc;AAAA,EACtF,SAAS,OAAO;AACd,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,EAAE,oCAAoC,EAAE;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3D;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,kCAAkC,UAAU,QAAQ,KAAK,SAAS,CAAC;AAEjF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,WAAW,KAAK,OAAO,KAAK,SAAS;AAAA,EACvC;AACA,SAAQ,QAAoC;AAC5C,SAAQ,QAAoC;AAC5C,SAAQ,QAAoC;AAE5C,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,SAAS,wCAAwC,CAAC;AACxD,QAAM,SAAS,OAAO,UAAU,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,OAAK,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,OAAO,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,KAAG,OAAO,MAAM,OAAO,IAAI;AAE3B,MAAI;AACF,UAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,UAAM,qCAAqC,OAAO,KAAK,UAAU,KAAK,cAAc;AAAA,EACtF,SAAS,OAAO;AACd,WAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAC5D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,EAAE,oCAAoC,EAAE;AAAA,MACjD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI;AAEpC,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,kCAAkC,UAAU,QAAQ,KAAK,SAAS,CAAC;AAEjF,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,OAAK,YAAY,oBAAI,KAAK;AAC1B,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,QAAM,qCAAqC,OAAO,KAAK,UAAU,KAAK,cAAc;AAEpF,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,uBAAuB;AAAA,MAC1F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,MACrF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;AAAA,MAC9E,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,iBAAiB;AAAA,MAChF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/business_rules/lib/expression-evaluator.js

@@ -1,5 +1,7 @@
 import { testLinearRegex } from "@open-mercato/shared/lib/regex/linear";
 import { getNestedValue, resolveSpecialValue } from "./value-resolver.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("business_rules").child({ component: "expression-evaluator" });
 function evaluateExpression(expression, data, context) {
   if (isGroupCondition(expression)) {
     return evaluateGroupCondition(expression, data, context);
@@ -18,13 +20,13 @@ function evaluateSimpleCondition(condition, data, context) {
     rightValue = resolveStaticOrSpecialValue(condition.value, context);
   }
   const result = applyOperator(leftValue, condition.operator, rightValue);
-  console.log("[RULE EVAL] Simple condition:", {
+  logger.debug("Simple condition evaluated", {
     field: condition.field,
     operator: condition.operator,
     expectedValue: rightValue,
     actualValue: leftValue,
     actualValueType: typeof leftValue,
-    result: result ? "\u2713 PASS" : "\u2717 FAIL"
+    passed: result
   });
   return result;
 }
@@ -33,7 +35,7 @@ function evaluateGroupCondition(condition, data, context) {
   if (!rules || rules.length === 0) {
     return true;
   }
-  console.log(`[RULE EVAL] Group condition: ${operator} with ${rules.length} rules`);
+  logger.debug("Group condition evaluating", { operator, ruleCount: rules.length });
   let result;
   switch (operator) {
     case "AND":
@@ -52,7 +54,7 @@ function evaluateGroupCondition(condition, data, context) {
     default:
       throw new Error(`Unknown logical operator: ${operator}`);
   }
-  console.log(`[RULE EVAL] Group ${operator} result: ${result ? "\u2713 PASS" : "\u2717 FAIL"}`);
+  logger.debug("Group condition evaluated", { operator, passed: result });
   return result;
 }
 function resolveFieldPath(path, data) {
@@ -179,7 +181,7 @@ function matches(str, pattern) {
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     if (process.env.NODE_ENV !== "test") {
-      console.error("Regex matching failed:", message);
+      logger.error("Regex matching failed", { message });
     }
     return false;
   }

package/dist/modules/business_rules/lib/expression-evaluator.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/business_rules/lib/expression-evaluator.ts"],
