@open-mercato/core 0.6.6-develop.6542.1.fee3e68aa6 → 0.6.6-develop.6551.1.1511bfa890

package/dist/modules/api_keys/api/keys/route.js

@@ -250,10 +250,13 @@ const crud = makeCrudRoute({
       scopedCtx.__apiKeyRoleIds = roleIds;
       const allowedIds = ctx.organizationScope?.allowedIds ?? null;
       const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null;
-      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(organizationId)) {
-          throw json({ error: translate("api_keys.errors.organizationOutOfScope", "Organization out of scope") }, { status: 403 });
-        }
+      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx);
+      if (!isOrganizationAccessAllowed({
+        isSuperAdmin,
+        allowedOrganizationIds: allowedIds,
+        targetOrganizationId: organizationId
+      })) {
+        throw json({ error: translate("api_keys.errors.organizationOutOfScope", "Organization out of scope") }, { status: 403 });
       }
       scopedCtx.__apiKeyOrganizationId = organizationId ?? null;
       return { ...input, organizationId };

package/dist/modules/api_keys/api/keys/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_keys/api/keys/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,UAAI,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AACxE,YAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACxC,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      if (\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: organizationId,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,UACE,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,MACxB,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzH;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/components/AttachmentContentPreview.js

@@ -2,6 +2,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { MarkdownContent } from "@open-mercato/ui/backend/markdown";
 import { Button } from "@open-mercato/ui/primitives/button";
+import { Tabs, TabsList, TabsTrigger } from "@open-mercato/ui/primitives/tabs";
 function AttachmentContentPreview({
   content,
   maxLength = 480,
@@ -14,50 +15,21 @@ function AttachmentContentPreview({
   const [expanded, setExpanded] = React.useState(false);
   const [tab, setTab] = React.useState("source");
   const text = (content ?? "").trim();
-  const sourceTabId = "attachment-content-preview-tab-source";
-  const previewTabId = "attachment-content-preview-tab-preview";
-  const sourcePanelId = "attachment-content-preview-panel-source";
-  const previewPanelId = "attachment-content-preview-panel-preview";
   if (!text) {
     return /* @__PURE__ */ jsx("div", { className: "text-xs text-muted-foreground italic", children: emptyLabel });
   }
   const shouldTruncate = !expanded && text.length > maxLength;
   const display = tab === "source" && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text;
   return /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
-    /* @__PURE__ */ jsx("div", { className: "border-b border-border", children: /* @__PURE__ */ jsxs("nav", { className: "flex items-center gap-4 text-xs", role: "tablist", "aria-label": "Content preview mode", children: [
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          id: sourceTabId,
-          role: "tab",
-          "aria-selected": tab === "source",
-          "aria-controls": sourcePanelId,
-          className: `-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${tab === "source" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("source"),
-          children: sourceLabel
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          id: previewTabId,
-          role: "tab",
-          "aria-selected": tab === "preview",
-          "aria-controls": previewPanelId,
-          className: `-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${tab === "preview" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("preview"),
-          children: previewLabel
-        }
-      )
+    /* @__PURE__ */ jsx(Tabs, { value: tab, onValueChange: (value) => setTab(value), variant: "underline", children: /* @__PURE__ */ jsxs(TabsList, { className: "w-full", children: [
+      /* @__PURE__ */ jsx(TabsTrigger, { value: "source", children: sourceLabel }),
+      /* @__PURE__ */ jsx(TabsTrigger, { value: "preview", children: previewLabel })
     ] }) }),
     tab === "source" ? /* @__PURE__ */ jsx(
       "div",
       {
         role: "tabpanel",
-        id: sourcePanelId,
-        "aria-labelledby": sourceTabId,
+        "aria-label": sourceLabel,
         "data-testid": "attachment-content-preview",
         className: "whitespace-pre-wrap text-sm text-muted-foreground",
         children: display
@@ -66,8 +38,7 @@ function AttachmentContentPreview({
       "div",
       {
         role: "tabpanel",
-        id: previewPanelId,
-        "aria-labelledby": previewTabId,
+        "aria-label": previewLabel,
         "data-testid": "markdown-preview",
         children: /* @__PURE__ */ jsx(
           MarkdownContent,

package/dist/modules/attachments/components/AttachmentContentPreview.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/components/AttachmentContentPreview.tsx"],
-  "sourcesContent": ["import * as React from 'react'\nimport { MarkdownContent } from '@open-mercato/ui/backend/markdown'\nimport { Button } from '@open-mercato/ui/primitives/button'\n\ntype Props = {\n  content?: string | null\n  maxLength?: number\n  emptyLabel?: string\n  showMoreLabel?: string\n  showLessLabel?: string\n  sourceLabel?: string\n  previewLabel?: string\n}\n\nexport function AttachmentContentPreview({\n  content,\n  maxLength = 480,\n  emptyLabel = 'No text extracted',\n  showMoreLabel = 'Show more',\n  showLessLabel = 'Show less',\n  sourceLabel = 'Source',\n  previewLabel = 'Preview',\n}: Props) {\n  const [expanded, setExpanded] = React.useState(false)\n  const [tab, setTab] = React.useState<'source' | 'preview'>('source')\n  const text = (content ?? '').trim()\n\n  // ARIA IDs for accessibility\n  const sourceTabId = 'attachment-content-preview-tab-source'\n  const previewTabId = 'attachment-content-preview-tab-preview'\n  const sourcePanelId = 'attachment-content-preview-panel-source'\n  const previewPanelId = 'attachment-content-preview-panel-preview'\n\n  if (!text) {\n    return <div className=\"text-xs text-muted-foreground italic\">{emptyLabel}</div>\n  }\n\n  const shouldTruncate = !expanded && text.length > maxLength\n  const display = tab === 'source' && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text\n\n  return (\n    <div className=\"space-y-2\">\n      {/* Tab Navigation */}\n      <div className=\"border-b border-border\">\n        <nav className=\"flex items-center gap-4 text-xs\" role=\"tablist\" aria-label=\"Content preview mode\">\n          <button\n            type=\"button\"\n            id={sourceTabId}\n            