@open-mercato/core 0.6.6-develop.6531.1.87e9d31db6 → 0.6.6-develop.6535.1.5cf43724de

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3471 entry points
+[build:core] found 3472 entry points
 [build:core] built successfully
 [build:core:generated] found 186 entry points
 [build:core:generated] built successfully

package/dist/modules/api_keys/api/keys/route.js

@@ -9,6 +9,8 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { enforceTenantSelection, resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { assertActorCanGrantRoles } from "@open-mercato/core/modules/auth/lib/grantChecks";
+import { isOrganizationAccessAllowed } from "@open-mercato/shared/lib/auth/organizationAccess";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 const listQuerySchema = z.object({
   page: z.string().optional(),
   pageSize: z.string().optional(),
@@ -273,18 +275,30 @@ const crud = makeCrudRoute({
       const { translate } = await resolveTranslations();
       if (!auth?.tenantId) throw json({ error: translate("api_keys.errors.tenantRequired", "Tenant context required") }, { status: 400 });
       const em = ctx.container.resolve("em");
-      const record = await em.findOne(ApiKey, { id, deletedAt: null });
-      if (!record) throw json({ error: translate("api_keys.errors.notFound", "Not found") }, { status: 404 });
       const scopedCtx = ctx;
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx);
-      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {
-        throw json({ error: translate("api_keys.errors.forbidden", "Forbidden") }, { status: 403 });
-      }
       const allowedIds = ctx.organizationScope?.allowedIds ?? null;
-      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(record.organizationId)) {
-          throw json({ error: translate("api_keys.errors.organizationOutOfScope", "Organization out of scope") }, { status: 403 });
-        }
+      const recordFilter = {
+        id,
+        tenantId: auth.tenantId,
+        deletedAt: null
+      };
+      if (!isSuperAdmin && Array.isArray(allowedIds)) {
+        recordFilter.organizationId = { $in: allowedIds };
+      }
+      const record = await findOneWithDecryption(
+        em,
+        ApiKey,
+        recordFilter,
+        void 0,
+        { tenantId: auth.tenantId, organizationId: null }
+      );
+      if (!record || record.tenantId !== auth.tenantId || !isOrganizationAccessAllowed({
+        isSuperAdmin,
+        allowedOrganizationIds: allowedIds,
+        targetOrganizationId: record.organizationId ?? null
+      })) {
+        throw json({ error: translate("api_keys.errors.notFound", "Not found") }, { status: 404 });
       }
       scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null;
     },

package/dist/modules/api_keys/api/keys/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_keys/api/keys/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const record = await em.findOne(ApiKey, { id, deletedAt: null })\n      if (!record) throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {\n        throw json({ error: translate('api_keys.errors.forbidden', 'Forbidden') }, { status: 403 })\n      }\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(record.organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AAgBzC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,UAAI,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AACxE,YAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACxC,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,KAAK,CAAC;AAC/D,UAAI,CAAC,OAAQ,OAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtG,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,UAAI,CAAC,gBAAgB,OAAO,YAAY,OAAO,aAAa,KAAK,UAAU;AACzE,cAAM,KAAK,EAAE,OAAO,UAAU,6BAA6B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5F;AACA,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,UAAI,OAAO,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AAC/E,YAAI,CAAC,WAAW,SAAS,OAAO,cAAc,GAAG;AAC/C,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,UAAI,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AACxE,YAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACxC,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/query_index/api/status.js

@@ -315,10 +315,7 @@ async function GET(req) {
     errorQuery = errorQuery.where("tenant_id", "is", null);
   }
   if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {
-    errorQuery = errorQuery.where((eb) => eb.or([
-      eb("organization_id", "is", null),
-      eb("organization_id", "in", organizationScopeIds)
-    ]));
+    errorQuery = errorQuery.where("organization_id", "in", organizationScopeIds);
   } else {
     errorQuery = errorQuery.where("organization_id", "is", null);
   }
@@ -349,10 +346,7 @@ async function GET(req) {
     logsQuery = logsQuery.where("tenant_id", "is", null);
   }
   if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {
-    logsQuery = logsQuery.where((eb) => eb.or([
-      eb("organization_id", "is", null),
-      eb("organization_id", "in", organizationScopeIds)
-    ]));
+    logsQuery = logsQuery.where("organization_id", "in", organizationScopeIds);
   } else {
     logsQuery = logsQuery.where("organization_id", "is", null);
   }

package/dist/modules/query_index/api/status.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/query_index/api/status.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { readCoverageSnapshots, refreshCoverageSnapshot, type CoverageSnapshot } from '../lib/coverage'\nimport { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'\nimport type { FullTextSearchStrategy } from '@open-mercato/search/strategies'\nimport type { SearchModuleConfig } from '@open-mercato/shared/modules/search'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { queryIndexTag, queryIndexErrorSchema, queryIndexStatusResponseSchema } from './openapi'\nimport { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['query_index.status.view'] },\n}\n\nconst STATUS_REFRESH_COOLDOWN_MS = 60_000\n\nfunction getCoverageSnapshotRefreshedAt(snapshot: Pick<CoverageSnapshot, 'refreshed_at'> | null | undefined): number | null {\n  const value = snapshot?.refreshed_at\n  if (value instanceof Date) {\n    const time = value.getTime()\n    return Number.isFinite(time) ? time : null\n  }\n  if (typeof value === 'string') {\n    const time = new Date(value).getTime()\n    return Number.isFinite(time) ? time : null\n  }\n  return null\n}\n\nfunction hasFreshCoverageSnapshots(\n  snapshots: Map<string, CoverageSnapshot>,\n  entityIds: string[],\n  now: number,\n): boolean {\n  for (const entityId of entityIds) {\n    const refreshedAt = getCoverageSnapshotRefreshedAt(snapshots.get(entityId))\n    if (refreshedAt === null || now - refreshedAt >= STATUS_REFRESH_COOLDOWN_MS) return false\n  }\n  return entityIds.length > 0\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const db = (em as any).getKysely()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const organizationId = scope.selectedId ?? auth.orgId ?? null\n  const tenantId = typeof scope.tenantId === 'string' && scope.tenantId.trim().length > 0\n    ? scope.tenantId.trim()\n    : (typeof auth.tenantId === 'string' && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null)\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })\n  }\n\n  const organizationFilter =\n    scope.filterIds === null\n      ? null\n      : Array.isArray(scope.filterIds) && scope.filterIds.length > 0\n        ? scope.filterIds\n        : organizationId\n          ? [organizationId]\n          : []\n\n  if (Array.isArray(organizationFilter) && organizationFilter.length === 0) {\n    return NextResponse.json({ error: 'Organization access denied' }, { status: 403 })\n  }\n\n  const organizationScopeIds = organizationFilter === null\n    ? null\n    : Array.from(\n      new Set(\n        organizationFilter.filter(\n          (value): value is string => typeof value === 'string' && value.length > 0,\n        ),\n      ),\n    )\n\n  if (Array.isArray(organizationScopeIds) && organizationScopeIds.length === 0) {\n    return NextResponse.json({ error: 'Organization access denied' }, { status: 403 })\n  }\n\n  const url = new URL(req.url)\n  const forceRefresh = url.searchParams.has('refresh') && url.searchParams.get('refresh') !== '0'\n\n  const generatedIds = flattenSystemEntityIds(getEntityIds() as Record<string, Record<string, string>>)\n  const generated = generatedIds.map((entityId) => ({ entityId, label: entityId }))\n\n  const byId = new Map<string, { entityId: string; label: string }>()\n  for (const g of generated) byId.set(g.entityId, g)\n\n  let entityIds = generatedIds.slice()\n\n  // Resolve search module configs to determine vector-enabled entities\n  // Entities with buildSource defined are vector-search enabled\n  let searchModuleConfigs: SearchModuleConfig[] = []\n  try {\n    searchModuleConfigs = container.resolve('searchModuleConfigs') as SearchModuleConfig[]\n  } catch {\n    // Search module configs not available\n  }\n\n  const vectorEnabledEntities = new Set<string>()\n  const fulltextEnabledEntities = new Set<string>()\n  for (const moduleConfig of searchModuleConfigs) {\n    for (const entity of moduleConfig.entities ?? []) {\n      if (entity.enabled !