-  "sourcesContent": ["import type { ComparisonOperator, LogicalOperator } from '../data/validators'\nimport { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'\nimport { getNestedValue, resolveSpecialValue } from './value-resolver'\n\n/**\n * Type definitions for condition expressions\n */\nexport type ConditionExpression = SimpleCondition | GroupCondition\n\nexport interface SimpleCondition {\n  field: string\n  operator: ComparisonOperator\n  value: any\n  valueField?: string // For field-to-field comparison\n}\n\nexport interface GroupCondition {\n  operator: LogicalOperator // 'AND' | 'OR' | 'NOT'\n  rules: ConditionExpression[]\n}\n\nexport interface EvaluationContext {\n  user?: {\n    id?: string\n    email?: string\n    role?: string\n    [key: string]: any\n  }\n  tenant?: {\n    id?: string\n    [key: string]: any\n  }\n  organization?: {\n    id?: string\n    [key: string]: any\n  }\n  now?: Date\n  today?: Date\n  [key: string]: any\n}\n\n/**\n * Evaluate a condition expression (simple or grouped)\n */\nexport function evaluateExpression(\n  expression: ConditionExpression,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  if (isGroupCondition(expression)) {\n    return evaluateGroupCondition(expression, data, context)\n  }\n\n  return evaluateSimpleCondition(expression, data, context)\n}\n\n/**\n * Check if expression is a group condition\n */\nfunction isGroupCondition(expression: ConditionExpression): expression is GroupCondition {\n  return 'rules' in expression && Array.isArray(expression.rules)\n}\n\n/**\n * Evaluate a simple condition\n */\nfunction evaluateSimpleCondition(\n  condition: SimpleCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  // Left side: always resolve from data (field path)\n  const leftValue = resolveFieldPath(condition.field, data)\n\n  let rightValue: any\n  if (condition.valueField) {\n    // Field-to-field comparison: resolve from data\n    rightValue = resolveFieldPath(condition.valueField, data)\n  } else {\n    // Static value or special value\n    rightValue = resolveStaticOrSpecialValue(condition.value, context)\n  }\n\n  const result = applyOperator(leftValue, condition.operator, rightValue)\n\n  // Detailed logging for debugging\n  console.log('[RULE EVAL] Simple condition:', {\n    field: condition.field,\n    operator: condition.operator,\n    expectedValue: rightValue,\n    actualValue: leftValue,\n    actualValueType: typeof leftValue,\n    result: result ? '\u2713 PASS' : '\u2717 FAIL',\n  })\n\n  return result\n}\n\n/**\n * Evaluate a group condition (AND, OR, NOT)\n */\nfunction evaluateGroupCondition(\n  condition: GroupCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  const { operator, rules } = condition\n\n  if (!rules || rules.length === 0) {\n    return true\n  }\n\n  console.log(`[RULE EVAL] Group condition: ${operator} with ${rules.length} rules`)\n\n  let result: boolean\n\n  switch (operator) {\n    case 'AND':\n      result = rules.every((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'OR':\n      result = rules.some((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'NOT':\n      // NOT operator - negate the first rule (or all rules combined with AND)\n      if (rules.length === 1) {\n        result = !evaluateExpression(rules[0], data, context)\n      } else {\n        // Multiple rules - combine with AND then negate\n        result = !rules.every((rule) => evaluateExpression(rule, data, context))\n      }\n      break\n\n    default:\n      throw new Error(`Unknown logical operator: ${operator}`)\n  }\n\n  console.log(`[RULE EVAL] Group ${operator} result: ${result ? '\u2713 PASS' : '\u2717 FAIL'}`)\n\n  return result\n}\n\n/**\n * Resolve a field path from data\n */\nfunction resolveFieldPath(path: string, data: any): any {\n  return getNestedValue(data, path)\n}\n\n/**\n * Resolve a static value or special template value\n */\nfunction resolveStaticOrSpecialValue(value: any, context: EvaluationContext): any {\n  // If not a string, return as-is (already a value)\n  if (typeof value !