role=\"tab\"\n            aria-selected={tab === 'source'}\n            aria-controls={sourcePanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'source'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('source')}\n          >\n            {sourceLabel}\n          </button>\n          <button\n            type=\"button\"\n            id={previewTabId}\n            role=\"tab\"\n            aria-selected={tab === 'preview'}\n            aria-controls={previewPanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'preview'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('preview')}\n          >\n            {previewLabel}\n          </button>\n        </nav>\n      </div>\n\n      {/* Tab Panels */}\n      {tab === 'source' ? (\n        <div\n          role=\"tabpanel\"\n          id={sourcePanelId}\n          aria-labelledby={sourceTabId}\n          data-testid=\"attachment-content-preview\"\n          className=\"whitespace-pre-wrap text-sm text-muted-foreground\"\n        >\n          {display}\n        </div>\n      ) : (\n        <div\n          role=\"tabpanel\"\n          id={previewPanelId}\n          aria-labelledby={previewTabId}\n          data-testid=\"markdown-preview\"\n        >\n          <MarkdownContent\n            body={text}\n            format=\"markdown\"\n            className=\"text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs\"\n          />\n        </div>\n      )}\n\n      {/* Show More/Less Button (only on source tab) */}\n      {tab === 'source' && text.length > maxLength ? (\n        <Button\n          type=\"button\"\n          variant=\"ghost\"\n          size=\"sm\"\n          className=\"h-auto px-0 py-1 text-xs\"\n          onClick={() => setExpanded((prev) => !prev)}\n        >\n          {expanded ? showLessLabel : showMoreLabel}\n        </Button>\n      ) : null}\n    </div>\n  )\n}\n"],
-  "mappings": "AAkCW,cAUH,YAVG;AAlCX,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,SAAS,cAAc;AAYhB,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,eAAe;AACjB,GAAU;AACR,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAA+B,QAAQ;AACnE,QAAM,QAAQ,WAAW,IAAI,KAAK;AAGlC,QAAM,cAAc;AACpB,QAAM,eAAe;AACrB,QAAM,gBAAgB;AACtB,QAAM,iBAAiB;AAEvB,MAAI,CAAC,MAAM;AACT,WAAO,oBAAC,SAAI,WAAU,wCAAwC,sBAAW;AAAA,EAC3E;AAEA,QAAM,iBAAiB,CAAC,YAAY,KAAK,SAAS;AAClD,QAAM,UAAU,QAAQ,YAAY,iBAAiB,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC,WAAM;AAEtF,SACE,qBAAC,SAAI,WAAU,aAEb;AAAA,wBAAC,SAAI,WAAU,0BACb,+BAAC,SAAI,WAAU,mCAAkC,MAAK,WAAU,cAAW,wBACzE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,WACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,QAAQ;AAAA,UAE7B;AAAA;AAAA,MACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,YACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,SAAS;AAAA,UAE9B;AAAA;AAAA,MACH;AAAA,OACF,GACF;AAAA,IAGC,QAAQ,WACP;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QACZ,WAAU;AAAA,QAET;AAAA;AAAA,IACH,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QAEZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,QAAO;AAAA,YACP,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA,IACF;AAAA,IAID,QAAQ,YAAY,KAAK,SAAS,YACjC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAS,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI;AAAA,QAEzC,qBAAW,gBAAgB;AAAA;AAAA,IAC9B,IACE;AAAA,KACN;AAEJ;",
+  "sourcesContent": ["import * as React from 'react'\nimport { MarkdownContent } from '@open-mercato/ui/backend/markdown'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'\n\ntype Props = {\n  content?: string | null\n  maxLength?: number\n  emptyLabel?: string\n  showMoreLabel?: string\n  showLessLabel?: string\n  sourceLabel?: string\n  previewLabel?: string\n}\n\nexport function AttachmentContentPreview({\n  content,\n  maxLength = 480,\n  emptyLabel = 'No text extracted',\n  showMoreLabel = 'Show more',\n  showLessLabel = 'Show less',\n  sourceLabel = 'Source',\n  previewLabel = 'Preview',\n}: Props) {\n  const [expanded, setExpanded] = React.useState(false)\n  const [tab, setTab] = React.useState<'source' | 'preview'>('source')\n  const text = (content ?? '').trim()\n\n  if (!text) {\n    return <div className=\"text-xs text-muted-foreground italic\">{emptyLabel}</div>\n  }\n\n  const shouldTruncate = !expanded && text.length > maxLength\n  const display = tab === 'source' && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text\n\n  return (\n    <div className=\"space-y-2\">\n      {/* Tab Navigation */}\n      <Tabs value={tab} onValueChange={(value) => setTab(value as 'source' | 'preview')} variant=\"underline\">\n        <TabsList className=\"w-full\">\n          <TabsTrigger value=\"source\">{sourceLabel}</TabsTrigger>\n          <TabsTrigger value=\"preview\">{previewLabel}</TabsTrigger>\n        </TabsList>\n      </Tabs>\n\n      {/* Tab Panels */}\n      {tab === 'source' ? (\n        <div\n          role=\"tabpanel\"\n          aria-label={sourceLabel}\n          data-testid=\"attachment-content-preview\"\n          className=\"whitespace-pre-wrap text-sm text-muted-foreground\"\n        >\n          {display}\n        </div>\n      ) : (\n        <div\n          role=\"tabpanel\"\n          aria-label={previewLabel}\n          data-testid=\"markdown-preview\"\n        >\n          <MarkdownContent\n            body={text}\n            format=\"markdown\"\n            className=\"text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs\"\n          />\n        </div>\n      )}\n\n      {/* Show More/Less Button (only on source tab) */}\n      {tab === 'source' && text.length > maxLength ? (\n        <Button\n          type=\"button\"\n          variant=\"ghost\"\n          size=\"sm\"\n          className=\"h-auto px-0 py-1 text-xs\"\n          onClick={() => setExpanded((prev) => !prev)}\n        >\n          {expanded ? showLessLabel : showMoreLabel}\n        </Button>\n      ) : null}\n    </div>\n  )\n}\n"],
+  "mappings": "AA6BW,cAUH,YAVG;AA7BX,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,SAAS,cAAc;AACvB,SAAS,MAAM,UAAU,mBAAmB;AAYrC,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,eAAe;AACjB,GAAU;AACR,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAA+B,QAAQ;AACnE,QAAM,QAAQ,WAAW,IAAI,KAAK;AAElC,MAAI,CAAC,MAAM;AACT,WAAO,oBAAC,SAAI,WAAU,wCAAwC,sBAAW;AAAA,EAC3E;AAEA,QAAM,iBAAiB,CAAC,YAAY,KAAK,SAAS;AAClD,QAAM,UAAU,QAAQ,YAAY,iBAAiB,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC,WAAM;AAEtF,SACE,qBAAC,SAAI,WAAU,aAEb;AAAA,wBAAC,QAAK,OAAO,KAAK,eAAe,CAAC,UAAU,OAAO,KAA6B,GAAG,SAAQ,aACzF,+BAAC,YAAS,WAAU,UAClB;AAAA,0BAAC,eAAY,OAAM,UAAU,uBAAY;AAAA,MACzC,oBAAC,eAAY,OAAM,WAAW,wBAAa;AAAA,OAC7C,GACF;AAAA,IAGC,QAAQ,WACP;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,cAAY;AAAA,QACZ,eAAY;AAAA,QACZ,WAAU;AAAA,QAET;AAAA;AAAA,IACH,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,cAAY;AAAA,QACZ,eAAY;AAAA,QAEZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,QAAO;AAAA,YACP,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA,IACF;AAAA,IAID,QAAQ,YAAY,KAAK,SAAS,YACjC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAS,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI;AAAA,QAEzC,qBAAW,gBAAgB;AAAA;AAAA,IAC9B,IACE;AAAA,KACN;AAEJ;",
