@open-mercato/core 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/dist/modules/auth/cli.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/auth/cli.ts"],
-  "sourcesContent": ["import type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { OM_LOG_LEVEL_ENV, resetLogLevelCache } from '@open-mercato/shared/lib/logger'\nimport { resetServerLoggerCache } from '@open-mercato/shared/lib/logger'\nimport { hash } from 'bcryptjs'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'\nimport { normalizeTenantId } from './lib/tenantAccess'\nimport { computeEmailHash, emailHashLookupValues } from './lib/emailHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { env } from 'process'\nimport type { KmsService, TenantDek } from '@open-mercato/shared/lib/encryption/kms'\nimport crypto from 'node:crypto'\nimport { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { getCliModules } from '@open-mercato/shared/modules/registry'\n\nasync function resolveTenantScopedRole(em: any, name: string, normalizedTenantId: string | null) {\n  const existing = await em.findOne(Role, { name, tenantId: normalizedTenantId })\n  if (existing) return existing\n  const role = em.create(Role, { name, tenantId: normalizedTenantId, createdAt: new Date() })\n  await em.persist(role).flush()\n  return role\n}\n\nconst addUser: ModuleCli = {\n  command: 'add-user',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n    const email = args.email\n    const password = args.password\n    const organizationId = String(args.organizationId ?? args.orgId ?? args.org)\n    const rolesCsv = (args.roles ?? '').trim()\n    if (!email || !password || !organizationId) {\n      console.error('Usage: mercato auth add-user --email <email> --password <password> --organizationId <id> [--roles customer,employee]')\n      return\n    }\n    if (!ensurePasswordPolicy(password)) return\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const org =\n      (await findOneWithDecryption(\n        em,\n        Organization,\n        { id: organizationId },\n        { populate: ['tenant'] },\n        { tenantId: null, organizationId },\n      )) ?? null\n    if (!org) throw new Error('Organization not found')\n    const orgTenantId = org.tenant?.id ? String(org.tenant.id) : null\n    const normalizedTenantId = normalizeTenantId(orgTenantId ?? null) ?? null\n    const u = em.create(User, {\n      email,\n      emailHash: computeEmailHash(email),\n      passwordHash: await hash(password, 10),\n      isConfirmed: true,\n      organizationId: org.id,\n      tenantId: org.tenant.id,\n    })\n    await em.persist(u).flush()\n    if (rolesCsv) {\n      const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)\n      for (const name of names) {\n        const role = await resolveTenantScopedRole(em, name, normalizedTenantId)\n        const link = em.create(UserRole, { user: u, role })\n        await em.persist(link).flush()\n      }\n    }\n    console.log('User created with id', u.id)\n  },\n}\n\nfunction parseArgs(rest: string[]) {\n  const args: Record<string, string | boolean> = {}\n  for (let i = 0; i < rest.length; i++) {\n    const a = rest[i]\n    if (!a) continue\n    if (a.startsWith('--')) {\n      const [k, v] = a.replace(/^--/, '').split('=')\n      if (v !== undefined) args[k] = v\n      else if (rest[i + 1] && !rest[i + 1]!.startsWith('--')) { args[k] = rest[i + 1]!; i++ }\n      else args[k] = true\n    }\n  }\n  return args\n}\n\nfunction normalizeKeyInput(value: string): string {\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\nfunction hashSecret(value: string | null | undefined): string | null {\n  if (!value) return null\n  return crypto.createHash('sha256').update(normalizeKeyInput(value)).digest('hex').slice(0, 12)\n}\n\nfunction ensurePasswordPolicy(password: string): boolean {\n  const policy = getPasswordPolicy()\n  const result = validatePassword(password, policy)\n  if (result.ok) return true\n  const requirements = formatPasswordRequirements(policy, (_key, fallback) => fallback)\n  const suffix = requirements ? `: ${requirements}` : ''\n  console.error(`Password does not meet the requirements${suffix}.