== 'string') {\n    return value\n  }\n\n  // Check for special values (template variables)\n  if (value.startsWith('{{') && value.endsWith('}}')) {\n    return resolveSpecialValue(value, context)\n  }\n\n  // Return static string value as-is\n  return value\n}\n\n/**\n * Apply a comparison operator\n */\nfunction applyOperator(left: any, operator: ComparisonOperator, right: any): boolean {\n  switch (operator) {\n    case '=':\n    case '==':\n      return equals(left, right)\n\n    case '!=':\n      return !equals(left, right)\n\n    case '>':\n      return compare(left, right) > 0\n\n    case '>=':\n      return compare(left, right) >= 0\n\n    case '<':\n      return compare(left, right) < 0\n\n    case '<=':\n      return compare(left, right) <= 0\n\n    case 'IN':\n      return isIn(left, right)\n\n    case 'NOT_IN':\n      return !isIn(left, right)\n\n    case 'CONTAINS':\n      return contains(left, right)\n\n    case 'NOT_CONTAINS':\n      return !contains(left, right)\n\n    case 'STARTS_WITH':\n      return startsWith(left, right)\n\n    case 'ENDS_WITH':\n      return endsWith(left, right)\n\n    case 'MATCHES':\n      return matches(left, right)\n\n    case 'IS_EMPTY':\n      return isEmpty(left)\n\n    case 'IS_NOT_EMPTY':\n      return !isEmpty(left)\n\n    default:\n      throw new Error(`Unknown operator: ${operator}`)\n  }\n}\n\n/**\n * Equality comparison (handles different types)\n */\nfunction equals(left: any, right: any): boolean {\n  // Handle null/undefined\n  if (left == null && right == null) return true\n  if (left == null || right == null) return false\n\n  // Type coercion for numbers\n  if (typeof left === 'number' || typeof right === 'number') {\n    return Number(left) === Number(right)\n  }\n\n  // String comparison (case-sensitive)\n  return left === right\n}\n\n/**\n * Comparison for ordering (>, <, >=, <=)\n */\nfunction compare(left: any, right: any): number {\n  // Handle null/undefined\n  if (left == null && right == null) return 0\n  if (left == null) return -1\n  if (right == null) return 1\n\n  // Date comparison\n  if (left instanceof Date && right instanceof Date) {\n    return left.getTime() - right.getTime()\n  }\n\n  // String date comparison\n  if (isDateString(left) && isDateString(right)) {\n    return new Date(left).getTime() - new Date(right).getTime()\n  }\n\n  // Numeric comparison\n  const leftNum = Number(left)\n  const rightNum = Number(right)\n  if (!isNaN(leftNum) && !isNaN(rightNum)) {\n    return leftNum - rightNum\n  }\n\n  // String comparison\n  const leftStr = String(left)\n  const rightStr = String(right)\n  return leftStr.localeCompare(rightStr)\n}\n\n/**\n * Check if value is in array\n */\nfunction isIn(value: any, array: any): boolean {\n  if (!Array.isArray(array)) {\n    return false\n  }\n\n  return array.some((item) => equals(value, item))\n}\n\n/**\n * Check if array/string contains value\n */\nfunction contains(container: any, value: any): boolean {\n  if (container == null) return false\n\n  // Array contains\n  if (Array.isArray(container)) {\n    return container.some((item) => equals(item, value))\n  }\n\n  // String contains\n  if (typeof container === 'string') {\n    return container.includes(String(value))\n  }\n\n  return false\n}\n\n/**\n * Check if string starts with value\n */\nfunction startsWith(str: any, prefix: any): boolean {\n  if (str == null || prefix == null) return false\n\n  return String(str).startsWith(String(prefix))\n}\n\n/**\n * Check if string ends with value\n */\nfunction endsWith(str: any, suffix: any): boolean {\n  if (str == null || suffix == null) return false\n\n  return String(str).endsWith(String(suffix))\n}\n\nconst MAX_REGEX_LENGTH = 200\nconst MAX_REGEX_INPUT_LENGTH = 10_000\n\n/**\n * Check if string matches regex pattern (with ReDoS protection)\n */\nfunction matches(str: any, pattern: any): boolean {\n  if (str == null || pattern == null) return false\n\n  try {\n    const patternStr = String(pattern)\n\n    // Prevent overly long patterns\n    if (patternStr.length > MAX_REGEX_LENGTH) {\n      return false\n    }\n\n    // Check for dangerous patterns that can cause exponential backtracking\n    // Patterns like (a+)+, (a*)*, (a+)*, etc.\n    if (/(\\(.*[+*]\\).