   "names": []
 }

package/dist/modules/audit_logs/backend/audit-logs/page.js

@@ -4,6 +4,7 @@ import React from "react";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
 import { Button } from "@open-mercato/ui/primitives/button";
+import { Tabs, TabsList, TabsTrigger } from "@open-mercato/ui/primitives/tabs";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { AuditLogsActions } from "../../components/AuditLogsActions.js";
 import { AccessLogsTable } from "../../components/AccessLogsTable.js";
@@ -139,30 +140,19 @@ function AuditLogsPage() {
     ] })
   ] });
   return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsxs(PageBody, { children: [
-    /* @__PURE__ */ jsx("div", { className: "mb-6 border-b border-border", children: /* @__PURE__ */ jsxs("nav", { className: "flex items-center gap-6 text-sm", role: "tablist", "aria-label": t("audit_logs.tabs.label"), children: [
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          role: "tab",
-          "aria-selected": tab === "actions",
-          className: `relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === "actions" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("actions"),
-          children: t("audit_logs.actions.title")
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          role: "tab",
-          "aria-selected": tab === "access",
-          className: `relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === "access" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("access"),
-          children: t("audit_logs.access.title")
-        }
-      )
-    ] }) }),
+    /* @__PURE__ */ jsx(
+      Tabs,
+      {
+        value: tab,
+        onValueChange: (value) => setTab(value),
+        variant: "underline",
+        className: "mb-6",
+        children: /* @__PURE__ */ jsxs(TabsList, { className: "w-full flex-wrap", "aria-label": t("audit_logs.tabs.label"), children: [
+          /* @__PURE__ */ jsx(TabsTrigger, { value: "actions", children: t("audit_logs.actions.title") }),
+          /* @__PURE__ */ jsx(TabsTrigger, { value: "access", children: t("audit_logs.access.title") })
+        ] })
+      }
+    ),
     error && /* @__PURE__ */ jsx("div", { className: "mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text", children: error }),
     tab === "actions" && /* @__PURE__ */ jsx(
       AuditLogsActions,

package/dist/modules/audit_logs/backend/audit-logs/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/audit_logs/backend/audit-logs/page.tsx"],
-  "sourcesContent": ["'use client'\n\nimport React from 'react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { ActionLogItem } from '../../components/AuditLogsActions'\nimport { AuditLogsActions } from '../../components/AuditLogsActions'\nimport type { AccessLogItem } from '../../components/AccessLogsTable'\nimport { AccessLogsTable } from '../../components/AccessLogsTable'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'audit-logs-page' })\n\ntype ActionLogResponse = {\n  items: ActionLogItem[]\n  canViewTenant: boolean\n  page: number\n  pageSize: number\n  total: number\n  totalPages: number\n}\n\ntype AccessLogResponse = {\n  items: AccessLogItem[]\n  canViewTenant: boolean\n  page: number\n  pageSize: number\n  total: number\n  totalPages: number\n}\n\ntype TabOption = 'actions' | 'access'\n\nconst DEFAULT_PAGE_SIZE = 50\n\nexport default function AuditLogsPage() {\n  const t = useT()\n  const [tab, setTab] = React.useState<TabOption>('actions')\n  const [actions, setActions] = React.useState<ActionLogItem[]>([])\n  const [accessLogs, setAccessLogs] = React.useState<AccessLogItem[]>([])\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const [undoableOnly, setUndoableOnly] = React.useState(false)\n  const [actionsPage, setActionsPage] = React.useState(1)\n  const [actionsPageSize, setActionsPageSize] = React.useState(DEFAULT_PAGE_SIZE)\n  const [actionsTotal, setActionsTotal] = React.useState(0)\n  const [actionsTotalPages, setActionsTotalPages] = React.useState(1)\n  const actionsPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)\n  const [accessPage, setAccessPage] = React.useState(1)\n  const [accessPageSize, setAccessPageSize] = React.useState(DEFAULT_PAGE_SIZE)\n  const [accessTotal, setAccessTotal] = React.useState(0)\n  const [accessTotalPages, setAccessTotalPages] = React.useState(1)\n  const accessPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)\n\n  const fetchActions = React.useCallback(async (page: number, pageSize: number) => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (undoableOnly) params.set('undoableOnly', 'true')\n    return readApiResultOrThrow<ActionLogResponse>(\n      `/api/audit_logs/audit-logs/actions?${params.toString()}`,\n      undefined,\n      { errorMessage: t('audit_logs.error.load') },\n    )\n  }, [undoableOnly, t])\n\n  const fetchAccess = React.useCallback(async (page: number, pageSize: number) => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    return readApiResultOrThrow<AccessLogResponse>(\n      `/api/audit_logs/audit-logs/access?${params.toString()}`,\n      undefined,\n      { errorMessage: t('audit_logs.error.load') },\n    )\n  }, [t])\n\n  const loadAll = React.useCallback(async (\n    actionPage: number, actionPageSize: number,\n    accessPageNum: number, accessPageSizeNum: number,\n  ) => {\n    const [actionsRes, accessRes] = await Promise.all([\n      fetchActions(actionPage, actionPageSize),\n      fetchAccess(accessPageNum, accessPageSizeNum),\n    ])\n    setActions(actionsRes.items ?? [])\n    setActionsPage(actionsRes.page ?? actionPage)\n    setActionsPageSize((prev) => {\n      const resolved = actionsRes.pageSize ?? actionPageSize\n      actionsPageSizeRef.current = resolved\n      return resolved === prev ? prev : resolved\n    })\n    setActionsTotal(actionsRes.total ?? (actionsRes.items?.length ?? 0))\n    setActionsTotalPages(actionsRes.totalPages ?? 1)\n    setAccessLogs(accessRes.items ?? [])\n    const resolvedPage = accessRes.page ?? accessPageNum\n    const resolvedPageSize = accessRes.pageSize ?? accessPageSizeNum\n    const resolvedTotal = accessRes.total ?? (accessRes.items?.length ?? 