`)\n  return false\n}\n\nasync function withEncryptionDebugDisabled<T>(fn: () => Promise<T>): Promise<T> {\n  const previous = process.env.TENANT_DATA_ENCRYPTION_DEBUG\n  process.env.TENANT_DATA_ENCRYPTION_DEBUG = 'no'\n  try {\n    return await fn()\n  } finally {\n    if (previous === undefined) {\n      delete process.env.TENANT_DATA_ENCRYPTION_DEBUG\n    } else {\n      process.env.TENANT_DATA_ENCRYPTION_DEBUG = previous\n    }\n  }\n}\n\nclass DerivedKeyKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    this.root = crypto.createHash('sha256').update(normalizeKeyInput(secret)).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nfunction fingerprintDek(dek: TenantDek | null): string | null {\n  if (!dek?.key) return null\n  return crypto.createHash('sha256').update(dek.key).digest('hex').slice(0, 12)\n}\n\nfunction decryptWithOldKey(\n  payload: string,\n  dek: TenantDek | null,\n): string | null {\n  if (!dek?.key) return null\n  return decryptWithAesGcm(payload, dek.key)\n}\n\nconst seedRoles: ModuleCli = {\n  command: 'seed-roles',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const key = rest[i]?.replace(/^--/, '')\n      if (!key) continue\n      const value = rest[i + 1]\n      if (value) args[key] = value\n    }\n    const tenantId = args.tenantId ?? args.tenant ?? args.tenant_id ?? null\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n    if (tenantId) {\n      await ensureRoles(em, { tenantId })\n      console.log('\uD83D\uDEE1\uFE0F Roles ensured for tenant', tenantId)\n      return\n    }\n    const tenants = await em.find(Tenant, {})\n    if (!tenants.length) {\n      console.log('No tenants found; nothing to seed.')\n      return\n    }\n    for (const tenant of tenants) {\n      const id = tenant.id ? String(tenant.id) : null\n      if (!id) continue\n      await ensureRoles(em, { tenantId: id })\n      console.log('\uD83D\uDEE1\uFE0F Roles ensured for tenant', id)\n    }\n  },\n}\n\nconst rotateEncryptionKey: ModuleCli = {\n  command: 'rotate-encryption-key',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantId = (args.tenantId as string) ?? (args.tenant as string) ?? (args.tenant_id as string) ?? null\n    const organizationId = (args.organizationId as string) ?? (args.orgId as string) ?? (args.org as string) ?? null\n    const oldKey = (args['old-key'] as string) ?? (args.oldKey as string) ?? null\n    const dryRun = Boolean(args['dry-run'] || args.dry)\n    const debug = Boolean(args.debug)\n    const rotate = Boolean(oldKey)\n    if (rotate && !tenantId) {\n      console.warn(\n        '\u26A0\uFE0F  Rotating with --old-key across all tenants. A single old key should normally target one tenant; consider --tenant.',\n      )\n    }\n    if (!isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting.')\n      return\n    }\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n    const encryptionService = new TenantDataEncryptionService(em as any, { kms: createKmsService() })\n    const oldKms = rotate && oldKey ? new DerivedKeyKmsService(oldKey) : null\n    if (debug) {\n      console.log('[rotate-encryption-key]', {\n        hasOldKey: Boolean(oldKey),\n        rotate,\n        tenantId: tenantId ?? null,\n        organizationId: organizationId ?? null,\n      })\n      console.log('[rotate-encryption-key] key fingerprints', {\n        oldKey: hashSecret(oldKey),\n        currentKey: hashSecret(process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY),\n      })\n    }\n    if (!encryptionService.isEnabled()) {\n      console.error('Encryption service is not enabled (KMS unhealthy or no DEK). Aborting.')\n      return\n    }\n    const conn: any = (em as any).getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw connection; aborting.')\n      return\n    }\n    const meta = (em as any)?.getMetadata?.()?.get?.(User)\n    const tableName = meta?.tableName || 'users'\n    const schema = meta?.schema\n    const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n    const isEncryptedPayload = (value: unknown): boolean => {\n      if (typeof value !