*[+*])/.test(patternStr)) {\n      return false\n    }\n\n    const testStr = String(str)\n    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {\n      return false\n    }\n\n    const result = testLinearRegex(patternStr, testStr, {\n      maxPatternLength: MAX_REGEX_LENGTH,\n      maxInputLength: MAX_REGEX_INPUT_LENGTH,\n    })\n    return result.ok ? result.matched : false\n  } catch (error) {\n    // Log the error for debugging but don't expose to user\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    if (process.env.NODE_ENV !== 'test') {\n      console.error('Regex matching failed:', message)\n    }\n    return false\n  }\n}\n\n/**\n * Check if value is empty (null, undefined, empty string, empty array, empty object)\n */\nfunction isEmpty(value: any): boolean {\n  if (value == null) return true\n\n  if (typeof value === 'string') return value.trim() === ''\n\n  if (Array.isArray(value)) return value.length === 0\n\n  if (typeof value === 'object') return Object.keys(value).length === 0\n\n  return false\n}\n\n/**\n * Check if string looks like a date (ISO format or common date formats)\n */\nfunction isDateString(value: any): boolean {\n  if (typeof value !== 'string') return false\n\n  // ISO date format: YYYY-MM-DD or YYYY-MM-DDTHH:mm:ss\n  const isoDateRegex = /^\\d{4}-\\d{2}-\\d{2}(T\\d{2}:\\d{2}:\\d{2})?/\n  if (isoDateRegex.test(value)) {\n    const date = new Date(value)\n    return !isNaN(date.getTime())\n  }\n\n  return false\n}\n"],
-  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,gBAAgB,2BAA2B;AA0C7C,SAAS,mBACd,YACA,MACA,SACS;AACT,MAAI,iBAAiB,UAAU,GAAG;AAChC,WAAO,uBAAuB,YAAY,MAAM,OAAO;AAAA,EACzD;AAEA,SAAO,wBAAwB,YAAY,MAAM,OAAO;AAC1D;AAKA,SAAS,iBAAiB,YAA+D;AACvF,SAAO,WAAW,cAAc,MAAM,QAAQ,WAAW,KAAK;AAChE;AAKA,SAAS,wBACP,WACA,MACA,SACS;AAET,QAAM,YAAY,iBAAiB,UAAU,OAAO,IAAI;AAExD,MAAI;AACJ,MAAI,UAAU,YAAY;AAExB,iBAAa,iBAAiB,UAAU,YAAY,IAAI;AAAA,EAC1D,OAAO;AAEL,iBAAa,4BAA4B,UAAU,OAAO,OAAO;AAAA,EACnE;AAEA,QAAM,SAAS,cAAc,WAAW,UAAU,UAAU,UAAU;AAGtE,UAAQ,IAAI,iCAAiC;AAAA,IAC3C,OAAO,UAAU;AAAA,IACjB,UAAU,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,iBAAiB,OAAO;AAAA,IACxB,QAAQ,SAAS,gBAAW;AAAA,EAC9B,CAAC;AAED,SAAO;AACT;AAKA,SAAS,uBACP,WACA,MACA,SACS;AACT,QAAM,EAAE,UAAU,MAAM,IAAI;AAE5B,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,WAAO;AAAA,EACT;AAEA,UAAQ,IAAI,gCAAgC,QAAQ,SAAS,MAAM,MAAM,QAAQ;AAEjF,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,eAAS,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACtE;AAAA,IAEF,KAAK;AACH,eAAS,MAAM,KAAK,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACrE;AAAA,IAEF,KAAK;AAEH,UAAI,MAAM,WAAW,GAAG;AACtB,iBAAS,CAAC,mBAAmB,MAAM,CAAC,GAAG,MAAM,OAAO;AAAA,MACtD,OAAO;AAEL,iBAAS,CAAC,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AAAA,MACzE;AACA;AAAA,IAEF;AACE,YAAM,IAAI,MAAM,6BAA6B,QAAQ,EAAE;AAAA,EAC3D;AAEA,UAAQ,IAAI,qBAAqB,QAAQ,YAAY,SAAS,gBAAW,aAAQ,EAAE;AAEnF,SAAO;AACT;AAKA,SAAS,iBAAiB,MAAc,MAAgB;AACtD,SAAO,eAAe,MAAM,IAAI;AAClC;AAKA,SAAS,4BAA4B,OAAY,SAAiC;AAEhF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG;AAClD,WAAO,oBAAoB,OAAO,OAAO;AAAA,EAC3C;AAGA,SAAO;AACT;AAKA,SAAS,cAAc,MAAW,UAA8B,OAAqB;AACnF,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,MAAM,KAAK;AAAA,IAE3B,KAAK;AACH,aAAO,CAAC,OAAO,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,KAAK,MAAM,KAAK;AAAA,IAEzB,KAAK;AACH,aAAO,CAAC,KAAK,MAAM,KAAK;AAAA,IAE1B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,CAAC,SAAS,MAAM,KAAK;AAAA,IAE9B,KAAK;AACH,aAAO,WAAW,MAAM,KAAK;AAAA,IAE/B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,IAAI;AAAA,IAErB,KAAK;AACH,aAAO,CAAC,QAAQ,IAAI;AAAA,IAEtB;AACE,YAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAAA,EACnD;AACF;AAKA,SAAS,OAAO,MAAW,OAAqB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAG1C,MAAI,OAAO,SAAS,YAAY,OAAO,UAAU,UAAU;AACzD,WAAO,OAAO,IAAI,MAAM,OAAO,KAAK;AAAA,EACtC;AAGA,SAAO,SAAS;AAClB;AAKA,SAAS,QAAQ,MAAW,OAAoB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,SAAS,KAAM,QAAO;AAG1B,MAAI,gBAAgB,QAAQ,iBAAiB,MAAM;AACjD,WAAO,KAAK,QAAQ,IAAI,MAAM,QAAQ;AAAA,EACxC;AAGA,MAAI,aAAa,IAAI,KAAK,aAAa,KAAK,GAAG;AAC7C,WAAO,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAAA,EAC5D;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG;AACvC,WAAO,UAAU;AAAA,EACnB;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAKA,SAAS,KAAK,OAAY,OAAqB;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,OAAO,IAAI,CAAC;AACjD;AAKA,SAAS,SAAS,WAAgB,OAAqB;AACrD,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,WAAO,UAAU,KAAK,CAAC,SAAS,OAAO,MAAM,KAAK,CAAC;AAAA,EACrD;AAGA,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO,UAAU,SAAS,OAAO,KAAK,CAAC;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,KAAU,QAAsB;AAClD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,WAAW,OAAO,MAAM,CAAC;AAC9C;AAKA,SAAS,SAAS,KAAU,QAAsB;AAChD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,SAAS,OAAO,MAAM,CAAC;AAC5C;AAEA,MAAM,mBAAmB;AACzB,MAAM,yBAAyB;AAK/B,SAAS,QAAQ,KAAU,SAAuB;AAChD,MAAI,OAAO,QAAQ,WAAW,KAAM,QAAO;AAE3C,MAAI;AACF,UAAM,aAAa,OAAO,OAAO;AAGjC,QAAI,WAAW,SAAS,kBAAkB;AACxC,aAAO;AAAA,IACT;AAIA,QAAI,qBAAqB,KAAK,UAAU,GAAG;AACzC,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,OAAO,GAAG;AAC1B,QAAI,QAAQ,SAAS,wBAAwB;AAC3C,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,gBAAgB,YAAY,SAAS;AAAA,MAClD,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,IAClB,CAAC;AACD,WAAO,OAAO,KAAK,OAAO,UAAU;AAAA,EACtC,SAAS,OAAO;AAEd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,QAAQ,IAAI,aAAa,QAAQ;AACnC,cAAQ,MAAM,0BAA0B,OAAO;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AACF;AAKA,SAAS,QAAQ,OAAqB;AACpC,MAAI,SAAS,KAAM,QAAO;AAE1B,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,KAAK,MAAM;AAEvD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,WAAW;AAElD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AAEpE,SAAO;AACT;AAKA,SAAS,aAAa,OAAqB;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AAGtC,QAAM,eAAe;AACrB,MAAI,aAAa,KAAK,KAAK,GAAG;AAC5B,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,WAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;AAAA,EAC9B;AAEA,SAAO;AACT;",
+  "sourcesContent": ["import type { ComparisonOperator, LogicalOperator } from '../data/validators'\nimport { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'\nimport { getNestedValue, resolveSpecialValue } from './value-resolver'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('business_rules').child({ component: 'expression-evaluator' })\n\n/**\n * Type definitions for condition expressions\n */\nexport type ConditionExpression = SimpleCondition | GroupCondition\n\nexport interface SimpleCondition {\n  field: string\n  operator: ComparisonOperator\n  value: any\n  valueField?: string // For field-to-field comparison\n}\n\nexport interface GroupCondition {\n  operator: LogicalOperator // 'AND' | 'OR' | 'NOT'\n  rules: ConditionExpression[]\n}\n\nexport interface EvaluationContext {\n  user?: {\n    id?: string\n    email?: string\n    role?: string\n    [key: string]: any\n  }\n  tenant?: {\n    id?: string\n    [key: string]: any\n  }\n  organization?: {\n    id?: string\n    [key: string]: any\n  }\n  now?: Date\n  today?: Date\n  [key: string]: any\n}\n\n/**\n * Evaluate a condition expression (simple or grouped)\n */\nexport function evaluateExpression(\n  expression: ConditionExpression,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  if (isGroupCondition(expression)) {\n    return evaluateGroupCondition(expression, data, context)\n  }\n\n  return evaluateSimpleCondition(expression, data, context)\n}\n\n/**\n * Check if expression is a group condition\n */\nfunction isGroupCondition(expression: ConditionExpression): expression is GroupCondition {\n  return 'rules' in expression && Array.isArray(expression.rules)\n}\n\n/**\n * Evaluate a simple condition\n */\nfunction evaluateSimpleCondition(\n  condition: SimpleCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  // Left side: always resolve from data (field path)\n  const leftValue = resolveFieldPath(condition.field, data)\n\n  let rightValue: any\n  if (condition.valueField) {\n    // Field-to-field comparison: resolve from data\n    rightValue = resolveFieldPath(condition.valueField, data)\n  } else {\n    // Static value or special