0)\n    const resolvedTotalPages = accessRes.totalPages ?? Math.max(1, Math.ceil((resolvedTotal || 0) / (resolvedPageSize || 1)))\n    setAccessPage(resolvedPage)\n    setAccessPageSize((prev) => {\n      if (resolvedPageSize === prev) {\n        accessPageSizeRef.current = prev\n        return prev\n      }\n      accessPageSizeRef.current = resolvedPageSize\n      return resolvedPageSize\n    })\n    setAccessTotal(resolvedTotal)\n    setAccessTotalPages(resolvedTotalPages)\n  }, [fetchActions, fetchAccess])\n\n  const loadWithState = React.useCallback(async (\n    actionPage: number, actionPageSize: number,\n    accessPageNum: number, accessPageSizeNum: number,\n  ) => {\n    setLoading(true)\n    setError(null)\n    try {\n      await loadAll(actionPage, actionPageSize, accessPageNum, accessPageSizeNum)\n    } catch (err) {\n      logger.error('Failed to load audit logs', { err })\n      setError(t('audit_logs.error.load'))\n    } finally {\n      setLoading(false)\n    }\n  }, [loadAll, t])\n\n  React.useEffect(() => {\n    setActionsPage(1)\n    setAccessPage(1)\n    void loadWithState(1, actionsPageSizeRef.current, 1, accessPageSizeRef.current)\n  }, [loadWithState, undoableOnly])\n\n  const renderRefreshButton = React.useCallback(() => (\n    <Button\n      variant=\"outline\"\n      size=\"sm\"\n      onClick={() => void loadWithState(actionsPage, actionsPageSize, accessPage, accessPageSize)}\n      disabled={loading}\n    >\n      {loading ? t('audit_logs.common.refreshing') : t('audit_logs.common.refresh')}\n    </Button>\n  ), [loadWithState, actionsPage, actionsPageSize, accessPage, accessPageSize, loading, t])\n\n  const handleUndoError = React.useCallback(() => {\n    setError(t('audit_logs.error.undo'))\n  }, [t])\n  const handleRedoError = React.useCallback(() => {\n    setError(t('audit_logs.error.redo'))\n  }, [t])\n\n  const handleActionsPageChange = React.useCallback((nextPage: number) => {\n    const totalPages = actionsTotalPages || 1\n    const normalized = Math.max(1, Math.min(nextPage, totalPages))\n    void loadWithState(normalized, actionsPageSizeRef.current, accessPage, accessPageSizeRef.current)\n  }, [actionsTotalPages, loadWithState, accessPage])\n\n  const handleAccessPageChange = React.useCallback((nextPage: number) => {\n    const totalPages = accessTotalPages || 1\n    const normalized = Math.max(1, Math.min(nextPage, totalPages))\n    void loadWithState(actionsPage, actionsPageSizeRef.current, normalized, accessPageSizeRef.current)\n  }, [accessTotalPages, loadWithState, actionsPage])\n\n  const headerExtras = (\n    <>\n      {renderRefreshButton()}\n      <label className=\"flex items-center gap-2 rounded border border-transparent px-2 py-1 text-sm text-muted-foreground\">\n        <span>{t('audit_logs.filters.undoable_only')}</span>\n        <input\n          type=\"checkbox\"\n          className=\"h-4 w-4 rounded border border-input\"\n          checked={undoableOnly}\n          onChange={(e) => setUndoableOnly(e.target.checked)}\n        />\n      </label>\n    </>\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <div className=\"mb-6 border-b border-border\">\n      <nav className=\"flex items-center gap-6 text-sm\" role=\"tablist\" aria-label={t('audit_logs.tabs.label')}>\n            <button\n              type=\"button\"\n              role=\"tab\"\n              aria-selected={tab === 'actions'}\n              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'actions' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}\n              onClick={() => setTab('actions')}\n            >\n              {t('audit_logs.actions.title')}\n            </button>\n            <button\n              type=\"button\"\n              role=\"tab\"\n              aria-selected={tab === 'access'}\n              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'access' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}\n              onClick={() => setTab('access')}\n            >\n              {t('audit_logs.access.title')}\n            </button>\n          </nav>\n        </div>\n\n        {error && <div className=\"mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text\">{error}</div>}\n\n        {tab === 'actions' && (\n          <AuditLogsActions\n            items={actions}\n            onRefresh={() => loadWithState(actionsPage, actionsPageSize, accessPage, accessPageSize)}\n            isLoading={loading}\n            headerExtras={headerExtras}\n            onUndoError={handleUndoError}\n            onRedoError={handleRedoError}\n            pagination={{\n              page: actionsPage,\n              pageSize: actionsPageSize,\n              total: actionsTotal,\n              totalPages: actionsTotalPages,\n              onPageChange: handleActionsPageChange,\n            }}\n          />\n        )}\n\n        {tab === 'access' && (\n          <AccessLogsTable\n            items={accessLogs}\n            isLoading={loading}\n            actions={renderRefreshButton()}\n            pagination={{\n              page: accessPage,\n              pageSize: accessPageSize,\n              total: accessTotal,\n              totalPages: accessTotalPages,\n              onPageChange: handleAccessPageChange,\n            }}\n          />\n        )}\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAyII,SA8BA,UA9BA,KAgCE,YAhCF;AAvIJ,OAAO,WAAW;AAClB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,4BAA4B;AACrC,SAAS,cAAc;AACvB,SAAS,YAAY;AAErB,SAAS,wBAAwB;AAEjC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAsBhF,MAAM,oBAAoB;AAEX,SAAR,gBAAiC;AACtC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAAoB,SAAS;AACzD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAA0B,CAAC,CAAC;AAChE,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAA0B,CAAC,CAAC;AACtE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,iBAAiB;AAC9E,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,CAAC;AACxD,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,CAAC;AAClE,QAAM,qBAAqB,MAAM,OAAO,iBAAiB;AACzD,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,iBAAiB;AAC5E,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,CAAC;AAChE,QAAM,oBAAoB,MAAM,OAAO,iBAAiB;AAExD,QAAM,eAAe,MAAM,YAAY,OAAO,MAAc,aAAqB;AAC/E,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,aAAc,QAAO,IAAI,gBAAgB,MAAM;AACnD,WAAO;AAAA,MACL,sCAAsC,OAAO,SAAS,CAAC;AAAA,MACvD;AAAA,MACA,EAAE,cAAc,EAAE,uBAAuB,EAAE;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,cAAc,CAAC,CAAC;AAEpB,QAAM,cAAc,MAAM,YAAY,OAAO,MAAc,aAAqB;AAC9E,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,WAAO;AAAA,MACL,qCAAqC,OAAO,SAAS,CAAC;AAAA,MACtD;AAAA,MACA,EAAE,cAAc,EAAE,uBAAuB,EAAE;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM,YAAY,OAChC,YAAoB,gBACpB,eAAuB,sBACpB;AACH,UAAM,CAAC,YAAY,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,MAChD,aAAa,YAAY,cAAc;AAAA,MACvC,YAAY,eAAe,iBAAiB;AAAA,IAC9C,CAAC;AACD,eAAW,WAAW,SAAS,CAAC,CAAC;AACjC,mBAAe,WAAW,QAAQ,UAAU;AAC5C,uBAAmB,CAAC,SAAS;AAC3B,YAAM,WAAW,WAAW,YAAY;AACxC,yBAAmB,UAAU;AAC7B,aAAO,aAAa,OAAO,OAAO;AAAA,IACpC,CAAC;AACD,oBAAgB,WAAW,UAAU,WAAW,OAAO,UAAU,EAAE;AACnE,yBAAqB,WAAW,cAAc,CAAC;AAC/C,kBAAc,UAAU,SAAS,CAAC,CAAC;AACnC,UAAM,eAAe,UAAU,QAAQ;AACvC,UAAM,mBAAmB,UAAU,YAAY;AAC/C,UAAM,gBAAgB,UAAU,UAAU,UAAU,OAAO,UAAU;AACrE,UAAM,qBAAqB,UAAU,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,iBAAiB,MAAM,oBAAoB,EAAE,CAAC;AACxH,kBAAc,YAAY;AAC1B,sBAAkB,CAAC,SAAS;AAC1B,UAAI,qBAAqB,MAAM;AAC7B,0BAAkB,UAAU;AAC5B,eAAO;AAAA,MACT;AACA,wBAAkB,UAAU;AAC5B,aAAO;AAAA,IACT,CAAC;AACD,mBAAe,aAAa;AAC5B,wBAAoB,kBAAkB;AAAA,EACxC,GAAG,CAAC,cAAc,WAAW,CAAC;AAE9B,QAAM,gBAAgB,MAAM,YAAY,OACtC,YAAoB,gBACpB,eAAuB,sBACpB;AACH,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,QAAQ,YAAY,gBAAgB,eAAe,iBAAiB;AAAA,IAC5E,SAAS,KAAK;AACZ,aAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC;AACjD,eAAS,EAAE,uBAAuB,CAAC;AAAA,IACrC,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,SAAS,CAAC,CAAC;AAEf,QAAM,UAAU,MAAM;AACpB,mBAAe,CAAC;AAChB,kBAAc,CAAC;AACf,SAAK,cAAc,GAAG,mBAAmB,SAAS,GAAG,kBAAkB,OAAO;AAAA,EAChF,GAAG,CAAC,eAAe,YAAY,CAAC;AAEhC,QAAM,sBAAsB,MAAM,YAAY,MAC5C;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,SAAS,MAAM,KAAK,cAAc,aAAa,iBAAiB,YAAY,cAAc;AAAA,MAC1F,UAAU;AAAA,MAET,oBAAU,EAAE,8BAA8B,IAAI,EAAE,2BAA2B;AAAA;AAAA,EAC9E,GACC,CAAC,eAAe,aAAa,iBAAiB,YAAY,gBAAgB,SAAS,CAAC,CAAC;AAExF,QAAM,kBAAkB,MAAM,YAAY,MAAM;AAC9C,aAAS,EAAE,uBAAuB,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC,CAAC;AACN,QAAM,kBAAkB,MAAM,YAAY,MAAM;AAC9C,aAAS,EAAE,uBAAuB,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,0BAA0B,MAAM,YAAY,CAAC,aAAqB;AACtE,UAAM,aAAa,qBAAqB;AACxC,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,UAAU,CAAC;AAC7D,SAAK,cAAc,YAAY,mBAAmB,SAAS,YAAY,kBAAkB,OAAO;AAAA,EAClG,GAAG,CAAC,mBAAmB,eAAe,UAAU,CAAC;AAEjD,QAAM,yBAAyB,MAAM,YAAY,CAAC,aAAqB;AACrE,UAAM,aAAa,oBAAoB;AACvC,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,UAAU,CAAC;AAC7D,SAAK,cAAc,aAAa,mBAAmB,SAAS,YAAY,kBAAkB,OAAO;AAAA,EACnG,GAAG,CAAC,kBAAkB,eAAe,WAAW,CAAC;AAEjD,QAAM,eACJ,iCACG;AAAA,wBAAoB;AAAA,IACrB,qBAAC,WAAM,WAAU,qGACf;AAAA,0BAAC,UAAM,YAAE,kCAAkC,GAAE;AAAA,MAC7C;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS;AAAA,UACT,UAAU,CAAC,MAAM,gBAAgB,EAAE,OAAO,OAAO;AAAA;AAAA,MACnD;AAAA,OACF;AAAA,KACF;AAGF,SACE,oBAAC,QACC,+BAAC,YACC;AAAA,wBAAC,SAAI,WAAU,+BACjB,+BAAC,SAAI,WAAU,mCAAkC,MAAK,WAAU,cAAY,EAAE,uBAAuB,GAC/F;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,WAAW,2EAA2E,QAAQ,YAAY,yCAAyC,gEAAgE;AAAA,UACnN,SAAS,MAAM,OAAO,SAAS;AAAA,UAE9B,YAAE,0BAA0B;AAAA;AAAA,MAC/B;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,WAAW,2EAA2E,QAAQ,WAAW,yCAAyC,gEAAgE;AAAA,UAClN,SAAS,MAAM,OAAO,QAAQ;AAAA,UAE7B,YAAE,yBAAyB;AAAA;AAAA,MAC9B;AAAA,OACF,GACF;AAAA,IAEC,SAAS,oBAAC,SAAI,WAAU,2GAA2G,iBAAM;AAAA,IAEzI,QAAQ,aACP;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,WAAW,MAAM,cAAc,aAAa,iBAAiB,YAAY,cAAc;AAAA,QACvF,WAAW;AAAA,QACX;AAAA,QACA,aAAa;AAAA,QACb,aAAa;AAAA,QACb,YAAY;AAAA,UACV,MAAM;AAAA,UACN,UAAU;AAAA,UACV,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,QAChB;AAAA;AAAA,IACF;AAAA,IAGD,QAAQ,YACP;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,WAAW;AAAA,QACX,SAAS,oBAAoB;AAAA,QAC7B,YAAY;AAAA,UACV,MAAM;AAAA,UACN,UAAU;AAAA,UACV,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,QAChB;AAAA;AAAA,IACF;AAAA,KAEJ,GACF;AAEJ;",
+  "sourcesContent": ["'use client'\n\nimport React from 'react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { ActionLogItem } from '../../components/AuditLogsActions'\nimport { AuditLogsActions } from '../../components/AuditLogsActions'\nimport type { AccessLogItem } from '../../components/AccessLogsTable'\nimport { AccessLogsTable } from '../../components/AccessLogsTable'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'audit-logs-page' })\n\ntype ActionLogResponse = {\n  items: ActionLogItem[]\n  canViewTenant: boolean\n  page: number\n  pageSize: number\n  total: number\n  totalPages: number\n}\n\ntype AccessLogResponse = {\n  items: AccessLogItem[]\n  canViewTenant: boolean\n  page: number\n  pageSize: number\n  total: number\n  totalPages: number\n}\n\ntype TabOption = 'actions' | 'access'\n\nconst DEFAULT_PAGE_SIZE = 50\n\nexport default function AuditLogsPage() {\n  const t = useT()\n  const [tab, setTab] = React.useState<TabOption>('actions')\n  const [actions, setActions] = React.useState<ActionLogItem[]>([])\n  const [accessLogs, setAccessLogs] = React.useState<AccessLogItem[]>([])\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const [undoableOnly, setUndoableOnly] = React.useState(false)\n  const [actionsPage, setActionsPage] = React.useState(1)\n  const [actionsPageSize, setActionsPageSize] = React.useState(DEFAULT_PAGE_SIZE)\n  const [actionsTotal, setActionsTotal] = React.useState(0)\n  const [actionsTotalPages, setActionsTotalPages] = React.useState(1)\n  const actionsPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)\n  const [accessPage, setAccessPage] = React.useState(1)\n  const [accessPageSize, setAccessPageSize] = React.useState(DEFAULT_PAGE_SIZE)\n  const [accessTotal, setAccessTotal] = React.useState(0)\n  const [accessTotalPages, setAccessTotalPages] = React.useState(1)\n  const accessPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)\n\n  const fetchActions = React.useCallback(async (page: number, pageSize: number) => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (undoableOnly) params.set('undoableOnly', 'true')\n    return readApiResultOrThrow<ActionLogResponse>(\n      `/api/audit_logs/audit-logs/actions?${params.toString()}`,\n      undefined,\n      { errorMessage: t('audit_logs.error.load') },\n    )\n  }, [undoableOnly, t])\n\n  const fetchAccess = React.useCallback(async (page: number, pageSize: number) => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    return readApiResultOrThrow<AccessLogResponse>(\n      `/api/audit_logs/audit-logs/access?${params.toString()}`,\n      undefined,\n      { errorMessage: t('audit_logs.error.load') },\n    )\n  }, [t])\n\n  const loadAll = React.useCallback(async (\n    actionPage: number, actionPageSize: number,\n    accessPageNum: number, accessPageSizeNum: number,\n  ) => {\n    const [actionsRes, accessRes] = await Promise.all([\n      fetchActions(actionPage, actionPageSize),\n      fetchAccess(accessPageNum, accessPageSizeNum),\n    ])\n    setActions(actionsRes.items ?? [])\n    setActionsPage(actionsRes.page ?? actionPage)\n    setActionsPageSize((prev) => {\n      const resolved = actionsRes.pageSize ?? actionPageSize\n      actionsPageSizeRef.current = resolved\n      return resolved === prev ? prev : resolved\n    })\n    setActionsTotal(actionsRes.total ?? (actionsRes.items?.length ?? 0))\n    setActionsTotalPages(actionsRes.totalPages ?? 1)\n    setAccessLogs(accessRes.items ?? [])\n    const resolvedPage = accessRes.page ?? accessPageNum\n    const resolvedPageSize = accessRes.pageSize ?? accessPageSizeNum\n    const resolvedTotal = accessRes.total ?? (accessRes.items?.length ?? 