== false) {\n        // Vector: entities with buildSource defined\n        if (typeof entity.buildSource === 'function') {\n          vectorEnabledEntities.add(entity.entityId)\n        }\n        // Fulltext: entities with fieldPolicy defined\n        if (entity.fieldPolicy && typeof entity.fieldPolicy === 'object') {\n          fulltextEnabledEntities.add(entity.entityId)\n        }\n      }\n    }\n  }\n\n  // Resolve fulltext strategy for entity counts\n  let fulltextStrategy: FullTextSearchStrategy | null = null\n  try {\n    const searchStrategies = container.resolve('searchStrategies') as unknown[]\n    fulltextStrategy = (searchStrategies?.find(\n      (s: unknown) => (s as { id?: string })?.id === 'fulltext',\n    ) as FullTextSearchStrategy) ?? null\n  } catch {\n    fulltextStrategy = null\n  }\n\n  // Fetch fulltext entity counts\n  let fulltextEntityCounts: Record<string, number> | null = null\n  if (fulltextStrategy) {\n    try {\n      fulltextEntityCounts = await fulltextStrategy.getEntityCounts(tenantId)\n    } catch {\n      fulltextEntityCounts = null\n    }\n  }\n\n  // Limit to entities that have active custom field definitions in current scope\n  try {\n    let cfQuery = db\n      .selectFrom('custom_field_defs' as any)\n      .select(['entity_id' as any])\n      .distinct()\n      .where('is_active' as any, '=', true)\n    if (tenantId != null) {\n      cfQuery = cfQuery.where((eb: any) => eb.or([\n        eb('tenant_id' as any, '=', tenantId),\n        eb('tenant_id' as any, 'is', null),\n      ]))\n    } else {\n      cfQuery = cfQuery.where('tenant_id' as any, 'is', null as any)\n    }\n    if (Array.isArray(organizationScopeIds)) {\n      cfQuery = cfQuery.where((eb: any) => eb.or([\n        eb('organization_id' as any, 'in', organizationScopeIds),\n        eb('organization_id' as any, 'is', null),\n      ]))\n    }\n    const cfRows = await cfQuery.execute() as Array<{ entity_id: string }>\n    const enabled = new Set<string>((cfRows || []).map((r) => String(r.entity_id)))\n    entityIds = entityIds.filter((id) => enabled.has(id))\n  } catch {}\n\n  const HEARTBEAT_STALE_MS = 60_000\n  const COVERAGE_STALE_MS = 60_000\n  const COVERAGE_REFRESH_CONCURRENCY = 8\n\n  async function fetchJobSummary(entityType: string, tenantIdParam: string | null, organizationIdParam: string | null) {\n    try {\n      let jobQuery = db\n        .selectFrom('entity_index_jobs' as any)\n        .selectAll()\n        .where('entity_type' as any, '=', entityType)\n        .where(sql<boolean>`tenant_id is not distinct from ${tenantIdParam ?? null}`)\n      if (organizationIdParam != null) {\n        jobQuery = jobQuery.where((eb: any) => eb.or([\n          eb('organization_id' as any, '=', organizationIdParam),\n          eb('organization_id' as any, 'is', null),\n        ]))\n      } else {\n        jobQuery = jobQuery.where(sql<boolean>`organization_id is not distinct from ${null}`)\n      }\n      const rows = await jobQuery\n        .orderBy('started_at' as any, 'desc')\n        .execute() as Array<Record<string, any>>\n\n      if (!rows.length) {\n        return { status: 'idle' as const, partitions: [] as any[] }\n      }\n\n      const preferOrg =\n        organizationIdParam != null && rows.some((row: any) => row.organization_id === organizationIdParam)\n      const pickPreferred = <T extends { startedTs: number; tenantMatch: boolean; orgMatch: boolean }>(\n        existing: T | null,\n        candidate: T,\n      ): T => {\n        if (!existing) return candidate\n        if (preferOrg) {\n          if (candidate.orgMatch && !existing.orgMatch) return candidate\n          if (!candidate.orgMatch && existing.orgMatch) return existing\n        }\n        if (candidate.tenantMatch && !existing.tenantMatch) return candidate\n        if (!candidate.tenantMatch && existing.tenantMatch) return existing\n        return candidate.startedTs > existing.startedTs ? candidate : existing\n      }\n\n      const partitionRows = new Map<string, { row: any; startedTs: number; tenantMatch: boolean; orgMatch: boolean }>()\n      let scopeRow: { row: any; startedTs: number; tenantMatch: boolean; orgMatch: boolean } | null = null\n      for (const row of rows) {\n        const key = String(row.partition_index ?? '__null__')\n        const startedTs = row.started_at ? new Date(row.started_at).getTime() : 0\n        const tenantMatch = tenantIdParam != null ? row.tenant_id === tenantIdParam : true\n        const orgMatch = organizationIdParam != null ? row.organization_id === organizationIdParam : row.organization_id == null\n        const candidate = { row, startedTs, tenantMatch, orgMatch }\n        if (row.partition_index == null) {\n          scopeRow = pickPreferred(scopeRow, candidate)\n          continue\n        }\n        const existing = partitionRows.get(key)\n        partitionRows.set(key, pickPreferred(existing ?? null, candidate))\n      }\n\n      const partitions = Array.from(partitionRows.values())\n        .filter((entry) => !preferOrg || entry.orgMatch)\n        .map(({ row }) => {\n          const heartbeatDate = row.heartbeat_at ? new Date(row.heartbeat_at) : null\n          const startedDate = row.started_at ? new Date(row.started_at) : null\n          const finishedDate = row.finished_at ? new Date(row.finished_at) : null\n          const stalled =\n            !finishedDate && (!heartbeatDate || Date.now() - heartbeatDate.getTime() > HEARTBEAT_STALE_MS)\n          const state = finishedDate\n            ? 'completed'\n            : stalled\n              ? 'stalled'\n              : (row.status as string) || 'reindexing'\n          return {\n            partitionIndex: row.partition_index ?? null,\n            partitionCount: row.partition_count ?? null,\n            status: state,\n            startedAt: startedDate ? startedDate.toISOString() : null,\n            finishedAt: finishedDate ? finishedDate.toISOString() : null,\n            heartbeatAt: heartbeatDate ? heartbeatDate.toISOString() : null,\n            processedCount: row.processed_count ?? null,\n            totalCount: row.total_count ?? null,\n          }\n        })\n        .sort((a, b) => (a.partitionIndex ?? 0) - (b.partitionIndex ?? 0))\n      const activePartitions = partitions.filter((p) => !p.finishedAt)\n      const runningPartitions = activePartitions.filter(\n        (p) => p.status === 'reindexing' || p.status === 'purging',\n      )\n      const stalledPartitions = activePartitions.filter((p) => p.status === 'stalled')\n      let status: 'idle' | 'reindexing' | 'purging' | 'stalled' = 'idle'\n      if (activePartitions.length) {\n        if (runningPartitions.length) {\n          status = runningPartitions.some((p) => p.status === 'purging') ? 'purging' : 'reindexing'\n        } else if (stalledPartitions.length) {\n          status = 'stalled'\n        }\n      }\n\n      const startedAt = activePartitions[0]?.startedAt ?? partitions[0]?.startedAt ?? null\n      const finishedAt = status === 'idle' ? (partitions.find((p) => p.finishedAt)?.finishedAt ?? null) : null\n      const heartbeatAt = activePartitions[0]?.heartbeatAt ?? partitions[0]?.heartbeatAt ?? null\n      const jobTotalCount = partitions.reduce((sum, p) => sum + (p.totalCount ?? 0), 0)\n      const processedSum = partitions.reduce((sum, p) => sum + (p.processedCount ?? 0), 0)\n      const processedCount = jobTotalCount ? Math.min(jobTotalCount, processedSum) : processedSum || null\n      const scopeCandidate = !preferOrg || !scopeRow || scopeRow.orgMatch ? scopeRow : null\n\n      return {\n        status,\n        startedAt,\n        finishedAt,\n        heartbeatAt,\n        processedCount: jobTotalCount ? processedCount : scopeCandidate?.row?.processed_count ?? null,\n        totalCount: jobTotalCount ? jobTotalCount : scopeCandidate?.row?.total_count ?? null,\n        partitions,\n        scope: scopeCandidate\n          ? {\n              status: (() => {\n                const heartbeatDate = scopeCandidate!.row.heartbeat_at ? new Date(scopeCandidate!.row.heartbeat_at) : null\n                const finishedDate = scopeCandidate!.row.finished_at ? new Date(scopeCandidate!.row.finished_at) : null\n                if (finishedDate) return 'completed'\n                if (\n                  !heartbeatDate ||\n                  Date.now() - heartbeatDate.getTime() > HEARTBEAT_STALE_MS\n                ) {\n                  return 'stalled'\n                }\n                return (scopeCandidate!.row.status as string) || 'reindexing'\n              })(),\n              processedCount: scopeCandidate.row.processed_count ?? null,\n              totalCount: scopeCandidate.row.total_count ?? null,\n            }\n          : null,\n      }\n    } catch {\n      return { status: 'idle' as const, partitions: [] as any[] }\n    }\n  }\n\n  const normalizeCount = (value: unknown): number | null => {\n    if (value == null) return null\n    if (typeof value === 'number') return Number.isFinite(value) ? value : null\n    const parsed = Number(value)\n    return Number.isFinite(parsed) ? parsed : null\n  }\n\n  const coverageScope = {\n    tenantId: tenantId ?? null,\n    organizationId,\n    withDeleted: false,\n  } as const\n  const entitiesNeedingRefresh = new Set<string>()\n\n  // Read every entity's coverage snapshot in a single batched query. This endpoint is\n  // polled by the status table every few seconds, so the poll path must stay read-cheap:\n  // stale snapshots are refreshed asynchronously via the query_index.coverage.refresh\n  // event emitted below, never inline per entity.\n  const snapshotByEntity = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })\n\n  // An explicit refresh action (?refresh) may block, but only when the durable\n  // coverage snapshots are stale. Recent persisted snapshots survive workers/restarts,\n  // so repeated refresh requests use them instead of hammering base-table counts.