value\n    rightValue = resolveStaticOrSpecialValue(condition.value, context)\n  }\n\n  const result = applyOperator(leftValue, condition.operator, rightValue)\n\n  logger.debug('Simple condition evaluated', {\n    field: condition.field,\n    operator: condition.operator,\n    expectedValue: rightValue,\n    actualValue: leftValue,\n    actualValueType: typeof leftValue,\n    passed: result,\n  })\n\n  return result\n}\n\n/**\n * Evaluate a group condition (AND, OR, NOT)\n */\nfunction evaluateGroupCondition(\n  condition: GroupCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  const { operator, rules } = condition\n\n  if (!rules || rules.length === 0) {\n    return true\n  }\n\n  logger.debug('Group condition evaluating', { operator, ruleCount: rules.length })\n\n  let result: boolean\n\n  switch (operator) {\n    case 'AND':\n      result = rules.every((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'OR':\n      result = rules.some((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'NOT':\n      // NOT operator - negate the first rule (or all rules combined with AND)\n      if (rules.length === 1) {\n        result = !evaluateExpression(rules[0], data, context)\n      } else {\n        // Multiple rules - combine with AND then negate\n        result = !rules.every((rule) => evaluateExpression(rule, data, context))\n      }\n      break\n\n    default:\n      throw new Error(`Unknown logical operator: ${operator}`)\n  }\n\n  logger.debug('Group condition evaluated', { operator, passed: result })\n\n  return result\n}\n\n/**\n * Resolve a field path from data\n */\nfunction resolveFieldPath(path: string, data: any): any {\n  return getNestedValue(data, path)\n}\n\n/**\n * Resolve a static value or special template value\n */\nfunction resolveStaticOrSpecialValue(value: any, context: EvaluationContext): any {\n  // If not a string, return as-is (already a value)\n  if (typeof value !== 'string') {\n    return value\n  }\n\n  // Check for special values (template variables)\n  if (value.startsWith('{{') && value.endsWith('}}')) {\n    return resolveSpecialValue(value, context)\n  }\n\n  // Return static string value as-is\n  return value\n}\n\n/**\n * Apply a comparison operator\n */\nfunction applyOperator(left: any, operator: ComparisonOperator, right: any): boolean {\n  switch (operator) {\n    case '=':\n    case '==':\n      return equals(left, right)\n\n    case '!=':\n      return !equals(left, right)\n\n    case '>':\n      return compare(left, right) > 0\n\n    case '>=':\n      return compare(left, right) >= 0\n\n    case '<':\n      return compare(left, right) < 0\n\n    case '<=':\n      return compare(left, right) <= 0\n\n    case 'IN':\n      return isIn(left, right)\n\n    case 'NOT_IN':\n      return !isIn(left, right)\n\n    case 'CONTAINS':\n      return contains(left, right)\n\n    case 'NOT_CONTAINS':\n      return !contains(left, right)\n\n    case 'STARTS_WITH':\n      return startsWith(left, right)\n\n    case 'ENDS_WITH':\n      return endsWith(left, right)\n\n    case 'MATCHES':\n      return matches(left, right)\n\n    case 'IS_EMPTY':\n      return isEmpty(left)\n\n    case 'IS_NOT_EMPTY':\n      return !isEmpty(left)\n\n    default:\n      throw new Error(`Unknown operator: ${operator}`)\n  }\n}\n\n/**\n * Equality comparison (handles different types)\n */\nfunction equals(left: any, right: any): boolean {\n  // Handle null/undefined\n  if (left == null && right == null) return true\n  if (left == null || right == null) return false\n\n  // Type coercion for numbers\n  if (typeof left === 'number' || typeof right === 'number') {\n    return Number(left) === Number(right)\n  }\n\n  // String comparison (case-sensitive)\n  return left === right\n}\n\n/**\n * Comparison for ordering (>, <, >=, <=)\n */\nfunction compare(left: any, right: any): number {\n  // Handle null/undefined\n  if (left == null && right == null) return 0\n  if (left == null) return -1\n  if (right == null) return 1\n\n  // Date comparison\n  if (left instanceof Date && right instanceof Date) {\n    return