0)\n    const resolvedTotalPages = accessRes.totalPages ?? Math.max(1, Math.ceil((resolvedTotal || 0) / (resolvedPageSize || 1)))\n    setAccessPage(resolvedPage)\n    setAccessPageSize((prev) => {\n      if (resolvedPageSize === prev) {\n        accessPageSizeRef.current = prev\n        return prev\n      }\n      accessPageSizeRef.current = resolvedPageSize\n      return resolvedPageSize\n    })\n    setAccessTotal(resolvedTotal)\n    setAccessTotalPages(resolvedTotalPages)\n  }, [fetchActions, fetchAccess])\n\n  const loadWithState = React.useCallback(async (\n    actionPage: number, actionPageSize: number,\n    accessPageNum: number, accessPageSizeNum: number,\n  ) => {\n    setLoading(true)\n    setError(null)\n    try {\n      await loadAll(actionPage, actionPageSize, accessPageNum, accessPageSizeNum)\n    } catch (err) {\n      logger.error('Failed to load audit logs', { err })\n      setError(t('audit_logs.error.load'))\n    } finally {\n      setLoading(false)\n    }\n  }, [loadAll, t])\n\n  React.useEffect(() => {\n    setActionsPage(1)\n    setAccessPage(1)\n    void loadWithState(1, actionsPageSizeRef.current, 1, accessPageSizeRef.current)\n  }, [loadWithState, undoableOnly])\n\n  const renderRefreshButton = React.useCallback(() => (\n    <Button\n      variant=\"outline\"\n      size=\"sm\"\n      onClick={() => void loadWithState(actionsPage, actionsPageSize, accessPage, accessPageSize)}\n      disabled={loading}\n    >\n      {loading ? t('audit_logs.common.refreshing') : t('audit_logs.common.refresh')}\n    </Button>\n  ), [loadWithState, actionsPage, actionsPageSize, accessPage, accessPageSize, loading, t])\n\n  const handleUndoError = React.useCallback(() => {\n    setError(t('audit_logs.error.undo'))\n  }, [t])\n  const handleRedoError = React.useCallback(() => {\n    setError(t('audit_logs.error.redo'))\n  }, [t])\n\n  const handleActionsPageChange = React.useCallback((nextPage: number) => {\n    const totalPages = actionsTotalPages || 1\n    const normalized = Math.max(1, Math.min(nextPage, totalPages))\n    void loadWithState(normalized, actionsPageSizeRef.current, accessPage, accessPageSizeRef.current)\n  }, [actionsTotalPages, loadWithState, accessPage])\n\n  const handleAccessPageChange = React.useCallback((nextPage: number) => {\n    const totalPages = accessTotalPages || 1\n    const normalized = Math.max(1, Math.min(nextPage, totalPages))\n    void loadWithState(actionsPage, actionsPageSizeRef.current, normalized, accessPageSizeRef.current)\n  }, [accessTotalPages, loadWithState, actionsPage])\n\n  const headerExtras = (\n    <>\n      {renderRefreshButton()}\n      <label className=\"flex items-center gap-2 rounded border border-transparent px-2 py-1 text-sm text-muted-foreground\">\n        <span>{t('audit_logs.filters.undoable_only')}</span>\n        <input\n          type=\"checkbox\"\n          className=\"h-4 w-4 rounded border border-input\"\n          checked={undoableOnly}\n          onChange={(e) => setUndoableOnly(e.target.checked)}\n        />\n      </label>\n    </>\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <Tabs\n          value={tab}\n          onValueChange={(value) => setTab(value as TabOption)}\n          variant=\"underline\"\n          className=\"mb-6\"\n        >\n          <TabsList className=\"w-full flex-wrap\" aria-label={t('audit_logs.tabs.label')}>\n            <TabsTrigger value=\"actions\">{t('audit_logs.actions.title')}</TabsTrigger>\n            <TabsTrigger value=\"access\">{t('audit_logs.access.title')}</TabsTrigger>\n          </TabsList>\n        </Tabs>\n\n        {error && <div className=\"mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text\">{error}</div>}\n\n        {tab === 'actions' && (\n          <AuditLogsActions\n            items={actions}\n            onRefresh={() => loadWithState(actionsPage, actionsPageSize, accessPage, accessPageSize)}\n            isLoading={loading}\n            headerExtras={headerExtras}\n            onUndoError={handleUndoError}\n            onRedoError={handleRedoError}\n            pagination={{\n              page: actionsPage,\n              pageSize: actionsPageSize,\n              total: actionsTotal,\n              totalPages: actionsTotalPages,\n              onPageChange: handleActionsPageChange,\n            }}\n          />\n        )}\n\n        {tab === 'access' && (\n          <AccessLogsTable\n            items={accessLogs}\n            isLoading={loading}\n            actions={renderRefreshButton()}\n            pagination={{\n              page: accessPage,\n              pageSize: accessPageSize,\n              total: accessTotal,\n              totalPages: accessTotalPages,\n              onPageChange: handleAccessPageChange,\n            }}\n          />\n        )}\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA0II,SA8BA,UA9BA,KAgCE,YAhCF;AAxIJ,OAAO,WAAW;AAClB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,4BAA4B;AACrC,SAAS,cAAc;AACvB,SAAS,MAAM,UAAU,mBAAmB;AAC5C,SAAS,YAAY;AAErB,SAAS,wBAAwB;AAEjC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAsBhF,MAAM,oBAAoB;AAEX,SAAR,gBAAiC;AACtC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAAoB,SAAS;AACzD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAA0B,CAAC,CAAC;AAChE,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAA0B,CAAC,CAAC;AACtE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,iBAAiB;AAC9E,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,CAAC;AACxD,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,CAAC;AAClE,QAAM,qBAAqB,MAAM,OAAO,iBAAiB;AACzD,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,iBAAiB;AAC5E,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,CAAC;AAChE,QAAM,oBAAoB,MAAM,OAAO,iBAAiB;AAExD,QAAM,eAAe,MAAM,YAAY,OAAO,MAAc,aAAqB;AAC/E,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,aAAc,QAAO,IAAI,gBAAgB,MAAM;AACnD,WAAO;AAAA,MACL,sCAAsC,OAAO,SAAS,CAAC;AAAA,MACvD;AAAA,MACA,EAAE,cAAc,EAAE,uBAAuB,EAAE;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,cAAc,CAAC,CAAC;AAEpB,QAAM,cAAc,MAAM,YAAY,OAAO,MAAc,aAAqB;AAC9E,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,WAAO;AAAA,MACL,qCAAqC,OAAO,SAAS,CAAC;AAAA,MACtD;AAAA,MACA,EAAE,cAAc,EAAE,uBAAuB,EAAE;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM,YAAY,OAChC,YAAoB,gBACpB,eAAuB,sBACpB;AACH,UAAM,CAAC,YAAY,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,MAChD,aAAa,YAAY,cAAc;AAAA,MACvC,YAAY,eAAe,iBAAiB;AAAA,IAC9C,CAAC;AACD,eAAW,WAAW,SAAS,CAAC,CAAC;AACjC,mBAAe,WAAW,QAAQ,UAAU;AAC5C,uBAAmB,CAAC,SAAS;AAC3B,YAAM,WAAW,WAAW,YAAY;AACxC,yBAAmB,UAAU;AAC7B,aAAO,aAAa,OAAO,OAAO;AAAA,IACpC,CAAC;AACD,oBAAgB,WAAW,UAAU,WAAW,OAAO,UAAU,EAAE;AACnE,yBAAqB,WAAW,cAAc,CAAC;AAC/C,kBAAc,UAAU,SAAS,CAAC,CAAC;AACnC,UAAM,eAAe,UAAU,QAAQ;AACvC,UAAM,mBAAmB,UAAU,YAAY;AAC/C,UAAM,gBAAgB,UAAU,UAAU,UAAU,OAAO,UAAU;AACrE,UAAM,qBAAqB,UAAU,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,iBAAiB,MAAM,oBAAoB,EAAE,CAAC;AACxH,kBAAc,YAAY;AAC1B,sBAAkB,CAAC,SAAS;AAC