== 'string') return false\n      const parts = value.split(':')\n      return parts.length === 4 && parts[3] === 'v1'\n    }\n    const printedDek = new Set<string>()\n    const oldDekCache = new Map<string, TenantDek | null>()\n    const processScope = async (scopeTenantId: string, scopeOrganizationId: string): Promise<number> => {\n      if (debug && !printedDek.has(scopeTenantId)) {\n        printedDek.add(scopeTenantId)\n        const [oldDek, newDek] = await Promise.all([\n          oldKms?.getTenantDek(scopeTenantId) ?? Promise.resolve(null),\n          encryptionService.getDek(scopeTenantId),\n        ])\n        console.log('[rotate-encryption-key] dek fingerprints', {\n          tenantId: scopeTenantId,\n          oldKey: fingerprintDek(oldDek),\n          currentKey: fingerprintDek(newDek),\n        })\n      }\n      const rawRows = await conn.execute(\n        `select id, email, email_hash from ${qualifiedTable} where tenant_id = ? and organization_id = ?`,\n        [scopeTenantId, scopeOrganizationId],\n      )\n      const rows = Array.isArray(rawRows) ? rawRows : []\n      const pending = rotate\n        ? rows\n        : rows.filter((row: any) => !isEncryptedPayload(row?.email))\n      if (!pending.length) return 0\n      console.log(\n        `Found ${pending.length} auth user records to process for org=${scopeOrganizationId}${dryRun ? ' (dry-run)' : ''}.`\n      )\n      if (dryRun) return 0\n      const ids = pending.map((row: any) => String(row.id))\n      const users = rotate\n        ? await em.find(\n          User,\n          { id: { $in: ids }, tenantId: scopeTenantId, organizationId: scopeOrganizationId },\n        )\n        : await findWithDecryption(\n          em,\n          User,\n          { id: { $in: ids }, tenantId: scopeTenantId, organizationId: scopeOrganizationId },\n          {},\n          { tenantId: scopeTenantId, organizationId: scopeOrganizationId, encryptionService },\n        )\n      const usersById = new Map(users.map((user) => [String(user.id), user]))\n      let updated = 0\n      for (const row of pending) {\n        const user = usersById.get(String(row.id))\n        if (!user) continue\n        const rawEmail = typeof row.email === 'string' ? row.email : String(row.email ?? '')\n        if (!rawEmail) continue\n        if (rotate && (!isEncryptedPayload(rawEmail) || !oldKms)) {\n          continue\n        }\n        let plainEmail = rawEmail\n        if (rotate && isEncryptedPayload(rawEmail) && oldKms) {\n          if (debug) {\n            console.log('[rotate-encryption-key] decrypting', {\n              userId: row.id,\n              tenantId: scopeTenantId,\n              organizationId: scopeOrganizationId,\n            })\n          }\n          let oldDek = oldDekCache.get(scopeTenantId) ?? null\n          if (!oldDekCache.has(scopeTenantId)) {\n            oldDek = await oldKms.getTenantDek(scopeTenantId)\n            oldDekCache.set(scopeTenantId, oldDek)\n          }\n          const maybeEmail = decryptWithOldKey(rawEmail, oldDek)\n          if (typeof maybeEmail !== 'string' || isEncryptedPayload(maybeEmail)) continue\n          plainEmail = maybeEmail\n        }\n        if (!plainEmail) continue\n        const encrypted = await encryptionService.encryptEntityPayload(\n          'auth:user',\n          { email: plainEmail },\n          scopeTenantId,\n          scopeOrganizationId,\n        )\n        const nextEmail = encrypted.email as string | undefined\n        if (nextEmail && nextEmail !== user.email) {\n          user.email = nextEmail as any\n          user.emailHash = (encrypted as any).emailHash ?? computeEmailHash(plainEmail)\n          em.persist(user)\n          updated += 1\n        }\n      }\n      if (updated > 0) {\n        await em.flush()\n      }\n      return updated\n    }\n\n    if (tenantId && organizationId) {\n      const updated = await processScope(String(tenantId), String(organizationId))\n      if (!updated) {\n        console.log('All auth user emails already encrypted for the selected scope.')\n      } else {\n        console.log(`Encrypted ${updated} auth user email(s).