left.getTime() - right.getTime()\n  }\n\n  // String date comparison\n  if (isDateString(left) && isDateString(right)) {\n    return new Date(left).getTime() - new Date(right).getTime()\n  }\n\n  // Numeric comparison\n  const leftNum = Number(left)\n  const rightNum = Number(right)\n  if (!isNaN(leftNum) && !isNaN(rightNum)) {\n    return leftNum - rightNum\n  }\n\n  // String comparison\n  const leftStr = String(left)\n  const rightStr = String(right)\n  return leftStr.localeCompare(rightStr)\n}\n\n/**\n * Check if value is in array\n */\nfunction isIn(value: any, array: any): boolean {\n  if (!Array.isArray(array)) {\n    return false\n  }\n\n  return array.some((item) => equals(value, item))\n}\n\n/**\n * Check if array/string contains value\n */\nfunction contains(container: any, value: any): boolean {\n  if (container == null) return false\n\n  // Array contains\n  if (Array.isArray(container)) {\n    return container.some((item) => equals(item, value))\n  }\n\n  // String contains\n  if (typeof container === 'string') {\n    return container.includes(String(value))\n  }\n\n  return false\n}\n\n/**\n * Check if string starts with value\n */\nfunction startsWith(str: any, prefix: any): boolean {\n  if (str == null || prefix == null) return false\n\n  return String(str).startsWith(String(prefix))\n}\n\n/**\n * Check if string ends with value\n */\nfunction endsWith(str: any, suffix: any): boolean {\n  if (str == null || suffix == null) return false\n\n  return String(str).endsWith(String(suffix))\n}\n\nconst MAX_REGEX_LENGTH = 200\nconst MAX_REGEX_INPUT_LENGTH = 10_000\n\n/**\n * Check if string matches regex pattern (with ReDoS protection)\n */\nfunction matches(str: any, pattern: any): boolean {\n  if (str == null || pattern == null) return false\n\n  try {\n    const patternStr = String(pattern)\n\n    // Prevent overly long patterns\n    if (patternStr.length > MAX_REGEX_LENGTH) {\n      return false\n    }\n\n    // Check for dangerous patterns that can cause exponential backtracking\n    // Patterns like (a+)+, (a*)*, (a+)*, etc.\n    if (/(\\(.*[+*]\\).*[+*])/.test(patternStr)) {\n      return false\n    }\n\n    const testStr = String(str)\n    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {\n      return false\n    }\n\n    const result = testLinearRegex(patternStr, testStr, {\n      maxPatternLength: MAX_REGEX_LENGTH,\n      maxInputLength: MAX_REGEX_INPUT_LENGTH,\n    })\n    return result.ok ? result.matched : false\n  } catch (error) {\n    // Log the error for debugging but don't expose to user\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    if (process.env.NODE_ENV !== 'test') {\n      logger.error('Regex matching failed', { message })\n    }\n    return false\n  }\n}\n\n/**\n * Check if value is empty (null, undefined, empty string, empty array, empty object)\n */\nfunction isEmpty(value: any): boolean {\n  if (value == null) return true\n\n  if (typeof value === 'string') return value.trim() === ''\n\n  if (Array.isArray(value)) return value.length === 0\n\n  if (typeof value === 'object') return Object.keys(value).length === 0\n\n  return false\n}\n\n/**\n * Check if string looks like a date (ISO format or common date formats)\n */\nfunction isDateString(value: any): boolean {\n  if (typeof value !== 'string') return false\n\n  // ISO date format: YYYY-MM-DD or YYYY-MM-DDTHH:mm:ss\n  const isoDateRegex = /^\\d{4}-\\d{2}-\\d{2}(T\\d{2}:\\d{2}:\\d{2})?/\n  if (isoDateRegex.test(value)) {\n    const date = new Date(value)\n    return !isNaN(date.getTime())\n  }\n\n  return