@open-mercato/core 0.6.6-develop.6465.1.019f0fb26f → 0.6.6-develop.6471.1.9ab5bdd79a

package/dist/modules/directory/commands/tenants.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/directory/commands/tenants.ts"],
-  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'\n\nexport const tenantCrudEvents: CrudEventsConfig = {\n  module: 'directory',\n  entity: 'tenant',\n  persistent: true,\n}\n\nexport const tenantCrudIndexer: CrudIndexerConfig = {\n  entityType: E.directory.tenant,\n}\n\nfunction serializeTenant(entity: Tenant) {\n  return {\n    id: String(entity.id),\n    name: entity.name,\n    isActive: !!entity.isActive,\n    createdAt: entity.createdAt ? entity.createdAt.toISOString() : null,\n    updatedAt: entity.updatedAt ? entity.updatedAt.toISOString() : null,\n    deletedAt: entity.deletedAt ? entity.deletedAt.toISOString() : null,\n  }\n}\n\ntype TenantPayload = Record<string, unknown>\ntype SerializedTenant = ReturnType<typeof serializeTenant>\n\nconst createTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    const tenant = await de.createOrmEntity({\n      entity: Tenant,\n      data: {\n        name: parsed.name,\n        isActive: parsed.isActive ?? true,\n      },\n    })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    if (isTenantDataEncryptionEnabled()) {\n      try {\n        const kms = ctx.container.resolve('kmsService') as { createTenantDek?: (id: string) => Promise<unknown>; isHealthy?: () => boolean }\n        if (kms?.isHealthy?.()) {\n          await kms?.createTenantDek?.(String(tenant.id))\n          console.info('\uD83D\uDD11 [encryption][tenant] created tenant DEK', { tenantId: String(tenant.id) })\n        } else {\n          console.warn('\u26A0\uFE0F [encryption][tenant] kms not healthy, skipping tenant DEK provisioning', { tenantId: String(tenant.id) })\n        }\n      } catch (err) {\n        console.warn('\u26A0\uFE0F [encryption] Failed to provision tenant key', err)\n      }\n    }\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ snapshots, result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const after = (snapshots.after as SerializedTenant | undefined) ?? serializeTenant(result)\n    return {\n      actionLabel: translate('directory.audit.tenants.create', 'Create tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      tenantId: ctx.auth?.tenantId ?? null,\n      snapshotAfter: after,\n      payload: { undo: { after } },\n    }\n  },\n  redo: makeCreateRedo<Tenant, SerializedTenant, TenantPayload, Tenant>({\n    entityClass: Tenant,\n    buildResult: (entity) => entity,\n    events: tenantCrudEvents,\n    indexer: tenantCrudIndexer,\n    afterRestore: ({ entity }) => {\n      Reflect.set(entity, 'tenantId', String(entity.id))\n    },\n  }),\n}\n\nconst updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null })\n    if (!current) throw new CrudHttpError(404, { error: 'Tenant not found' })\n    return { before: serializeTenant(current) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.updateOrmEntity({\n      entity: Tenant,\n      where: { id: parsed.id, deletedAt: null } as FilterQuery<Tenant>,\n      apply: (entity) => {\n        if (parsed.name !== undefined) entity.name = parsed.name\n        if (parsed.isActive !== undefined) entity.isActive = parsed.isActive\n        entity.updatedAt = new Date()\n      },\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeRecord = (snapshots.before ?? null) as Record<string, unknown> | null\n    const after = serializeTenant(result)\n    const changes = buildChanges(beforeRecord, after as Record<string, unknown>, ['name', 'isActive'])\n    return {\n      actionLabel: translate('directory.audit.tenants.update', 'Update tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      changes,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nconst deleteTenantCommand: CommandHandler<{ body: any; query: Record<string, string> }, Tenant> = {\n  id: 'directory.tenants.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Tenant id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await em.findOne(Tenant, { id, deletedAt: null })\n    return existing ? { before: serializeTenant(existing) } : {}\n  },\n  async execute(rawInput, ctx) {\n    const id = requireId(rawInput, 'Tenant id required')\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.deleteOrmEntity({\n      entity: Tenant,\n      where: { id, deletedAt: null } as FilterQuery<Tenant>,\n      soft: true,\n      softDeleteField: 'deletedAt',\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    const identifiers = {\n      id: String(id),\n      organizationId: null,\n      tenantId: String(id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  buildLog: async ({ snapshots, input, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshot = (snapshots.before ?? null) as SerializedTenant | null\n    const id = String(input?.body?.id ?? input?.query?.id ?? '')\n    const fallbackId = beforeSnapshot?.id ?? null\n    return {\n      actionLabel: translate('directory.audit.tenants.delete', 'Delete tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: id || fallbackId || null,\n      snapshotBefore: beforeSnapshot ?? null,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nregisterCommand(createTenantCommand)\nregisterCommand(updateTenantCommand)\nregisterCommand(deleteTenantCommand)\n"],
-  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,cAAc;AAGvB,SAAS,qBAAqB;AAC9B,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,SAAS,qCAAqC;AAC9C,SAAS,sBAAsB;AAExB,MAAM,mBAAqC;AAAA,EAChD,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AACd;AAEO,MAAM,oBAAuC;AAAA,EAClD,YAAY,EAAE,UAAU;AAC1B;AAEA,SAAS,gBAAgB,QAAgB;AACvC,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,EAAE;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,UAAU,CAAC,CAAC,OAAO;AAAA,IACnB,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EACjE;AACF;AAKA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAE9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO;AAAA,QACb,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,8BAA8B,GAAG;AACnC,UAAI;AACF,cAAM,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,YAAI,KAAK,YAAY,GAAG;AACtB,gBAAM,KAAK,kBAAkB,OAAO,OAAO,EAAE,CAAC;AAC9C,kBAAQ,KAAK,qDAA8C,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QAC5F,OAAO;AACL,kBAAQ,KAAK,uFAA6E,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QAC3H;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,KAAK,4DAAkD,GAAG;AAAA,MACpE;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,WAAW,QAAQ,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,QAAS,UAAU,SAA0C,gBAAgB,MAAM;AACzF,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,eAAe;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,IAC7B;AAAA,EACF;AAAA,EACA,MAAM,eAAgE;AAAA,IACpE,aAAa;AAAA,IACb,aAAa,CAAC,WAAW;AAAA,IACzB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,cAAc,CAAC,EAAE,OAAO,MAAM;AAC5B,cAAQ,IAAI,QAAQ,YAAY,OAAO,OAAO,EAAE,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AACH;AAEA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AACrE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,UAAU,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,CAAC;AAC3E,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACxE,WAAO,EAAE,QAAQ,gBAAgB,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,YAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,YAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAC5D,eAAO,YAAY,oBAAI,KAAK;AAAA,MAC9B;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,eAAgB,UAAU,UAAU;AAC1C,UAAM,QAAQ,gBAAgB,MAAM;AACpC,UAAM,UAAU,aAAa,cAAc,OAAkC,CAAC,QAAQ,UAAU,CAAC;AACjG,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B;AAAA,MACA,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,MAAM,sBAA4F;AAAA,EAChG,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,WAAO,WAAW,EAAE,QAAQ,gBAAgB,QAAQ,EAAE,IAAI,CAAC;AAAA,EAC7D;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,KAAK,UAAU,UAAU,oBAAoB;AACnD,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,WAAW,KAAK;AAAA,MAC7B,MAAM;AAAA,MACN,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,EAAE;AAAA,MACb,gBAAgB;AAAA,MAChB,UAAU,OAAO,EAAE;AAAA,IACrB;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,OAAO,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,iBAAkB,UAAU,UAAU;AAC5C,UAAM,KAAK,OAAO,OAAO,MAAM,MAAM,OAAO,OAAO,MAAM,EAAE;AAC3D,UAAM,aAAa,gBAAgB,MAAM;AACzC,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,MAAM,cAAc;AAAA,MAChC,gBAAgB,kBAAkB;AAAA,MAClC,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;",
+  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('directory').child({ component: 'tenants' })\n\nexport const tenantCrudEvents: CrudEventsConfig = {\n  module: 'directory',\n  entity: 'tenant',\n  persistent: true,\n}\n\nexport const tenantCrudIndexer: CrudIndexerConfig = {\n  entityType: E.directory.tenant,\n}\n\nfunction serializeTenant(entity: Tenant) {\n  return {\n    id: String(entity.id),\n    name: entity.name,\n    isActive: !!entity.isActive,\n    createdAt: entity.createdAt ? entity.createdAt.toISOString() : null,\n    updatedAt: entity.updatedAt ? entity.updatedAt.toISOString() : null,\n    deletedAt: entity.deletedAt ? entity.deletedAt.toISOString() : null,\n  }\n}\n\ntype TenantPayload = Record<string, unknown>\ntype SerializedTenant = ReturnType<typeof serializeTenant>\n\nconst createTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    const tenant = await de.createOrmEntity({\n      entity: Tenant,\n      data: {\n        name: parsed.name,\n        isActive: parsed.isActive ?? true,\n      },\n    })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    if (isTenantDataEncryptionEnabled()) {\n      try {\n        const kms = ctx.container.resolve('kmsService') as { createTenantDek?: (id: string) => Promise<unknown>; isHealthy?: () => boolean }\n        if (kms?.isHealthy?.()) {\n          await kms?.createTenantDek?.(String(tenant.id))\n          logger.info('Created tenant DEK', { tenantId: String(tenant.id) })\n        } else {\n          logger.warn('KMS not healthy, skipping tenant DEK provisioning', { tenantId: String(tenant.id) })\n        }\n      } catch (err) {\n        logger.warn('Failed to provision tenant key', { err })\n      }\n    }\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ snapshots, result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const after = (snapshots.after as SerializedTenant | undefined) ?? serializeTenant(result)\n    return {\n      actionLabel: translate('directory.audit.tenants.create', 'Create tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      tenantId: ctx.auth?.tenantId ?? null,\n      snapshotAfter: after,\n      payload: { undo: { after } },\n    }\n  },\n  redo: makeCreateRedo<Tenant, SerializedTenant, TenantPayload, Tenant>({\n    entityClass: Tenant,\n    buildResult: (entity) => entity,\n    events: tenantCrudEvents,\n    indexer: tenantCrudIndexer,\n    afterRestore: ({ entity }) => {\n      Reflect.set(entity, 'tenantId', String(entity.id))\n    },\n  }),\n}\n\nconst updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null })\n    if (!current) throw new CrudHttpError(404, { error: 'Tenant not found' })\n    return { before: serializeTenant(current) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.updateOrmEntity({\n      entity: Tenant,\n      where: { id: parsed.id, deletedAt: null } as FilterQuery<Tenant>,\n      apply: (entity) => {\n        if (parsed.name !