`)\n      }\n      return\n    }\n\n    const organizations = await em.find(Organization, {})\n    if (!organizations.length) {\n      console.log('No organizations found; nothing to encrypt.')\n      return\n    }\n    let total = 0\n    for (const org of organizations) {\n      const scopeTenantId = org.tenant?.id ? String(org.tenant.id) : org.tenant.id ? String(org.tenant.id) : null\n      const scopeOrganizationId = org.id ? String(org.id) : null\n      if (!scopeTenantId || !scopeOrganizationId) continue\n      total += await processScope(scopeTenantId, scopeOrganizationId)\n    }\n    if (total > 0) {\n      console.log(`Encrypted ${total} auth user email(s) across all organizations.`)\n    } else {\n      console.log('All auth user emails already encrypted across all organizations.')\n    }\n  },\n}\n\n// will be exported at the bottom with all commands\n\nconst addOrganization: ModuleCli = {\n  command: 'add-org',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n    const name = args.name || args.orgName\n    if (!name) {\n      console.error('Usage: mercato auth add-org --name <organization name>')\n      return\n    }\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    // Create tenant implicitly for simplicity\n    const tenant = em.create(Tenant, { name: `${name} Tenant` })\n    await em.persist(tenant).flush()\n    const org = em.create(Organization, { name, tenant })\n    await em.persist(org).flush()\n    await rebuildHierarchyForTenant(em, String(tenant.id))\n    console.log('Organization created with id', org.id, 'in tenant', tenant.id)\n  },\n}\n\nconst SETUP_USAGE = 'Usage: mercato auth setup --orgName <name> --email <email> --password <password> [--orgSlug <slug>] [--roles superadmin,admin,employee] [--skip-password-policy] [--include-demo-users] [--with-examples] [--json]'\n\nconst setupApp: ModuleCli = {\n  command: 'setup',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const orgName = typeof args.orgName === 'string'\n      ? args.orgName\n      : typeof args.name === 'string'\n        ? args.name\n        : undefined\n    const email = typeof args.email === 'string' ? args.email : undefined\n    const password = typeof args.password === 'string' ? args.password : undefined\n    const orgSlugRaw = typeof args.orgSlug === 'string'\n      ? args.orgSlug\n      : typeof args.slug === 'string'\n        ? args.slug\n        : undefined\n    const orgSlug = orgSlugRaw && orgSlugRaw.trim().length ? orgSlugRaw.trim() : undefined\n    if (orgSlug !== undefined && !ORG_SLUG_PATTERN.test(orgSlug)) {\n      process.stderr.write(`Invalid --orgSlug: must match ${ORG_SLUG_PATTERN.source} (lowercase, digits, dashes; 1-63 chars; cannot start or end with a dash)\\n`)\n      process.exitCode = 2\n      return\n    }\n    const rolesCsv = typeof args.roles === 'string'\n      ? args.roles.trim()\n      : 'superadmin,admin,employee'\n    const skipPasswordPolicyRaw =\n      args['skip-password-policy'] ??\n      args.skipPasswordPolicy ??\n      args['allow-weak-password'] ??\n      args.allowWeakPassword\n    const skipPasswordPolicy = typeof skipPasswordPolicyRaw === 'boolean'\n      ? skipPasswordPolicyRaw\n      : parseBooleanToken(typeof skipPasswordPolicyRaw === 'string' ? skipPasswordPolicyRaw : null) ?? false\n    const withExamplesRaw = args['with-examples'] ?? args.withExamples\n    const withExamples = typeof withExamplesRaw === 'boolean'\n      ? withExamplesRaw\n      : parseBooleanToken(typeof withExamplesRaw === 'string' ? withExamplesRaw : null) ?? false\n    const includeDemoUsersRaw = args['include-demo-users'] ?? args.includeDemoUsers\n    const includeDemoUsers = typeof includeDemoUsersRaw === 'boolean'\n      ? includeDemoUsersRaw\n      : parseBooleanToken(typeof includeDemoUsersRaw === 'string' ? includeDemoUsersRaw : null) ?? false\n    const jsonModeRaw = args.json\n    const jsonMode = typeof jsonModeRaw === 'boolean'\n      ? jsonModeRaw\n      : parseBooleanToken(typeof jsonModeRaw === 'string' ? jsonModeRaw : null) ?? false\n    if (!orgName || !email || !password) {\n      process.stderr.write(`${SETUP_USAGE}\\n`)\n      process.exitCode = 2\n      return\n    }\n    if (!skipPasswordPolicy && !ensurePasswordPolicy(password)) {\n      process.exitCode = 2\n      return\n    }\n    if (skipPasswordPolicy && !jsonMode) {\n      console.warn('\u26A0\uFE0F  Password policy validation skipped for setup.')