false\n}\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,gBAAgB,2BAA2B;AACpD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AA0ClF,SAAS,mBACd,YACA,MACA,SACS;AACT,MAAI,iBAAiB,UAAU,GAAG;AAChC,WAAO,uBAAuB,YAAY,MAAM,OAAO;AAAA,EACzD;AAEA,SAAO,wBAAwB,YAAY,MAAM,OAAO;AAC1D;AAKA,SAAS,iBAAiB,YAA+D;AACvF,SAAO,WAAW,cAAc,MAAM,QAAQ,WAAW,KAAK;AAChE;AAKA,SAAS,wBACP,WACA,MACA,SACS;AAET,QAAM,YAAY,iBAAiB,UAAU,OAAO,IAAI;AAExD,MAAI;AACJ,MAAI,UAAU,YAAY;AAExB,iBAAa,iBAAiB,UAAU,YAAY,IAAI;AAAA,EAC1D,OAAO;AAEL,iBAAa,4BAA4B,UAAU,OAAO,OAAO;AAAA,EACnE;AAEA,QAAM,SAAS,cAAc,WAAW,UAAU,UAAU,UAAU;AAEtE,SAAO,MAAM,8BAA8B;AAAA,IACzC,OAAO,UAAU;AAAA,IACjB,UAAU,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,iBAAiB,OAAO;AAAA,IACxB,QAAQ;AAAA,EACV,CAAC;AAED,SAAO;AACT;AAKA,SAAS,uBACP,WACA,MACA,SACS;AACT,QAAM,EAAE,UAAU,MAAM,IAAI;AAE5B,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,8BAA8B,EAAE,UAAU,WAAW,MAAM,OAAO,CAAC;AAEhF,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,eAAS,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACtE;AAAA,IAEF,KAAK;AACH,eAAS,MAAM,KAAK,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACrE;AAAA,IAEF,KAAK;AAEH,UAAI,MAAM,WAAW,GAAG;AACtB,iBAAS,CAAC,mBAAmB,MAAM,CAAC,GAAG,MAAM,OAAO;AAAA,MACtD,OAAO;AAEL,iBAAS,CAAC,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AAAA,MACzE;AACA;AAAA,IAEF;AACE,YAAM,IAAI,MAAM,6BAA6B,QAAQ,EAAE;AAAA,EAC3D;AAEA,SAAO,MAAM,6BAA6B,EAAE,UAAU,QAAQ,OAAO,CAAC;AAEtE,SAAO;AACT;AAKA,SAAS,iBAAiB,MAAc,MAAgB;AACtD,SAAO,eAAe,MAAM,IAAI;AAClC;AAKA,SAAS,4BAA4B,OAAY,SAAiC;AAEhF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG;AAClD,WAAO,oBAAoB,OAAO,OAAO;AAAA,EAC3C;AAGA,SAAO;AACT;AAKA,SAAS,cAAc,MAAW,UAA8B,OAAqB;AACnF,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,MAAM,KAAK;AAAA,IAE3B,KAAK;AACH,aAAO,CAAC,OAAO,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,KAAK,MAAM,KAAK;AAAA,IAEzB,KAAK;AACH,aAAO,CAAC,KAAK,MAAM,KAAK;AAAA,IAE1B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,CAAC,SAAS,MAAM,KAAK;AAAA,IAE9B,KAAK;AACH,aAAO,WAAW,MAAM,KAAK;AAAA,IAE/B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,IAAI;AAAA,IAErB,KAAK;AACH,aAAO,CAAC,QAAQ,IAAI;AAAA,IAEtB;AACE,YAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAAA,EACnD;AACF;AAKA,SAAS,OAAO,MAAW,OAAqB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAG1C,MAAI,OAAO,SAAS,YAAY,OAAO,UAAU,UAAU;AACzD,WAAO,OAAO,IAAI,MAAM,OAAO,KAAK;AAAA,EACtC;AAGA,SAAO,SAAS;AAClB;AAKA,SAAS,QAAQ,MAAW,OAAoB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,SAAS,KAAM,QAAO;AAG1B,MAAI,gBAAgB,QAAQ,iBAAiB,MAAM;AACjD,WAAO,KAAK,QAAQ,IAAI,MAAM,QAAQ;AAAA,EACxC;AAGA,MAAI,aAAa,IAAI,KAAK,aAAa,KAAK,GAAG;AAC7C,WAAO,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAAA,EAC5D;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG;AACvC,WAAO,UAAU;AAAA,EACnB;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAKA,SAAS,KAAK,OAAY,OAAqB;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,OAAO,IAAI,CAAC;AACjD;AAKA,SAAS,SAAS,WAAgB,OAAqB;AACrD,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,WAAO,UAAU,KAAK,CAAC,SAAS,OAAO,MAAM,KAAK,CAAC;AAAA,EACrD;AAGA,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO,UAAU,SAAS,OAAO,KAAK,CAAC;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,KAAU,QAAsB;AAClD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,WAAW,OAAO,MAAM,CAAC;AAC9C;AAKA,SAAS,SAAS,KAAU,QAAsB;AAChD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,SAAS,OAAO,MAAM,CAAC;AAC5C;AAEA,MAAM,mBAAmB;AACzB,MAAM,yBAAyB;AAK/B,SAAS,QAAQ,KAAU,SAAuB;AAChD,MAAI,OAAO,QAAQ,WAAW,KAAM,QAAO;AAE3C,MAAI;AACF,UAAM,aAAa,OAAO,OAAO;AAGjC,QAAI,WAAW,SAAS,kBAAkB;AACxC,aAAO;AAAA,IACT;AAIA,QAAI,qBAAqB,KAAK,UAAU,GAAG;AACzC,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,OAAO,GAAG;AAC1B,QAAI,QAAQ,SAAS,wBAAwB;AAC3C,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,gBAAgB,YAAY,SAAS;AAAA,MAClD,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,IAClB,CAAC;AACD,WAAO,OAAO,KAAK,OAAO,UAAU;AAAA,EACtC,SAAS,OAAO;AAEd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,QAAQ,IAAI,aAAa,QAAQ;AACnC,aAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AACF;AAKA,SAAS,QAAQ,OAAqB;AACpC,MAAI,SAAS,KAAM,QAAO;AAE1B,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,KAAK,MAAM;AAEvD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,WAAW;AAElD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AAEpE,SAAO;AACT;AAKA,SAAS,aAAa,OAAqB;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AAGtC,QAAM,eAAe;AACrB,MAAI,aAAa,KAAK,KAAK,GAAG;AAC5B,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,WAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;AAAA,EAC9B;AAEA,SAAO;AACT;",
   "names": []
 }