\n  if (forceRefresh && entityIds.length > 0 && !hasFreshCoverageSnapshots(snapshotByEntity, entityIds, Date.now())) {\n    await mapWithConcurrency(entityIds, COVERAGE_REFRESH_CONCURRENCY, (entityId) =>\n      refreshCoverageSnapshot(em, { entityType: entityId, ...coverageScope }).catch(() => undefined),\n    )\n    const refreshed = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })\n    for (const [entityId, snapshot] of refreshed) snapshotByEntity.set(entityId, snapshot)\n  }\n\n  const coverageSnapshots = entityIds.map((entityId) => snapshotByEntity.get(entityId) ?? null)\n\n  const jobs = await Promise.all(entityIds.map((eid) => fetchJobSummary(eid, tenantId, organizationId)))\n\n  const items: any[] = []\n  for (let idx = 0; idx < entityIds.length; idx += 1) {\n    const eid = entityIds[idx]\n    let coverage = coverageSnapshots[idx]\n\n    const refreshedAt = coverage?.refreshed_at instanceof Date ? coverage.refreshed_at : coverage?.refreshed_at ? new Date(coverage.refreshed_at) : null\n    const isStale = !coverage || !refreshedAt || (Date.now() - refreshedAt.getTime() > COVERAGE_STALE_MS)\n    if (isStale) entitiesNeedingRefresh.add(eid)\n\n    const job = jobs[idx]\n    const label = (byId.get(eid)?.label) || eid\n    const baseCountNumber = normalizeCount(coverage?.baseCount)\n    const indexCountNumber = normalizeCount(coverage?.indexedCount)\n    const vectorEnabled = vectorEnabledEntities.has(eid)\n    const vectorCountNumber = vectorEnabled ? normalizeCount((coverage as any)?.vectorIndexedCount ?? (coverage as any)?.vector_indexed_count) : null\n    const fulltextEnabled = fulltextEnabledEntities.has(eid)\n    const fulltextCountNumber = fulltextEnabled ? (fulltextEntityCounts?.[eid] ?? 0) : null\n    const ok = (() => {\n      if (baseCountNumber == null || indexCountNumber == null) return false\n      if (baseCountNumber !== indexCountNumber) return false\n      if (!vectorEnabled) return true\n      return vectorCountNumber != null && vectorCountNumber === baseCountNumber\n    })()\n    items.push({\n      entityId: eid,\n      label,\n      baseCount: baseCountNumber,\n      indexCount: indexCountNumber,\n      vectorCount: vectorEnabled ? vectorCountNumber : null,\n      vectorEnabled,\n      fulltextCount: fulltextCountNumber,\n      fulltextEnabled,\n      ok,\n      job,\n      refreshedAt: refreshedAt ?? null,\n    })\n  }\n\n  if (!forceRefresh) {\n    try {\n      const eventBus = container.resolve('eventBus')\n      if (entitiesNeedingRefresh.size > 0) {\n        await Promise.all(\n          Array.from(entitiesNeedingRefresh).map((entityId) =>\n            eventBus\n              .emitEvent('query_index.coverage.refresh', {\n                entityType: entityId,\n                tenantId: tenantId ?? null,\n                organizationId,\n                delayMs: 0,\n              })\n              .catch(() => undefined)\n          )\n        )\n      }\n    } catch {}\n  }\n\n  let errorQuery = db\n    .selectFrom('indexer_error_logs' as any)\n    .selectAll()\n  if (tenantId != null) {\n    errorQuery = errorQuery.where((eb: any) => eb.or([\n      eb('tenant_id' as any, '=', tenantId),\n      eb('tenant_id' as any, 'is', null),\n    ]))\n  } else {\n    errorQuery = errorQuery.where('tenant_id' as any, 'is', null as any)\n  }\n  if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {\n    errorQuery = errorQuery.where((eb: any) => eb.or([\n      eb('organization_id' as any, 'is', null),\n      eb('organization_id' as any, 'in', organizationScopeIds),\n    ]))\n  } else {\n    errorQuery = errorQuery.where('organization_id' as any, 'is', null as any)\n  }\n  const errorRows = await errorQuery\n    .orderBy('occurred_at' as any, 'desc')\n    .limit(100)\n    .execute() as Array<Record<string, any>>\n\n  const errors = errorRows.map((row: any) => {\n    const occurredAt = row.occurred_at instanceof Date ? row.occurred_at : row.occurred_at ? new Date(row.occurred_at) : null\n    return {\n      id: String(row.id),\n      source: String(row.source ?? ''),\n      handler: String(row.handler ?? ''),\n      entityType: row.entity_type ?? null,\n      recordId: row.record_id ?? null,\n      tenantId: row.tenant_id ?? null,\n      organizationId: row.organization_id ?? null,\n      message: String(row.message ?? ''),\n      stack: row.stack ?? null,\n      payload: row.payload ?? null,\n      occurredAt: occurredAt ? occurredAt.toISOString() : new Date().toISOString(),\n    }\n  })\n\n  let logsQuery = db\n    .selectFrom('indexer_status_logs' as any)\n    .selectAll()\n  if (tenantId != null) {\n    logsQuery = logsQuery.where((eb: any) => eb.or([\n      eb('tenant_id' as any, '=', tenantId),\n      eb('tenant_id' as any, 'is', null),\n    ]))\n  } else {\n    logsQuery = logsQuery.where('tenant_id' as any, 'is', null as any)\n  }\n  if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {\n    logsQuery = logsQuery.where((eb: any) => eb.or([\n      eb('organization_id' as any, 'is', null),\n      eb('organization_id' as any, 'in', organizationScopeIds),\n    ]))\n  } else {\n    logsQuery = logsQuery.where('organization_id' as any, 'is', null as any)\n  }\n  const logRows = await logsQuery\n    .orderBy('occurred_at' as any, 'desc')\n    .limit(100)\n    .execute() as Array<Record<string, any>>\n\n  const logs = logRows.map((row: any) => {\n    const occurredAt = row.occurred_at instanceof Date ? row.occurred_at : row.occurred_at ? new Date(row.occurred_at) : null\n    const level = row.level === 'warn' ? 'warn' : 'info'\n    return {\n      id: String(row.id),\n      source: String(row.source ?? ''),\n      handler: String(row.handler ?? ''),\n      level,\n      entityType: row.entity_type ?? null,\n      recordId: row.record_id ?? null,\n      tenantId: row.tenant_id ?? null,\n      organizationId: row.organization_id ?? null,\n      message: String(row.message ?? ''),\n      details: row.details ?? null,\n      occurredAt: occurredAt ? occurredAt.toISOString() : new Date().toISOString(),\n    }\n  })\n\n  const response = NextResponse.json({ items, errors, logs })\n  const partial = items.find((item) => {\n    // Coverage not computed yet (no snapshot) \u2014 pending an async refresh, not a partial\n    // index. Do not raise the partial-index warning while counts are still unknown.\n    if (item.baseCount == null && item.indexCount == null) return false\n    if (item.baseCount == null || item.indexCount == null) return true\n    return item.baseCount !== item.indexCount\n  })\n  if (partial) {\n    response.headers.set(\n      'x-om-partial-index',\n      JSON.stringify({\n        type: 'partial_index',\n        entity: partial.entityId,\n        entityLabel: partial.label ?? partial.entityId,\n        baseCount: partial.baseCount,\n        indexedCount: partial.indexCount,\n        scope: organizationId,\n      })\n    )\n  }\n  return response\n}\n\nconst queryIndexStatusDoc: OpenApiMethodDoc = {\n  summary: 'Inspect query index coverage',\n  description: 'Returns entity counts comparing base tables with the query index along with the latest job status.',\n  tags: [queryIndexTag],\n  responses: [\n    { status: 200, description: 'Current query index status.', schema: queryIndexStatusResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Tenant or organization context required', schema: queryIndexErrorSchema },\n    { status: 401, description: 'Authentication required', schema: queryIndexErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: queryIndexTag,\n  summary: 'Query index status',\n  methods: {\n    GET: queryIndexStatusDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,WAAW;AACpB,SAAS,uBAAuB,+BAAsD;AACtF,SAAS,0BAA0B;AAInC,SAAS,eAAe,uBAAuB,sCAAsC;AACrF,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AAE5C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AACzE;AAEA,MAAM,6BAA6B;AAEnC,SAAS,+BAA+B,UAAoF;AAC1H,QAAM,QAAQ,UAAU;AACxB,MAAI,iBAAiB,MAAM;AACzB,UAAM,OAAO,MAAM,QAAQ;AAC3B,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AAAA,EACxC;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,IAAI,KAAK,KAAK,EAAE,QAAQ;AACrC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,0BACP,WACA,WACA,KACS;AACT,aAAW,YAAY,WAAW;AAChC,UAAM,cAAc,+BAA+B,UAAU,IAAI,QAAQ,CAAC;AAC1E,QAAI,gBAAgB,QAAQ,MAAM,eAAe,2BAA4B,QAAO;AAAA,EACtF;AACA,SAAO,UAAU,SAAS;AAC5B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,iBAAiB,MAAM,cAAc,KAAK,SAAS;AACzD,QAAM,WAAW,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,IAClF,MAAM,SAAS,KAAK,IACnB,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,IAAI,KAAK,SAAS,KAAK,IAAI;AACnG,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,qBACJ,MAAM,cAAc,OAChB,OACA,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,UAAU,SAAS,IACzD,MAAM,YACN,iBACE,CAAC,cAAc,IACf,CAAC;AAEX,MAAI,MAAM,QAAQ,kBAAkB,KAAK,mBAAmB,WAAW,GAAG;AACxE,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,uBAAuB,uBAAuB,OAChD,OACA,MAAM;AAAA,IACN,IAAI;AAAA,MACF,mBAAmB;AAAA,QACjB,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEF,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,WAAW,GAAG;AAC5E,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,eAAe,IAAI,aAAa,IAAI,SAAS,KAAK,IAAI,aAAa,IAAI,SAAS,MAAM;AAE5F,QAAM,eAAe,uBAAuB,aAAa,CAA2C;AACpG,QAAM,YAAY,aAAa,IAAI,CAAC,cAAc,EAAE,UAAU,OAAO,SAAS,EAAE;AAEhF,QAAM,OAAO,oBAAI,IAAiD;AAClE,aAAW,KAAK,UAAW,MAAK,IAAI,EAAE,UAAU,CAAC;AAEjD,MAAI,YAAY,aAAa,MAAM;AAInC,MAAI,sBAA4C,CAAC;AACjD,MAAI;AACF,0BAAsB,UAAU,QAAQ,qBAAqB;AAAA,EAC/D,QAAQ;AAAA,EAER;AAEA,QAAM,wBAAwB,oBAAI,IAAY;AAC9C,QAAM,0BAA0B,oBAAI,IAAY;AAChD,aAAW,gBAAgB,qBAAqB;AAC9C,eAAW,UAAU,aAAa,YAAY,CAAC,GAAG;AAChD,UAAI,OAAO,YAAY,OAAO;AAE5B,YAAI,OAAO,OAAO,gBAAgB,YAAY;AAC5C,gCAAsB,IAAI,OAAO,QAAQ;AAAA,QAC3C;AAEA,YAAI,OAAO,eAAe,OAAO,OAAO,gBAAgB,UAAU;AAChE,kCAAwB,IAAI,OAAO,QAAQ;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,mBAAkD;AACtD,MAAI;AACF,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,uBAAoB,kBAAkB;AAAA,MACpC,CAAC,MAAgB,GAAuB,OAAO;AAAA,IACjD,KAAgC;AAAA,EAClC,QAAQ;AACN,uBAAmB;AAAA,EACrB;AAGA,MAAI,uBAAsD;AAC1D,MAAI,kBAAkB;AACpB,QAAI;AACF,6BAAuB,MAAM,iBAAiB,gBAAgB,QAAQ;AAAA,IACxE,QAAQ;AACN,6BAAuB;AAAA,IACzB;AAAA,EACF;AAGA,MAAI;AACF,QAAI,UAAU,GACX,WAAW,mBAA0B,EACrC,OAAO,CAAC,WAAkB,CAAC,EAC3B,SAAS,EACT,MAAM,aAAoB,KAAK,IAAI;AACtC,QAAI,YAAY,MAAM;AACpB,gBAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QACzC,GAAG,aAAoB,KAAK,QAAQ;AAAA,QACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,MACnC,CAAC,CAAC;AAAA,IACJ,OAAO;AACL,gBAAU,QAAQ,MAAM,aAAoB,MAAM,IAAW;AAAA,IAC/D;AACA,QAAI,MAAM,QAAQ,oBAAoB,GAAG;AACvC,gBAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QACzC,GAAG,mBAA0B,MAAM,oBAAoB;AAAA,QACvD,GAAG,mBAA0B,MAAM,IAAI;AAAA,MACzC,CAAC,CAAC;AAAA,IACJ;AACA,UAAM,SAAS,MAAM,QAAQ,QAAQ;AACrC,UAAM,UAAU,IAAI,KAAa,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9E,gBAAY,UAAU,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAAA,EACtD,QAAQ;AAAA,EAAC;AAET,QAAM,qBAAqB;AAC3B,QAAM,oBAAoB;AAC1B,QAAM,+BAA+B;AAErC,iBAAe,gBAAgB,YAAoB,eAA8B,qBAAoC;AACnH,QAAI;AACF,UAAI,WAAW,GACZ,WAAW,mBAA0B,EACrC,UAAU,EACV,MAAM,eAAsB,KAAK,UAAU,EAC3C,MAAM,qCAA8C,iBAAiB,IAAI,EAAE;AAC9E,UAAI,uBAAuB,MAAM;AAC/B,mBAAW,SAAS,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UAC3C,GAAG,mBAA0B,KAAK,mBAAmB;AAAA,UACrD,GAAG,mBAA0B,MAAM,IAAI;AAAA,QACzC,CAAC,CAAC;AAAA,MACJ,OAAO;AACL,mBAAW,SAAS,MAAM,2CAAoD,IAAI,EAAE;AAAA,MACtF;AACA,YAAM,OAAO,MAAM,SAChB,QAAQ,cAAqB,MAAM,EACnC,QAAQ;AAEX,UAAI,CAAC,KAAK,QAAQ;AAChB,eAAO,EAAE,QAAQ,QAAiB,YAAY,CAAC,EAAW;AAAA,MAC5D;AAEA,YAAM,YACJ,uBAAuB,QAAQ,KAAK,KAAK,CAAC,QAAa,IAAI,oBAAoB,mBAAmB;AACpG,YAAM,gBAAgB,CACpB,UACA,cACM;AACN,YAAI,CAAC,SAAU,QAAO;AACtB,YAAI,WAAW;AACb,cAAI,UAAU,YAAY,CAAC,SAAS,SAAU,QAAO;AACrD,cAAI,CAAC,UAAU,YAAY,SAAS,SAAU,QAAO;AAAA,QACvD;AACA,YAAI,UAAU,eAAe,CAAC,SAAS,YAAa,QAAO;AAC3D,YAAI,CAAC,UAAU,eAAe,SAAS,YAAa,QAAO;AAC3D,eAAO,UAAU,YAAY,SAAS,YAAY,YAAY;AAAA,MAChE;AAEA,YAAM,gBAAgB,oBAAI,IAAsF;AAChH,UAAI,WAA4F;AAChG,iBAAW,OAAO,MAAM;AACtB,cAAM,MAAM,OAAO,IAAI,mBAAmB,UAAU;AACpD,cAAM,YAAY,IAAI,aAAa,IAAI,KAAK,IAAI,UAAU,EAAE,QAAQ,IAAI;AACxE,cAAM,cAAc,iBAAiB,OAAO,IAAI,cAAc,gBAAgB;AAC9E,cAAM,WAAW,uBAAuB,OAAO,IAAI,oBAAoB,sBAAsB,IAAI,mBAAmB;AACpH,cAAM,YAAY,EAAE,KAAK,WAAW,aAAa,SAAS;AAC1D,YAAI,IAAI,mBAAmB,MAAM;AAC/B,qBAAW,cAAc,UAAU,SAAS;AAC5C;AAAA,QACF;AACA,cAAM,WAAW,cAAc,IAAI,GAAG;AACtC,sBAAc,IAAI,KAAK,cAAc,YAAY,MAAM,SAAS,CAAC;AAAA,MACnE;AAEA,YAAM,aAAa,MAAM,KAAK,cAAc,OAAO,CAAC,EACjD,OAAO,CAAC,UAAU,CAAC,aAAa,MAAM,QAAQ,EAC9C,IAAI,CAAC,EAAE,IAAI,MAAM;AAChB,cAAM,gBAAgB,IAAI,eAAe,IAAI,KAAK,IAAI,YAAY,IAAI;AACtE,cAAM,cAAc,IAAI,aAAa,IAAI,KAAK,IAAI,UAAU,IAAI;AAChE,cAAM,eAAe,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;AACnE,cAAM,UACJ,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,IAAI,IAAI,cAAc,QAAQ,IAAI;AAC7E,cAAM,QAAQ,eACV,cACA,UACE,YACC,IAAI,UAAqB;AAChC,eAAO;AAAA,UACL,gBAAgB,IAAI,mBAAmB;AAAA,UACvC,gBAAgB,IAAI,mBAAmB;AAAA,UACvC,QAAQ;AAAA,UACR,WAAW,cAAc,YAAY,YAAY,IAAI;AAAA,UACrD,YAAY,eAAe,aAAa,YAAY,IAAI;AAAA,UACxD,aAAa,gBAAgB,cAAc,YAAY,IAAI;AAAA,UAC3D,gBAAgB,IAAI,mBAAmB;AAAA,UACvC,YAAY,IAAI,eAAe;AAAA,QACjC;AAAA,MACF,CAAC,EACA,KAAK,CAAC,GAAG,OAAO,EAAE,kBAAkB,MAAM,EAAE,kBAAkB,EAAE;AACnE,YAAM,mBAAmB,WAAW,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU;AAC/D,YAAM,oBAAoB,iBAAiB;AAAA,QACzC,CAAC,MAAM,EAAE,WAAW,gBAAgB,EAAE,WAAW;AAAA,MACnD;AACA,YAAM,oBAAoB,iBAAiB,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAC/E,UAAI,SAAwD;AAC5D,UAAI,iBAAiB,QAAQ;AAC3B,YAAI,kBAAkB,QAAQ;AAC5B,mBAAS,kBAAkB,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,IAAI,YAAY;AAAA,QAC/E,WAAW,kBAAkB,QAAQ;AACnC,mBAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,YAAY,iBAAiB,CAAC,GAAG,aAAa,WAAW,CAAC,GAAG,aAAa;AAChF,YAAM,aAAa,WAAW,SAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,OAAQ;AACpG,YAAM,cAAc,iBAAiB,CAAC,GAAG,eAAe,WAAW,CAAC,GAAG,eAAe;AACtF,YAAM,gBAAgB,WAAW,OAAO,CAAC,KAAK,MAAM,OAAO,EAAE,cAAc,IAAI,CAAC;AAChF,YAAM,eAAe,WAAW,OAAO,CAAC,KAAK,MAAM,OAAO,EAAE,kBAAkB,IAAI,CAAC;AACnF,YAAM,iBAAiB,gBAAgB,KAAK,IAAI,eAAe,YAAY,IAAI,gBAAgB;AAC/F,YAAM,iBAAiB,CAAC,aAAa,CAAC,YAAY,SAAS,WAAW,WAAW;AAEjF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,gBAAgB,iBAAiB,gBAAgB,KAAK,mBAAmB;AAAA,QACzF,YAAY,gBAAgB,gBAAgB,gBAAgB,KAAK,eAAe;AAAA,QAChF;AAAA,QACA,OAAO,iBACH;AAAA,UACE,SAAS,MAAM;AACb,kBAAM,gBAAgB,eAAgB,IAAI,eAAe,IAAI,KAAK,eAAgB,IAAI,YAAY,IAAI;AACtG,kBAAM,eAAe,eAAgB,IAAI,cAAc,IAAI,KAAK,eAAgB,IAAI,WAAW,IAAI;AACnG,gBAAI,aAAc,QAAO;AACzB,gBACE,CAAC,iBACD,KAAK,IAAI,IAAI,cAAc,QAAQ,IAAI,oBACvC;AACA,qBAAO;AAAA,YACT;AACA,mBAAQ,eAAgB,IAAI,UAAqB;AAAA,UACnD,GAAG;AAAA,UACH,gBAAgB,eAAe,IAAI,mBAAmB;AAAA,UACtD,YAAY,eAAe,IAAI,eAAe;AAAA,QAChD,IACA;AAAA,MACN;AAAA,IACF,QAAQ;AACN,aAAO,EAAE,QAAQ,QAAiB,YAAY,CAAC,EAAW;AAAA,IAC5D;AAAA,EACF;AAEA,QAAM,iBAAiB,CAAC,UAAkC;AACxD,QAAI,SAAS,KAAM,QAAO;AAC1B,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,EAC5C;AAEA,QAAM,gBAAgB;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,aAAa;AAAA,EACf;AACA,QAAM,yBAAyB,oBAAI,IAAY;AAM/C,QAAM,mBAAmB,MAAM,sBAAsB,IAAI,EAAE,aAAa,WAAW,GAAG,cAAc,CAAC;AAKrG,MAAI,gBAAgB,UAAU,SAAS,KAAK,CAAC,0BAA0B,kBAAkB,WAAW,KAAK,IAAI,CAAC,GAAG;AAC/G,UAAM;AAAA,MAAmB;AAAA,MAAW;AAAA,MAA8B,CAAC,aACjE,wBAAwB,IAAI,EAAE,YAAY,UAAU,GAAG,cAAc,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/F;AACA,UAAM,YAAY,MAAM,sBAAsB,IAAI,EAAE,aAAa,WAAW,GAAG,cAAc,CAAC;AAC9F,eAAW,CAAC,UAAU,QAAQ,KAAK,UAAW,kBAAiB,IAAI,UAAU,QAAQ;AAAA,EACvF;AAEA,QAAM,oBAAoB,UAAU,IAAI,CAAC,aAAa,iBAAiB,IAAI,QAAQ,KAAK,IAAI;AAE5F,QAAM,OAAO,MAAM,QAAQ,IAAI,UAAU,IAAI,CAAC,QAAQ,gBAAgB,KAAK,UAAU,cAAc,CAAC,CAAC;AAErG,QAAM,QAAe,CAAC;AACtB,WAAS,MAAM,GAAG,MAAM,UAAU,QAAQ,OAAO,GAAG;AAClD,UAAM,MAAM,UAAU,GAAG;AACzB,QAAI,WAAW,kBAAkB,GAAG;AAEpC,UAAM,cAAc,UAAU,wBAAwB,OAAO,SAAS,eAAe,UAAU,eAAe,IAAI,KAAK,SAAS,YAAY,IAAI;AAChJ,UAAM,UAAU,CAAC,YAAY,CAAC,eAAgB,KAAK,IAAI,IAAI,YAAY,QAAQ,IAAI;AACnF,QAAI,QAAS,wBAAuB,IAAI,GAAG;AAE3C,UAAM,MAAM,KAAK,GAAG;AACpB,UAAM,QAAS,KAAK,IAAI,GAAG,GAAG,SAAU;AACxC,UAAM,kBAAkB,eAAe,UAAU,SAAS;AAC1D,UAAM,mBAAmB,eAAe,UAAU,YAAY;AAC9D,UAAM,gBAAgB,sBAAsB,IAAI,GAAG;AACnD,UAAM,oBAAoB,gBAAgB,eAAgB,UAAkB,sBAAuB,UAAkB,oBAAoB,IAAI;AAC7I,UAAM,kBAAkB,wBAAwB,IAAI,GAAG;AACvD,UAAM,sBAAsB,kBAAmB,uBAAuB,GAAG,KAAK,IAAK;AACnF,UAAM,MAAM,MAAM;AAChB,UAAI,mBAAmB,QAAQ,oBAAoB,KAAM,QAAO;AAChE,UAAI,oBAAoB,iBAAkB,QAAO;AACjD,UAAI,CAAC,cAAe,QAAO;AAC3B,aAAO,qBAAqB,QAAQ,sBAAsB;AAAA,IAC5D,GAAG;AACH,UAAM,KAAK;AAAA,MACT,UAAU;AAAA,MACV;AAAA,MACA,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,aAAa,gBAAgB,oBAAoB;AAAA,MACjD;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,cAAc;AACjB,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAC7C,UAAI,uBAAuB,OAAO,GAAG;AACnC,cAAM,QAAQ;AAAA,UACZ,MAAM,KAAK,sBAAsB,EAAE;AAAA,YAAI,CAAC,aACtC,SACG,UAAU,gCAAgC;AAAA,cACzC,YAAY;AAAA,cACZ,UAAU,YAAY;AAAA,cACtB;AAAA,cACA,SAAS;AAAA,YACX,CAAC,EACA,MAAM,MAAM,MAAS;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,MAAI,aAAa,GACd,WAAW,oBAA2B,EACtC,UAAU;AACb,MAAI,YAAY,MAAM;AACpB,iBAAa,WAAW,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MAC/C,GAAG,aAAoB,KAAK,QAAQ;AAAA,MACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,IACnC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,iBAAa,WAAW,MAAM,aAAoB,MAAM,IAAW;AAAA,EACrE;AACA,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,QAAQ;AACtE,iBAAa,WAAW,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MAC/C,GAAG,mBAA0B,MAAM,IAAI;AAAA,MACvC,GAAG,mBAA0B,MAAM,oBAAoB;AAAA,IACzD,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,iBAAa,WAAW,MAAM,mBAA0B,MAAM,IAAW;AAAA,EAC3E;AACA,QAAM,YAAY,MAAM,WACrB,QAAQ,eAAsB,MAAM,EACpC,MAAM,GAAG,EACT,QAAQ;AAEX,QAAM,SAAS,UAAU,IAAI,CAAC,QAAa;AACzC,UAAM,aAAa,IAAI,uBAAuB,OAAO,IAAI,cAAc,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;AACrH,WAAO;AAAA,MACL,IAAI,OAAO,IAAI,EAAE;AAAA,MACjB,QAAQ,OAAO,IAAI,UAAU,EAAE;AAAA,MAC/B,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC,YAAY,IAAI,eAAe;AAAA,MAC/B,UAAU,IAAI,aAAa;AAAA,MAC3B,UAAU,IAAI,aAAa;AAAA,MAC3B,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC,OAAO,IAAI,SAAS;AAAA,MACpB,SAAS,IAAI,WAAW;AAAA,MACxB,YAAY,aAAa,WAAW,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7E;AAAA,EACF,CAAC;AAED,MAAI,YAAY,GACb,WAAW,qBAA4B,EACvC,UAAU;AACb,MAAI,YAAY,MAAM;AACpB,gBAAY,UAAU,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MAC7C,GAAG,aAAoB,KAAK,QAAQ;AAAA,MACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,IACnC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,gBAAY,UAAU,MAAM,aAAoB,MAAM,IAAW;AAAA,EACnE;AACA,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,QAAQ;AACtE,gBAAY,UAAU,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MAC7C,GAAG,mBAA0B,MAAM,IAAI;AAAA,MACvC,GAAG,mBAA0B,MAAM,oBAAoB;AAAA,IACzD,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,gBAAY,UAAU,MAAM,mBAA0B,MAAM,IAAW;AAAA,EACzE;AACA,QAAM,UAAU,MAAM,UACnB,QAAQ,eAAsB,MAAM,EACpC,MAAM,GAAG,EACT,QAAQ;AAEX,QAAM,OAAO,QAAQ,IAAI,CAAC,QAAa;AACrC,UAAM,aAAa,IAAI,uBAAuB,OAAO,IAAI,cAAc,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;AACrH,UAAM,QAAQ,IAAI,UAAU,SAAS,SAAS;AAC9C,WAAO;AAAA,MACL,IAAI,OAAO,IAAI,EAAE;AAAA,MACjB,QAAQ,OAAO,IAAI,UAAU,EAAE;AAAA,MAC/B,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC;AAAA,MACA,YAAY,IAAI,eAAe;AAAA,MAC/B,UAAU,IAAI,aAAa;AAAA,MAC3B,UAAU,IAAI,aAAa;AAAA,MAC3B,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC,SAAS,IAAI,WAAW;AAAA,MACxB,YAAY,aAAa,WAAW,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7E;AAAA,EACF,CAAC;AAED,QAAM,WAAW,aAAa,KAAK,EAAE,OAAO,QAAQ,KAAK,CAAC;AAC1D,QAAM,UAAU,MAAM,KAAK,CAAC,SAAS;AAGnC,QAAI,KAAK,aAAa,QAAQ,KAAK,cAAc,KAAM,QAAO;AAC9D,QAAI,KAAK,aAAa,QAAQ,KAAK,cAAc,KAAM,QAAO;AAC9D,WAAO,KAAK,cAAc,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,SAAS;AACX,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,KAAK,UAAU;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ,SAAS,QAAQ;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,+BAA+B;AAAA,EACpG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,sBAAsB;AAAA,IACrG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { readCoverageSnapshots, refreshCoverageSnapshot, type CoverageSnapshot } from '../lib/coverage'\nimport { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'\nimport type { FullTextSearchStrategy } from '@open-mercato/search/strategies'\nimport type { SearchModuleConfig } from '@open-mercato/shared/modules/search'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { queryIndexTag, queryIndexErrorSchema, queryIndexStatusResponseSchema } from './openapi'\nimport { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['query_index.status.view'] },\n}\n\nconst STATUS_REFRESH_COOLDOWN_MS = 60_000\n\nfunction getCoverageSnapshotRefreshedAt(snapshot: Pick<CoverageSnapshot, 'refreshed_at'> | null | undefined): number | null {\n  const value = snapshot?.refreshed_at\n  if (value instanceof Date) {\n    const time = value.getTime()\n    return Number.isFinite(time) ? time : null\n  }\n  if (typeof value === 'string') {\n    const time = new Date(value).getTime()\n    return Number.isFinite(time) ? time : null\n  }\n  return null\n}\n\nfunction hasFreshCoverageSnapshots(\n  snapshots: Map<string, CoverageSnapshot>,\n  entityIds: string[],\n  now: number,\n): boolean {\n  for (const entityId of entityIds) {\n    const refreshedAt = getCoverageSnapshotRefreshedAt(snapshots.get(entityId))\n    if (refreshedAt === null || now - refreshedAt >= STATUS_REFRESH_COOLDOWN_MS) return false\n  }\n  return entityIds.length > 0\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const db = (em as any).getKysely()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const organizationId = scope.selectedId ?? auth.orgId ?? null\n  const tenantId = typeof scope.tenantId === 'string' && scope.tenantId.trim().length > 0\n    ? scope.tenantId.trim()\n    : (typeof auth.tenantId === 'string' && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null)\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })\n  }\n\n  const organizationFilter =\n    scope.filterIds === null\n      ? null\n      : Array.isArray(scope.filterIds) && scope.filterIds.length > 0\n        ? scope.filterIds\n        : organizationId\n          ? [organizationId]\n          : []\n\n  if (Array.isArray(organizationFilter) && organizationFilter.length === 0) {\n    return NextResponse.json({ error: 'Organization access denied' }, { status: 403 })\n  }\n\n  const organizationScopeIds = organizationFilter === null\n    ? null\n    : Array.from(\n      new Set(\n        organizationFilter.filter(\n          (value): value is string => typeof value === 'string' && value.length > 0,\n        ),\n      ),\n    )\n\n  if (Array.isArray(organizationScopeIds) && organizationScopeIds.length === 0) {\n    return NextResponse.json({ error: 'Organization access denied' }, { status: 403 })\n  }\n\n  const url = new URL(req.url)\n  const forceRefresh = url.searchParams.has('refresh') && url.searchParams.get('refresh') !== '0'\n\n  const generatedIds = flattenSystemEntityIds(getEntityIds() as Record<string, Record<string, string>>)\n  const generated = generatedIds.map((entityId) => ({ entityId, label: entityId }))\n\n  const byId = new Map<string, { entityId: string; label: string }>()\n  for (const g of generated) byId.set(g.entityId, g)\n\n  let entityIds = generatedIds.slice()\n\n  // Resolve search module configs to determine vector-enabled entities\n  // Entities with buildSource defined are vector-search enabled\n  let searchModuleConfigs: SearchModuleConfig[] = []\n  try {\n    searchModuleConfigs = container.resolve('searchModuleConfigs') as SearchModuleConfig[]\n  } catch {\n    // Search module configs not available\n  }\n\n  const vectorEnabledEntities = new Set<string>()\n  const fulltextEnabledEntities = new Set<string>()\n  for (const moduleConfig of searchModuleConfigs) {\n    for (const entity of moduleConfig.entities ?? []) {\n      if (entity.enabled !== false) {\n        // Vector: entities with buildSource defined\n        if (typeof entity.buildSource === 'function') {\n          vectorEnabledEntities.add(entity.entityId)\n        }\n        // Fulltext: entities with fieldPolicy defined\n        if (entity.fieldPolicy && typeof entity.fieldPolicy === 'object') {\n          fulltextEnabledEntities.add(entity.entityId)\n        }\n      }\n    }\n  }\n\n  // Resolve fulltext strategy for entity counts\n  let fulltextStrategy: FullTextSearchStrategy | null = null\n  try {\n    const searchStrategies = container.resolve('searchStrategies') as unknown[]\n    fulltextStrategy = (searchStrategies?.find(\n      (s: unknown) => (s as { id?: string })?.id === 'fulltext',\n    ) as FullTextSearchStrategy) ?? null\n  } catch {\n    fulltextStrategy = null\n  }\n\n  // Fetch fulltext entity counts\n  let fulltextEntityCounts: Record<string, number> | null = null\n  if (fulltextStrategy) {\n    try {\n      fulltextEntityCounts = await fulltextStrategy.getEntityCounts(tenantId)\n    } catch {\n      fulltextEntityCounts = null\n    }\n  }\n\n  // Limit to entities that have active custom field definitions in current scope\n  try {\n    let cfQuery = db\n      .selectFrom('custom_field_defs' as any)\n      .select(['entity_id' as any])\n      .distinct()\n      .where('is_active' as any, '=', true)\n    if (tenantId != null) {\n      cfQuery = cfQuery.where((eb: any) => eb.or([\n        eb('tenant_id' as any, '=', tenantId),\n        eb('tenant_id' as any, 'is', null),\n      ]))\n    } else {\n      cfQuery = cfQuery.where('tenant_id' as any, 'is', null as any)\n    }\n    if (Array.isArray(organizationScopeIds)) {\n      cfQuery = cfQuery.where((eb: any) => eb.or([\n        eb('organization_id' as any, 'in', organizationScopeIds),\n        eb('organization_id' as any, 'is', null),\n      ]))\n    }\n    const cfRows = await cfQuery.execute() as Array<{ entity_id: string }>\n    const enabled = new Set<string>((cfRows || []).map((r) => String(r.entity_id)))\n    entityIds = entityIds.filter((id) => enabled.has(id))\n  } catch {}\n\n  const HEARTBEAT_STALE_MS = 60_000\n  const COVERAGE_STALE_MS = 60_000\n  const COVERAGE_REFRESH_CONCURRENCY = 8\n\n  async function fetchJobSummary(entityType: string, tenantIdParam: string | null, organizationIdParam: string | null) {\n    try {\n      let jobQuery = db\n        .selectFrom('entity_index_jobs' as any)\n        .selectAll()\n        .where('entity_type' as any, '=', entityType)\n        .where(sql<boolean>`tenant_id is not distinct from ${tenantIdParam ?? null}`)\n      if (organizationIdParam != null) {\n        jobQuery = jobQuery.where((eb: any) => eb.or([\n          eb('organization_id' as any, '=', organizationIdParam),\n          eb('organization_id' as any, 'is', null),\n        ]))\n      } else {\n        jobQuery = jobQuery.where(sql<boolean>`organization_id is not distinct from ${null}`)\n      }\n      const rows = await jobQuery\n        .orderBy('started_at' as any, 'desc')\n        .execute() as Array<Record<string, any>>\n\n      if (!rows.length) {\n        return { status: 'idle' as const, partitions: [] as any[] }\n      }\n\n      const preferOrg =\n        organizationIdParam != null && rows.some((row: any) => row.organization_id === organizationIdParam)\n      const pickPreferred = <T extends { startedTs: number; tenantMatch: boolean; orgMatch: boolean }>(\n        existing: T | null,\n        candidate: T,\n      ): T => {\n        if (!existing) return candidate\n        if (preferOrg) {\n          if (candidate.orgMatch && !existing.orgMatch) return candidate\n          if (!candidate.orgMatch && existing.orgMatch) return existing\n        }\n        if (candidate.tenantMatch && !existing.tenantMatch) return candidate\n        if (!candidate.tenantMatch && existing.tenantMatch) return existing\n        return candidate.startedTs > existing.startedTs ? candidate : existing\n      }\n\n      const partitionRows = new Map<string, { row: any; startedTs: number; tenantMatch: boolean; orgMatch: boolean }>()\n      let scopeRow: { row: any; startedTs: number; tenantMatch: boolean; orgMatch: boolean } | null = null\n      for (const row of rows) {\n        const key = String(row.partition_index ?? '__null__')\n        const startedTs = row.started_at ? new Date(row.started_at).getTime() : 0\n        const tenantMatch = tenantIdParam != null ? row.tenant_id === tenantIdParam : true\n        const orgMatch = organizationIdParam != null ? row.organization_id === organizationIdParam : row.organization_id == null\n        const candidate = { row, startedTs, tenantMatch, orgMatch }\n        if (row.partition_index == null) {\n          scopeRow = pickPreferred(scopeRow, candidate)\n          continue\n        }\n        const existing = partitionRows.get(key)\n        partitionRows.set(key, pickPreferred(existing ?? null, candidate))\n      }\n\n      const partitions = Array.from(partitionRows.values())\n        .filter((entry) => !preferOrg || entry.orgMatch)\n        .map(({ row }) => {\n          const heartbeatDate = row.heartbeat_at ? new Date(row.heartbeat_at) : null\n          const startedDate = row.started_at ? new Date(row.started_at) : null\n          const finishedDate = row.finished_at ? new Date(row.finished_at) : null\n          const stalled =\n            !finishedDate && (!heartbeatDate || Date.now() - heartbeatDate.getTime() > HEARTBEAT_STALE_MS)\n          const state = finishedDate\n            ? 'completed'\n            : stalled\n              ? 'stalled'\n              : (row.status as string) || 'reindexing'\n          return {\n            partitionIndex: row.partition_index ?? null,\n            partitionCount: row.partition_count ?? null,\n            status: state,\n            startedAt: startedDate ? startedDate.toISOString() : null,\n            finishedAt: finishedDate ? finishedDate.toISOString() : null,\n            heartbeatAt: heartbeatDate ? heartbeatDate.toISOString() : null,\n            processedCount: row.processed_count ?? null,\n            totalCount: row.total_count ?? null,\n          }\n        })\n        .sort((a, b) => (a.partitionIndex ?? 0) - (b.partitionIndex ?? 0))\n      const activePartitions = partitions.filter((p) => !p.finishedAt)\n      const runningPartitions = activePartitions.filter(\n        (p) => p.status === 'reindexing' || p.status === 'purging',\n      )\n      const stalledPartitions = activePartitions.filter((p) => p.status === 'stalled')\n      let status: 'idle' | 'reindexing' | 'purging' | 'stalled' = 'idle'\n      if (activePartitions.length) {\n        if (runningPartitions.length) {\n          status = runningPartitions.some((p) => p.status === 'purging') ? 'purging' : 'reindexing'\n        } else if (stalledPartitions.length) {\n          status = 'stalled'\n        }\n      }\n\n      const startedAt = activePartitions[0]?.startedAt ?? partitions[0]?.startedAt ?? null\n      const finishedAt = status === 'idle' ? (partitions.find((p) => p.finishedAt)?.finishedAt ?? null) : null\n      const heartbeatAt = activePartitions[0]?.heartbeatAt ?? partitions[0]?.heartbeatAt ?? null\n      const jobTotalCount = partitions.reduce((sum, p) => sum + (p.totalCount ?? 0), 0)\n      const processedSum = partitions.reduce((sum, p) => sum + (p.processedCount ?? 0), 0)\n      const processedCount = jobTotalCount ? Math.min(jobTotalCount, processedSum) : processedSum || null\n      const scopeCandidate = !preferOrg || !scopeRow || scopeRow.orgMatch ? scopeRow : null\n\n      return {\n        status,\n        startedAt,\n        finishedAt,\n        heartbeatAt,\n        processedCount: jobTotalCount ? processedCount : scopeCandidate?.row?.processed_count ?? null,\n        totalCount: jobTotalCount ? jobTotalCount : scopeCandidate?.row?.total_count ?? null,\n        partitions,\n        scope: scopeCandidate\n          ? {\n              status: (() => {\n                const heartbeatDate = scopeCandidate!.row.heartbeat_at ? new Date(scopeCandidate!.row.heartbeat_at) : null\n                const finishedDate = scopeCandidate!.row.finished_at ? new Date(scopeCandidate!.row.finished_at) : null\n                if (finishedDate) return 'completed'\n                if (\n                  !heartbeatDate ||\n                  Date.now() - heartbeatDate.getTime() > HEARTBEAT_STALE_MS\n                ) {\n                  return 'stalled'\n                }\n                return (scopeCandidate!.row.status as string) || 'reindexing'\n              })(),\n              processedCount: scopeCandidate.row.processed_count ?? null,\n              totalCount: scopeCandidate.row.total_count ?? null,\n            }\n          : null,\n      }\n    } catch {\n      return { status: 'idle' as const, partitions: [] as any[] }\n    }\n  }\n\n  const normalizeCount = (value: unknown): number | null => {\n    if (value == null) return null\n    if (typeof value === 'number') return Number.isFinite(value) ? value : null\n    const parsed = Number(value)\n    return Number.isFinite(parsed) ? parsed : null\n  }\n\n  const coverageScope = {\n    tenantId: tenantId ?? null,\n    organizationId,\n    withDeleted: false,\n  } as const\n  const entitiesNeedingRefresh = new Set<string>()\n\n  // Read every entity's coverage snapshot in a single batched query. This endpoint is\n  // polled by the status table every few seconds, so the poll path must stay read-cheap:\n  // stale snapshots are refreshed asynchronously via the query_index.coverage.refresh\n  // event emitted below, never inline per entity.\n  const snapshotByEntity = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })\n\n  // An explicit refresh action (?refresh) may block, but only when the durable\n  // coverage snapshots are stale. Recent persisted snapshots survive workers/restarts,\n  // so repeated refresh requests use them instead of hammering base-table counts.\n  if (forceRefresh && entityIds.length > 0 && !hasFreshCoverageSnapshots(snapshotByEntity, entityIds, Date.now())) {\n    await mapWithConcurrency(entityIds, COVERAGE_REFRESH_CONCURRENCY, (entityId) =>\n      refreshCoverageSnapshot(em, { entityType: entityId, ...coverageScope }).catch(() => undefined),\n    )\n    const refreshed = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })\n    for (const [entityId, snapshot] of refreshed) snapshotByEntity.set(entityId, snapshot)\n  }\n\n  const coverageSnapshots = entityIds.map((entityId) => snapshotByEntity.get(entityId) ?? null)\n\n  const jobs = await Promise.all(entityIds.map((eid) => fetchJobSummary(eid, tenantId, organizationId)))\n\n  const items: any[] = []\n  for (let idx = 0; idx < entityIds.length; idx += 1) {\n    const eid = entityIds[idx]\n    let coverage = coverageSnapshots[idx]\n\n    const refreshedAt = coverage?.refreshed_at instanceof Date ? coverage.refreshed_at : coverage?.refreshed_at ? new Date(coverage.refreshed_at) : null\n    const isStale = !coverage || !refreshedAt || (Date.now() - refreshedAt.getTime() > COVERAGE_STALE_MS)\n    if (isStale) entitiesNeedingRefresh.add(eid)\n\n    const job = jobs[idx]\n    const label = (byId.get(eid)?.label) || eid\n    const baseCountNumber = normalizeCount(coverage?.baseCount)\n    const indexCountNumber = normalizeCount(coverage?.indexedCount)\n    const vectorEnabled = vectorEnabledEntities.has(eid)\n    const vectorCountNumber = vectorEnabled ? normalizeCount((coverage as any)?.vectorIndexedCount ?? (coverage as any)?.vector_indexed_count) : null\n    const fulltextEnabled = fulltextEnabledEntities.has(eid)\n    const fulltextCountNumber = fulltextEnabled ? (fulltextEntityCounts?.[eid] ?? 0) : null\n    const ok = (() => {\n      if (baseCountNumber == null || indexCountNumber == null) return false\n      if (baseCountNumber !== indexCountNumber) return false\n      if (!vectorEnabled) return true\n      return vectorCountNumber != null && vectorCountNumber === baseCountNumber\n    })()\n    items.push({\n      entityId: eid,\n      label,\n      baseCount: baseCountNumber,\n      indexCount: indexCountNumber,\n      vectorCount: vectorEnabled ? vectorCountNumber : null,\n      vectorEnabled,\n      fulltextCount: fulltextCountNumber,\n      fulltextEnabled,\n      ok,\n      job,\n      refreshedAt: refreshedAt ?? null,\n    })\n  }\n\n  if (!forceRefresh) {\n    try {\n      const eventBus = container.resolve('eventBus')\n      if (entitiesNeedingRefresh.size > 0) {\n        await Promise.all(\n          Array.from(entitiesNeedingRefresh).map((entityId) =>\n            eventBus\n              .emitEvent('query_index.coverage.refresh', {\n                entityType: entityId,\n                tenantId: tenantId ?? null,\n                organizationId,\n                delayMs: 0,\n              })\n              .catch(() => undefined)\n          )\n        )\n      }\n    } catch {}\n  }\n\n  let errorQuery = db\n    .selectFrom('indexer_error_logs' as any)\n    .selectAll()\n  if (tenantId != null) {\n    errorQuery = errorQuery.where((eb: any) => eb.or([\n      eb('tenant_id' as any, '=', tenantId),\n      eb('tenant_id' as any, 'is', null),\n    ]))\n  } else {\n    errorQuery = errorQuery.where('tenant_id' as any, 'is', null as any)\n  }\n  if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {\n    errorQuery = errorQuery.where('organization_id' as any, 'in', organizationScopeIds)\n  } else {\n    errorQuery = errorQuery.where('organization_id' as any, 'is', null as any)\n  }\n  const errorRows = await errorQuery\n    .orderBy('occurred_at' as any, 'desc')\n    .limit(100)\n    .execute() as Array<Record<string, any>>\n\n  const errors = errorRows.map((row: any) => {\n    const occurredAt = row.occurred_at instanceof Date ? row.occurred_at : row.occurred_at ? new Date(row.occurred_at) : null\n    return {\n      id: String(row.id),\n      source: String(row.source ?? ''),\n      handler: String(row.handler ?? ''),\n      entityType: row.entity_type ?? null,\n      recordId: row.record_id ?? null,\n      tenantId: row.tenant_id ?? null,\n      organizationId: row.organization_id ?? null,\n      message: String(row.message ?? ''),\n      stack: row.stack ?? null,\n      payload: row.payload ?? null,\n      occurredAt: occurredAt ? occurredAt.toISOString() : new Date().toISOString(),\n    }\n  })\n\n  let logsQuery = db\n    .selectFrom('indexer_status_logs' as any)\n    .selectAll()\n  if (tenantId != null) {\n    logsQuery = logsQuery.where((eb: any) => eb.or([\n      eb('tenant_id' as any, '=', tenantId),\n      eb('tenant_id' as any, 'is', null),\n    ]))\n  } else {\n    logsQuery = logsQuery.where('tenant_id' as any, 'is', null as any)\n  }\n  if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {\n    logsQuery = logsQuery.where('organization_id' as any, 'in', organizationScopeIds)\n  } else {\n    logsQuery = logsQuery.where('organization_id' as any, 'is', null as any)\n  }\n  const logRows = await logsQuery\n    .orderBy('occurred_at' as any, 'desc')\n    .limit(100)\n    .execute() as Array<Record<string, any>>\n\n  const logs = logRows.map((row: any) => {\n    const occurredAt = row.occurred_at instanceof Date ? row.occurred_at : row.occurred_at ? new Date(row.occurred_at) : null\n    const level = row.level === 'warn' ? 'warn' : 'info'\n    return {\n      id: String(row.id),\n      source: String(row.source ?? ''),\n      handler: String(row.handler ?? ''),\n      level,\n      entityType: row.entity_type ?? null,\n      recordId: row.record_id ?? null,\n      tenantId: row.tenant_id ?? null,\n      organizationId: row.organization_id ?? null,\n      message: String(row.message ?? ''),\n      details: row.details ?? null,\n      occurredAt: occurredAt ? occurredAt.toISOString() : new Date().toISOString(),\n    }\n  })\n\n  const response = NextResponse.json({ items, errors, logs })\n  const partial = items.find((item) => {\n    // Coverage not computed yet (no snapshot) \u2014 pending an async refresh, not a partial\n    // index. Do not raise the partial-index warning while counts are still unknown.\n    if (item.baseCount == null && item.indexCount == null) return false\n    if (item.baseCount == null || item.indexCount == null) return true\n    return item.baseCount !== item.indexCount\n  })\n  if (partial) {\n    response.headers.set(\n      'x-om-partial-index',\n      JSON.stringify({\n        type: 'partial_index',\n        entity: partial.entityId,\n        entityLabel: partial.label ?? partial.entityId,\n        baseCount: partial.baseCount,\n        indexedCount: partial.indexCount,\n        scope: organizationId,\n      })\n    )\n  }\n  return response\n}\n\nconst queryIndexStatusDoc: OpenApiMethodDoc = {\n  summary: 'Inspect query index coverage',\n  description: 'Returns entity counts comparing base tables with the query index along with the latest job status.',\n  tags: [queryIndexTag],\n  responses: [\n    { status: 200, description: 'Current query index status.', schema: queryIndexStatusResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Tenant or organization context required', schema: queryIndexErrorSchema },\n    { status: 401, description: 'Authentication required', schema: queryIndexErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: queryIndexTag,\n  summary: 'Query index status',\n  methods: {\n    GET: queryIndexStatusDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,WAAW;AACpB,SAAS,uBAAuB,+BAAsD;AACtF,SAAS,0BAA0B;AAInC,SAAS,eAAe,uBAAuB,sCAAsC;AACrF,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AAE5C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AACzE;AAEA,MAAM,6BAA6B;AAEnC,SAAS,+BAA+B,UAAoF;AAC1H,QAAM,QAAQ,UAAU;AACxB,MAAI,iBAAiB,MAAM;AACzB,UAAM,OAAO,MAAM,QAAQ;AAC3B,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AAAA,EACxC;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,IAAI,KAAK,KAAK,EAAE,QAAQ;AACrC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,0BACP,WACA,WACA,KACS;AACT,aAAW,YAAY,WAAW;AAChC,UAAM,cAAc,+BAA+B,UAAU,IAAI,QAAQ,CAAC;AAC1E,QAAI,gBAAgB,QAAQ,MAAM,eAAe,2BAA4B,QAAO;AAAA,EACtF;AACA,SAAO,UAAU,SAAS;AAC5B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,iBAAiB,MAAM,cAAc,KAAK,SAAS;AACzD,QAAM,WAAW,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,IAClF,MAAM,SAAS,KAAK,IACnB,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,EAAE,SAAS,IAAI,KAAK,SAAS,KAAK,IAAI;AACnG,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,qBACJ,MAAM,cAAc,OAChB,OACA,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,UAAU,SAAS,IACzD,MAAM,YACN,iBACE,CAAC,cAAc,IACf,CAAC;AAEX,MAAI,MAAM,QAAQ,kBAAkB,KAAK,mBAAmB,WAAW,GAAG;AACxE,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,uBAAuB,uBAAuB,OAChD,OACA,MAAM;AAAA,IACN,IAAI;AAAA,MACF,mBAAmB;AAAA,QACjB,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEF,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,WAAW,GAAG;AAC5E,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,eAAe,IAAI,aAAa,IAAI,SAAS,KAAK,IAAI,aAAa,IAAI,SAAS,MAAM;AAE5F,QAAM,eAAe,uBAAuB,aAAa,CAA2C;AACpG,QAAM,YAAY,aAAa,IAAI,CAAC,cAAc,EAAE,UAAU,OAAO,SAAS,EAAE;AAEhF,QAAM,OAAO,oBAAI,IAAiD;AAClE,aAAW,KAAK,UAAW,MAAK,IAAI,EAAE,UAAU,CAAC;AAEjD,MAAI,YAAY,aAAa,MAAM;AAInC,MAAI,sBAA4C,CAAC;AACjD,MAAI;AACF,0BAAsB,UAAU,QAAQ,qBAAqB;AAAA,EAC/D,QAAQ;AAAA,EAER;AAEA,QAAM,wBAAwB,oBAAI,IAAY;AAC9C,QAAM,0BAA0B,oBAAI,IAAY;AAChD,aAAW,gBAAgB,qBAAqB;AAC9C,eAAW,UAAU,aAAa,YAAY,CAAC,GAAG;AAChD,UAAI,OAAO,YAAY,OAAO;AAE5B,YAAI,OAAO,OAAO,gBAAgB,YAAY;AAC5C,gCAAsB,IAAI,OAAO,QAAQ;AAAA,QAC3C;AAEA,YAAI,OAAO,eAAe,OAAO,OAAO,gBAAgB,UAAU;AAChE,kCAAwB,IAAI,OAAO,QAAQ;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,mBAAkD;AACtD,MAAI;AACF,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,uBAAoB,kBAAkB;AAAA,MACpC,CAAC,MAAgB,GAAuB,OAAO;AAAA,IACjD,KAAgC;AAAA,EAClC,QAAQ;AACN,uBAAmB;AAAA,EACrB;AAGA,MAAI,uBAAsD;AAC1D,MAAI,kBAAkB;AACpB,QAAI;AACF,6BAAuB,MAAM,iBAAiB,gBAAgB,QAAQ;AAAA,IACxE,QAAQ;AACN,6BAAuB;AAAA,IACzB;AAAA,EACF;AAGA,MAAI;AACF,QAAI,UAAU,GACX,WAAW,mBAA0B,EACrC,OAAO,CAAC,WAAkB,CAAC,EAC3B,SAAS,EACT,MAAM,aAAoB,KAAK,IAAI;AACtC,QAAI,YAAY,MAAM;AACpB,gBAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QACzC,GAAG,aAAoB,KAAK,QAAQ;AAAA,QACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,MACnC,CAAC,CAAC;AAAA,IACJ,OAAO;AACL,gBAAU,QAAQ,MAAM,aAAoB,MAAM,IAAW;AAAA,IAC/D;AACA,QAAI,MAAM,QAAQ,oBAAoB,GAAG;AACvC,gBAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QACzC,GAAG,mBAA0B,MAAM,oBAAoB;AAAA,QACvD,GAAG,mBAA0B,MAAM,IAAI;AAAA,MACzC,CAAC,CAAC;AAAA,IACJ;AACA,UAAM,SAAS,MAAM,QAAQ,QAAQ;AACrC,UAAM,UAAU,IAAI,KAAa,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9E,gBAAY,UAAU,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAAA,EACtD,QAAQ;AAAA,EAAC;AAET,QAAM,qBAAqB;AAC3B,QAAM,oBAAoB;AAC1B,QAAM,+BAA+B;AAErC,iBAAe,gBAAgB,YAAoB,eAA8B,qBAAoC;AACnH,QAAI;AACF,UAAI,WAAW,GACZ,WAAW,mBAA0B,EACrC,UAAU,EACV,MAAM,eAAsB,KAAK,UAAU,EAC3C,MAAM,qCAA8C,iBAAiB,IAAI,EAAE;AAC9E,UAAI,uBAAuB,MAAM;AAC/B,mBAAW,SAAS,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UAC3C,GAAG,mBAA0B,KAAK,mBAAmB;AAAA,UACrD,GAAG,mBAA0B,MAAM,IAAI;AAAA,QACzC,CAAC,CAAC;AAAA,MACJ,OAAO;AACL,mBAAW,SAAS,MAAM,2CAAoD,IAAI,EAAE;AAAA,MACtF;AACA,YAAM,OAAO,MAAM,SAChB,QAAQ,cAAqB,MAAM,EACnC,QAAQ;AAEX,UAAI,CAAC,KAAK,QAAQ;AAChB,eAAO,EAAE,QAAQ,QAAiB,YAAY,CAAC,EAAW;AAAA,MAC5D;AAEA,YAAM,YACJ,uBAAuB,QAAQ,KAAK,KAAK,CAAC,QAAa,IAAI,oBAAoB,mBAAmB;AACpG,YAAM,gBAAgB,CACpB,UACA,cACM;AACN,YAAI,CAAC,SAAU,QAAO;AACtB,YAAI,WAAW;AACb,cAAI,UAAU,YAAY,CAAC,SAAS,SAAU,QAAO;AACrD,cAAI,CAAC,UAAU,YAAY,SAAS,SAAU,QAAO;AAAA,QACvD;AACA,YAAI,UAAU,eAAe,CAAC,SAAS,YAAa,QAAO;AAC3D,YAAI,CAAC,UAAU,eAAe,SAAS,YAAa,QAAO;AAC3D,eAAO,UAAU,YAAY,SAAS,YAAY,YAAY;AAAA,MAChE;AAEA,YAAM,gBAAgB,oBAAI,IAAsF;AAChH,UAAI,WAA4F;AAChG,iBAAW,OAAO,MAAM;AACtB,cAAM,MAAM,OAAO,IAAI,mBAAmB,UAAU;AACpD,cAAM,YAAY,IAAI,aAAa,IAAI,KAAK,IAAI,UAAU,EAAE,QAAQ,IAAI;AACxE,cAAM,cAAc,iBAAiB,OAAO,IAAI,cAAc,gBAAgB;AAC9E,cAAM,WAAW,uBAAuB,OAAO,IAAI,oBAAoB,sBAAsB,IAAI,mBAAmB;AACpH,cAAM,YAAY,EAAE,KAAK,WAAW,aAAa,SAAS;AAC1D,YAAI,IAAI,mBAAmB,MAAM;AAC/B,qBAAW,cAAc,UAAU,SAAS;AAC5C;AAAA,QACF;AACA,cAAM,WAAW,cAAc,IAAI,GAAG;AACtC,sBAAc,IAAI,KAAK,cAAc,YAAY,MAAM,SAAS,CAAC;AAAA,MACnE;AAEA,YAAM,aAAa,MAAM,KAAK,cAAc,OAAO,CAAC,EACjD,OAAO,CAAC,UAAU,CAAC,aAAa,MAAM,QAAQ,EAC9C,IAAI,CAAC,EAAE,IAAI,MAAM;AAChB,cAAM,gBAAgB,IAAI,eAAe,IAAI,KAAK,IAAI,YAAY,IAAI;AACtE,cAAM,cAAc,IAAI,aAAa,IAAI,KAAK,IAAI,UAAU,IAAI;AAChE,cAAM,eAAe,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;AACnE,cAAM,UACJ,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,IAAI,IAAI,cAAc,QAAQ,IAAI;AAC7E,cAAM,QAAQ,eACV,cACA,UACE,YACC,IAAI,UAAqB;AAChC,eAAO;AAAA,UACL,gBAAgB,IAAI,mBAAmB;AAAA,UACvC,gBAAgB,IAAI,mBAAmB;AAAA,UACvC,QAAQ;AAAA,UACR,WAAW,cAAc,YAAY,YAAY,IAAI;AAAA,UACrD,YAAY,eAAe,aAAa,YAAY,IAAI;AAAA,UACxD,aAAa,gBAAgB,cAAc,YAAY,IAAI;AAAA,UAC3D,gBAAgB,IAAI,mBAAmB;AAAA,UACvC,YAAY,IAAI,eAAe;AAAA,QACjC;AAAA,MACF,CAAC,EACA,KAAK,CAAC,GAAG,OAAO,EAAE,kBAAkB,MAAM,EAAE,kBAAkB,EAAE;AACnE,YAAM,mBAAmB,WAAW,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU;AAC/D,YAAM,oBAAoB,iBAAiB;AAAA,QACzC,CAAC,MAAM,EAAE,WAAW,gBAAgB,EAAE,WAAW;AAAA,MACnD;AACA,YAAM,oBAAoB,iBAAiB,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAC/E,UAAI,SAAwD;AAC5D,UAAI,iBAAiB,QAAQ;AAC3B,YAAI,kBAAkB,QAAQ;AAC5B,mBAAS,kBAAkB,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,IAAI,YAAY;AAAA,QAC/E,WAAW,kBAAkB,QAAQ;AACnC,mBAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,YAAY,iBAAiB,CAAC,GAAG,aAAa,WAAW,CAAC,GAAG,aAAa;AAChF,YAAM,aAAa,WAAW,SAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,OAAQ;AACpG,YAAM,cAAc,iBAAiB,CAAC,GAAG,eAAe,WAAW,CAAC,GAAG,eAAe;AACtF,YAAM,gBAAgB,WAAW,OAAO,CAAC,KAAK,MAAM,OAAO,EAAE,cAAc,IAAI,CAAC;AAChF,YAAM,eAAe,WAAW,OAAO,CAAC,KAAK,MAAM,OAAO,EAAE,kBAAkB,IAAI,CAAC;AACnF,YAAM,iBAAiB,gBAAgB,KAAK,IAAI,eAAe,YAAY,IAAI,gBAAgB;AAC/F,YAAM,iBAAiB,CAAC,aAAa,CAAC,YAAY,SAAS,WAAW,WAAW;AAEjF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,gBAAgB,iBAAiB,gBAAgB,KAAK,mBAAmB;AAAA,QACzF,YAAY,gBAAgB,gBAAgB,gBAAgB,KAAK,eAAe;AAAA,QAChF;AAAA,QACA,OAAO,iBACH;AAAA,UACE,SAAS,MAAM;AACb,kBAAM,gBAAgB,eAAgB,IAAI,eAAe,IAAI,KAAK,eAAgB,IAAI,YAAY,IAAI;AACtG,kBAAM,eAAe,eAAgB,IAAI,cAAc,IAAI,KAAK,eAAgB,IAAI,WAAW,IAAI;AACnG,gBAAI,aAAc,QAAO;AACzB,gBACE,CAAC,iBACD,KAAK,IAAI,IAAI,cAAc,QAAQ,IAAI,oBACvC;AACA,qBAAO;AAAA,YACT;AACA,mBAAQ,eAAgB,IAAI,UAAqB;AAAA,UACnD,GAAG;AAAA,UACH,gBAAgB,eAAe,IAAI,mBAAmB;AAAA,UACtD,YAAY,eAAe,IAAI,eAAe;AAAA,QAChD,IACA;AAAA,MACN;AAAA,IACF,QAAQ;AACN,aAAO,EAAE,QAAQ,QAAiB,YAAY,CAAC,EAAW;AAAA,IAC5D;AAAA,EACF;AAEA,QAAM,iBAAiB,CAAC,UAAkC;AACxD,QAAI,SAAS,KAAM,QAAO;AAC1B,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,EAC5C;AAEA,QAAM,gBAAgB;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,aAAa;AAAA,EACf;AACA,QAAM,yBAAyB,oBAAI,IAAY;AAM/C,QAAM,mBAAmB,MAAM,sBAAsB,IAAI,EAAE,aAAa,WAAW,GAAG,cAAc,CAAC;AAKrG,MAAI,gBAAgB,UAAU,SAAS,KAAK,CAAC,0BAA0B,kBAAkB,WAAW,KAAK,IAAI,CAAC,GAAG;AAC/G,UAAM;AAAA,MAAmB;AAAA,MAAW;AAAA,MAA8B,CAAC,aACjE,wBAAwB,IAAI,EAAE,YAAY,UAAU,GAAG,cAAc,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/F;AACA,UAAM,YAAY,MAAM,sBAAsB,IAAI,EAAE,aAAa,WAAW,GAAG,cAAc,CAAC;AAC9F,eAAW,CAAC,UAAU,QAAQ,KAAK,UAAW,kBAAiB,IAAI,UAAU,QAAQ;AAAA,EACvF;AAEA,QAAM,oBAAoB,UAAU,IAAI,CAAC,aAAa,iBAAiB,IAAI,QAAQ,KAAK,IAAI;AAE5F,QAAM,OAAO,MAAM,QAAQ,IAAI,UAAU,IAAI,CAAC,QAAQ,gBAAgB,KAAK,UAAU,cAAc,CAAC,CAAC;AAErG,QAAM,QAAe,CAAC;AACtB,WAAS,MAAM,GAAG,MAAM,UAAU,QAAQ,OAAO,GAAG;AAClD,UAAM,MAAM,UAAU,GAAG;AACzB,QAAI,WAAW,kBAAkB,GAAG;AAEpC,UAAM,cAAc,UAAU,wBAAwB,OAAO,SAAS,eAAe,UAAU,eAAe,IAAI,KAAK,SAAS,YAAY,IAAI;AAChJ,UAAM,UAAU,CAAC,YAAY,CAAC,eAAgB,KAAK,IAAI,IAAI,YAAY,QAAQ,IAAI;AACnF,QAAI,QAAS,wBAAuB,IAAI,GAAG;AAE3C,UAAM,MAAM,KAAK,GAAG;AACpB,UAAM,QAAS,KAAK,IAAI,GAAG,GAAG,SAAU;AACxC,UAAM,kBAAkB,eAAe,UAAU,SAAS;AAC1D,UAAM,mBAAmB,eAAe,UAAU,YAAY;AAC9D,UAAM,gBAAgB,sBAAsB,IAAI,GAAG;AACnD,UAAM,oBAAoB,gBAAgB,eAAgB,UAAkB,sBAAuB,UAAkB,oBAAoB,IAAI;AAC7I,UAAM,kBAAkB,wBAAwB,IAAI,GAAG;AACvD,UAAM,sBAAsB,kBAAmB,uBAAuB,GAAG,KAAK,IAAK;AACnF,UAAM,MAAM,MAAM;AAChB,UAAI,mBAAmB,QAAQ,oBAAoB,KAAM,QAAO;AAChE,UAAI,oBAAoB,iBAAkB,QAAO;AACjD,UAAI,CAAC,cAAe,QAAO;AAC3B,aAAO,qBAAqB,QAAQ,sBAAsB;AAAA,IAC5D,GAAG;AACH,UAAM,KAAK;AAAA,MACT,UAAU;AAAA,MACV;AAAA,MACA,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,aAAa,gBAAgB,oBAAoB;AAAA,MACjD;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,cAAc;AACjB,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,UAAU;AAC7C,UAAI,uBAAuB,OAAO,GAAG;AACnC,cAAM,QAAQ;AAAA,UACZ,MAAM,KAAK,sBAAsB,EAAE;AAAA,YAAI,CAAC,aACtC,SACG,UAAU,gCAAgC;AAAA,cACzC,YAAY;AAAA,cACZ,UAAU,YAAY;AAAA,cACtB;AAAA,cACA,SAAS;AAAA,YACX,CAAC,EACA,MAAM,MAAM,MAAS;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,MAAI,aAAa,GACd,WAAW,oBAA2B,EACtC,UAAU;AACb,MAAI,YAAY,MAAM;AACpB,iBAAa,WAAW,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MAC/C,GAAG,aAAoB,KAAK,QAAQ;AAAA,MACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,IACnC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,iBAAa,WAAW,MAAM,aAAoB,MAAM,IAAW;AAAA,EACrE;AACA,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,QAAQ;AACtE,iBAAa,WAAW,MAAM,mBAA0B,MAAM,oBAAoB;AAAA,EACpF,OAAO;AACL,iBAAa,WAAW,MAAM,mBAA0B,MAAM,IAAW;AAAA,EAC3E;AACA,QAAM,YAAY,MAAM,WACrB,QAAQ,eAAsB,MAAM,EACpC,MAAM,GAAG,EACT,QAAQ;AAEX,QAAM,SAAS,UAAU,IAAI,CAAC,QAAa;AACzC,UAAM,aAAa,IAAI,uBAAuB,OAAO,IAAI,cAAc,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;AACrH,WAAO;AAAA,MACL,IAAI,OAAO,IAAI,EAAE;AAAA,MACjB,QAAQ,OAAO,IAAI,UAAU,EAAE;AAAA,MAC/B,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC,YAAY,IAAI,eAAe;AAAA,MAC/B,UAAU,IAAI,aAAa;AAAA,MAC3B,UAAU,IAAI,aAAa;AAAA,MAC3B,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC,OAAO,IAAI,SAAS;AAAA,MACpB,SAAS,IAAI,WAAW;AAAA,MACxB,YAAY,aAAa,WAAW,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7E;AAAA,EACF,CAAC;AAED,MAAI,YAAY,GACb,WAAW,qBAA4B,EACvC,UAAU;AACb,MAAI,YAAY,MAAM;AACpB,gBAAY,UAAU,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MAC7C,GAAG,aAAoB,KAAK,QAAQ;AAAA,MACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,IACnC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,gBAAY,UAAU,MAAM,aAAoB,MAAM,IAAW;AAAA,EACnE;AACA,MAAI,MAAM,QAAQ,oBAAoB,KAAK,qBAAqB,QAAQ;AACtE,gBAAY,UAAU,MAAM,mBAA0B,MAAM,oBAAoB;AAAA,EAClF,OAAO;AACL,gBAAY,UAAU,MAAM,mBAA0B,MAAM,IAAW;AAAA,EACzE;AACA,QAAM,UAAU,MAAM,UACnB,QAAQ,eAAsB,MAAM,EACpC,MAAM,GAAG,EACT,QAAQ;AAEX,QAAM,OAAO,QAAQ,IAAI,CAAC,QAAa;AACrC,UAAM,aAAa,IAAI,uBAAuB,OAAO,IAAI,cAAc,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI;AACrH,UAAM,QAAQ,IAAI,UAAU,SAAS,SAAS;AAC9C,WAAO;AAAA,MACL,IAAI,OAAO,IAAI,EAAE;AAAA,MACjB,QAAQ,OAAO,IAAI,UAAU,EAAE;AAAA,MAC/B,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC;AAAA,MACA,YAAY,IAAI,eAAe;AAAA,MAC/B,UAAU,IAAI,aAAa;AAAA,MAC3B,UAAU,IAAI,aAAa;AAAA,MAC3B,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,SAAS,OAAO,IAAI,WAAW,EAAE;AAAA,MACjC,SAAS,IAAI,WAAW;AAAA,MACxB,YAAY,aAAa,WAAW,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7E;AAAA,EACF,CAAC;AAED,QAAM,WAAW,aAAa,KAAK,EAAE,OAAO,QAAQ,KAAK,CAAC;AAC1D,QAAM,UAAU,MAAM,KAAK,CAAC,SAAS;AAGnC,QAAI,KAAK,aAAa,QAAQ,KAAK,cAAc,KAAM,QAAO;AAC9D,QAAI,KAAK,aAAa,QAAQ,KAAK,cAAc,KAAM,QAAO;AAC9D,WAAO,KAAK,cAAc,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,SAAS;AACX,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,KAAK,UAAU;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ,SAAS,QAAQ;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,+BAA+B;AAAA,EACpG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,sBAAsB;AAAA,IACrG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6531.1.87e9d31db6",
+  "version": "0.6.6-develop.6535.1.5cf43724de",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6531.1.87e9d31db6",
-    "@open-mercato/shared": "0.6.6-develop.6531.1.87e9d31db6",
-    "@open-mercato/ui": "0.6.6-develop.6531.1.87e9d31db6",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6535.1.5cf43724de",
+    "@open-mercato/shared": "0.6.6-develop.6535.1.5cf43724de",
+    "@open-mercato/ui": "0.6.6-develop.6535.1.5cf43724de",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6531.1.87e9d31db6",
-    "@open-mercato/shared": "0.6.6-develop.6531.1.87e9d31db6",
-    "@open-mercato/ui": "0.6.6-develop.6531.1.87e9d31db6",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6535.1.5cf43724de",
+    "@open-mercato/shared": "0.6.6-develop.6535.1.5cf43724de",
+    "@open-mercato/ui": "0.6.6-develop.6535.1.5cf43724de",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/api_keys/api/keys/route.ts

@@ -13,6 +13,8 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 type ApiKeyCrudCtx = CrudCtx & {
   __apiKeySecret?: { secret: string; prefix: string }
@@ -322,18 +324,34 @@ const crud = makeCrudRoute<
       const { translate } = await resolveTranslations()
       if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })
       const em = (ctx.container.resolve('em') as EntityManager)
-      const record = await em.findOne(ApiKey, { id, deletedAt: null })
-      if (!record) throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
       const scopedCtx = ctx as ApiKeyCrudCtx
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
-      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {
-        throw json({ error: translate('api_keys.errors.forbidden', 'Forbidden') }, { status: 403 })
-      }
       const allowedIds = ctx.organizationScope?.allowedIds ?? null
-      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(record.organizationId)) {
-          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
-        }
+      const recordFilter: FilterQuery<ApiKey> = {
+        id,
+        tenantId: auth.tenantId,
+        deletedAt: null,
+      }
+      if (!isSuperAdmin && Array.isArray(allowedIds)) {
+        recordFilter.organizationId = { $in: allowedIds }
+      }
+      const record = await findOneWithDecryption(
+        em,
+        ApiKey,
+        recordFilter,
+        undefined,
+        { tenantId: auth.tenantId, organizationId: null },
+      )
+      if (
+        !record ||
+        record.tenantId !== auth.tenantId ||
+        !isOrganizationAccessAllowed({
+          isSuperAdmin,
+          allowedOrganizationIds: allowedIds,
+          targetOrganizationId: record.organizationId ?? null,
+        })
+      ) {
+        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
       }
       scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null
     },

package/src/modules/query_index/api/status.ts

@@ -415,10 +415,7 @@ export async function GET(req: Request) {
     errorQuery = errorQuery.where('tenant_id' as any, 'is', null as any)
   }
   if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {
-    errorQuery = errorQuery.where((eb: any) => eb.or([
-      eb('organization_id' as any, 'is', null),
-      eb('organization_id' as any, 'in', organizationScopeIds),
-    ]))
+    errorQuery = errorQuery.where('organization_id' as any, 'in', organizationScopeIds)
   } else {
     errorQuery = errorQuery.where('organization_id' as any, 'is', null as any)
   }
@@ -456,10 +453,7 @@ export async function GET(req: Request) {
     logsQuery = logsQuery.where('tenant_id' as any, 'is', null as any)
   }
   if (Array.isArray(organizationScopeIds) && organizationScopeIds.length) {
-    logsQuery = logsQuery.where((eb: any) => eb.or([
-      eb('organization_id' as any, 'is', null),
-      eb('organization_id' as any, 'in', organizationScopeIds),
-    ]))
+    logsQuery = logsQuery.where('organization_id' as any, 'in', organizationScopeIds)
   } else {
     logsQuery = logsQuery.where('organization_id' as any, 'is', null as any)
   }