\n    }\n    let restoreConsole: (() => void) | null = null\n    if (jsonMode) {\n      // Force quiet mode so module bootstrap / lifecycle hooks cannot pollute\n      // stdout. The JSON contract relies on a single line, so any console.log\n      // from setupInitialTenant or seedExamples would otherwise break the\n      // consumer's `jq` pipe. We additionally rebind console.log/info to a\n      // no-op for the duration of the call because OM_CLI_QUIET is honored\n      // unevenly across module setup hooks. Rebind AFTER early-return\n      // validation so the missing-args and password-policy paths can't\n      // leak the rebinding into a long-lived process (e.g. test runner).\n      process.env.OM_CLI_QUIET = process.env.OM_CLI_QUIET ?? '1'\n      const originalLog = console.log\n      const originalInfo = console.info\n      console.log = () => undefined\n      console.info = () => undefined\n      const originalLogLevel = process.env[OM_LOG_LEVEL_ENV]\n      process.env[OM_LOG_LEVEL_ENV] = 'error'\n      resetLogLevelCache()\n      resetServerLoggerCache()\n      restoreConsole = () => {\n        console.log = originalLog\n        console.info = originalInfo\n        if (originalLogLevel === undefined) delete process.env[OM_LOG_LEVEL_ENV]\n        else process.env[OM_LOG_LEVEL_ENV] = originalLogLevel\n        resetLogLevelCache()\n        resetServerLoggerCache()\n      }\n    }\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const roleNames = rolesCsv\n      ? rolesCsv.split(',').map((s) => s.trim()).filter(Boolean)\n      : undefined\n\n    try {\n      const modules = getCliModules()\n      const result = await setupInitialTenant(em, {\n        orgName,\n        orgSlug,\n        roleNames,\n        primaryUser: { email, password, confirm: true },\n        // Derived admin/employee demo accounts only land when the operator\n        // explicitly opts in via --include-demo-users. Default-deny prevents\n        // production deployments from silently seeding well-known emails.\n        includeDerivedUsers: includeDemoUsers,\n        // When demo users are explicitly requested, the operator has consented\n        // to having admin@/employee@ accounts created with autogenerated\n        // passwords (surfaced in stdout) when no env override is provided.\n        allowDemoDerivedPasswords: includeDemoUsers,\n        // When the caller passes an explicit slug, treat it as a \"fresh tenant\"\n        // signal \u2014 silent reuse of an existing user's tenant defeats the point\n        // of slugging the new tenant for downstream tooling.\n        failIfUserExists: orgSlug !== undefined,\n        modules,\n      })\n\n      if (withExamples) {\n        const seedCtx = {\n          em,\n          tenantId: result.tenantId,\n          organizationId: result.organizationId,\n          container,\n        }\n        for (const mod of modules) {\n          if (mod.setup?.seedExamples) {\n            await mod.setup.seedExamples(seedCtx as any)\n          }\n        }\n      }\n\n      if (jsonMode) {\n        const adminSnapshot = pickAdminSnapshot(result.users, email)\n        const adminUserId = adminSnapshot && adminSnapshot.user.id != null\n          ? String(adminSnapshot.user.id)\n          : null\n        const payload = {\n          tenantId: result.tenantId,\n          organizationId: result.organizationId,\n          adminUserId,\n          adminEmail: email,\n          reusedExistingUser: result.reusedExistingUser,\n        }\n        if (restoreConsole) restoreConsole()\n        process.stdout.write(`${JSON.stringify(payload)}\\n`)\n        return\n      }\n\n      if (result.reusedExistingUser) {\n        console.log('\u26A0\uFE0F  Existing initial user detected during setup.')\n        console.log(`\u26A0\uFE0F  Email: ${email}`)\n        console.log('\u26A0\uFE0F  Updated roles if missing and reused tenant/organization.')