1B,UAAI,qBAAqB,MAAM;AAC7B,0BAAkB,UAAU;AAC5B,eAAO;AAAA,MACT;AACA,wBAAkB,UAAU;AAC5B,aAAO;AAAA,IACT,CAAC;AACD,mBAAe,aAAa;AAC5B,wBAAoB,kBAAkB;AAAA,EACxC,GAAG,CAAC,cAAc,WAAW,CAAC;AAE9B,QAAM,gBAAgB,MAAM,YAAY,OACtC,YAAoB,gBACpB,eAAuB,sBACpB;AACH,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,QAAQ,YAAY,gBAAgB,eAAe,iBAAiB;AAAA,IAC5E,SAAS,KAAK;AACZ,aAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC;AACjD,eAAS,EAAE,uBAAuB,CAAC;AAAA,IACrC,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,SAAS,CAAC,CAAC;AAEf,QAAM,UAAU,MAAM;AACpB,mBAAe,CAAC;AAChB,kBAAc,CAAC;AACf,SAAK,cAAc,GAAG,mBAAmB,SAAS,GAAG,kBAAkB,OAAO;AAAA,EAChF,GAAG,CAAC,eAAe,YAAY,CAAC;AAEhC,QAAM,sBAAsB,MAAM,YAAY,MAC5C;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,SAAS,MAAM,KAAK,cAAc,aAAa,iBAAiB,YAAY,cAAc;AAAA,MAC1F,UAAU;AAAA,MAET,oBAAU,EAAE,8BAA8B,IAAI,EAAE,2BAA2B;AAAA;AAAA,EAC9E,GACC,CAAC,eAAe,aAAa,iBAAiB,YAAY,gBAAgB,SAAS,CAAC,CAAC;AAExF,QAAM,kBAAkB,MAAM,YAAY,MAAM;AAC9C,aAAS,EAAE,uBAAuB,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC,CAAC;AACN,QAAM,kBAAkB,MAAM,YAAY,MAAM;AAC9C,aAAS,EAAE,uBAAuB,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,0BAA0B,MAAM,YAAY,CAAC,aAAqB;AACtE,UAAM,aAAa,qBAAqB;AACxC,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,UAAU,CAAC;AAC7D,SAAK,cAAc,YAAY,mBAAmB,SAAS,YAAY,kBAAkB,OAAO;AAAA,EAClG,GAAG,CAAC,mBAAmB,eAAe,UAAU,CAAC;AAEjD,QAAM,yBAAyB,MAAM,YAAY,CAAC,aAAqB;AACrE,UAAM,aAAa,oBAAoB;AACvC,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,UAAU,CAAC;AAC7D,SAAK,cAAc,aAAa,mBAAmB,SAAS,YAAY,kBAAkB,OAAO;AAAA,EACnG,GAAG,CAAC,kBAAkB,eAAe,WAAW,CAAC;AAEjD,QAAM,eACJ,iCACG;AAAA,wBAAoB;AAAA,IACrB,qBAAC,WAAM,WAAU,qGACf;AAAA,0BAAC,UAAM,YAAE,kCAAkC,GAAE;AAAA,MAC7C;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,WAAU;AAAA,UACV,SAAS;AAAA,UACT,UAAU,CAAC,MAAM,gBAAgB,EAAE,OAAO,OAAO;AAAA;AAAA,MACnD;AAAA,OACF;AAAA,KACF;AAGF,SACE,oBAAC,QACC,+BAAC,YACC;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,eAAe,CAAC,UAAU,OAAO,KAAkB;AAAA,QACnD,SAAQ;AAAA,QACR,WAAU;AAAA,QAEV,+BAAC,YAAS,WAAU,oBAAmB,cAAY,EAAE,uBAAuB,GAC1E;AAAA,8BAAC,eAAY,OAAM,WAAW,YAAE,0BAA0B,GAAE;AAAA,UAC5D,oBAAC,eAAY,OAAM,UAAU,YAAE,yBAAyB,GAAE;AAAA,WAC5D;AAAA;AAAA,IACF;AAAA,IAEC,SAAS,oBAAC,SAAI,WAAU,2GAA2G,iBAAM;AAAA,IAEzI,QAAQ,aACP;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,WAAW,MAAM,cAAc,aAAa,iBAAiB,YAAY,cAAc;AAAA,QACvF,WAAW;AAAA,QACX;AAAA,QACA,aAAa;AAAA,QACb,aAAa;AAAA,QACb,YAAY;AAAA,UACV,MAAM;AAAA,UACN,UAAU;AAAA,UACV,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,QAChB;AAAA;AAAA,IACF;AAAA,IAGD,QAAQ,YACP;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,WAAW;AAAA,QACX,SAAS,oBAAoB;AAAA,QAC7B,YAAY;AAAA,UACV,MAAM;AAAA,UACN,UAAU;AAAA,UACV,OAAO;AAAA,UACP,YAAY;AAAA,UACZ,cAAc;AAAA,QAChB;AAAA;AAAA,IACF;AAAA,KAEJ,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/auth/api/autologin.js

@@ -0,0 +1,85 @@
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { signJwt } from "@open-mercato/shared/lib/auth/jwt";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { buildSafeRedirectResponse, resolveTrustedRedirectBase } from "@open-mercato/core/modules/auth/lib/requestRedirect";
+import { sanitizeRedirectPath } from "@open-mercato/core/modules/auth/lib/safeRedirect";
+import { resolveAutoLoginCredentials } from "@open-mercato/core/modules/auth/lib/autologin";
+import { emitAuthEvent } from "@open-mercato/core/modules/auth/events";
+const metadata = { requireAuth: false };
+const accessTokenMaxAgeSeconds = 60 * 60 * 8;
+const logger = createLogger("auth").child({ component: "autologin" });
+async function GET(req) {
+  const url = new URL(req.url);
+  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin;
+  const redirectTo = sanitizeRedirectPath(url.searchParams.get("redirect"), baseUrl, "/backend");
+  const credentials = resolveAutoLoginCredentials();
+  if (!credentials) {
+    return buildSafeRedirectResponse(req, "/login");
+  }
+  const existing = await getAuthFromRequest(req);
+  if (existing) {
+    return buildSafeRedirectResponse(req, redirectTo);
+  }
+  const container = await createRequestContainer();
+  const auth = container.resolve("authService");
+  let user = null;
+  if (credentials.tenantId) {
+    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId);
+  } else {
+    const users = await auth.findUsersByEmail(credentials.email);
+    user = users.length === 1 ? users[0] : null;
+  }
+  const ok = await auth.verifyPassword(user, credentials.password);
+  if (!user || !ok) {
+    logger.warn("OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login");
+    return buildSafeRedirectResponse(req, "/login");
+  }
+  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null);
+  const roles = await auth.getUserRoles(user, resolvedTenantId);
+  await auth.updateLastLoginAt(user);
+  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1e3);
+  const { session } = await auth.createSession(user, expiresAt);
+  const token = signJwt({
+    sub: String(user.id),
+    sid: String(session.id),
+    tenantId: resolvedTenantId,
+    orgId: user.organizationId ? String(user.organizationId) : null,
+    email: user.email,
+    roles
+  });
+  void emitAuthEvent("auth.login.success", {
+    id: String(user.id),
+    email: user.email,
+    tenantId: resolvedTenantId,
+    organizationId: user.organizationId ? String(user.organizationId) : null
+  }).catch(() => void 0);
+  const res = buildSafeRedirectResponse(req, redirectTo);
+  res.cookies.set("auth_token", token, {
+    httpOnly: true,
+    path: "/",
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production",
+    maxAge: accessTokenMaxAgeSeconds
+  });
+  return res;
+}
+const openApi = {
+  tag: "Authentication & Accounts",
+  summary: "Demo autologin",
+  methods: {
+    GET: {
+      summary: "Auto sign-in using env-configured demo credentials",
+      description: "When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.",
+      responses: [
+        { status: 307, description: "Redirect into the app (or to /login on failure)", mediaType: "text/html" }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=autologin.js.map

package/dist/modules/auth/api/autologin.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/api/autologin.ts"],