== undefined) entity.name = parsed.name\n        if (parsed.isActive !== undefined) entity.isActive = parsed.isActive\n        entity.updatedAt = new Date()\n      },\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeRecord = (snapshots.before ?? null) as Record<string, unknown> | null\n    const after = serializeTenant(result)\n    const changes = buildChanges(beforeRecord, after as Record<string, unknown>, ['name', 'isActive'])\n    return {\n      actionLabel: translate('directory.audit.tenants.update', 'Update tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      changes,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nconst deleteTenantCommand: CommandHandler<{ body: any; query: Record<string, string> }, Tenant> = {\n  id: 'directory.tenants.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Tenant id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await em.findOne(Tenant, { id, deletedAt: null })\n    return existing ? { before: serializeTenant(existing) } : {}\n  },\n  async execute(rawInput, ctx) {\n    const id = requireId(rawInput, 'Tenant id required')\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.deleteOrmEntity({\n      entity: Tenant,\n      where: { id, deletedAt: null } as FilterQuery<Tenant>,\n      soft: true,\n      softDeleteField: 'deletedAt',\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    const identifiers = {\n      id: String(id),\n      organizationId: null,\n      tenantId: String(id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  buildLog: async ({ snapshots, input, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshot = (snapshots.before ?? null) as SerializedTenant | null\n    const id = String(input?.body?.id ?? input?.query?.id ?? '')\n    const fallbackId = beforeSnapshot?.id ?? null\n    return {\n      actionLabel: translate('directory.audit.tenants.delete', 'Delete tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: id || fallbackId || null,\n      snapshotBefore: beforeSnapshot ?? null,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nregisterCommand(createTenantCommand)\nregisterCommand(updateTenantCommand)\nregisterCommand(deleteTenantCommand)\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,cAAc;AAGvB,SAAS,qBAAqB;AAC9B,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,SAAS,qCAAqC;AAC9C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEhE,MAAM,mBAAqC;AAAA,EAChD,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AACd;AAEO,MAAM,oBAAuC;AAAA,EAClD,YAAY,EAAE,UAAU;AAC1B;AAEA,SAAS,gBAAgB,QAAgB;AACvC,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,EAAE;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,UAAU,CAAC,CAAC,OAAO;AAAA,IACnB,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EACjE;AACF;AAKA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAE9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO;AAAA,QACb,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,8BAA8B,GAAG;AACnC,UAAI;AACF,cAAM,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,YAAI,KAAK,YAAY,GAAG;AACtB,gBAAM,KAAK,kBAAkB,OAAO,OAAO,EAAE,CAAC;AAC9C,iBAAO,KAAK,sBAAsB,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QACnE,OAAO;AACL,iBAAO,KAAK,qDAAqD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QAClG;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,kCAAkC,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,WAAW,QAAQ,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,QAAS,UAAU,SAA0C,gBAAgB,MAAM;AACzF,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,eAAe;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,IAC7B;AAAA,EACF;AAAA,EACA,MAAM,eAAgE;AAAA,IACpE,aAAa;AAAA,IACb,aAAa,CAAC,WAAW;AAAA,IACzB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,cAAc,CAAC,EAAE,OAAO,MAAM;AAC5B,cAAQ,IAAI,QAAQ,YAAY,OAAO,OAAO,EAAE,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AACH;AAEA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AACrE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,UAAU,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,CAAC;AAC3E,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACxE,WAAO,EAAE,QAAQ,gBAAgB,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,YAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,YAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAC5D,eAAO,YAAY,oBAAI,KAAK;AAAA,MAC9B;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,eAAgB,UAAU,UAAU;AAC1C,UAAM,QAAQ,gBAAgB,MAAM;AACpC,UAAM,UAAU,aAAa,cAAc,OAAkC,CAAC,QAAQ,UAAU,CAAC;AACjG,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B;AAAA,MACA,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,MAAM,sBAA4F;AAAA,EAChG,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,WAAO,WAAW,EAAE,QAAQ,gBAAgB,QAAQ,EAAE,IAAI,CAAC;AAAA,EAC7D;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,KAAK,UAAU,UAAU,oBAAoB;AACnD,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,WAAW,KAAK;AAAA,MAC7B,MAAM;AAAA,MACN,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,EAAE;AAAA,MACb,gBAAgB;AAAA,MAChB,UAAU,OAAO,EAAE;AAAA,IACrB;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,OAAO,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,iBAAkB,UAAU,UAAU;AAC5C,UAAM,KAAK,OAAO,OAAO,MAAM,MAAM,OAAO,OAAO,MAAM,EAAE;AAC3D,UAAM,aAAa,gBAAgB,MAAM;AACzC,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,MAAM,cAAc;AAAA,MAChC,gBAAgB,kBAAkB;AAAA,MAClC,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;",
   "names": []
 }

package/dist/modules/directory/utils/organizationScope.js

@@ -1,6 +1,8 @@
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { isAllOrganizationsSelection } from "@open-mercato/core/modules/directory/constants";
 import { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from "./scopeCookies.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("directory").child({ component: "org-scope-cache" });
 const ORG_SCOPE_CACHE_KEY_PREFIX = "org-scope";
 const ORG_SCOPE_DEFAULT_TTL_MS = 0;
 function resolveOrgScopeTtlMs() {
@@ -50,7 +52,7 @@ async function invalidateOrganizationScopeCacheForUser(container, userId) {
   try {
     await cache.deleteByTags([buildOrgScopeUserCacheTag(userId)]);
   } catch (err) {
-    console.warn("[org-scope:cache] invalidate user failed", err);
+    logger.warn("Cache invalidate user failed", { err });
   }
 }
 async function invalidateOrganizationScopeCacheForTenant(container, tenantId) {
@@ -59,7 +61,7 @@ async function invalidateOrganizationScopeCacheForTenant(container, tenantId) {
   try {
     await cache.deleteByTags([buildOrgScopeTenantCacheTag(tenantId)]);
   } catch (err) {
-    console.warn("[org-scope:cache] invalidate tenant failed", err);
+    logger.warn("Cache invalidate tenant failed", { err });
   }
 }
 const orgScopeRequestMemo = /* @__PURE__ */ new WeakMap();
@@ -304,7 +306,7 @@ async function resolveOrganizationScopeForRequest({
         const cached = await cache.get(cacheKey);
         if (isValidCachedScope(cached)) return cached;
       } catch (err) {
-        console.warn("[org-scope:cache] read failed", err);
+        logger.warn("Cache read failed", { err });
       }
     }
     const baseScope = await resolveOrganizationScope({
@@ -321,7 +323,7 @@ async function resolveOrganizationScopeForRequest({
           tags: buildOrgScopeCacheTags({ userId, effectiveTenantId })
         });
       } catch (err) {
-        console.warn("[org-scope:cache] write failed", err);
+        logger.warn("Cache write failed", { err });
       }
     }
     return baseScope;

package/dist/modules/directory/utils/organizationScope.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/directory/utils/organizationScope.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { AwilixContainer } from 'awilix'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'\n\nexport { parseSelectedOrganizationCookie, parseSelectedTenantCookie }\n\nexport type OrganizationScope = {\n  selectedId: string | null\n  filterIds: string[] | null\n  allowedIds: string[] | null\n  tenantId: string | null\n}\n\n// Phase 4 \u2014 short-TTL cache for resolveOrganizationScopeForRequest.\n// OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,\n// requestedTenant) between membership changes; caching it bypasses 1\n// SELECT on `organizations` per CRUD request. TTL is short (60s default)\n// to keep staleness bounded as a backstop. Tag-based invalidation also fires\n// eagerly: per-user entries are dropped by RbacService.invalidateUserCache\n// (every ACL/role grant change goes through it \u2014 see buildOrgScopeUserCacheTag)\n// and per-tenant entries by the directory.organization.* subscriber plus\n// RbacService.invalidateTenantCache (role-ACL changes).\nconst ORG_SCOPE_CACHE_KEY_PREFIX = 'org-scope'\n// Phase 4 default-off until the same readiness probe (`GET /api/customers/people`)\n// stays green with the cache layer engaged. Set `OM_ORG_SCOPE_CACHE_TTL_MS=60000`\n// (or any positive integer) to opt in once cross-request safety is re-verified.\nconst ORG_SCOPE_DEFAULT_TTL_MS = 0\n\nfunction resolveOrgScopeTtlMs(): number {\n  const raw = process.env.OM_ORG_SCOPE_CACHE_TTL_MS\n  if (raw === undefined) return ORG_SCOPE_DEFAULT_TTL_MS\n  const parsed = Number(raw)\n  if (!Number.isFinite(parsed) || parsed < 0) return ORG_SCOPE_DEFAULT_TTL_MS\n  return parsed\n}\n\nfunction buildOrgScopeCacheKey(parts: {\n  userId: string\n  effectiveTenantId: string\n  selectedOrgId: string | null\n  requestedTenantId: string | null\n}): string {\n  const selected = parts.selectedOrgId ?? 'none'\n  const requested = parts.requestedTenantId ?? 'none'\n  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:${parts.userId}:${parts.effectiveTenantId}:${selected}:${requested}`\n}\n\n// Tag builders are exported so the modules that own the \"this user's scope\n// changed\" / \"this tenant's org tree changed\" signals (auth RBAC invalidation,\n// the directory.organization.* subscriber) can drop the matching cross-request\n// cache entries without re-deriving the tag format. Keeping the format in one\n// place is what lets the TTL be enabled safely (issue #2259).\nexport function buildOrgScopeUserCacheTag(userId: string): string {\n  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:user:${userId}`\n}\n\nexport function buildOrgScopeTenantCacheTag(tenantId: string): string {\n  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:tenant:${tenantId}`\n}\n\nfunction buildOrgScopeCacheTags(parts: { userId: string; effectiveTenantId: string }): string[] {\n  return [\n    buildOrgScopeUserCacheTag(parts.userId),\n    buildOrgScopeTenantCacheTag(parts.effectiveTenantId),\n  ]\n}\n\nfunction isValidCachedScope(value: unknown): value is OrganizationScope {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<OrganizationScope>\n  const idOk = (v: unknown) => v === null || typeof v === 'string'\n  const arrOk = (v: unknown) => v === null || (Array.isArray(v) && v.every((entry) => typeof entry === 'string'))\n  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds)\n}\n\nfunction resolveCacheFromContainer(container: AwilixContainer | null | undefined): CacheStrategy | null {\n  if (!container) return null\n  try {\n    const c = container.resolve('cache') as CacheStrategy | undefined\n    if (c && typeof c.get === 'function' && typeof c.set === 'function') return c\n  } catch {\n    return null\n  }\n  return null\n}\n\nexport async function invalidateOrganizationScopeCacheForUser(\n  container: AwilixContainer,\n  userId: string,\n): Promise<void> {\n  const cache = resolveCacheFromContainer(container)\n  if (!cache?.deleteByTags) return\n  try {\n    await cache.deleteByTags([buildOrgScopeUserCacheTag(userId)])\n  } catch (err) {\n    console.warn('[org-scope:cache] invalidate user failed', err)\n  }\n}\n\nexport async function invalidateOrganizationScopeCacheForTenant(\n  container: AwilixContainer,\n  tenantId: string,\n): Promise<void> {\n  const cache = resolveCacheFromContainer(container)\n  if (!cache?.deleteByTags) return\n  try {\n    await cache.deleteByTags([buildOrgScopeTenantCacheTag(tenantId)])\n  } catch (err) {\n    console.warn('[org-scope:cache] invalidate tenant failed', err)\n  }\n}\n\n// Issue #2259 \u2014 per-request memoization. resolveOrganizationScopeForRequest\n// runs at least twice per CRUD request: once for the route-level feature check\n// (resolveFeatureCheckContext) and once inside the shared factory's withCtx.\n// Those two call sites use different request-scoped DI containers but are handed\n// the SAME Request instance, so memoizing the resolved scope on a WeakMap keyed\n// by that request collapses the duplicate work \u2014 and the duplicate\n// `organizations` SELECT \u2014 into a single resolution. The inner map is keyed by\n// the same identity tuple as the cross-request cache key, so distinct explicit\n// selectedId/tenant overrides on one request stay independent. There is no\n// staleness risk: the memo lives only for the lifetime of one request and is\n// dropped with the request object by the GC.\nconst orgScopeRequestMemo = new WeakMap<object, Map<string, Promise<OrganizationScope>>>()\n\nfunction getRequestScopeMemo(request: unknown): Map<string, Promise<OrganizationScope>> | null {\n  if (!request || (typeof request !== 'object' && typeof request !== 'function')) return null\n  const key = request as object\n  let memo = orgScopeRequestMemo.get(key)\n  if (!memo) {\n    memo = new Map<string, Promise<OrganizationScope>>()\n    orgScopeRequestMemo.set(key, memo)\n  }\n  return memo\n}\n\nfunction normalizeOrganizationId(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\nexport function getSelectedOrganizationFromRequest(req: Request | { cookies?: { get: (name: string) => { value: string } | undefined }; headers?: { get(name: string): string | null } }): string | null {\n  const cookieContainer = (req as { cookies?: { get: (name: string) => { value: string } | undefined } }).cookies\n  if (cookieContainer && typeof cookieContainer.get === 'function') {\n    const val = cookieContainer.get('om_selected_org')?.value\n    return val ?? null\n  }\n  const headerContainer = (req as { headers?: { get(name: string): string | null } }).headers\n  const header = typeof headerContainer?.get === 'function' ? headerContainer.get('cookie') : null\n  return parseSelectedOrganizationCookie(header)\n}\n\nexport function getSelectedTenantFromRequest(\n  req: Request | { cookies?: { get: (name: string) => { value: string } | undefined }; headers?: { get(name: string): string | null } },\n): string | null {\n  const cookieContainer = (req as { cookies?: { get: (name: string) => { value: string } | undefined } }).cookies\n  if (cookieContainer && typeof cookieContainer.get === 'function') {\n    const val = cookieContainer.get('om_selected_tenant')?.value\n    return val ?? null\n  }\n  const headerContainer = (req as { headers?: { get(name: string): string | null } }).headers\n  const header = typeof headerContainer?.get === 'function' ? headerContainer.get('cookie') : null\n  return parseSelectedTenantCookie(header)\n}\n\nfunction normalizeOrganizationIds(ids: string[]): string[] {\n  return Array.from(new Set(\n    ids.map((value) => normalizeOrganizationId(value)).filter((value): value is string => {\n      if (!value) return false\n      if (isAllOrganizationsSelection(value)) return false\n      return true\n    })\n  ))\n}\n\n// Map each organization id to itself plus its persisted descendant ids. Only\n// orgs that exist for the tenant and are not soft-deleted are included, so an\n// unknown/inaccessible id simply has no entry (matching the per-id query that\n// returned an empty set for it).\ntype OrgDescendantMap = Map<string, string[]>\n\n// Issue #2228 \u2014 single round-trip for org-scope resolution. Instead of issuing\n// one `organizations` SELECT per `collectWithDescendants` call (up to 3-4\n// sequential queries per request: accessible set, fallback set, selected set),\n// gather every candidate id up front and fetch their descendant expansions in\n// one `em.find(Organization, { id: $in })`. Expansion then happens in-memory.\nasync function loadOrgDescendantMap(em: EntityManager, tenantId: string, ids: string[]): Promise<OrgDescendantMap> {\n  const unique = normalizeOrganizationIds(ids)\n  if (!unique.length) return new Map()\n  const filter: FilterQuery<Organization> = {\n    tenant: tenantId,\n    id: { $in: unique },\n    deletedAt: null,\n  }\n  const orgs = await em.find(Organization, filter)\n  const map: OrgDescendantMap = new Map()\n  for (const org of orgs) {\n    const id = String(org.id)\n    const expansion = [id]\n    if (Array.isArray(org.descendantIds)) {\n      for (const desc of org.descendantIds) expansion.push(String(desc))\n    }\n    map.set(id, expansion)\n  }\n  return map\n}\n\nfunction expandWithDescendants(map: OrgDescendantMap, ids: string[]): Set<string> {\n  const set = new Set<string>()\n  for (const value of ids) {\n    const id = normalizeOrganizationId(value)\n    if (!id || isAllOrganizationsSelection(id)) continue\n    const expansion = map.get(id)\n    if (!expansion) continue\n    for (const entry of expansion) set.add(entry)\n  }\n  return set\n}\n\nexport async function resolveOrganizationScope({\n  em,\n  rbac,\n  auth,\n  selectedId,\n  tenantId: tenantIdOverride,\n}: {\n  em: EntityManager\n  rbac: RbacService\n  auth: AuthContext\n  selectedId?: string | null\n  tenantId?: string | null\n}): Promise<OrganizationScope> {\n  if (!auth || !auth.sub) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n  const actorTenantId = typeof auth.tenantId === 'string' && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null\n  const candidateTenantId = typeof tenantIdOverride === 'string' && tenantIdOverride.trim().length > 0\n    ? tenantIdOverride.trim()\n    : tenantIdOverride === null\n      ? null\n      : actorTenantId\n  if (!candidateTenantId) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n  const usingOverride = candidateTenantId !== actorTenantId\n  const isSuperAdminActor = auth.isSuperAdmin === true\n  const tenantId = usingOverride && actorTenantId && !isSuperAdminActor ? actorTenantId : candidateTenantId\n  if (!tenantId) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n  const normalizedRequestedSelection = normalizeOrganizationId(selectedId)\n  const explicitAllOrgsChoice =\n    normalizedRequestedSelection !== null && isAllOrganizationsSelection(normalizedRequestedSelection)\n  const normalizedSelectedId = explicitAllOrgsChoice\n    ? null\n    : normalizedRequestedSelection\n  const contextOrgId = actorTenantId && actorTenantId === tenantId ? normalizeOrganizationId(auth.orgId) : null\n  const acl = await rbac.loadAcl(auth.sub, { tenantId, organizationId: contextOrgId })\n  const aclIsSuperAdmin = acl?.isSuperAdmin === true\n  const effectiveSuperAdmin = aclIsSuperAdmin || isSuperAdminActor\n  const normalizedAccessible = effectiveSuperAdmin\n    ? null\n    : Array.isArray(acl?.organizations)\n      ? acl.organizations\n        .map((value) => normalizeOrganizationId(value))\n        .filter((value): value is string => value !== null)\n      : null\n  const accessibleList = effectiveSuperAdmin\n    ? null\n    : normalizedAccessible && normalizedAccessible.some((value) => isAllOrganizationsSelection(value))\n      ? null\n      : normalizedAccessible?.filter((value) => !isAllOrganizationsSelection(value)) ?? null\n\n  const accountOrgId = actorTenantId && actorTenantId === tenantId ? normalizeOrganizationId(auth.orgId) : null\n  const fallbackOrgId = accountOrgId ?? null\n\n  // Every id that could be expanded below \u2014 accessible set, fallback (account)\n  // org, and the requested selection \u2014 is known up front, so fetch them all in\n  // a single `organizations` query and expand from the in-memory map.\n  const candidateIds = [\n    ...(accessibleList ?? []),\n    ...(fallbackOrgId ? [fallbackOrgId] : []),\n    ...(normalizedSelectedId ? [normalizedSelectedId] : []),\n  ]\n  const orgDescendants = await loadOrgDescendantMap(em, tenantId, candidateIds)\n  const loadFallbackSet = (): Set<string> | null =>\n    fallbackOrgId ? expandWithDescendants(orgDescendants, [fallbackOrgId]) : null\n\n  let allowedSet: Set<string> | null = null\n  if (accessibleList === null) {\n    allowedSet = null\n  } else if (accessibleList.length === 0) {\n    allowedSet = new Set()\n  } else {\n    allowedSet = expandWithDescendants(orgDescendants, accessibleList)\n  }\n\n  if (allowedSet && allowedSet.size === 0 && fallbackOrgId) {\n    const computed = loadFallbackSet()\n    if (computed && computed.size > 0) {\n      allowedSet = computed\n    }\n  }\n\n  const hasUnrestrictedAccess = effectiveSuperAdmin || (accessibleList === null)\n  const noOrgSelection = normalizedSelectedId === null && !explicitAllOrgsChoice\n  const widenToAllOrgs =\n    (explicitAllOrgsChoice && hasUnrestrictedAccess)\n    || (effectiveSuperAdmin && noOrgSelection)\n  const initialSelected =\n    normalizedSelectedId\n    ?? (widenToAllOrgs ? null : accountOrgId ?? null)\n  let effectiveSelected: string | null = null\n  if (initialSelected) {\n    if (allowedSet === null || allowedSet.has(initialSelected)) {\n      effectiveSelected = initialSelected\n    }\n  }\n\n  let filterSet: Set<string> | null = null\n  if (effectiveSelected) {\n    filterSet = expandWithDescendants(orgDescendants, [effectiveSelected])\n  } else if (allowedSet !== null) {\n    filterSet = allowedSet\n  } else if (widenToAllOrgs) {\n    filterSet = null\n  } else if (auth.orgId) {\n    filterSet = loadFallbackSet()\n  }\n\n  if ((!filterSet || filterSet.size === 0) && fallbackOrgId && !widenToAllOrgs) {\n    const computed = loadFallbackSet()\n    if (computed && computed.size > 0) {\n      filterSet = computed\n      if (!effectiveSelected) {\n        effectiveSelected = fallbackOrgId\n      }\n    }\n  }\n\n  return {\n    selectedId: effectiveSelected,\n    filterIds: filterSet ? Array.from(filterSet) : null,\n    allowedIds: allowedSet ? Array.from(allowedSet) : null,\n    tenantId,\n  }\n}\n\nexport async function resolveOrganizationScopeForRequest({\n  container,\n  auth,\n  request,\n  selectedId,\n  tenantId: tenantOverride,\n}: {\n  container: AwilixContainer\n  auth: AuthContext | null | undefined\n  request?: Request | { cookies?: { get: (name: string) => { value: string } | undefined }; headers?: { get(name: string): string | null } }\n  selectedId?: string | null\n  tenantId?: string | null\n}): Promise<OrganizationScope> {\n  if (!auth || !auth.sub) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n\n  let em: EntityManager | null = null\n  let rbac: RbacService | null = null\n  try { em = container.resolve<EntityManager>('em') } catch { em = null }\n  try { rbac = container.resolve<RbacService>('rbacService') } catch { rbac = null }\n  const normalizeString = (value: unknown): string | null => {\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n    return null\n  }\n  if (!em || !rbac) {\n    const fallbackSelected = normalizeOrganizationId(selectedId ?? auth.orgId ?? null)\n    return {\n      selectedId: fallbackSelected,\n      filterIds: fallbackSelected ? [fallbackSelected] : null,\n      allowedIds: fallbackSelected ? [fallbackSelected] : null,\n      tenantId: normalizeString(auth.tenantId),\n    }\n  }\n\n  const actorTenantField = (auth as { actorTenantId?: string | null }).actorTenantId\n  const actorTenant = actorTenantField === undefined\n    ? normalizeString(auth.tenantId)\n    : actorTenantField === null\n      ? null\n      : normalizeString(actorTenantField)\n  const actorOrgField = (auth as { actorOrgId?: string | null }).actorOrgId\n  const actorOrgId = actorOrgField === undefined\n    ? normalizeString(auth.orgId)\n    : actorOrgField === null\n      ? null\n      : normalizeString(actorOrgField)\n\n  const cookieTenant = request ? getSelectedTenantFromRequest(request) : null\n  const requestedTenant =\n    tenantOverride !== undefined\n      ? tenantOverride\n      : cookieTenant !== undefined\n        ? cookieTenant\n        : undefined\n  const requestedTenantId = typeof requestedTenant === 'string' && requestedTenant.trim().length > 0 ? requestedTenant.trim() : null\n  const isSuperAdminActor = auth.isSuperAdmin === true\n  let effectiveTenantId = requestedTenantId ?? actorTenant ?? null\n  if (actorTenant && effectiveTenantId && effectiveTenantId !== actorTenant && !isSuperAdminActor) {\n    effectiveTenantId = actorTenant\n  }\n  if (!effectiveTenantId) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n\n  const scopedAuth = {\n    ...auth,\n    tenantId: effectiveTenantId,\n    orgId: actorTenant && actorTenant === effectiveTenantId ? actorOrgId ?? null : null,\n  }\n\n  const rawSelected = selectedId !== undefined ? selectedId : (request ? getSelectedOrganizationFromRequest(request) : null)\n  const normalizedSelectedId = typeof rawSelected === 'string' && rawSelected.trim().length > 0\n    ? rawSelected.trim()\n    : null\n\n  const userId = typeof auth.sub === 'string' && auth.sub.length > 0 ? auth.sub : null\n  const ttlMs = resolveOrgScopeTtlMs()\n  const cache = ttlMs > 0 ? resolveCacheFromContainer(container) : null\n  const cacheKey = userId\n    ? buildOrgScopeCacheKey({\n        userId,\n        effectiveTenantId,\n        selectedOrgId: normalizedSelectedId,\n        requestedTenantId: requestedTenantId ?? null,\n      })\n    : null\n\n  const requestMemo = getRequestScopeMemo(request)\n  if (requestMemo && cacheKey) {\n    const memoized = requestMemo.get(cacheKey)\n    if (memoized) return memoized\n  }\n\n  const resolveScope = async (): Promise<OrganizationScope> => {\n    if (cache && cacheKey && typeof cache.get === 'function') {\n      try {\n        const cached = await cache.get(cacheKey)\n        if (isValidCachedScope(cached)) return cached\n      } catch (err) {\n        console.warn('[org-scope:cache] read failed', err)\n      }\n    }\n\n    const baseScope = await resolveOrganizationScope({\n      em,\n      rbac,\n      auth: scopedAuth,\n      selectedId: rawSelected,\n      tenantId: effectiveTenantId,\n    })\n\n    if (cache && cacheKey && userId && typeof cache.set === 'function') {\n      try {\n        await cache.set(cacheKey, baseScope, {\n          ttl: ttlMs,\n          tags: buildOrgScopeCacheTags({ userId, effectiveTenantId }),\n        })\n      } catch (err) {\n        console.warn('[org-scope:cache] write failed', err)\n      }\n    }\n\n    return baseScope\n  }\n\n  if (requestMemo && cacheKey) {\n    const pending = resolveScope()\n    requestMemo.set(cacheKey, pending)\n    return pending\n  }\n\n  return resolveScope()\n}\n\nexport type FeatureCheckContext = {\n  organizationId: string | null\n  scope: OrganizationScope\n  allowedOrganizationIds: string[] | null\n}\n\nexport async function resolveFeatureCheckContext({\n  container,\n  auth,\n  request,\n  selectedId,\n  tenantId,\n}: {\n  container: AwilixContainer\n  auth: AuthContext | null | undefined\n  request?: Request | { cookies?: { get: (name: string) => { value: string } | undefined } }\n  selectedId?: string | null\n  tenantId?: string | null\n}): Promise<FeatureCheckContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request, selectedId, tenantId })\n  const allowedOrganizationIds = scope.allowedIds ?? null\n  const authOrgId = auth?.orgId ?? null\n  const organizationId =\n    scope.selectedId\n    ?? (authOrgId && (!Array.isArray(allowedOrganizationIds) || allowedOrganizationIds.includes(authOrgId)) ? authOrgId : null)\n    ?? (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length ? allowedOrganizationIds[0] : null)\n\n  return { organizationId, scope, allowedOrganizationIds }\n}\n"],
-  "mappings": "AAGA,SAAS,oBAAoB;AAC7B,SAAS,mCAAmC;AAI5C,SAAS,iCAAiC,iCAAiC;AAoB3E,MAAM,6BAA6B;AAInC,MAAM,2BAA2B;AAEjC,SAAS,uBAA+B;AACtC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,SAAS,OAAO,GAAG;AACzB,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;AAEA,SAAS,sBAAsB,OAKpB;AACT,QAAM,WAAW,MAAM,iBAAiB;AACxC,QAAM,YAAY,MAAM,qBAAqB;AAC7C,SAAO,GAAG,0BAA0B,IAAI,MAAM,MAAM,IAAI,MAAM,iBAAiB,IAAI,QAAQ,IAAI,SAAS;AAC1G;AAOO,SAAS,0BAA0B,QAAwB;AAChE,SAAO,GAAG,0BAA0B,SAAS,MAAM;AACrD;AAEO,SAAS,4BAA4B,UAA0B;AACpE,SAAO,GAAG,0BAA0B,WAAW,QAAQ;AACzD;AAEA,SAAS,uBAAuB,OAAgE;AAC9F,SAAO;AAAA,IACL,0BAA0B,MAAM,MAAM;AAAA,IACtC,4BAA4B,MAAM,iBAAiB;AAAA,EACrD;AACF;AAEA,SAAS,mBAAmB,OAA4C;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,QAAM,OAAO,CAAC,MAAe,MAAM,QAAQ,OAAO,MAAM;AACxD,QAAM,QAAQ,CAAC,MAAe,MAAM,QAAS,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AAC7G,SAAO,KAAK,OAAO,UAAU,KAAK,KAAK,OAAO,QAAQ,KAAK,MAAM,OAAO,SAAS,KAAK,MAAM,OAAO,UAAU;AAC/G;AAEA,SAAS,0BAA0B,WAAqE;AACtG,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI;AACF,UAAM,IAAI,UAAU,QAAQ,OAAO;AACnC,QAAI,KAAK,OAAO,EAAE,QAAQ,cAAc,OAAO,EAAE,QAAQ,WAAY,QAAO;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,eAAsB,wCACpB,WACA,QACe;AACf,QAAM,QAAQ,0BAA0B,SAAS;AACjD,MAAI,CAAC,OAAO,aAAc;AAC1B,MAAI;AACF,UAAM,MAAM,aAAa,CAAC,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC9D,SAAS,KAAK;AACZ,YAAQ,KAAK,4CAA4C,GAAG;AAAA,EAC9D;AACF;AAEA,eAAsB,0CACpB,WACA,UACe;AACf,QAAM,QAAQ,0BAA0B,SAAS;AACjD,MAAI,CAAC,OAAO,aAAc;AAC1B,MAAI;AACF,UAAM,MAAM,aAAa,CAAC,4BAA4B,QAAQ,CAAC,CAAC;AAAA,EAClE,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA8C,GAAG;AAAA,EAChE;AACF;AAaA,MAAM,sBAAsB,oBAAI,QAAyD;AAEzF,SAAS,oBAAoB,SAAkE;AAC7F,MAAI,CAAC,WAAY,OAAO,YAAY,YAAY,OAAO,YAAY,WAAa,QAAO;AACvF,QAAM,MAAM;AACZ,MAAI,OAAO,oBAAoB,IAAI,GAAG;AACtC,MAAI,CAAC,MAAM;AACT,WAAO,oBAAI,IAAwC;AACnD,wBAAoB,IAAI,KAAK,IAAI;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEO,SAAS,mCAAmC,KAAsJ;AACvM,QAAM,kBAAmB,IAA+E;AACxG,MAAI,mBAAmB,OAAO,gBAAgB,QAAQ,YAAY;AAChE,UAAM,MAAM,gBAAgB,IAAI,iBAAiB,GAAG;AACpD,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,kBAAmB,IAA2D;AACpF,QAAM,SAAS,OAAO,iBAAiB,QAAQ,aAAa,gBAAgB,IAAI,QAAQ,IAAI;AAC5F,SAAO,gCAAgC,MAAM;AAC/C;AAEO,SAAS,6BACd,KACe;AACf,QAAM,kBAAmB,IAA+E;AACxG,MAAI,mBAAmB,OAAO,gBAAgB,QAAQ,YAAY;AAChE,UAAM,MAAM,gBAAgB,IAAI,oBAAoB,GAAG;AACvD,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,kBAAmB,IAA2D;AACpF,QAAM,SAAS,OAAO,iBAAiB,QAAQ,aAAa,gBAAgB,IAAI,QAAQ,IAAI;AAC5F,SAAO,0BAA0B,MAAM;AACzC;AAEA,SAAS,yBAAyB,KAAyB;AACzD,SAAO,MAAM,KAAK,IAAI;AAAA,IACpB,IAAI,IAAI,CAAC,UAAU,wBAAwB,KAAK,CAAC,EAAE,OAAO,CAAC,UAA2B;AACpF,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI,4BAA4B,KAAK,EAAG,QAAO;AAC/C,aAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AACH;AAaA,eAAe,qBAAqB,IAAmB,UAAkB,KAA0C;AACjH,QAAM,SAAS,yBAAyB,GAAG;AAC3C,MAAI,CAAC,OAAO,OAAQ,QAAO,oBAAI,IAAI;AACnC,QAAM,SAAoC;AAAA,IACxC,QAAQ;AAAA,IACR,IAAI,EAAE,KAAK,OAAO;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,OAAO,MAAM,GAAG,KAAK,cAAc,MAAM;AAC/C,QAAM,MAAwB,oBAAI,IAAI;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,KAAK,OAAO,IAAI,EAAE;AACxB,UAAM,YAAY,CAAC,EAAE;AACrB,QAAI,MAAM,QAAQ,IAAI,aAAa,GAAG;AACpC,iBAAW,QAAQ,IAAI,cAAe,WAAU,KAAK,OAAO,IAAI,CAAC;AAAA,IACnE;AACA,QAAI,IAAI,IAAI,SAAS;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAuB,KAA4B;AAChF,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,SAAS,KAAK;AACvB,UAAM,KAAK,wBAAwB,KAAK;AACxC,QAAI,CAAC,MAAM,4BAA4B,EAAE,EAAG;AAC5C,UAAM,YAAY,IAAI,IAAI,EAAE;AAC5B,QAAI,CAAC,UAAW;AAChB,eAAW,SAAS,UAAW,KAAI,IAAI,KAAK;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AACZ,GAM+B;AAC7B,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AACA,QAAM,gBAAgB,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,IAAI,KAAK,SAAS,KAAK,IAAI;AACpH,QAAM,oBAAoB,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,IAC/F,iBAAiB,KAAK,IACtB,qBAAqB,OACnB,OACA;AACN,MAAI,CAAC,mBAAmB;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AACA,QAAM,gBAAgB,sBAAsB;AAC5C,QAAM,oBAAoB,KAAK,iBAAiB;AAChD,QAAM,WAAW,iBAAiB,iBAAiB,CAAC,oBAAoB,gBAAgB;AACxF,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AACA,QAAM,+BAA+B,wBAAwB,UAAU;AACvE,QAAM,wBACJ,iCAAiC,QAAQ,4BAA4B,4BAA4B;AACnG,QAAM,uBAAuB,wBACzB,OACA;AACJ,QAAM,eAAe,iBAAiB,kBAAkB,WAAW,wBAAwB,KAAK,KAAK,IAAI;AACzG,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,gBAAgB,aAAa,CAAC;AACnF,QAAM,kBAAkB,KAAK,iBAAiB;AAC9C,QAAM,sBAAsB,mBAAmB;AAC/C,QAAM,uBAAuB,sBACzB,OACA,MAAM,QAAQ,KAAK,aAAa,IAC9B,IAAI,cACH,IAAI,CAAC,UAAU,wBAAwB,KAAK,CAAC,EAC7C,OAAO,CAAC,UAA2B,UAAU,IAAI,IAClD;AACN,QAAM,iBAAiB,sBACnB,OACA,wBAAwB,qBAAqB,KAAK,CAAC,UAAU,4BAA4B,KAAK,CAAC,IAC7F,OACA,sBAAsB,OAAO,CAAC,UAAU,CAAC,4BAA4B,KAAK,CAAC,KAAK;AAEtF,QAAM,eAAe,iBAAiB,kBAAkB,WAAW,wBAAwB,KAAK,KAAK,IAAI;AACzG,QAAM,gBAAgB,gBAAgB;AAKtC,QAAM,eAAe;AAAA,IACnB,GAAI,kBAAkB,CAAC;AAAA,IACvB,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,uBAAuB,CAAC,oBAAoB,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,iBAAiB,MAAM,qBAAqB,IAAI,UAAU,YAAY;AAC5E,QAAM,kBAAkB,MACtB,gBAAgB,sBAAsB,gBAAgB,CAAC,aAAa,CAAC,IAAI;AAE3E,MAAI,aAAiC;AACrC,MAAI,mBAAmB,MAAM;AAC3B,iBAAa;AAAA,EACf,WAAW,eAAe,WAAW,GAAG;AACtC,iBAAa,oBAAI,IAAI;AAAA,EACvB,OAAO;AACL,iBAAa,sBAAsB,gBAAgB,cAAc;AAAA,EACnE;AAEA,MAAI,cAAc,WAAW,SAAS,KAAK,eAAe;AACxD,UAAM,WAAW,gBAAgB;AACjC,QAAI,YAAY,SAAS,OAAO,GAAG;AACjC,mBAAa;AAAA,IACf;AAAA,EACF;AAEA,QAAM,wBAAwB,uBAAwB,mBAAmB;AACzE,QAAM,iBAAiB,yBAAyB,QAAQ,CAAC;AACzD,QAAM,iBACH,yBAAyB,yBACtB,uBAAuB;AAC7B,QAAM,kBACJ,yBACI,iBAAiB,OAAO,gBAAgB;AAC9C,MAAI,oBAAmC;AACvC,MAAI,iBAAiB;AACnB,QAAI,eAAe,QAAQ,WAAW,IAAI,eAAe,GAAG;AAC1D,0BAAoB;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,YAAgC;AACpC,MAAI,mBAAmB;AACrB,gBAAY,sBAAsB,gBAAgB,CAAC,iBAAiB,CAAC;AAAA,EACvE,WAAW,eAAe,MAAM;AAC9B,gBAAY;AAAA,EACd,WAAW,gBAAgB;AACzB,gBAAY;AAAA,EACd,WAAW,KAAK,OAAO;AACrB,gBAAY,gBAAgB;AAAA,EAC9B;AAEA,OAAK,CAAC,aAAa,UAAU,SAAS,MAAM,iBAAiB,CAAC,gBAAgB;AAC5E,UAAM,WAAW,gBAAgB;AACjC,QAAI,YAAY,SAAS,OAAO,GAAG;AACjC,kBAAY;AACZ,UAAI,CAAC,mBAAmB;AACtB,4BAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW,YAAY,MAAM,KAAK,SAAS,IAAI;AAAA,IAC/C,YAAY,aAAa,MAAM,KAAK,UAAU,IAAI;AAAA,IAClD;AAAA,EACF;AACF;AAEA,eAAsB,mCAAmC;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AACZ,GAM+B;AAC7B,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AAEA,MAAI,KAA2B;AAC/B,MAAI,OAA2B;AAC/B,MAAI;AAAE,SAAK,UAAU,QAAuB,IAAI;AAAA,EAAE,QAAQ;AAAE,SAAK;AAAA,EAAK;AACtE,MAAI;AAAE,WAAO,UAAU,QAAqB,aAAa;AAAA,EAAE,QAAQ;AAAE,WAAO;AAAA,EAAK;AACjF,QAAM,kBAAkB,CAAC,UAAkC;AACzD,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAC5E,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,CAAC,MAAM;AAChB,UAAM,mBAAmB,wBAAwB,cAAc,KAAK,SAAS,IAAI;AACjF,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW,mBAAmB,CAAC,gBAAgB,IAAI;AAAA,MACnD,YAAY,mBAAmB,CAAC,gBAAgB,IAAI;AAAA,MACpD,UAAU,gBAAgB,KAAK,QAAQ;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,mBAAoB,KAA2C;AACrE,QAAM,cAAc,qBAAqB,SACrC,gBAAgB,KAAK,QAAQ,IAC7B,qBAAqB,OACnB,OACA,gBAAgB,gBAAgB;AACtC,QAAM,gBAAiB,KAAwC;AAC/D,QAAM,aAAa,kBAAkB,SACjC,gBAAgB,KAAK,KAAK,IAC1B,kBAAkB,OAChB,OACA,gBAAgB,aAAa;AAEnC,QAAM,eAAe,UAAU,6BAA6B,OAAO,IAAI;AACvE,QAAM,kBACJ,mBAAmB,SACf,iBACA,iBAAiB,SACf,eACA;AACR,QAAM,oBAAoB,OAAO,oBAAoB,YAAY,gBAAgB,KAAK,EAAE,SAAS,IAAI,gBAAgB,KAAK,IAAI;AAC9H,QAAM,oBAAoB,KAAK,iBAAiB;AAChD,MAAI,oBAAoB,qBAAqB,eAAe;AAC5D,MAAI,eAAe,qBAAqB,sBAAsB,eAAe,CAAC,mBAAmB;AAC/F,wBAAoB;AAAA,EACtB;AACA,MAAI,CAAC,mBAAmB;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,UAAU;AAAA,IACV,OAAO,eAAe,gBAAgB,oBAAoB,cAAc,OAAO;AAAA,EACjF;AAEA,QAAM,cAAc,eAAe,SAAY,aAAc,UAAU,mCAAmC,OAAO,IAAI;AACrH,QAAM,uBAAuB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IACxF,YAAY,KAAK,IACjB;AAEJ,QAAM,SAAS,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AAChF,QAAM,QAAQ,qBAAqB;AACnC,QAAM,QAAQ,QAAQ,IAAI,0BAA0B,SAAS,IAAI;AACjE,QAAM,WAAW,SACb,sBAAsB;AAAA,IACpB;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf,mBAAmB,qBAAqB;AAAA,EAC1C,CAAC,IACD;AAEJ,QAAM,cAAc,oBAAoB,OAAO;AAC/C,MAAI,eAAe,UAAU;AAC3B,UAAM,WAAW,YAAY,IAAI,QAAQ;AACzC,QAAI,SAAU,QAAO;AAAA,EACvB;AAEA,QAAM,eAAe,YAAwC;AAC3D,QAAI,SAAS,YAAY,OAAO,MAAM,QAAQ,YAAY;AACxD,UAAI;AACF,cAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,YAAI,mBAAmB,MAAM,EAAG,QAAO;AAAA,MACzC,SAAS,KAAK;AACZ,gBAAQ,KAAK,iCAAiC,GAAG;AAAA,MACnD;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,yBAAyB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,SAAS,YAAY,UAAU,OAAO,MAAM,QAAQ,YAAY;AAClE,UAAI;AACF,cAAM,MAAM,IAAI,UAAU,WAAW;AAAA,UACnC,KAAK;AAAA,UACL,MAAM,uBAAuB,EAAE,QAAQ,kBAAkB,CAAC;AAAA,QAC5D,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ,KAAK,kCAAkC,GAAG;AAAA,MACpD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,UAAU;AAC3B,UAAM,UAAU,aAAa;AAC7B,gBAAY,IAAI,UAAU,OAAO;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,aAAa;AACtB;AAQA,eAAsB,2BAA2B;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMiC;AAC/B,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,YAAY,SAAS,CAAC;AACzG,QAAM,yBAAyB,MAAM,cAAc;AACnD,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,iBACJ,MAAM,eACF,cAAc,CAAC,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,SAAS,KAAK,YAAY,UAClH,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,uBAAuB,CAAC,IAAI;AAE3G,SAAO,EAAE,gBAAgB,OAAO,uBAAuB;AACzD;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { AwilixContainer } from 'awilix'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('directory').child({ component: 'org-scope-cache' })\n\nexport { parseSelectedOrganizationCookie, parseSelectedTenantCookie }\n\nexport type OrganizationScope = {\n  selectedId: string | null\n  filterIds: string[] | null\n  allowedIds: string[] | null\n  tenantId: string | null\n}\n\n// Phase 4 \u2014 short-TTL cache for resolveOrganizationScopeForRequest.\n// OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,\n// requestedTenant) between membership changes; caching it bypasses 1\n// SELECT on `organizations` per CRUD request. TTL is short (60s default)\n// to keep staleness bounded as a backstop. Tag-based invalidation also fires\n// eagerly: per-user entries are dropped by RbacService.invalidateUserCache\n// (every ACL/role grant change goes through it \u2014 see buildOrgScopeUserCacheTag)\n// and per-tenant entries by the directory.organization.* subscriber plus\n// RbacService.invalidateTenantCache (role-ACL changes).\nconst ORG_SCOPE_CACHE_KEY_PREFIX = 'org-scope'\n// Phase 4 default-off until the same readiness probe (`GET /api/customers/people`)\n// stays green with the cache layer engaged. Set `OM_ORG_SCOPE_CACHE_TTL_MS=60000`\n// (or any positive integer) to opt in once cross-request safety is re-verified.\nconst ORG_SCOPE_DEFAULT_TTL_MS = 0\n\nfunction resolveOrgScopeTtlMs(): number {\n  const raw = process.env.OM_ORG_SCOPE_CACHE_TTL_MS\n  if (raw === undefined) return ORG_SCOPE_DEFAULT_TTL_MS\n  const parsed = Number(raw)\n  if (!Number.isFinite(parsed) || parsed < 0) return ORG_SCOPE_DEFAULT_TTL_MS\n  return parsed\n}\n\nfunction buildOrgScopeCacheKey(parts: {\n  userId: string\n  effectiveTenantId: string\n  selectedOrgId: string | null\n  requestedTenantId: string | null\n}): string {\n  const selected = parts.selectedOrgId ?? 'none'\n  const requested = parts.requestedTenantId ?? 'none'\n  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:${parts.userId}:${parts.effectiveTenantId}:${selected}:${requested}`\n}\n\n// Tag builders are exported so the modules that own the \"this user's scope\n// changed\" / \"this tenant's org tree changed\" signals (auth RBAC invalidation,\n// the directory.organization.* subscriber) can drop the matching cross-request\n// cache entries without re-deriving the tag format. Keeping the format in one\n// place is what lets the TTL be enabled safely (issue #2259).\nexport function buildOrgScopeUserCacheTag(userId: string): string {\n  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:user:${userId}`\n}\n\nexport function buildOrgScopeTenantCacheTag(tenantId: string): string {\n  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:tenant:${tenantId}`\n}\n\nfunction buildOrgScopeCacheTags(parts: { userId: string; effectiveTenantId: string }): string[] {\n  return [\n    buildOrgScopeUserCacheTag(parts.userId),\n    buildOrgScopeTenantCacheTag(parts.effectiveTenantId),\n  ]\n}\n\nfunction isValidCachedScope(value: unknown): value is OrganizationScope {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<OrganizationScope>\n  const idOk = (v: unknown) => v === null || typeof v === 'string'\n  const arrOk = (v: unknown) => v === null || (Array.isArray(v) && v.every((entry) => typeof entry === 'string'))\n  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds)\n}\n\nfunction resolveCacheFromContainer(container: AwilixContainer | null | undefined): CacheStrategy | null {\n  if (!container) return null\n  try {\n    const c = container.resolve('cache') as CacheStrategy | undefined\n    if (c && typeof c.get === 'function' && typeof c.set === 'function') return c\n  } catch {\n    return null\n  }\n  return null\n}\n\nexport async function invalidateOrganizationScopeCacheForUser(\n  container: AwilixContainer,\n  userId: string,\n): Promise<void> {\n  const cache = resolveCacheFromContainer(container)\n  if (!cache?.deleteByTags) return\n  try {\n    await cache.deleteByTags([buildOrgScopeUserCacheTag(userId)])\n  } catch (err) {\n    logger.warn('Cache invalidate user failed', { err })\n  }\n}\n\nexport async function invalidateOrganizationScopeCacheForTenant(\n  container: AwilixContainer,\n  tenantId: string,\n): Promise<void> {\n  const cache = resolveCacheFromContainer(container)\n  if (!cache?.deleteByTags) return\n  try {\n    await cache.deleteByTags([buildOrgScopeTenantCacheTag(tenantId)])\n  } catch (err) {\n    logger.warn('Cache invalidate tenant failed', { err })\n  }\n}\n\n// Issue #2259 \u2014 per-request memoization. resolveOrganizationScopeForRequest\n// runs at least twice per CRUD request: once for the route-level feature check\n// (resolveFeatureCheckContext) and once inside the shared factory's withCtx.\n// Those two call sites use different request-scoped DI containers but are handed\n// the SAME Request instance, so memoizing the resolved scope on a WeakMap keyed\n// by that request collapses the duplicate work \u2014 and the duplicate\n// `organizations` SELECT \u2014 into a single resolution. The inner map is keyed by\n// the same identity tuple as the cross-request cache key, so distinct explicit\n// selectedId/tenant overrides on one request stay independent. There is no\n// staleness risk: the memo lives only for the lifetime of one request and is\n// dropped with the request object by the GC.\nconst orgScopeRequestMemo = new WeakMap<object, Map<string, Promise<OrganizationScope>>>()\n\nfunction getRequestScopeMemo(request: unknown): Map<string, Promise<OrganizationScope>> | null {\n  if (!request || (typeof request !== 'object' && typeof request !== 'function')) return null\n  const key = request as object\n  let memo = orgScopeRequestMemo.get(key)\n  if (!memo) {\n    memo = new Map<string, Promise<OrganizationScope>>()\n    orgScopeRequestMemo.set(key, memo)\n  }\n  return memo\n}\n\nfunction normalizeOrganizationId(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\nexport function getSelectedOrganizationFromRequest(req: Request | { cookies?: { get: (name: string) => { value: string } | undefined }; headers?: { get(name: string): string | null } }): string | null {\n  const cookieContainer = (req as { cookies?: { get: (name: string) => { value: string } | undefined } }).cookies\n  if (cookieContainer && typeof cookieContainer.get === 'function') {\n    const val = cookieContainer.get('om_selected_org')?.value\n    return val ?? null\n  }\n  const headerContainer = (req as { headers?: { get(name: string): string | null } }).headers\n  const header = typeof headerContainer?.get === 'function' ? headerContainer.get('cookie') : null\n  return parseSelectedOrganizationCookie(header)\n}\n\nexport function getSelectedTenantFromRequest(\n  req: Request | { cookies?: { get: (name: string) => { value: string } | undefined }; headers?: { get(name: string): string | null } },\n): string | null {\n  const cookieContainer = (req as { cookies?: { get: (name: string) => { value: string } | undefined } }).cookies\n  if (cookieContainer && typeof cookieContainer.get === 'function') {\n    const val = cookieContainer.get('om_selected_tenant')?.value\n    return val ?? null\n  }\n  const headerContainer = (req as { headers?: { get(name: string): string | null } }).headers\n  const header = typeof headerContainer?.get === 'function' ? headerContainer.get('cookie') : null\n  return parseSelectedTenantCookie(header)\n}\n\nfunction normalizeOrganizationIds(ids: string[]): string[] {\n  return Array.from(new Set(\n    ids.map((value) => normalizeOrganizationId(value)).filter((value): value is string => {\n      if (!value) return false\n      if (isAllOrganizationsSelection(value)) return false\n      return true\n    })\n  ))\n}\n\n// Map each organization id to itself plus its persisted descendant ids. Only\n// orgs that exist for the tenant and are not soft-deleted are included, so an\n// unknown/inaccessible id simply has no entry (matching the per-id query that\n// returned an empty set for it).\ntype OrgDescendantMap = Map<string, string[]>\n\n// Issue #2228 \u2014 single round-trip for org-scope resolution. Instead of issuing\n// one `organizations` SELECT per `collectWithDescendants` call (up to 3-4\n// sequential queries per request: accessible set, fallback set, selected set),\n// gather every candidate id up front and fetch their descendant expansions in\n// one `em.find(Organization, { id: $in })`. Expansion then happens in-memory.\nasync function loadOrgDescendantMap(em: EntityManager, tenantId: string, ids: string[]): Promise<OrgDescendantMap> {\n  const unique = normalizeOrganizationIds(ids)\n  if (!unique.length) return new Map()\n  const filter: FilterQuery<Organization> = {\n    tenant: tenantId,\n    id: { $in: unique },\n    deletedAt: null,\n  }\n  const orgs = await em.find(Organization, filter)\n  const map: OrgDescendantMap = new Map()\n  for (const org of orgs) {\n    const id = String(org.id)\n    const expansion = [id]\n    if (Array.isArray(org.descendantIds)) {\n      for (const desc of org.descendantIds) expansion.push(String(desc))\n    }\n    map.set(id, expansion)\n  }\n  return map\n}\n\nfunction expandWithDescendants(map: OrgDescendantMap, ids: string[]): Set<string> {\n  const set = new Set<string>()\n  for (const value of ids) {\n    const id = normalizeOrganizationId(value)\n    if (!id || isAllOrganizationsSelection(id)) continue\n    const expansion = map.get(id)\n    if (!expansion) continue\n    for (const entry of expansion) set.add(entry)\n  }\n  return set\n}\n\nexport async function resolveOrganizationScope({\n  em,\n  rbac,\n  auth,\n  selectedId,\n  tenantId: tenantIdOverride,\n}: {\n  em: EntityManager\n  rbac: RbacService\n  auth: AuthContext\n  selectedId?: string | null\n  tenantId?: string | null\n}): Promise<OrganizationScope> {\n  if (!auth || !auth.sub) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n  const actorTenantId = typeof auth.tenantId === 'string' && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null\n  const candidateTenantId = typeof tenantIdOverride === 'string' && tenantIdOverride.trim().length > 0\n    ? tenantIdOverride.trim()\n    : tenantIdOverride === null\n      ? null\n      : actorTenantId\n  if (!candidateTenantId) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n  const usingOverride = candidateTenantId !== actorTenantId\n  const isSuperAdminActor = auth.isSuperAdmin === true\n  const tenantId = usingOverride && actorTenantId && !isSuperAdminActor ? actorTenantId : candidateTenantId\n  if (!tenantId) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n  const normalizedRequestedSelection = normalizeOrganizationId(selectedId)\n  const explicitAllOrgsChoice =\n    normalizedRequestedSelection !== null && isAllOrganizationsSelection(normalizedRequestedSelection)\n  const normalizedSelectedId = explicitAllOrgsChoice\n    ? null\n    : normalizedRequestedSelection\n  const contextOrgId = actorTenantId && actorTenantId === tenantId ? normalizeOrganizationId(auth.orgId) : null\n  const acl = await rbac.loadAcl(auth.sub, { tenantId, organizationId: contextOrgId })\n  const aclIsSuperAdmin = acl?.isSuperAdmin === true\n  const effectiveSuperAdmin = aclIsSuperAdmin || isSuperAdminActor\n  const normalizedAccessible = effectiveSuperAdmin\n    ? null\n    : Array.isArray(acl?.organizations)\n      ? acl.organizations\n        .map((value) => normalizeOrganizationId(value))\n        .filter((value): value is string => value !== null)\n      : null\n  const accessibleList = effectiveSuperAdmin\n    ? null\n    : normalizedAccessible && normalizedAccessible.some((value) => isAllOrganizationsSelection(value))\n      ? null\n      : normalizedAccessible?.filter((value) => !isAllOrganizationsSelection(value)) ?? null\n\n  const accountOrgId = actorTenantId && actorTenantId === tenantId ? normalizeOrganizationId(auth.orgId) : null\n  const fallbackOrgId = accountOrgId ?? null\n\n  // Every id that could be expanded below \u2014 accessible set, fallback (account)\n  // org, and the requested selection \u2014 is known up front, so fetch them all in\n  // a single `organizations` query and expand from the in-memory map.\n  const candidateIds = [\n    ...(accessibleList ?? []),\n    ...(fallbackOrgId ? [fallbackOrgId] : []),\n    ...(normalizedSelectedId ? [normalizedSelectedId] : []),\n  ]\n  const orgDescendants = await loadOrgDescendantMap(em, tenantId, candidateIds)\n  const loadFallbackSet = (): Set<string> | null =>\n    fallbackOrgId ? expandWithDescendants(orgDescendants, [fallbackOrgId]) : null\n\n  let allowedSet: Set<string> | null = null\n  if (accessibleList === null) {\n    allowedSet = null\n  } else if (accessibleList.length === 0) {\n    allowedSet = new Set()\n  } else {\n    allowedSet = expandWithDescendants(orgDescendants, accessibleList)\n  }\n\n  if (allowedSet && allowedSet.size === 0 && fallbackOrgId) {\n    const computed = loadFallbackSet()\n    if (computed && computed.size > 0) {\n      allowedSet = computed\n    }\n  }\n\n  const hasUnrestrictedAccess = effectiveSuperAdmin || (accessibleList === null)\n  const noOrgSelection = normalizedSelectedId === null && !explicitAllOrgsChoice\n  const widenToAllOrgs =\n    (explicitAllOrgsChoice && hasUnrestrictedAccess)\n    || (effectiveSuperAdmin && noOrgSelection)\n  const initialSelected =\n    normalizedSelectedId\n    ?? (widenToAllOrgs ? null : accountOrgId ?? null)\n  let effectiveSelected: string | null = null\n  if (initialSelected) {\n    if (allowedSet === null || allowedSet.has(initialSelected)) {\n      effectiveSelected = initialSelected\n    }\n  }\n\n  let filterSet: Set<string> | null = null\n  if (effectiveSelected) {\n    filterSet = expandWithDescendants(orgDescendants, [effectiveSelected])\n  } else if (allowedSet !== null) {\n    filterSet = allowedSet\n  } else if (widenToAllOrgs) {\n    filterSet = null\n  } else if (auth.orgId) {\n    filterSet = loadFallbackSet()\n  }\n\n  if ((!filterSet || filterSet.size === 0) && fallbackOrgId && !widenToAllOrgs) {\n    const computed = loadFallbackSet()\n    if (computed && computed.size > 0) {\n      filterSet = computed\n      if (!effectiveSelected) {\n        effectiveSelected = fallbackOrgId\n      }\n    }\n  }\n\n  return {\n    selectedId: effectiveSelected,\n    filterIds: filterSet ? Array.from(filterSet) : null,\n    allowedIds: allowedSet ? Array.from(allowedSet) : null,\n    tenantId,\n  }\n}\n\nexport async function resolveOrganizationScopeForRequest({\n  container,\n  auth,\n  request,\n  selectedId,\n  tenantId: tenantOverride,\n}: {\n  container: AwilixContainer\n  auth: AuthContext | null | undefined\n  request?: Request | { cookies?: { get: (name: string) => { value: string } | undefined }; headers?: { get(name: string): string | null } }\n  selectedId?: string | null\n  tenantId?: string | null\n}): Promise<OrganizationScope> {\n  if (!auth || !auth.sub) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n\n  let em: EntityManager | null = null\n  let rbac: RbacService | null = null\n  try { em = container.resolve<EntityManager>('em') } catch { em = null }\n  try { rbac = container.resolve<RbacService>('rbacService') } catch { rbac = null }\n  const normalizeString = (value: unknown): string | null => {\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n    return null\n  }\n  if (!em || !rbac) {\n    const fallbackSelected = normalizeOrganizationId(selectedId ?? auth.orgId ?? null)\n    return {\n      selectedId: fallbackSelected,\n      filterIds: fallbackSelected ? [fallbackSelected] : null,\n      allowedIds: fallbackSelected ? [fallbackSelected] : null,\n      tenantId: normalizeString(auth.tenantId),\n    }\n  }\n\n  const actorTenantField = (auth as { actorTenantId?: string | null }).actorTenantId\n  const actorTenant = actorTenantField === undefined\n    ? normalizeString(auth.tenantId)\n    : actorTenantField === null\n      ? null\n      : normalizeString(actorTenantField)\n  const actorOrgField = (auth as { actorOrgId?: string | null }).actorOrgId\n  const actorOrgId = actorOrgField === undefined\n    ? normalizeString(auth.orgId)\n    : actorOrgField === null\n      ? null\n      : normalizeString(actorOrgField)\n\n  const cookieTenant = request ? getSelectedTenantFromRequest(request) : null\n  const requestedTenant =\n    tenantOverride !== undefined\n      ? tenantOverride\n      : cookieTenant !== undefined\n        ? cookieTenant\n        : undefined\n  const requestedTenantId = typeof requestedTenant === 'string' && requestedTenant.trim().length > 0 ? requestedTenant.trim() : null\n  const isSuperAdminActor = auth.isSuperAdmin === true\n  let effectiveTenantId = requestedTenantId ?? actorTenant ?? null\n  if (actorTenant && effectiveTenantId && effectiveTenantId !== actorTenant && !isSuperAdminActor) {\n    effectiveTenantId = actorTenant\n  }\n  if (!effectiveTenantId) {\n    return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }\n  }\n\n  const scopedAuth = {\n    ...auth,\n    tenantId: effectiveTenantId,\n    orgId: actorTenant && actorTenant === effectiveTenantId ? actorOrgId ?? null : null,\n  }\n\n  const rawSelected = selectedId !== undefined ? selectedId : (request ? getSelectedOrganizationFromRequest(request) : null)\n  const normalizedSelectedId = typeof rawSelected === 'string' && rawSelected.trim().length > 0\n    ? rawSelected.trim()\n    : null\n\n  const userId = typeof auth.sub === 'string' && auth.sub.length > 0 ? auth.sub : null\n  const ttlMs = resolveOrgScopeTtlMs()\n  const cache = ttlMs > 0 ? resolveCacheFromContainer(container) : null\n  const cacheKey = userId\n    ? buildOrgScopeCacheKey({\n        userId,\n        effectiveTenantId,\n        selectedOrgId: normalizedSelectedId,\n        requestedTenantId: requestedTenantId ?? null,\n      })\n    : null\n\n  const requestMemo = getRequestScopeMemo(request)\n  if (requestMemo && cacheKey) {\n    const memoized = requestMemo.get(cacheKey)\n    if (memoized) return memoized\n  }\n\n  const resolveScope = async (): Promise<OrganizationScope> => {\n    if (cache && cacheKey && typeof cache.get === 'function') {\n      try {\n        const cached = await cache.get(cacheKey)\n        if (isValidCachedScope(cached)) return cached\n      } catch (err) {\n        logger.warn('Cache read failed', { err })\n      }\n    }\n\n    const baseScope = await resolveOrganizationScope({\n      em,\n      rbac,\n      auth: scopedAuth,\n      selectedId: rawSelected,\n      tenantId: effectiveTenantId,\n    })\n\n    if (cache && cacheKey && userId && typeof cache.set === 'function') {\n      try {\n        await cache.set(cacheKey, baseScope, {\n          ttl: ttlMs,\n          tags: buildOrgScopeCacheTags({ userId, effectiveTenantId }),\n        })\n      } catch (err) {\n        logger.warn('Cache write failed', { err })\n      }\n    }\n\n    return baseScope\n  }\n\n  if (requestMemo && cacheKey) {\n    const pending = resolveScope()\n    requestMemo.set(cacheKey, pending)\n    return pending\n  }\n\n  return resolveScope()\n}\n\nexport type FeatureCheckContext = {\n  organizationId: string | null\n  scope: OrganizationScope\n  allowedOrganizationIds: string[] | null\n}\n\nexport async function resolveFeatureCheckContext({\n  container,\n  auth,\n  request,\n  selectedId,\n  tenantId,\n}: {\n  container: AwilixContainer\n  auth: AuthContext | null | undefined\n  request?: Request | { cookies?: { get: (name: string) => { value: string } | undefined } }\n  selectedId?: string | null\n  tenantId?: string | null\n}): Promise<FeatureCheckContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request, selectedId, tenantId })\n  const allowedOrganizationIds = scope.allowedIds ?? null\n  const authOrgId = auth?.orgId ?? null\n  const organizationId =\n    scope.selectedId\n    ?? (authOrgId && (!Array.isArray(allowedOrganizationIds) || allowedOrganizationIds.includes(authOrgId)) ? authOrgId : null)\n    ?? (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length ? allowedOrganizationIds[0] : null)\n\n  return { organizationId, scope, allowedOrganizationIds }\n}\n"],
+  "mappings": "AAGA,SAAS,oBAAoB;AAC7B,SAAS,mCAAmC;AAI5C,SAAS,iCAAiC,iCAAiC;AAC3E,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAoB/E,MAAM,6BAA6B;AAInC,MAAM,2BAA2B;AAEjC,SAAS,uBAA+B;AACtC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,SAAS,OAAO,GAAG;AACzB,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;AAEA,SAAS,sBAAsB,OAKpB;AACT,QAAM,WAAW,MAAM,iBAAiB;AACxC,QAAM,YAAY,MAAM,qBAAqB;AAC7C,SAAO,GAAG,0BAA0B,IAAI,MAAM,MAAM,IAAI,MAAM,iBAAiB,IAAI,QAAQ,IAAI,SAAS;AAC1G;AAOO,SAAS,0BAA0B,QAAwB;AAChE,SAAO,GAAG,0BAA0B,SAAS,MAAM;AACrD;AAEO,SAAS,4BAA4B,UAA0B;AACpE,SAAO,GAAG,0BAA0B,WAAW,QAAQ;AACzD;AAEA,SAAS,uBAAuB,OAAgE;AAC9F,SAAO;AAAA,IACL,0BAA0B,MAAM,MAAM;AAAA,IACtC,4BAA4B,MAAM,iBAAiB;AAAA,EACrD;AACF;AAEA,SAAS,mBAAmB,OAA4C;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,QAAM,OAAO,CAAC,MAAe,MAAM,QAAQ,OAAO,MAAM;AACxD,QAAM,QAAQ,CAAC,MAAe,MAAM,QAAS,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AAC7G,SAAO,KAAK,OAAO,UAAU,KAAK,KAAK,OAAO,QAAQ,KAAK,MAAM,OAAO,SAAS,KAAK,MAAM,OAAO,UAAU;AAC/G;AAEA,SAAS,0BAA0B,WAAqE;AACtG,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI;AACF,UAAM,IAAI,UAAU,QAAQ,OAAO;AACnC,QAAI,KAAK,OAAO,EAAE,QAAQ,cAAc,OAAO,EAAE,QAAQ,WAAY,QAAO;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,eAAsB,wCACpB,WACA,QACe;AACf,QAAM,QAAQ,0BAA0B,SAAS;AACjD,MAAI,CAAC,OAAO,aAAc;AAC1B,MAAI;AACF,UAAM,MAAM,aAAa,CAAC,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC9D,SAAS,KAAK;AACZ,WAAO,KAAK,gCAAgC,EAAE,IAAI,CAAC;AAAA,EACrD;AACF;AAEA,eAAsB,0CACpB,WACA,UACe;AACf,QAAM,QAAQ,0BAA0B,SAAS;AACjD,MAAI,CAAC,OAAO,aAAc;AAC1B,MAAI;AACF,UAAM,MAAM,aAAa,CAAC,4BAA4B,QAAQ,CAAC,CAAC;AAAA,EAClE,SAAS,KAAK;AACZ,WAAO,KAAK,kCAAkC,EAAE,IAAI,CAAC;AAAA,EACvD;AACF;AAaA,MAAM,sBAAsB,oBAAI,QAAyD;AAEzF,SAAS,oBAAoB,SAAkE;AAC7F,MAAI,CAAC,WAAY,OAAO,YAAY,YAAY,OAAO,YAAY,WAAa,QAAO;AACvF,QAAM,MAAM;AACZ,MAAI,OAAO,oBAAoB,IAAI,GAAG;AACtC,MAAI,CAAC,MAAM;AACT,WAAO,oBAAI,IAAwC;AACnD,wBAAoB,IAAI,KAAK,IAAI;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEO,SAAS,mCAAmC,KAAsJ;AACvM,QAAM,kBAAmB,IAA+E;AACxG,MAAI,mBAAmB,OAAO,gBAAgB,QAAQ,YAAY;AAChE,UAAM,MAAM,gBAAgB,IAAI,iBAAiB,GAAG;AACpD,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,kBAAmB,IAA2D;AACpF,QAAM,SAAS,OAAO,iBAAiB,QAAQ,aAAa,gBAAgB,IAAI,QAAQ,IAAI;AAC5F,SAAO,gCAAgC,MAAM;AAC/C;AAEO,SAAS,6BACd,KACe;AACf,QAAM,kBAAmB,IAA+E;AACxG,MAAI,mBAAmB,OAAO,gBAAgB,QAAQ,YAAY;AAChE,UAAM,MAAM,gBAAgB,IAAI,oBAAoB,GAAG;AACvD,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,kBAAmB,IAA2D;AACpF,QAAM,SAAS,OAAO,iBAAiB,QAAQ,aAAa,gBAAgB,IAAI,QAAQ,IAAI;AAC5F,SAAO,0BAA0B,MAAM;AACzC;AAEA,SAAS,yBAAyB,KAAyB;AACzD,SAAO,MAAM,KAAK,IAAI;AAAA,IACpB,IAAI,IAAI,CAAC,UAAU,wBAAwB,KAAK,CAAC,EAAE,OAAO,CAAC,UAA2B;AACpF,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI,4BAA4B,KAAK,EAAG,QAAO;AAC/C,aAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AACH;AAaA,eAAe,qBAAqB,IAAmB,UAAkB,KAA0C;AACjH,QAAM,SAAS,yBAAyB,GAAG;AAC3C,MAAI,CAAC,OAAO,OAAQ,QAAO,oBAAI,IAAI;AACnC,QAAM,SAAoC;AAAA,IACxC,QAAQ;AAAA,IACR,IAAI,EAAE,KAAK,OAAO;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,OAAO,MAAM,GAAG,KAAK,cAAc,MAAM;AAC/C,QAAM,MAAwB,oBAAI,IAAI;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,KAAK,OAAO,IAAI,EAAE;AACxB,UAAM,YAAY,CAAC,EAAE;AACrB,QAAI,MAAM,QAAQ,IAAI,aAAa,GAAG;AACpC,iBAAW,QAAQ,IAAI,cAAe,WAAU,KAAK,OAAO,IAAI,CAAC;AAAA,IACnE;AACA,QAAI,IAAI,IAAI,SAAS;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAuB,KAA4B;AAChF,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,SAAS,KAAK;AACvB,UAAM,KAAK,wBAAwB,KAAK;AACxC,QAAI,CAAC,MAAM,4BAA4B,EAAE,EAAG;AAC5C,UAAM,YAAY,IAAI,IAAI,EAAE;AAC5B,QAAI,CAAC,UAAW;AAChB,eAAW,SAAS,UAAW,KAAI,IAAI,KAAK;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AACZ,GAM+B;AAC7B,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AACA,QAAM,gBAAgB,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,IAAI,KAAK,SAAS,KAAK,IAAI;AACpH,QAAM,oBAAoB,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,IAC/F,iBAAiB,KAAK,IACtB,qBAAqB,OACnB,OACA;AACN,MAAI,CAAC,mBAAmB;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AACA,QAAM,gBAAgB,sBAAsB;AAC5C,QAAM,oBAAoB,KAAK,iBAAiB;AAChD,QAAM,WAAW,iBAAiB,iBAAiB,CAAC,oBAAoB,gBAAgB;AACxF,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AACA,QAAM,+BAA+B,wBAAwB,UAAU;AACvE,QAAM,wBACJ,iCAAiC,QAAQ,4BAA4B,4BAA4B;AACnG,QAAM,uBAAuB,wBACzB,OACA;AACJ,QAAM,eAAe,iBAAiB,kBAAkB,WAAW,wBAAwB,KAAK,KAAK,IAAI;AACzG,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,gBAAgB,aAAa,CAAC;AACnF,QAAM,kBAAkB,KAAK,iBAAiB;AAC9C,QAAM,sBAAsB,mBAAmB;AAC/C,QAAM,uBAAuB,sBACzB,OACA,MAAM,QAAQ,KAAK,aAAa,IAC9B,IAAI,cACH,IAAI,CAAC,UAAU,wBAAwB,KAAK,CAAC,EAC7C,OAAO,CAAC,UAA2B,UAAU,IAAI,IAClD;AACN,QAAM,iBAAiB,sBACnB,OACA,wBAAwB,qBAAqB,KAAK,CAAC,UAAU,4BAA4B,KAAK,CAAC,IAC7F,OACA,sBAAsB,OAAO,CAAC,UAAU,CAAC,4BAA4B,KAAK,CAAC,KAAK;AAEtF,QAAM,eAAe,iBAAiB,kBAAkB,WAAW,wBAAwB,KAAK,KAAK,IAAI;AACzG,QAAM,gBAAgB,gBAAgB;AAKtC,QAAM,eAAe;AAAA,IACnB,GAAI,kBAAkB,CAAC;AAAA,IACvB,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,uBAAuB,CAAC,oBAAoB,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,iBAAiB,MAAM,qBAAqB,IAAI,UAAU,YAAY;AAC5E,QAAM,kBAAkB,MACtB,gBAAgB,sBAAsB,gBAAgB,CAAC,aAAa,CAAC,IAAI;AAE3E,MAAI,aAAiC;AACrC,MAAI,mBAAmB,MAAM;AAC3B,iBAAa;AAAA,EACf,WAAW,eAAe,WAAW,GAAG;AACtC,iBAAa,oBAAI,IAAI;AAAA,EACvB,OAAO;AACL,iBAAa,sBAAsB,gBAAgB,cAAc;AAAA,EACnE;AAEA,MAAI,cAAc,WAAW,SAAS,KAAK,eAAe;AACxD,UAAM,WAAW,gBAAgB;AACjC,QAAI,YAAY,SAAS,OAAO,GAAG;AACjC,mBAAa;AAAA,IACf;AAAA,EACF;AAEA,QAAM,wBAAwB,uBAAwB,mBAAmB;AACzE,QAAM,iBAAiB,yBAAyB,QAAQ,CAAC;AACzD,QAAM,iBACH,yBAAyB,yBACtB,uBAAuB;AAC7B,QAAM,kBACJ,yBACI,iBAAiB,OAAO,gBAAgB;AAC9C,MAAI,oBAAmC;AACvC,MAAI,iBAAiB;AACnB,QAAI,eAAe,QAAQ,WAAW,IAAI,eAAe,GAAG;AAC1D,0BAAoB;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,YAAgC;AACpC,MAAI,mBAAmB;AACrB,gBAAY,sBAAsB,gBAAgB,CAAC,iBAAiB,CAAC;AAAA,EACvE,WAAW,eAAe,MAAM;AAC9B,gBAAY;AAAA,EACd,WAAW,gBAAgB;AACzB,gBAAY;AAAA,EACd,WAAW,KAAK,OAAO;AACrB,gBAAY,gBAAgB;AAAA,EAC9B;AAEA,OAAK,CAAC,aAAa,UAAU,SAAS,MAAM,iBAAiB,CAAC,gBAAgB;AAC5E,UAAM,WAAW,gBAAgB;AACjC,QAAI,YAAY,SAAS,OAAO,GAAG;AACjC,kBAAY;AACZ,UAAI,CAAC,mBAAmB;AACtB,4BAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW,YAAY,MAAM,KAAK,SAAS,IAAI;AAAA,IAC/C,YAAY,aAAa,MAAM,KAAK,UAAU,IAAI;AAAA,IAClD;AAAA,EACF;AACF;AAEA,eAAsB,mCAAmC;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AACZ,GAM+B;AAC7B,MAAI,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AAEA,MAAI,KAA2B;AAC/B,MAAI,OAA2B;AAC/B,MAAI;AAAE,SAAK,UAAU,QAAuB,IAAI;AAAA,EAAE,QAAQ;AAAE,SAAK;AAAA,EAAK;AACtE,MAAI;AAAE,WAAO,UAAU,QAAqB,aAAa;AAAA,EAAE,QAAQ;AAAE,WAAO;AAAA,EAAK;AACjF,QAAM,kBAAkB,CAAC,UAAkC;AACzD,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAC5E,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,CAAC,MAAM;AAChB,UAAM,mBAAmB,wBAAwB,cAAc,KAAK,SAAS,IAAI;AACjF,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW,mBAAmB,CAAC,gBAAgB,IAAI;AAAA,MACnD,YAAY,mBAAmB,CAAC,gBAAgB,IAAI;AAAA,MACpD,UAAU,gBAAgB,KAAK,QAAQ;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,mBAAoB,KAA2C;AACrE,QAAM,cAAc,qBAAqB,SACrC,gBAAgB,KAAK,QAAQ,IAC7B,qBAAqB,OACnB,OACA,gBAAgB,gBAAgB;AACtC,QAAM,gBAAiB,KAAwC;AAC/D,QAAM,aAAa,kBAAkB,SACjC,gBAAgB,KAAK,KAAK,IAC1B,kBAAkB,OAChB,OACA,gBAAgB,aAAa;AAEnC,QAAM,eAAe,UAAU,6BAA6B,OAAO,IAAI;AACvE,QAAM,kBACJ,mBAAmB,SACf,iBACA,iBAAiB,SACf,eACA;AACR,QAAM,oBAAoB,OAAO,oBAAoB,YAAY,gBAAgB,KAAK,EAAE,SAAS,IAAI,gBAAgB,KAAK,IAAI;AAC9H,QAAM,oBAAoB,KAAK,iBAAiB;AAChD,MAAI,oBAAoB,qBAAqB,eAAe;AAC5D,MAAI,eAAe,qBAAqB,sBAAsB,eAAe,CAAC,mBAAmB;AAC/F,wBAAoB;AAAA,EACtB;AACA,MAAI,CAAC,mBAAmB;AACtB,WAAO,EAAE,YAAY,MAAM,WAAW,MAAM,YAAY,MAAM,UAAU,KAAK;AAAA,EAC/E;AAEA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,UAAU;AAAA,IACV,OAAO,eAAe,gBAAgB,oBAAoB,cAAc,OAAO;AAAA,EACjF;AAEA,QAAM,cAAc,eAAe,SAAY,aAAc,UAAU,mCAAmC,OAAO,IAAI;AACrH,QAAM,uBAAuB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IACxF,YAAY,KAAK,IACjB;AAEJ,QAAM,SAAS,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AAChF,QAAM,QAAQ,qBAAqB;AACnC,QAAM,QAAQ,QAAQ,IAAI,0BAA0B,SAAS,IAAI;AACjE,QAAM,WAAW,SACb,sBAAsB;AAAA,IACpB;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf,mBAAmB,qBAAqB;AAAA,EAC1C,CAAC,IACD;AAEJ,QAAM,cAAc,oBAAoB,OAAO;AAC/C,MAAI,eAAe,UAAU;AAC3B,UAAM,WAAW,YAAY,IAAI,QAAQ;AACzC,QAAI,SAAU,QAAO;AAAA,EACvB;AAEA,QAAM,eAAe,YAAwC;AAC3D,QAAI,SAAS,YAAY,OAAO,MAAM,QAAQ,YAAY;AACxD,UAAI;AACF,cAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,YAAI,mBAAmB,MAAM,EAAG,QAAO;AAAA,MACzC,SAAS,KAAK;AACZ,eAAO,KAAK,qBAAqB,EAAE,IAAI,CAAC;AAAA,MAC1C;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,yBAAyB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,SAAS,YAAY,UAAU,OAAO,MAAM,QAAQ,YAAY;AAClE,UAAI;AACF,cAAM,MAAM,IAAI,UAAU,WAAW;AAAA,UACnC,KAAK;AAAA,UACL,MAAM,uBAAuB,EAAE,QAAQ,kBAAkB,CAAC;AAAA,QAC5D,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,KAAK,sBAAsB,EAAE,IAAI,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,UAAU;AAC3B,UAAM,UAAU,aAAa;AAC7B,gBAAY,IAAI,UAAU,OAAO;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,aAAa;AACtB;AAQA,eAAsB,2BAA2B;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMiC;AAC/B,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,YAAY,SAAS,CAAC;AACzG,QAAM,yBAAyB,MAAM,cAAc;AACnD,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,iBACJ,MAAM,eACF,cAAc,CAAC,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,SAAS,KAAK,YAAY,UAClH,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,SAAS,uBAAuB,CAAC,IAAI;AAE3G,SAAO,EAAE,gBAAgB,OAAO,uBAAuB;AACzD;",
   "names": []
 }

package/dist/modules/entities/api/definitions.cache.js

@@ -1,3 +1,5 @@
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("entities").child({ component: "definitions-cache" });
 const CACHE_PREFIX = "entities:definitions";
 const ENTITY_DEFINITIONS_CACHE_TTL_MS = 5 * 60 * 1e3;
 function normalizeTenantId(tenantId) {
@@ -36,7 +38,7 @@ async function invalidateDefinitionsCache(cache, options) {
   try {
     await cache.deleteByTags(targets);
   } catch (err) {
-    console.warn("[entities.definitions.cache] Failed to invalidate cache", err);
+    logger.warn("Failed to invalidate cache", { err });
   }
 }
 export {

package/dist/modules/entities/api/definitions.cache.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/definitions.cache.ts"],
-  "sourcesContent": ["import type { CacheStrategy } from '@open-mercato/cache'\n\nconst CACHE_PREFIX = 'entities:definitions'\nexport const ENTITY_DEFINITIONS_CACHE_TTL_MS = 5 * 60 * 1000\n\ntype CacheKeyOptions = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n  entityIds: string[]\n}\n\nfunction normalizeTenantId(tenantId: string | null | undefined): string {\n  return tenantId ?? 'global'\n}\n\nfunction normalizeOrganizationId(organizationId: string | null | undefined): string {\n  return organizationId ?? 'none'\n}\n\nexport function createDefinitionsCacheKey(options: CacheKeyOptions): string {\n  const tenant = normalizeTenantId(options.tenantId)\n  const organization = normalizeOrganizationId(options.organizationId)\n  const scope = options.entityIds.join('|')\n  return `${CACHE_PREFIX}:${tenant}:${organization}:entities=${scope}`\n}\n\nexport function createDefinitionsCacheTags(options: CacheKeyOptions): string[] {\n  const tenant = normalizeTenantId(options.tenantId)\n  const organization = normalizeOrganizationId(options.organizationId)\n  const baseTenant = `${CACHE_PREFIX}:${tenant}`\n  const tags = new Set<string>([\n    baseTenant,\n    `${baseTenant}:org:${organization}`,\n  ])\n\n  const uniqueEntities = Array.from(new Set(options.entityIds))\n  for (const entityId of uniqueEntities) {\n    tags.add(`${baseTenant}:entity:${entityId}`)\n    tags.add(`${baseTenant}:org:${organization}:entity:${entityId}`)\n  }\n\n  return Array.from(tags)\n}\n\nexport async function invalidateDefinitionsCache(\n  cache: CacheStrategy | undefined,\n  options: { tenantId: string | null | undefined; organizationId: string | null | undefined; entityIds: string[] }\n): Promise<void> {\n  if (!cache?.deleteByTags) return\n  const tags = createDefinitionsCacheTags(options)\n  const entityTags = tags.filter((tag) => tag.includes(':entity:'))\n  const targets = entityTags.length ? entityTags : tags\n  if (!targets.length) return\n  try {\n    await cache.deleteByTags(targets)\n  } catch (err) {\n    console.warn('[entities.definitions.cache] Failed to invalidate cache', err)\n  }\n}\n"],
-  "mappings": "AAEA,MAAM,eAAe;AACd,MAAM,kCAAkC,IAAI,KAAK;AAQxD,SAAS,kBAAkB,UAA6C;AACtE,SAAO,YAAY;AACrB;AAEA,SAAS,wBAAwB,gBAAmD;AAClF,SAAO,kBAAkB;AAC3B;AAEO,SAAS,0BAA0B,SAAkC;AAC1E,QAAM,SAAS,kBAAkB,QAAQ,QAAQ;AACjD,QAAM,eAAe,wBAAwB,QAAQ,cAAc;AACnE,QAAM,QAAQ,QAAQ,UAAU,KAAK,GAAG;AACxC,SAAO,GAAG,YAAY,IAAI,MAAM,IAAI,YAAY,aAAa,KAAK;AACpE;AAEO,SAAS,2BAA2B,SAAoC;AAC7E,QAAM,SAAS,kBAAkB,QAAQ,QAAQ;AACjD,QAAM,eAAe,wBAAwB,QAAQ,cAAc;AACnE,QAAM,aAAa,GAAG,YAAY,IAAI,MAAM;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAAA,IAC3B;AAAA,IACA,GAAG,UAAU,QAAQ,YAAY;AAAA,EACnC,CAAC;AAED,QAAM,iBAAiB,MAAM,KAAK,IAAI,IAAI,QAAQ,SAAS,CAAC;AAC5D,aAAW,YAAY,gBAAgB;AACrC,SAAK,IAAI,GAAG,UAAU,WAAW,QAAQ,EAAE;AAC3C,SAAK,IAAI,GAAG,UAAU,QAAQ,YAAY,WAAW,QAAQ,EAAE;AAAA,EACjE;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAsB,2BACpB,OACA,SACe;AACf,MAAI,CAAC,OAAO,aAAc;AAC1B,QAAM,OAAO,2BAA2B,OAAO;AAC/C,QAAM,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC;AAChE,QAAM,UAAU,WAAW,SAAS,aAAa;AACjD,MAAI,CAAC,QAAQ,OAAQ;AACrB,MAAI;AACF,UAAM,MAAM,aAAa,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,YAAQ,KAAK,2DAA2D,GAAG;AAAA,EAC7E;AACF;",
+  "sourcesContent": ["import type { CacheStrategy } from '@open-mercato/cache'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('entities').child({ component: 'definitions-cache' })\n\nconst CACHE_PREFIX = 'entities:definitions'\nexport const ENTITY_DEFINITIONS_CACHE_TTL_MS = 5 * 60 * 1000\n\ntype CacheKeyOptions = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n  entityIds: string[]\n}\n\nfunction normalizeTenantId(tenantId: string | null | undefined): string {\n  return tenantId ?? 'global'\n}\n\nfunction normalizeOrganizationId(organizationId: string | null | undefined): string {\n  return organizationId ?? 'none'\n}\n\nexport function createDefinitionsCacheKey(options: CacheKeyOptions): string {\n  const tenant = normalizeTenantId(options.tenantId)\n  const organization = normalizeOrganizationId(options.organizationId)\n  const scope = options.entityIds.join('|')\n  return `${CACHE_PREFIX}:${tenant}:${organization}:entities=${scope}`\n}\n\nexport function createDefinitionsCacheTags(options: CacheKeyOptions): string[] {\n  const tenant = normalizeTenantId(options.tenantId)\n  const organization = normalizeOrganizationId(options.organizationId)\n  const baseTenant = `${CACHE_PREFIX}:${tenant}`\n  const tags = new Set<string>([\n    baseTenant,\n    `${baseTenant}:org:${organization}`,\n  ])\n\n  const uniqueEntities = Array.from(new Set(options.entityIds))\n  for (const entityId of uniqueEntities) {\n    tags.add(`${baseTenant}:entity:${entityId}`)\n    tags.add(`${baseTenant}:org:${organization}:entity:${entityId}`)\n  }\n\n  return Array.from(tags)\n}\n\nexport async function invalidateDefinitionsCache(\n  cache: CacheStrategy | undefined,\n  options: { tenantId: string | null | undefined; organizationId: string | null | undefined; entityIds: string[] }\n): Promise<void> {\n  if (!cache?.deleteByTags) return\n  const tags = createDefinitionsCacheTags(options)\n  const entityTags = tags.filter((tag) => tag.includes(':entity:'))\n  const targets = entityTags.length ? entityTags : tags\n  if (!targets.length) return\n  try {\n    await cache.deleteByTags(targets)\n  } catch (err) {\n    logger.warn('Failed to invalidate cache', { err })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,oBAAoB,CAAC;AAEhF,MAAM,eAAe;AACd,MAAM,kCAAkC,IAAI,KAAK;AAQxD,SAAS,kBAAkB,UAA6C;AACtE,SAAO,YAAY;AACrB;AAEA,SAAS,wBAAwB,gBAAmD;AAClF,SAAO,kBAAkB;AAC3B;AAEO,SAAS,0BAA0B,SAAkC;AAC1E,QAAM,SAAS,kBAAkB,QAAQ,QAAQ;AACjD,QAAM,eAAe,wBAAwB,QAAQ,cAAc;AACnE,QAAM,QAAQ,QAAQ,UAAU,KAAK,GAAG;AACxC,SAAO,GAAG,YAAY,IAAI,MAAM,IAAI,YAAY,aAAa,KAAK;AACpE;AAEO,SAAS,2BAA2B,SAAoC;AAC7E,QAAM,SAAS,kBAAkB,QAAQ,QAAQ;AACjD,QAAM,eAAe,wBAAwB,QAAQ,cAAc;AACnE,QAAM,aAAa,GAAG,YAAY,IAAI,MAAM;AAC5C,QAAM,OAAO,oBAAI,IAAY;AAAA,IAC3B;AAAA,IACA,GAAG,UAAU,QAAQ,YAAY;AAAA,EACnC,CAAC;AAED,QAAM,iBAAiB,MAAM,KAAK,IAAI,IAAI,QAAQ,SAAS,CAAC;AAC5D,aAAW,YAAY,gBAAgB;AACrC,SAAK,IAAI,GAAG,UAAU,WAAW,QAAQ,EAAE;AAC3C,SAAK,IAAI,GAAG,UAAU,QAAQ,YAAY,WAAW,QAAQ,EAAE;AAAA,EACjE;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAsB,2BACpB,OACA,SACe;AACf,MAAI,CAAC,OAAO,aAAc;AAC1B,QAAM,OAAO,2BAA2B,OAAO;AAC/C,QAAM,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,SAAS,UAAU,CAAC;AAChE,QAAM,UAAU,WAAW,SAAS,aAAa;AACjD,MAAI,CAAC,QAAQ,OAAQ;AACrB,MAAI;AACF,UAAM,MAAM,aAAa,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,WAAO,KAAK,8BAA8B,EAAE,IAAI,CAAC;AAAA,EACnD;AACF;",
   "names": []
 }

package/dist/modules/entities/api/definitions.js

@@ -30,6 +30,8 @@ import {
   selectVisibleDefinitionWinner
 } from "../lib/definition-scope.js";
 import { resolveEntityDefinitionsVersion } from "../lib/definitions-version.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("entities").child({ component: "definitions" });
 async function validateDefaultValueByKind(value, kind, cfg, em, tenantContext) {
   switch (kind) {
     case "boolean":
@@ -65,7 +67,7 @@ async function validateDefaultValueByKind(value, kind, cfg, em, tenantContext) {
           });
           if (!entry) return `defaultValue "${value}" does not match any entry in the configured dictionary`;
         } catch (err) {
-          console.debug("[entities.definitions] dictionary validation skipped \u2014 module not available", err);
+          logger.debug("Dictionary validation skipped \u2014 module not available", { err });
         }
       }
       return null;
@@ -81,7 +83,7 @@ async function validateDefaultValueByKind(value, kind, cfg, em, tenantContext) {
         const currency = await em.findOne(Currency, where);
         if (!currency) return `defaultValue "${value}" does not match any available currency`;
       } catch (err) {
-        console.debug("[entities.definitions] currency validation skipped \u2014 module not available", err);
+        logger.debug("Currency validation skipped \u2014 module not available", { err });
       }
       return null;
     }
@@ -224,7 +226,7 @@ async function GET(req) {
         createOnly: true
       });
     } catch (err) {
-      console.warn("[entities.definitions] Failed to synchronize module-backed definitions", {
+      logger.warn("Failed to synchronize module-backed definitions", {
         tenantId,
         entityIds,
         err
@@ -244,7 +246,7 @@ async function GET(req) {
         return NextResponse.json(cached);
       }
     } catch (err) {
-      console.warn("[entities.definitions.cache] Failed to read cache", err);
+      logger.warn("Failed to read cache", { err });
     }
   }
   const fieldsetConfigs = await loadEntityFieldsetConfigs(em, {
@@ -404,7 +406,7 @@ async function GET(req) {
         tags
       });
     } catch (err) {
-      console.warn("[entities.definitions.cache] Failed to store cache entry", err);
+      logger.warn("Failed to store cache entry", { err });
     }
   }
   return NextResponse.json(responseBody);