\n      }\n\n      if (env.NODE_ENV !== 'test') {\n        for (const snapshot of result.users) {\n          if (snapshot.created) {\n            if (snapshot.generatedPassword) {\n              console.log('\u26A0\uFE0F  GENERATED password \u2014 copy now; it is not stored in plain text')\n              console.log('\uD83C\uDF89 Created user', snapshot.user.email, 'password:', snapshot.generatedPassword)\n            } else {\n              console.log('\uD83C\uDF89 Created user', snapshot.user.email)\n            }\n          } else {\n            console.log(`Updated user ${snapshot.user.email}`)\n          }\n        }\n      }\n\n      if (env.NODE_ENV !== 'test') console.log('\u2705 Setup complete:', { tenantId: result.tenantId, organizationId: result.organizationId })\n    } catch (err) {\n      if (restoreConsole) restoreConsole()\n      if (err instanceof OrgSlugExistsError) {\n        process.stderr.write(`${err.message}\\n`)\n        process.exitCode = 1\n        return\n      }\n      if (err instanceof DerivedUserPasswordRequiredError) {\n        process.stderr.write(\n          `Setup aborted: ${err.message}. In production, set OM_INIT_ADMIN_PASSWORD and OM_INIT_EMPLOYEE_PASSWORD before passing --include-demo-users, or omit --include-demo-users to skip derived demo accounts entirely.\\n`,\n        )\n        process.exitCode = 2\n        return\n      }\n      if (err instanceof Error && err.message === 'USER_EXISTS') {\n        process.stderr.write('Setup aborted: user already exists with the provided email.\\n')\n        process.exitCode = 1\n        return\n      }\n      throw err\n    } finally {\n      if (restoreConsole) restoreConsole()\n    }\n  },\n}\n\nconst ORG_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/\n\nfunction pickAdminSnapshot(\n  users: Array<{ user: { id: string; email: string }; roles: string[]; created: boolean }>,\n  adminEmail: string,\n): { user: { id: string; email: string } } | undefined {\n  const normalizedEmail = adminEmail.toLowerCase()\n  const exact = users.find(\n    (snapshot) =>\n      snapshot.created &&\n      snapshot.roles.includes('superadmin') &&\n      typeof snapshot.user.email === 'string' &&\n      snapshot.user.email.toLowerCase() === normalizedEmail,\n  )\n  if (exact) return exact\n  return users.find((snapshot) => snapshot.roles.includes('superadmin'))\n}\n\nconst listOrganizations: ModuleCli = {\n  command: 'list-orgs',\n  async run() {\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const orgs = await findWithDecryption(\n      em,\n      Organization,\n      {},\n      { populate: ['tenant'] },\n      { tenantId: null, organizationId: null },\n    )\n\n    if (orgs.length === 0) {\n      console.log('No organizations found')\n      return\n    }\n\n    console.log(`Found ${orgs.length} organization(s):`)\n    console.log('')\n    console.log('ID                                   | Name                    | Tenant ID                            | Created')\n    console.log('-------------------------------------|-------------------------|-------------------------------------|-------------------')\n\n    for (const org of orgs) {\n      const created = org.createdAt ? new Date(org.createdAt).toLocaleDateString() : 'N/A'\n      const id = org.id || 'N/A'\n      const tenantId = org.tenant?.id || 'N/A'\n      const name = (org.name || 'Unnamed').padEnd(23)\n      console.log(`${id.padEnd(35)} | ${name} | ${tenantId.padEnd(35)} | ${created}`)\n    }\n  },\n}\n\nconst listTenants: ModuleCli = {\n  command: 'list-tenants',\n  async run() {\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const tenants = await em.find(Tenant, {})\n\n    if (tenants.length === 0) {\n      console.log('No tenants found')\n      return\n    }\n\n    console.log(`Found ${tenants.length} tenant(s):`)\n    console.log('')\n    console.log('ID                                   | Name                    | Created')\n    console.log('-------------------------------------|-------------------------|-------------------')\n\n    for (const tenant of tenants) {\n      const created = tenant.createdAt ? new