+  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\n\nexport const metadata = { requireAuth: false }\n\nconst accessTokenMaxAgeSeconds = 60 * 60 * 8\nconst logger = createLogger('auth').child({ component: 'autologin' })\n\n// Demo-only convenience: when OM_AUTOLOGIN_* credentials are configured, sign the\n// visitor in with those credentials and redirect into the app. Gated entirely\n// behind env vars \u2014 the homepage only routes here when they are set. On any\n// failure (feature off, bad credentials) it falls back to the manual login form\n// so a misconfigured demo can never loop.\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin\n  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/backend')\n\n  const credentials = resolveAutoLoginCredentials()\n  if (!credentials) {\n    return buildSafeRedirectResponse(req, '/login')\n  }\n\n  // Already signed in \u2014 go straight to the app instead of re-issuing a session.\n  const existing = await getAuthFromRequest(req)\n  if (existing) {\n    return buildSafeRedirectResponse(req, redirectTo)\n  }\n\n  const container = await createRequestContainer()\n  const auth = container.resolve<AuthService>('authService')\n\n  let user = null\n  if (credentials.tenantId) {\n    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(credentials.email)\n    user = users.length === 1 ? users[0] : null\n  }\n\n  const ok = await auth.verifyPassword(user, credentials.password)\n  if (!user || !ok) {\n    // Misconfigured demo credentials \u2014 never loop; drop to the manual form.\n    logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')\n    return buildSafeRedirectResponse(req, '/login')\n  }\n\n  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const roles = await auth.getUserRoles(user, resolvedTenantId)\n  await auth.updateLastLoginAt(user)\n  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session } = await auth.createSession(user, expiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(session.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles,\n  })\n  void emitAuthEvent('auth.login.success', {\n    id: String(user.id),\n    email: user.email,\n    tenantId: resolvedTenantId,\n    organizationId: user.organizationId ? String(user.organizationId) : null,\n  }).catch(() => undefined)\n\n  const res = buildSafeRedirectResponse(req, redirectTo)\n  res.cookies.set('auth_token', token, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: accessTokenMaxAgeSeconds,\n  })\n  return res\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Demo autologin',\n  methods: {\n    GET: {\n      summary: 'Auto sign-in using env-configured demo credentials',\n      description:\n        'When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.',\n      responses: [\n        { status: 307, description: 'Redirect into the app (or to /login on failure)', mediaType: 'text/html' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB;AAEvB,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,2BAA2B,KAAK,KAAK;AAC3C,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC;AAOpE,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,2BAA2B,GAAG,KAAK,IAAI;AACvD,QAAM,aAAa,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,UAAU;AAE7F,QAAM,cAAc,4BAA4B;AAChD,MAAI,CAAC,aAAa;AAChB,WAAO,0BAA0B,KAAK,QAAQ;AAAA,EAChD;AAGA,QAAM,WAAW,MAAM,mBAAmB,GAAG;AAC7C,MAAI,UAAU;AACZ,WAAO,0BAA0B,KAAK,UAAU;AAAA,EAClD;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AAEzD,MAAI,OAAO;AACX,MAAI,YAAY,UAAU;AACxB,WAAO,MAAM,KAAK,yBAAyB,YAAY,OAAO,YAAY,QAAQ;AAAA,EACpF,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,YAAY,KAAK;AAC3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAEA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,YAAY,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,IAAI;AAEhB,WAAO,KAAK,wFAAwF;AACpG,WAAO,0BAA0B,KAAK,QAAQ;AAAA,EAChD;AAEA,QAAM,mBAAmB,YAAY,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC1F,QAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,gBAAgB;AAC5D,QAAM,KAAK,kBAAkB,IAAI;AACjC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACvE,QAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,cAAc,MAAM,SAAS;AAC5D,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,QAAQ,EAAE;AAAA,IACtB,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ;AAAA,EACF,CAAC;AACD,OAAK,cAAc,sBAAsB;AAAA,IACvC,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,OAAO,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,EACtE,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,0BAA0B,KAAK,UAAU;AACrD,MAAI,QAAQ,IAAI,cAAc,OAAO;AAAA,IACnC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mDAAmD,WAAW,YAAY;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/auth/lib/autologin.js

@@ -0,0 +1,19 @@
+function readEnvValue(env, key) {
+  const value = env[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+function resolveAutoLoginCredentials(env = process.env) {
+  const email = readEnvValue(env, "OM_AUTOLOGIN_EMAIL");
+  const password = env.OM_AUTOLOGIN_PASSWORD ?? "";
+  if (!email || !password) return null;
+  const tenantId = readEnvValue(env, "OM_AUTOLOGIN_TENANT");
+  return { email, password, tenantId: tenantId || null };
+}
+function isAutoLoginEnabled(env = process.env) {
+  return resolveAutoLoginCredentials(env) !== null;
+}
+export {
+  isAutoLoginEnabled,
+  resolveAutoLoginCredentials
+};
+//# sourceMappingURL=autologin.js.map

package/dist/modules/auth/lib/autologin.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/autologin.ts"],
+  "sourcesContent": ["export type AutoLoginCredentials = {\n  email: string\n  password: string\n  tenantId: string | null\n}\n\nfunction readEnvValue(env: Record<string, string | undefined>, key: string): string {\n  const value = env[key]\n  return typeof value === 'string' ? value.trim() : ''\n}\n\n/**\n * Reads the optional demo-autologin credentials from env. When both\n * `OM_AUTOLOGIN_EMAIL` and `OM_AUTOLOGIN_PASSWORD` are set, the homepage hands\n * unauthenticated visitors to the autologin route which signs them in and drops\n * them into the app. Unset (the default) \u2192 `null` \u2192 normal login flow.\n *\n * `OM_AUTOLOGIN_TENANT` is optional and only needed when the same email exists\n * across multiple tenants. Pure: pass the env bag so it stays testable.\n */\nexport function resolveAutoLoginCredentials(\n  env: Record<string, string | undefined> = process.env,\n): AutoLoginCredentials | null {\n  const email = readEnvValue(env, 'OM_AUTOLOGIN_EMAIL')\n  const password = env.OM_AUTOLOGIN_PASSWORD ?? ''\n  if (!email || !password) return null\n  const tenantId = readEnvValue(env, 'OM_AUTOLOGIN_TENANT')\n  return { email, password, tenantId: tenantId || null }\n}\n\n/** True when demo autologin credentials are configured via env. */\nexport function isAutoLoginEnabled(\n  env: Record<string, string | undefined> = process.env,\n): boolean {\n  return resolveAutoLoginCredentials(env) !== null\n}\n"],
+  "mappings": "AAMA,SAAS,aAAa,KAAyC,KAAqB;AAClF,QAAM,QAAQ,IAAI,GAAG;AACrB,SAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACpD;AAWO,SAAS,4BACd,MAA0C,QAAQ,KACrB;AAC7B,QAAM,QAAQ,aAAa,KAAK,oBAAoB;AACpD,QAAM,WAAW,IAAI,yBAAyB;AAC9C,MAAI,CAAC,SAAS,CAAC,SAAU,QAAO;AAChC,QAAM,WAAW,aAAa,KAAK,qBAAqB;AACxD,SAAO,EAAE,OAAO,UAAU,UAAU,YAAY,KAAK;AACvD;AAGO,SAAS,mBACd,MAA0C,QAAQ,KACzC;AACT,SAAO,4BAA4B,GAAG,MAAM;AAC9C;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/admin/roles/[id]/acl.js

@@ -38,6 +38,7 @@ async function PUT(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {