@open-mercato/core 0.6.6-develop.6465.1.019f0fb26f → 0.6.6-develop.6471.1.9ab5bdd79a

package/dist/modules/audit_logs/services/actionLogService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/services/actionLogService.ts"],
-  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  TenantDataEncryptionService,\n  parseDecryptedFieldValue,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\nconst UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          return parseDecryptedFieldValue(decrypted)\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      // Audit log jsonb columns are encrypted as JSON-stringified payloads. After the\n      // service-level `decryptEntityPayload` call (which now returns raw strings \u2014\n      // see issue #1810 follow-up), reattach the structured shape via\n      // `parseDecryptedFieldValue` before running the recursive `deepDecrypt` walk\n      // so nested encrypted strings inside payload objects/arrays are handled.\n      const restoreJson = (value: unknown): unknown =>\n        typeof value === 'string' ? parseDecryptedFieldValue(value) : value\n\n      merged.changesJson = deepDecrypt(restoreJson(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json))\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(restoreJson(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before))\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(restoreJson(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after))\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(restoreJson(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload))\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(restoreJson(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json))\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        console.warn('[audit_logs] failed to decrypt action log entry', err)\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persist(log).flush()\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          console.warn('[audit_logs] falling back to permissive action log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      relatedResourceKind: toOptionalString(data.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(data.relatedResourceId) ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        relatedResourceKind: null,\n        relatedResourceId: null,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value\n      return UUID_REGEX.test(candidate) ? candidate : null\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      relatedResourceKind: toOptionalString(input.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(input.relatedResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    let query = (this.buildListQuery(parsed) as any).select('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query = query.limit(limit).offset(offset)\n    }\n\n    const rows = await query.execute()\n    const ids = rows.map((row: any) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry: any) => [entry.id, entry]))\n    return ids\n      .map((id: any) => byId.get(id))\n      .filter((entry: any): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery): any {\n    let query = (this.em.getKysely<any>() as any)\n      .selectFrom('action_logs')\n      .selectAll()\n      .where('action_logs.deleted_at', 'is', null) as any\n\n    if (parsed.tenantId) query = query.where('action_logs.tenant_id', '=', parsed.tenantId)\n    if (parsed.organizationId) query = query.where('action_logs.organization_id', '=', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query = query.where('action_logs.actor_user_id', '=', actorUserIds[0])\n    if (actorUserIds.length > 1) query = query.where('action_logs.actor_user_id', 'in', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query = query.where((eb: any) =>\n        eb.or([\n          eb.and([\n            eb('action_logs.resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.parent_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.parent_resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.related_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.related_resource_id', '=', parsed.resourceId),\n          ]),\n        ])\n      )\n    } else {\n      if (parsed.resourceKind) query = query.where('action_logs.resource_kind', '=', parsed.resourceKind)\n      if (parsed.resourceId) query = query.where('action_logs.resource_id', '=', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query = query.where('action_logs.undo_token', 'is not', null)\n    if (parsed.before) query = query.where('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query = query.where('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length === 1) query = query.where('action_logs.primary_changed_field', '=', fieldNames[0])\n    if (fieldNames.length > 1) query = query.where('action_logs.primary_changed_field', 'in', fieldNames)\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query = query.where('action_logs.action_type', '=', actionTypes[0])\n    if (actionTypes.length > 1) query = query.where('action_logs.action_type', 'in', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query = query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query = query.orderBy(sql`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '')`, sortDir)\n        break\n      case 'action':\n        query = query.orderBy(sql`coalesce(action_logs.action_type, '')`, sortDir)\n        break\n      case 'field':\n        query = query.orderBy(sql`coalesce(action_logs.primary_changed_field, '')`, sortDir)\n        break\n      case 'source':\n        query = query.orderBy(sql`coalesce(action_logs.source_key, '')`, sortDir)\n        break\n      case 'createdAt':\n      default:\n        query = query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query = query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query = query.orderBy('action_logs.created_at', 'desc')\n    query = query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await (this.buildListQuery(parsed) as any)\n      .clearSelect()\n      .clearOrderBy()\n      .select(sql<string>`count(*)`.as('count'))\n      .executeTakeFirst()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async claimForUndo(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'done', deletedAt: null },\n      { executionState: 'undoing' },\n    )\n    return affected === 1\n  }\n\n  async releaseUndoClaim(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'undoing', deletedAt: null },\n      { executionState: 'done' },\n    )\n    return affected === 1\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = (this.em.getKysely<any>() as any)\n        .selectFrom('action_logs')\n        .select([\n          'action_logs.id',\n          'action_logs.tenant_id',\n          'action_logs.organization_id',\n          'action_logs.actor_user_id',\n          'action_logs.command_id',\n          'action_logs.action_label',\n          'action_logs.snapshot_before',\n          'action_logs.changes_json',\n          'action_logs.context_json',\n          'action_logs.action_type',\n          'action_logs.source_key',\n          'action_logs.changed_fields',\n          'action_logs.primary_changed_field',\n          'action_logs.created_at',\n        ])\n        .where('action_logs.deleted_at', 'is', null) as any\n\n      if (options.tenantId) rowsQuery.where('action_logs.tenant_id', '=', options.tenantId)\n      if (options.organizationId) rowsQuery.where('action_logs.organization_id', '=', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.action_type', 'is', null),\n            eb('action_logs.source_key', 'is', null),\n            eb('action_logs.changed_fields', 'is', null),\n          ])\n        )\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.created_at', '>', cursorCreatedAt),\n            eb.and([\n              eb('action_logs.created_at', '=', cursorCreatedAt),\n              eb('action_logs.id', '>', cursorId),\n            ]),\n          ])\n        )\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await (this.em.getKysely<any>() as any)\n            .updateTable('action_logs')\n            .set({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n            .where('id', '=', row.id)\n            .execute()\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,WAAW;AACpB,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC;AAAA,EAEE;AAAA,OACK;AACP,SAAS,wBAAwB;AAEjC,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AACA,MAAM,aAAa;AAkCnB,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,iBAAO,yBAAyBA,UAAS;AAAA,QAC3C;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAOA,YAAM,cAAc,CAAC,UACnB,OAAO,UAAU,WAAW,yBAAyB,KAAK,IAAI;AAEhE,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc,CAAC;AAC5I,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,gBAAQ,KAAK,mDAAmD,GAAG;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,QAAQ,GAAG,EAAE,MAAM;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,qBAAqB,iBAAiB,KAAK,mBAAmB,KAAK;AAAA,MACnE,mBAAmB,iBAAiB,KAAK,iBAAiB,KAAK;AAAA,MAC/D,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAMC,cAAa;AACnB,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,YAAM,YAAY,MAAM,WAAW,UAAU,IAAI,MAAM,MAAM,WAAW,MAAM,IAAI;AAClF,aAAOA,YAAW,KAAK,SAAS,IAAI,YAAY;AAAA,IAClD;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,qBAAqB,iBAAiB,MAAM,mBAAmB,KAAK;AAAA,MACpE,mBAAmB,iBAAiB,MAAM,iBAAiB,KAAK;AAAA,MAChE,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,QAAI,QAAS,KAAK,eAAe,MAAM,EAAU,OAAO,sBAAsB;AAE9E,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,cAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAC1C;AAEA,UAAM,OAAO,MAAM,MAAM,QAAQ;AACjC,UAAM,MAAM,KAAK,IAAI,CAAC,QAAa,IAAI,EAAE,EAAE,OAAO,OAAO;AACzD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAe,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AACnE,WAAO,IACJ,IAAI,CAAC,OAAY,KAAK,IAAI,EAAE,CAAC,EAC7B,OAAO,CAAC,UAAmC,QAAQ,KAAK,CAAC;AAAA,EAC9D;AAAA,EAEQ,eAAe,QAAiC;AACtD,QAAI,QAAS,KAAK,GAAG,UAAe,EACjC,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,0BAA0B,MAAM,IAAI;AAE7C,QAAI,OAAO,SAAU,SAAQ,MAAM,MAAM,yBAAyB,KAAK,OAAO,QAAQ;AACtF,QAAI,OAAO,eAAgB,SAAQ,MAAM,MAAM,+BAA+B,KAAK,OAAO,cAAc;AAExG,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,SAAQ,MAAM,MAAM,6BAA6B,KAAK,aAAa,CAAC,CAAC;AACpG,QAAI,aAAa,SAAS,EAAG,SAAQ,MAAM,MAAM,6BAA6B,MAAM,YAAY;AAEhG,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,cAAQ,MAAM;AAAA,QAAM,CAAC,OACnB,GAAG,GAAG;AAAA,UACJ,GAAG,IAAI;AAAA,YACL,GAAG,6BAA6B,KAAK,OAAO,YAAY;AAAA,YACxD,GAAG,2BAA2B,KAAK,OAAO,UAAU;AAAA,UACtD,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,oCAAoC,KAAK,OAAO,YAAY;AAAA,YAC/D,GAAG,kCAAkC,KAAK,OAAO,UAAU;AAAA,UAC7D,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,qCAAqC,KAAK,OAAO,YAAY;AAAA,YAChE,GAAG,mCAAmC,KAAK,OAAO,UAAU;AAAA,UAC9D,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,UAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,6BAA6B,KAAK,OAAO,YAAY;AAClG,UAAI,OAAO,WAAY,SAAQ,MAAM,MAAM,2BAA2B,KAAK,OAAO,UAAU;AAAA,IAC9F;AAEA,QAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,0BAA0B,UAAU,IAAI;AACrF,QAAI,OAAO,OAAQ,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,MAAM;AACnF,QAAI,OAAO,MAAO,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,KAAK;AAEjF,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,WAAW,EAAG,SAAQ,MAAM,MAAM,qCAAqC,KAAK,WAAW,CAAC,CAAC;AACxG,QAAI,WAAW,SAAS,EAAG,SAAQ,MAAM,MAAM,qCAAqC,MAAM,UAAU;AAEpG,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,SAAQ,MAAM,MAAM,2BAA2B,KAAK,YAAY,CAAC,CAAC;AAChG,QAAI,YAAY,SAAS,EAAG,SAAQ,MAAM,MAAM,2BAA2B,MAAM,WAAW;AAE5F,QAAI,OAAO,cAAc,QAAQ;AAC/B,cAAQ,MAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IAC9F;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,gBAAQ,MAAM,QAAQ,oEAAoE,OAAO;AACjG;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,4CAA4C,OAAO;AACzE;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,sDAAsD,OAAO;AACnF;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,2CAA2C,OAAO;AACxE;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,MAAM,QAAQ,YAAY,WAAW,OAAO;AACpD,gBAAQ,MAAM,QAAQ,kBAAkB,OAAO;AAC/C,eAAO;AAAA,IACX;AAEA,YAAQ,MAAM,QAAQ,0BAA0B,MAAM;AACtD,YAAQ,MAAM,QAAQ,kBAAkB,MAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAO,KAAK,eAAe,MAAM,EAC1C,YAAY,EACZ,aAAa,EACb,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AAEpB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAA8B;AAC/C,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,QAAQ,WAAW,KAAK;AAAA,MAC9C,EAAE,gBAAgB,UAAU;AAAA,IAC9B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAiB,IAA8B;AACnD,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,WAAW,WAAW,KAAK;AAAA,MACjD,EAAE,gBAAgB,OAAO;AAAA,IAC3B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAM,SAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAa,KAAK,GAAG,UAAe,EACvC,WAAW,aAAa,EACxB,OAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EACA,MAAM,0BAA0B,MAAM,IAAI;AAE7C,UAAI,QAAQ,SAAU,WAAU,MAAM,yBAAyB,KAAK,QAAQ,QAAQ;AACpF,UAAI,QAAQ,eAAgB,WAAU,MAAM,+BAA+B,KAAK,QAAQ,cAAc;AAEtG,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,2BAA2B,MAAM,IAAI;AAAA,YACxC,GAAG,0BAA0B,MAAM,IAAI;AAAA,YACvC,GAAG,8BAA8B,MAAM,IAAI;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,0BAA0B,KAAK,eAAe;AAAA,YACjD,GAAG,IAAI;AAAA,cACL,GAAG,0BAA0B,KAAK,eAAe;AAAA,cACjD,GAAG,kBAAkB,KAAK,QAAQ;AAAA,YACpC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAO,KAAK,GAAG,UAAe,EAC3B,YAAY,aAAa,EACzB,IAAI;AAAA,YACH,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC,EACA,MAAM,MAAM,KAAK,IAAI,EAAE,EACvB,QAAQ;AAEX,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,iBAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
-  "names": ["decrypted", "UUID_REGEX"]
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  TenantDataEncryptionService,\n  parseDecryptedFieldValue,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'action-log-service' })\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\nconst UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          return parseDecryptedFieldValue(decrypted)\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      // Audit log jsonb columns are encrypted as JSON-stringified payloads. After the\n      // service-level `decryptEntityPayload` call (which now returns raw strings \u2014\n      // see issue #1810 follow-up), reattach the structured shape via\n      // `parseDecryptedFieldValue` before running the recursive `deepDecrypt` walk\n      // so nested encrypted strings inside payload objects/arrays are handled.\n      const restoreJson = (value: unknown): unknown =>\n        typeof value === 'string' ? parseDecryptedFieldValue(value) : value\n\n      merged.changesJson = deepDecrypt(restoreJson(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json))\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(restoreJson(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before))\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(restoreJson(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after))\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(restoreJson(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload))\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(restoreJson(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json))\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        logger.warn('Failed to decrypt action log entry', { err })\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persist(log).flush()\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          logger.warn('Falling back to permissive action log payload parser', { err })\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      relatedResourceKind: toOptionalString(data.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(data.relatedResourceId) ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        relatedResourceKind: null,\n        relatedResourceId: null,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value\n      return UUID_REGEX.test(candidate) ? candidate : null\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      relatedResourceKind: toOptionalString(input.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(input.relatedResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    let query = (this.buildListQuery(parsed) as any).select('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query = query.limit(limit).offset(offset)\n    }\n\n    const rows = await query.execute()\n    const ids = rows.map((row: any) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry: any) => [entry.id, entry]))\n    return ids\n      .map((id: any) => byId.get(id))\n      .filter((entry: any): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery): any {\n    let query = (this.em.getKysely<any>() as any)\n      .selectFrom('action_logs')\n      .selectAll()\n      .where('action_logs.deleted_at', 'is', null) as any\n\n    if (parsed.tenantId) query = query.where('action_logs.tenant_id', '=', parsed.tenantId)\n    if (parsed.organizationId) query = query.where('action_logs.organization_id', '=', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query = query.where('action_logs.actor_user_id', '=', actorUserIds[0])\n    if (actorUserIds.length > 1) query = query.where('action_logs.actor_user_id', 'in', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query = query.where((eb: any) =>\n        eb.or([\n          eb.and([\n            eb('action_logs.resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.parent_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.parent_resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.related_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.related_resource_id', '=', parsed.resourceId),\n          ]),\n        ])\n      )\n    } else {\n      if (parsed.resourceKind) query = query.where('action_logs.resource_kind', '=', parsed.resourceKind)\n      if (parsed.resourceId) query = query.where('action_logs.resource_id', '=', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query = query.where('action_logs.undo_token', 'is not', null)\n    if (parsed.before) query = query.where('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query = query.where('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length === 1) query = query.where('action_logs.primary_changed_field', '=', fieldNames[0])\n    if (fieldNames.length > 1) query = query.where('action_logs.primary_changed_field', 'in', fieldNames)\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query = query.where('action_logs.action_type', '=', actionTypes[0])\n    if (actionTypes.length > 1) query = query.where('action_logs.action_type', 'in', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query = query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query = query.orderBy(sql`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '')`, sortDir)\n        break\n      case 'action':\n        query = query.orderBy(sql`coalesce(action_logs.action_type, '')`, sortDir)\n        break\n      case 'field':\n        query = query.orderBy(sql`coalesce(action_logs.primary_changed_field, '')`, sortDir)\n        break\n      case 'source':\n        query = query.orderBy(sql`coalesce(action_logs.source_key, '')`, sortDir)\n        break\n      case 'createdAt':\n      default:\n        query = query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query = query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query = query.orderBy('action_logs.created_at', 'desc')\n    query = query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await (this.buildListQuery(parsed) as any)\n      .clearSelect()\n      .clearOrderBy()\n      .select(sql<string>`count(*)`.as('count'))\n      .executeTakeFirst()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async claimForUndo(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'done', deletedAt: null },\n      { executionState: 'undoing' },\n    )\n    return affected === 1\n  }\n\n  async releaseUndoClaim(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'undoing', deletedAt: null },\n      { executionState: 'done' },\n    )\n    return affected === 1\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = (this.em.getKysely<any>() as any)\n        .selectFrom('action_logs')\n        .select([\n          'action_logs.id',\n          'action_logs.tenant_id',\n          'action_logs.organization_id',\n          'action_logs.actor_user_id',\n          'action_logs.command_id',\n          'action_logs.action_label',\n          'action_logs.snapshot_before',\n          'action_logs.changes_json',\n          'action_logs.context_json',\n          'action_logs.action_type',\n          'action_logs.source_key',\n          'action_logs.changed_fields',\n          'action_logs.primary_changed_field',\n          'action_logs.created_at',\n        ])\n        .where('action_logs.deleted_at', 'is', null) as any\n\n      if (options.tenantId) rowsQuery.where('action_logs.tenant_id', '=', options.tenantId)\n      if (options.organizationId) rowsQuery.where('action_logs.organization_id', '=', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.action_type', 'is', null),\n            eb('action_logs.source_key', 'is', null),\n            eb('action_logs.changed_fields', 'is', null),\n          ])\n        )\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.created_at', '>', cursorCreatedAt),\n            eb.and([\n              eb('action_logs.created_at', '=', cursorCreatedAt),\n              eb('action_logs.id', '>', cursorId),\n            ]),\n          ])\n        )\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await (this.em.getKysely<any>() as any)\n            .updateTable('action_logs')\n            .set({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n            .where('id', '=', row.id)\n            .execute()\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,WAAW;AACpB,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC;AAAA,EAEE;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAEnF,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AACA,MAAM,aAAa;AAkCnB,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,iBAAO,yBAAyBA,UAAS;AAAA,QAC3C;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAOA,YAAM,cAAc,CAAC,UACnB,OAAO,UAAU,WAAW,yBAAyB,KAAK,IAAI;AAEhE,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc,CAAC;AAC5I,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,eAAO,KAAK,sCAAsC,EAAE,IAAI,CAAC;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,QAAQ,GAAG,EAAE,MAAM;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,iBAAO,KAAK,wDAAwD,EAAE,IAAI,CAAC;AAAA,QAC7E;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,qBAAqB,iBAAiB,KAAK,mBAAmB,KAAK;AAAA,MACnE,mBAAmB,iBAAiB,KAAK,iBAAiB,KAAK;AAAA,MAC/D,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAMC,cAAa;AACnB,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,YAAM,YAAY,MAAM,WAAW,UAAU,IAAI,MAAM,MAAM,WAAW,MAAM,IAAI;AAClF,aAAOA,YAAW,KAAK,SAAS,IAAI,YAAY;AAAA,IAClD;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,qBAAqB,iBAAiB,MAAM,mBAAmB,KAAK;AAAA,MACpE,mBAAmB,iBAAiB,MAAM,iBAAiB,KAAK;AAAA,MAChE,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,QAAI,QAAS,KAAK,eAAe,MAAM,EAAU,OAAO,sBAAsB;AAE9E,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,cAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAC1C;AAEA,UAAM,OAAO,MAAM,MAAM,QAAQ;AACjC,UAAM,MAAM,KAAK,IAAI,CAAC,QAAa,IAAI,EAAE,EAAE,OAAO,OAAO;AACzD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAe,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AACnE,WAAO,IACJ,IAAI,CAAC,OAAY,KAAK,IAAI,EAAE,CAAC,EAC7B,OAAO,CAAC,UAAmC,QAAQ,KAAK,CAAC;AAAA,EAC9D;AAAA,EAEQ,eAAe,QAAiC;AACtD,QAAI,QAAS,KAAK,GAAG,UAAe,EACjC,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,0BAA0B,MAAM,IAAI;AAE7C,QAAI,OAAO,SAAU,SAAQ,MAAM,MAAM,yBAAyB,KAAK,OAAO,QAAQ;AACtF,QAAI,OAAO,eAAgB,SAAQ,MAAM,MAAM,+BAA+B,KAAK,OAAO,cAAc;AAExG,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,SAAQ,MAAM,MAAM,6BAA6B,KAAK,aAAa,CAAC,CAAC;AACpG,QAAI,aAAa,SAAS,EAAG,SAAQ,MAAM,MAAM,6BAA6B,MAAM,YAAY;AAEhG,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,cAAQ,MAAM;AAAA,QAAM,CAAC,OACnB,GAAG,GAAG;AAAA,UACJ,GAAG,IAAI;AAAA,YACL,GAAG,6BAA6B,KAAK,OAAO,YAAY;AAAA,YACxD,GAAG,2BAA2B,KAAK,OAAO,UAAU;AAAA,UACtD,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,oCAAoC,KAAK,OAAO,YAAY;AAAA,YAC/D,GAAG,kCAAkC,KAAK,OAAO,UAAU;AAAA,UAC7D,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,qCAAqC,KAAK,OAAO,YAAY;AAAA,YAChE,GAAG,mCAAmC,KAAK,OAAO,UAAU;AAAA,UAC9D,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,UAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,6BAA6B,KAAK,OAAO,YAAY;AAClG,UAAI,OAAO,WAAY,SAAQ,MAAM,MAAM,2BAA2B,KAAK,OAAO,UAAU;AAAA,IAC9F;AAEA,QAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,0BAA0B,UAAU,IAAI;AACrF,QAAI,OAAO,OAAQ,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,MAAM;AACnF,QAAI,OAAO,MAAO,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,KAAK;AAEjF,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,WAAW,EAAG,SAAQ,MAAM,MAAM,qCAAqC,KAAK,WAAW,CAAC,CAAC;AACxG,QAAI,WAAW,SAAS,EAAG,SAAQ,MAAM,MAAM,qCAAqC,MAAM,UAAU;AAEpG,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,SAAQ,MAAM,MAAM,2BAA2B,KAAK,YAAY,CAAC,CAAC;AAChG,QAAI,YAAY,SAAS,EAAG,SAAQ,MAAM,MAAM,2BAA2B,MAAM,WAAW;AAE5F,QAAI,OAAO,cAAc,QAAQ;AAC/B,cAAQ,MAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IAC9F;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,gBAAQ,MAAM,QAAQ,oEAAoE,OAAO;AACjG;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,4CAA4C,OAAO;AACzE;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,sDAAsD,OAAO;AACnF;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,2CAA2C,OAAO;AACxE;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,MAAM,QAAQ,YAAY,WAAW,OAAO;AACpD,gBAAQ,MAAM,QAAQ,kBAAkB,OAAO;AAC/C,eAAO;AAAA,IACX;AAEA,YAAQ,MAAM,QAAQ,0BAA0B,MAAM;AACtD,YAAQ,MAAM,QAAQ,kBAAkB,MAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAO,KAAK,eAAe,MAAM,EAC1C,YAAY,EACZ,aAAa,EACb,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AAEpB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAA8B;AAC/C,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,QAAQ,WAAW,KAAK;AAAA,MAC9C,EAAE,gBAAgB,UAAU;AAAA,IAC9B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAiB,IAA8B;AACnD,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,WAAW,WAAW,KAAK;AAAA,MACjD,EAAE,gBAAgB,OAAO;AAAA,IAC3B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAMC,UAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAa,KAAK,GAAG,UAAe,EACvC,WAAW,aAAa,EACxB,OAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EACA,MAAM,0BAA0B,MAAM,IAAI;AAE7C,UAAI,QAAQ,SAAU,WAAU,MAAM,yBAAyB,KAAK,QAAQ,QAAQ;AACpF,UAAI,QAAQ,eAAgB,WAAU,MAAM,+BAA+B,KAAK,QAAQ,cAAc;AAEtG,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,2BAA2B,MAAM,IAAI;AAAA,YACxC,GAAG,0BAA0B,MAAM,IAAI;AAAA,YACvC,GAAG,8BAA8B,MAAM,IAAI;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,0BAA0B,KAAK,eAAe;AAAA,YACjD,GAAG,IAAI;AAAA,cACL,GAAG,0BAA0B,KAAK,eAAe;AAAA,cACjD,GAAG,kBAAkB,KAAK,QAAQ;AAAA,YACpC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAO,KAAK,GAAG,UAAe,EAC3B,YAAY,aAAa,EACzB,IAAI;AAAA,YACH,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC,EACA,MAAM,MAAM,KAAK,IAAI,EAAE,EACvB,QAAQ;AAEX,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,UAAAA,QAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB,MAAAA;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": ["decrypted", "UUID_REGEX", "logger"]
 }

package/dist/modules/auth/api/profile/route.js

@@ -8,6 +8,8 @@ import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { buildPasswordSchema } from "@open-mercato/shared/lib/auth/passwordPolicy";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("auth").child({ component: "profile" });
 const profileResponseSchema = z.object({
   email: z.string().email(),
   roles: z.array(z.string())
@@ -92,7 +94,7 @@ async function GET(req) {
     }
     return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] });
   } catch (err) {
-    console.error("auth.profile.load failed", err);
+    logger.error("Profile load failed", { err });
     return NextResponse.json({ error: translate("auth.profile.form.errors.load", "Failed to load profile.") }, { status: 400 });
   }
 }
@@ -179,7 +181,7 @@ async function PUT(req) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
-    console.error("auth.profile.update failed", err);
+    logger.error("Profile update failed", { err });
     return NextResponse.json({ error: translate("auth.profile.form.errors.save", "Failed to update profile.") }, { status: 400 });
   }
 }

package/dist/modules/auth/api/profile/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/profile/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] })\n  } catch (err) {\n    console.error('auth.profile.load failed', err)\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('auth.profile.update failed', err)\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address for the signed-in user.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAEpC,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,KAAK,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;AAAA,EACjF,SAAS,KAAK;AACZ,YAAQ,MAAM,4BAA4B,GAAG;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address for the signed-in user.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,KAAK,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;AAAA,EACjF,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/reset/confirm.js

@@ -8,6 +8,8 @@ import { z } from "zod";
 import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
 import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
 import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("auth").child({ component: "reset-confirm" });
 const resetConfirmRateLimitConfig = readEndpointRateLimitConfig("RESET_CONFIRM", {
   points: 5,
   duration: 300,
@@ -43,7 +45,7 @@ async function POST(req) {
       }
     }
   } catch (err) {
-    console.error("[auth.reset.confirm] Failed to create notification:", err);
+    logger.error("Failed to create notification", { err });
   }
   return NextResponse.json({ ok: true, redirect: "/login" });
 }

package/dist/modules/auth/api/reset/confirm.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/reset/confirm.ts"],
-  "sourcesContent": ["import { confirmPasswordResetSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'\nimport notificationTypes from '@open-mercato/core/modules/auth/notifications'\nimport { z } from 'zod'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\n\nconst resetConfirmRateLimitConfig = readEndpointRateLimitConfig('RESET_CONFIRM', {\n  points: 5, duration: 300, keyPrefix: 'reset-confirm',\n})\n\n// validation via confirmPasswordResetSchema\n\nexport async function POST(req: Request) {\n  const form = await req.formData()\n  const token = String(form.get('token') ?? '')\n  const password = String(form.get('password') ?? '')\n  // Rate limit by IP \u2014 checked before validation and DB work\n  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetConfirmRateLimitConfig })\n  if (rateLimitError) return rateLimitError\n  const parsed = confirmPasswordResetSchema.safeParse({ token, password })\n  if (!parsed.success) return NextResponse.json({ ok: false, error: 'Invalid request' }, { status: 400 })\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const user = await auth.confirmPasswordReset(parsed.data.token, parsed.data.password)\n  if (!user) return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })\n  try {\n    const tenantId = user.tenantId ? String(user.tenantId) : null\n    if (tenantId) {\n      const notificationService = resolveNotificationService(c)\n      const typeDef = notificationTypes.find((type) => type.type === 'auth.password_reset.completed')\n      if (typeDef) {\n        const notificationInput = buildNotificationFromType(typeDef, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, {\n          tenantId,\n          organizationId: user.organizationId ? String(user.organizationId) : null,\n        })\n      }\n    }\n  } catch (err) {\n    console.error('[auth.reset.confirm] Failed to create notification:', err)\n  }\n  return NextResponse.json({ ok: true, redirect: '/login' })\n}\n\nexport const metadata = { requireAuth: false }\n\nconst passwordResetConfirmResponseSchema = z.object({\n  ok: z.literal(true),\n  redirect: z.string(),\n})\n\nconst passwordResetErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Confirm password reset',\n  methods: {\n    POST: {\n      summary: 'Complete password reset',\n      description: 'Validates the reset token and updates the user password.',\n      requestBody: {\n        contentType: 'application/x-www-form-urlencoded',\n        schema: confirmPasswordResetSchema,\n      },\n      responses: [\n        { status: 200, description: 'Password reset succeeded', schema: passwordResetConfirmResponseSchema },\n        { status: 400, description: 'Invalid token or payload', schema: passwordResetErrorSchema },\n      ],\n      errors: [\n        { status: 429, description: 'Too many reset confirmation attempts', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,OAAO,uBAAuB;AAC9B,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AAEnC,MAAM,8BAA8B,4BAA4B,iBAAiB;AAAA,EAC/E,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAK,WAAW;AACvC,CAAC;AAID,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAC5C,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAElD,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB,EAAE,KAAK,UAAU,4BAA4B,CAAC;AACzG,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,2BAA2B,UAAU,EAAE,OAAO,SAAS,CAAC;AACvE,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtG,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,OAAO,MAAM,KAAK,qBAAqB,OAAO,KAAK,OAAO,OAAO,KAAK,QAAQ;AACpF,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACrG,MAAI;AACF,UAAM,WAAW,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACzD,QAAI,UAAU;AACZ,YAAM,sBAAsB,2BAA2B,CAAC;AACxD,YAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,+BAA+B;AAC9F,UAAI,SAAS;AACX,cAAM,oBAAoB,0BAA0B,SAAS;AAAA,UAC3D,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB;AAAA,UAClD;AAAA,UACA,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACtE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,MAAM,uDAAuD,GAAG;AAAA,EAC1E;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,UAAU,SAAS,CAAC;AAC3D;AAEO,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,qCAAqC,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,UAAU,EAAE,OAAO;AACrB,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,mCAAmC;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,yBAAyB;AAAA,MAC3F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,qBAAqB;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { confirmPasswordResetSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'\nimport notificationTypes from '@open-mercato/core/modules/auth/notifications'\nimport { z } from 'zod'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'reset-confirm' })\n\nconst resetConfirmRateLimitConfig = readEndpointRateLimitConfig('RESET_CONFIRM', {\n  points: 5, duration: 300, keyPrefix: 'reset-confirm',\n})\n\n// validation via confirmPasswordResetSchema\n\nexport async function POST(req: Request) {\n  const form = await req.formData()\n  const token = String(form.get('token') ?? '')\n  const password = String(form.get('password') ?? '')\n  // Rate limit by IP \u2014 checked before validation and DB work\n  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetConfirmRateLimitConfig })\n  if (rateLimitError) return rateLimitError\n  const parsed = confirmPasswordResetSchema.safeParse({ token, password })\n  if (!parsed.success) return NextResponse.json({ ok: false, error: 'Invalid request' }, { status: 400 })\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const user = await auth.confirmPasswordReset(parsed.data.token, parsed.data.password)\n  if (!user) return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })\n  try {\n    const tenantId = user.tenantId ? String(user.tenantId) : null\n    if (tenantId) {\n      const notificationService = resolveNotificationService(c)\n      const typeDef = notificationTypes.find((type) => type.type === 'auth.password_reset.completed')\n      if (typeDef) {\n        const notificationInput = buildNotificationFromType(typeDef, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, {\n          tenantId,\n          organizationId: user.organizationId ? String(user.organizationId) : null,\n        })\n      }\n    }\n  } catch (err) {\n    logger.error('Failed to create notification', { err })\n  }\n  return NextResponse.json({ ok: true, redirect: '/login' })\n}\n\nexport const metadata = { requireAuth: false }\n\nconst passwordResetConfirmResponseSchema = z.object({\n  ok: z.literal(true),\n  redirect: z.string(),\n})\n\nconst passwordResetErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Confirm password reset',\n  methods: {\n    POST: {\n      summary: 'Complete password reset',\n      description: 'Validates the reset token and updates the user password.',\n      requestBody: {\n        contentType: 'application/x-www-form-urlencoded',\n        schema: confirmPasswordResetSchema,\n      },\n      responses: [\n        { status: 200, description: 'Password reset succeeded', schema: passwordResetConfirmResponseSchema },\n        { status: 400, description: 'Invalid token or payload', schema: passwordResetErrorSchema },\n      ],\n      errors: [\n        { status: 429, description: 'Too many reset confirmation attempts', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,OAAO,uBAAuB;AAC9B,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAExE,MAAM,8BAA8B,4BAA4B,iBAAiB;AAAA,EAC/E,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAK,WAAW;AACvC,CAAC;AAID,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAC5C,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAElD,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB,EAAE,KAAK,UAAU,4BAA4B,CAAC;AACzG,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,2BAA2B,UAAU,EAAE,OAAO,SAAS,CAAC;AACvE,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtG,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,OAAO,MAAM,KAAK,qBAAqB,OAAO,KAAK,OAAO,OAAO,KAAK,QAAQ;AACpF,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACrG,MAAI;AACF,UAAM,WAAW,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACzD,QAAI,UAAU;AACZ,YAAM,sBAAsB,2BAA2B,CAAC;AACxD,YAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,+BAA+B;AAC9F,UAAI,SAAS;AACX,cAAM,oBAAoB,0BAA0B,SAAS;AAAA,UAC3D,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB;AAAA,UAClD;AAAA,UACA,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACtE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,iCAAiC,EAAE,IAAI,CAAC;AAAA,EACvD;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,UAAU,SAAS,CAAC;AAC3D;AAEO,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,qCAAqC,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,UAAU,EAAE,OAAO;AACrB,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,mCAAmC;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,yBAAyB;AAAA,MAC3F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,qBAAqB;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/reset.js

@@ -12,6 +12,8 @@ import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers
 import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
 import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
 import { mapSecurityEmailUrlError, toSecurityEmailUrl } from "@open-mercato/shared/lib/url";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("auth").child({ component: "reset" });
 const resetRateLimitConfig = readEndpointRateLimitConfig("RESET", {
   points: 3,
   duration: 60,
@@ -68,7 +70,7 @@ async function POST(req) {
   try {
     await sendEmail({ to: user.email, subject, react: ResetPasswordEmail({ resetUrl, copy }) });
   } catch (err) {
-    console.error("[auth.reset] Failed to send reset email:", err);
+    logger.error("Failed to send reset email", { err });
   }
   try {
     const tenantId = user.tenantId ? String(user.tenantId) : null;
@@ -88,7 +90,7 @@ async function POST(req) {
       }
     }
   } catch (err) {
-    console.error("[auth.reset] Failed to create notification:", err);
+    logger.error("Failed to create notification", { err });
   }
   return NextResponse.json({ ok: true });
 }

package/dist/modules/auth/api/reset.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/reset.ts"],
-  "sourcesContent": ["import { requestPasswordResetSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport ResetPasswordEmail from '@open-mercato/core/modules/auth/emails/ResetPasswordEmail'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'\nimport notificationTypes from '@open-mercato/core/modules/auth/notifications'\nimport { z } from 'zod'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { mapSecurityEmailUrlError, toSecurityEmailUrl } from '@open-mercato/shared/lib/url'\n\nconst resetRateLimitConfig = readEndpointRateLimitConfig('RESET', {\n  points: 3, duration: 60, blockDuration: 60, keyPrefix: 'reset',\n})\nconst resetIpRateLimitConfig = readEndpointRateLimitConfig('RESET_IP', {\n  points: 10, duration: 60, blockDuration: 60, keyPrefix: 'reset-ip',\n})\n\n// validation via requestPasswordResetSchema\n\nexport async function POST(req: Request) {\n  const form = await req.formData()\n  const email = String(form.get('email') ?? '')\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req, ipConfig: resetIpRateLimitConfig, compoundConfig: resetRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = requestPasswordResetSchema.safeParse({ email })\n  if (!parsed.success) {\n    const fieldErrors = parsed.error.flatten().fieldErrors\n    return NextResponse.json({ error: 'Validation failed', fieldErrors }, { status: 422 })\n  }\n  let resetUrlTemplate: string\n  try {\n    resetUrlTemplate = toSecurityEmailUrl(req, '/reset/__token__')\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'auth.reset',\n      configMessage: 'Password reset is not configured',\n    })\n    if (mapped) return NextResponse.json(mapped.body, { status: mapped.status })\n    throw error\n  }\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const resReq = await auth.requestPasswordReset(parsed.data.email)\n  if (!resReq) return NextResponse.json({ ok: true })\n  const { user, token } = resReq\n  const resetUrl = resetUrlTemplate.replace('__token__', token)\n\n  const { translate } = await resolveTranslations()\n  const subject = translate('auth.email.resetPassword.subject', 'Reset your password')\n  const copy = {\n    preview: translate('auth.email.resetPassword.preview', 'Reset your password'),\n    title: translate('auth.email.resetPassword.title', 'Reset your password'),\n    body: translate('auth.email.resetPassword.body', 'Click the link below to set a new password. This link will expire in 60 minutes.'),\n    cta: translate('auth.email.resetPassword.cta', 'Set a new password'),\n    hint: translate('auth.email.resetPassword.hint', \"If you didn't request this, you can safely ignore this email.\"),\n  }\n\n  try {\n    await sendEmail({ to: user.email, subject, react: ResetPasswordEmail({ resetUrl, copy }) })\n  } catch (err) {\n    console.error('[auth.reset] Failed to send reset email:', err)\n  }\n  try {\n    const tenantId = user.tenantId ? String(user.tenantId) : null\n    if (tenantId) {\n      const notificationService = resolveNotificationService(c)\n      const typeDef = notificationTypes.find((type) => type.type === 'auth.password_reset.requested')\n      if (typeDef) {\n        const notificationInput = buildNotificationFromType(typeDef, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, {\n          tenantId,\n          organizationId: user.organizationId ? String(user.organizationId) : null,\n        })\n      }\n    }\n  } catch (err) {\n    console.error('[auth.reset] Failed to create notification:', err)\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const metadata = { requireAuth: false }\n\nconst passwordResetRequestSchema = z.object({\n  email: z.string().email(),\n})\n\nconst passwordResetResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst passwordResetErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Request password reset',\n  methods: {\n    POST: {\n      summary: 'Send reset email',\n      description: 'Requests a password reset email for the given account. The endpoint always returns `ok: true` to avoid leaking account existence.',\n      requestBody: {\n        contentType: 'application/x-www-form-urlencoded',\n        schema: passwordResetRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Reset email dispatched (or ignored for unknown accounts)', schema: passwordResetResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request origin', schema: passwordResetErrorSchema },\n        { status: 429, description: 'Too many password reset requests', schema: rateLimitErrorSchema },\n        { status: 500, description: 'Password reset email origin is not configured', schema: passwordResetErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,iBAAiB;AAC1B,OAAO,wBAAwB;AAC/B,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,OAAO,uBAAuB;AAC9B,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,0BAA0B,0BAA0B;AAE7D,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAID,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAE5C,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,2BAA2B,UAAU,EAAE,MAAM,CAAC;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,cAAc,OAAO,MAAM,QAAQ,EAAE;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AACA,MAAI;AACJ,MAAI;AACF,uBAAmB,mBAAmB,KAAK,kBAAkB;AAAA,EAC/D,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC3E,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO,KAAK,KAAK;AAChE,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAClD,QAAM,EAAE,MAAM,MAAM,IAAI;AACxB,QAAM,WAAW,iBAAiB,QAAQ,aAAa,KAAK;AAE5D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,UAAU,UAAU,oCAAoC,qBAAqB;AACnF,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,oCAAoC,qBAAqB;AAAA,IAC5E,OAAO,UAAU,kCAAkC,qBAAqB;AAAA,IACxE,MAAM,UAAU,iCAAiC,kFAAkF;AAAA,IACnI,KAAK,UAAU,gCAAgC,oBAAoB;AAAA,IACnE,MAAM,UAAU,iCAAiC,+DAA+D;AAAA,EAClH;AAEA,MAAI;AACF,UAAM,UAAU,EAAE,IAAI,KAAK,OAAO,SAAS,OAAO,mBAAmB,EAAE,UAAU,KAAK,CAAC,EAAE,CAAC;AAAA,EAC5F,SAAS,KAAK;AACZ,YAAQ,MAAM,4CAA4C,GAAG;AAAA,EAC/D;AACA,MAAI;AACF,UAAM,WAAW,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACzD,QAAI,UAAU;AACZ,YAAM,sBAAsB,2BAA2B,CAAC;AACxD,YAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,+BAA+B;AAC9F,UAAI,SAAS;AACX,cAAM,oBAAoB,0BAA0B,SAAS;AAAA,UAC3D,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB;AAAA,UAClD;AAAA,UACA,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACtE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,MAAM,+CAA+C,GAAG;AAAA,EAClE;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4DAA4D,QAAQ,4BAA4B;AAAA,MAC9H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,yBAAyB;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,qBAAqB;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,iDAAiD,QAAQ,yBAAyB;AAAA,MAChH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { requestPasswordResetSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport ResetPasswordEmail from '@open-mercato/core/modules/auth/emails/ResetPasswordEmail'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'\nimport notificationTypes from '@open-mercato/core/modules/auth/notifications'\nimport { z } from 'zod'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { mapSecurityEmailUrlError, toSecurityEmailUrl } from '@open-mercato/shared/lib/url'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'reset' })\n\nconst resetRateLimitConfig = readEndpointRateLimitConfig('RESET', {\n  points: 3, duration: 60, blockDuration: 60, keyPrefix: 'reset',\n})\nconst resetIpRateLimitConfig = readEndpointRateLimitConfig('RESET_IP', {\n  points: 10, duration: 60, blockDuration: 60, keyPrefix: 'reset-ip',\n})\n\n// validation via requestPasswordResetSchema\n\nexport async function POST(req: Request) {\n  const form = await req.formData()\n  const email = String(form.get('email') ?? '')\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req, ipConfig: resetIpRateLimitConfig, compoundConfig: resetRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = requestPasswordResetSchema.safeParse({ email })\n  if (!parsed.success) {\n    const fieldErrors = parsed.error.flatten().fieldErrors\n    return NextResponse.json({ error: 'Validation failed', fieldErrors }, { status: 422 })\n  }\n  let resetUrlTemplate: string\n  try {\n    resetUrlTemplate = toSecurityEmailUrl(req, '/reset/__token__')\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'auth.reset',\n      configMessage: 'Password reset is not configured',\n    })\n    if (mapped) return NextResponse.json(mapped.body, { status: mapped.status })\n    throw error\n  }\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const resReq = await auth.requestPasswordReset(parsed.data.email)\n  if (!resReq) return NextResponse.json({ ok: true })\n  const { user, token } = resReq\n  const resetUrl = resetUrlTemplate.replace('__token__', token)\n\n  const { translate } = await resolveTranslations()\n  const subject = translate('auth.email.resetPassword.subject', 'Reset your password')\n  const copy = {\n    preview: translate('auth.email.resetPassword.preview', 'Reset your password'),\n    title: translate('auth.email.resetPassword.title', 'Reset your password'),\n    body: translate('auth.email.resetPassword.body', 'Click the link below to set a new password. This link will expire in 60 minutes.'),\n    cta: translate('auth.email.resetPassword.cta', 'Set a new password'),\n    hint: translate('auth.email.resetPassword.hint', \"If you didn't request this, you can safely ignore this email.\"),\n  }\n\n  try {\n    await sendEmail({ to: user.email, subject, react: ResetPasswordEmail({ resetUrl, copy }) })\n  } catch (err) {\n    logger.error('Failed to send reset email', { err })\n  }\n  try {\n    const tenantId = user.tenantId ? String(user.tenantId) : null\n    if (tenantId) {\n      const notificationService = resolveNotificationService(c)\n      const typeDef = notificationTypes.find((type) => type.type === 'auth.password_reset.requested')\n      if (typeDef) {\n        const notificationInput = buildNotificationFromType(typeDef, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, {\n          tenantId,\n          organizationId: user.organizationId ? String(user.organizationId) : null,\n        })\n      }\n    }\n  } catch (err) {\n    logger.error('Failed to create notification', { err })\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const metadata = { requireAuth: false }\n\nconst passwordResetRequestSchema = z.object({\n  email: z.string().email(),\n})\n\nconst passwordResetResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst passwordResetErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Request password reset',\n  methods: {\n    POST: {\n      summary: 'Send reset email',\n      description: 'Requests a password reset email for the given account. The endpoint always returns `ok: true` to avoid leaking account existence.',\n      requestBody: {\n        contentType: 'application/x-www-form-urlencoded',\n        schema: passwordResetRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Reset email dispatched (or ignored for unknown accounts)', schema: passwordResetResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request origin', schema: passwordResetErrorSchema },\n        { status: 429, description: 'Too many password reset requests', schema: rateLimitErrorSchema },\n        { status: 500, description: 'Password reset email origin is not configured', schema: passwordResetErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,iBAAiB;AAC1B,OAAO,wBAAwB;AAC/B,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,OAAO,uBAAuB;AAC9B,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,0BAA0B,0BAA0B;AAC7D,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEhE,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAID,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAE5C,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,2BAA2B,UAAU,EAAE,MAAM,CAAC;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,cAAc,OAAO,MAAM,QAAQ,EAAE;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AACA,MAAI;AACJ,MAAI;AACF,uBAAmB,mBAAmB,KAAK,kBAAkB;AAAA,EAC/D,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC3E,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO,KAAK,KAAK;AAChE,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAClD,QAAM,EAAE,MAAM,MAAM,IAAI;AACxB,QAAM,WAAW,iBAAiB,QAAQ,aAAa,KAAK;AAE5D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,UAAU,UAAU,oCAAoC,qBAAqB;AACnF,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,oCAAoC,qBAAqB;AAAA,IAC5E,OAAO,UAAU,kCAAkC,qBAAqB;AAAA,IACxE,MAAM,UAAU,iCAAiC,kFAAkF;AAAA,IACnI,KAAK,UAAU,gCAAgC,oBAAoB;AAAA,IACnE,MAAM,UAAU,iCAAiC,+DAA+D;AAAA,EAClH;AAEA,MAAI;AACF,UAAM,UAAU,EAAE,IAAI,KAAK,OAAO,SAAS,OAAO,mBAAmB,EAAE,UAAU,KAAK,CAAC,EAAE,CAAC;AAAA,EAC5F,SAAS,KAAK;AACZ,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAAA,EACpD;AACA,MAAI;AACF,UAAM,WAAW,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACzD,QAAI,UAAU;AACZ,YAAM,sBAAsB,2BAA2B,CAAC;AACxD,YAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,+BAA+B;AAC9F,UAAI,SAAS;AACX,cAAM,oBAAoB,0BAA0B,SAAS;AAAA,UAC3D,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB;AAAA,UAClD;AAAA,UACA,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACtE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,iCAAiC,EAAE,IAAI,CAAC;AAAA,EACvD;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4DAA4D,QAAQ,4BAA4B;AAAA,MAC9H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,yBAAyB;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,qBAAqB;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,iDAAiD,QAAQ,yBAAyB;AAAA,MAChH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/roles/route.js

@@ -13,6 +13,8 @@ import { roleCrudEvents, roleCrudIndexer } from "@open-mercato/core/modules/auth
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { assertActorCanModifySuperAdminRoleTarget } from "@open-mercato/core/modules/auth/lib/grantChecks";
 import { enforceRoleTenantAccess } from "@open-mercato/core/modules/auth/lib/roleTenantGuard";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("auth").child({ component: "roles" });
 const querySchema = z.object({
   id: z.string().uuid().optional(),
   page: z.coerce.number().min(1).default(1),
@@ -119,7 +121,7 @@ async function GET(req) {
       isSuperAdmin = !!acl?.isSuperAdmin;
     }
   } catch (err) {
-    console.error("roles: failed to resolve rbac", err);
+    logger.error("Failed to resolve rbac", { err });
   }
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null;
   if (!isSuperAdmin && !actorTenantId) {