Date(tenant.createdAt).toLocaleDateString() : 'N/A'\n      const id = tenant.id || 'N/A'\n      const name = (tenant.name || 'Unnamed').padEnd(23)\n      console.log(`${id.padEnd(35)} | ${name} | ${created}`)\n    }\n  },\n}\n\nconst listUsers: ModuleCli = {\n  command: 'list-users',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n\n    // Build query with optional filters\n    const where: any = {}\n    if (args.organizationId || args.orgId || args.org) {\n      where.organizationId = args.organizationId || args.orgId || args.org\n    }\n    if (args.tenantId || args.tenant) {\n      where.tenantId = args.tenantId || args.tenant\n    }\n\n    const users = await em.find(User, where)\n\n    if (users.length === 0) {\n      console.log('No users found')\n      return\n    }\n\n    console.log(`Found ${users.length} user(s):`)\n    console.log('')\n    console.log('ID                                   | Email                   | Name                    | Organization ID      | Tenant ID            | Roles')\n    console.log('-------------------------------------|-------------------------|-------------------------|---------------------|---------------------|-------------------')\n\n    for (const user of users) {\n      // Get user roles separately\n      const userRoles = await findWithDecryption(\n        em,\n        UserRole,\n        { user: user.id },\n        { populate: ['role'] },\n        { tenantId: user.tenantId ?? null, organizationId: user.organizationId ?? null },\n      )\n      const roles = userRoles.map((ur: any) => ur.role?.name).filter(Boolean).join(', ') || 'None'\n\n      // Get organization and tenant names if IDs exist\n      let orgName = 'N/A'\n      let tenantName = 'N/A'\n\n      if (user.organizationId) {\n        const org = await em.findOne(Organization, { id: user.organizationId })\n        orgName = org?.name ? `${org.name.substring(0, 19)}...` : `${user.organizationId.substring(0, 8)}...`\n      }\n\n      if (user.tenantId) {\n        const tenant = await em.findOne(Tenant, { id: user.tenantId })\n        tenantName = tenant?.name ? `${tenant.name.substring(0, 19)}...` : `${user.tenantId.substring(0, 8)}...`\n      }\n\n      const id = user.id || 'N/A'\n      const email = (user.email || 'N/A').padEnd(23)\n      const name = (user.name || 'Unnamed').padEnd(23)\n\n      console.log(`${id.padEnd(35)} | ${email} | ${name} | ${orgName.padEnd(19)} | ${tenantName.padEnd(19)} | ${roles}`)\n    }\n  },\n}\n\nconst setPassword: ModuleCli = {\n  command: 'set-password',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n\n    const email = args.email\n    const password = args.password\n\n    if (!email || !password) {\n      console.error('Usage: mercato auth set-password --email <email> --password <newPassword>')\n      return\n    }\n    if (!ensurePasswordPolicy(password)) return\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { $or: [{ email }, { emailHash: { $in: emailHashLookupValues(email) } }] } as any,\n      undefined,\n      { tenantId: null, organizationId: null },\n    )\n\n    if (!user) {\n      console.error(`User with email \"${email}\" not found`)\n      return\n    }\n\n    user.passwordHash = await hash(password, 10)\n    await em.persist(user).flush()\n\n    console.log(`\u2705 Password updated successfully for user: ${email}`)\n  },\n}\n\nconst syncRoleAcls: ModuleCli = {\n  command: 'sync-role-acls',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    const flags = new Set<string>()\n    for (let i = 0; i < rest.length; i++) {\n      const token = rest[i]\n      if (!token?.startsWith('--')) continue\n      const key = token.replace(/^--/, '')\n      const next = rest[i + 1]\n      if (next && !next.startsWith('--')) {\n        args[key] = next\n        i++\n      } else {\n        flags.add(key)\n      }\n    }\n    const tenantArg = args.tenantId ?? args.tenant ?? args.tenant_id ?? null\n    const includeSuperadminRole = !flags.has('no-superadmin')\n\n    const modules = getCliModules()\n    if (!modules.length) {\n      console.error('\u274C No CLI modules registered. Run `yarn generate` first.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n\n    const targetTenantIds: string[] = []\n    if (tenantArg) {\n      const normalized = normalizeTenantId(tenantArg)\n      if (!normalized) {\n        console.error(`\u274C Invalid --tenant value: ${tenantArg}`)\n        return\n      }\n      const tenant = await em.findOne(Tenant, { id: normalized })\n      if (!tenant) {\n        console.error(`\u274C Tenant not found: ${normalized}`)\n        return\n      }\n      targetTenantIds.push(normalized)\n    } else {\n      const tenants = await em.find(Tenant, {})\n      if (!tenants.length) {\n        console.log('No tenants found; nothing to sync.')\n        return\n      }\n      for (const tenant of tenants) {\n        const id = tenant.id ? String(tenant.id) : null\n        if (id) targetTenantIds.push(id)\n      }\n    }\n\n    for (const tenantId of targetTenantIds) {\n      await ensureDefaultRoleAcls(em, tenantId, modules, { includeSuperadminRole })\n      await ensureCustomRoleAcls(em, tenantId, modules)\n      console.log(`\u2705 Synced role ACLs for tenant ${tenantId}`)\n    }\n  },\n}\n\n// Export the full CLI list\nexport default [addUser, seedRoles, syncRoleAcls, rotateEncryptionKey, addOrganization, setupApp, listOrganizations, listTenants, listUsers, setPassword]\n"],
-  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,kBAAkB,0BAA0B;AACrD,SAAS,8BAA8B;AACvC,SAAS,YAAY;AAErB,SAAS,MAAM,MAAM,gBAAgB;AACrC,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,aAAa,oBAAoB,uBAAuB,sBAAsB,oBAAoB,wCAAwC;AACnJ,SAAS,yBAAyB;AAClC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,qCAAqC;AAC9C,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,yBAAyB;AAClC,SAAS,WAAW;AAEpB,OAAO,YAAY;AACnB,SAAS,4BAA4B,mBAAmB,wBAAwB;AAChF,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAE9B,eAAe,wBAAwB,IAAS,MAAc,oBAAmC;AAC/F,QAAM,WAAW,MAAM,GAAG,QAAQ,MAAM,EAAE,MAAM,UAAU,mBAAmB,CAAC;AAC9E,MAAI,SAAU,QAAO;AACrB,QAAM,OAAO,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,oBAAoB,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC1F,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,SAAO;AACT;AAEA,MAAM,UAAqB;AAAA,EACzB,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AACA,UAAM,QAAQ,KAAK;AACnB,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,KAAK,kBAAkB,KAAK,SAAS,KAAK,GAAG;AAC3E,UAAM,YAAY,KAAK,SAAS,IAAI,KAAK;AACzC,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,gBAAgB;AAC1C,cAAQ,MAAM,sHAAsH;AACpI;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB,QAAQ,EAAG;AACrC,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,MACH,MAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA,EAAE,IAAI,eAAe;AAAA,MACrB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,eAAe;AAAA,IACnC,KAAM;AACR,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,wBAAwB;AAClD,UAAM,cAAc,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,EAAE,IAAI;AAC7D,UAAM,qBAAqB,kBAAkB,eAAe,IAAI,KAAK;AACrE,UAAM,IAAI,GAAG,OAAO,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,iBAAiB,KAAK;AAAA,MACjC,cAAc,MAAM,KAAK,UAAU,EAAE;AAAA,MACrC,aAAa;AAAA,MACb,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI,OAAO;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,QAAQ,CAAC,EAAE,MAAM;AAC1B,QAAI,UAAU;AACZ,YAAM,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACnE,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAO,MAAM,wBAAwB,IAAI,MAAM,kBAAkB;AACvE,cAAM,OAAO,GAAG,OAAO,UAAU,EAAE,MAAM,GAAG,KAAK,CAAC;AAClD,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF;AACA,YAAQ,IAAI,wBAAwB,EAAE,EAAE;AAAA,EAC1C;AACF;AAEA,SAAS,UAAU,MAAgB;AACjC,QAAM,OAAyC,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,IAAI,GAAG;AACtB,YAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG;AAC7C,UAAI,MAAM,OAAW,MAAK,CAAC,IAAI;AAAA,eACtB,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAG,WAAW,IAAI,GAAG;AAAE,aAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAAI;AAAA,MAAI,MACjF,MAAK,CAAC,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAEA,SAAS,WAAW,OAAiD;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,kBAAkB,KAAK,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC/F;AAEA,SAAS,qBAAqB,UAA2B;AACvD,QAAM,SAAS,kBAAkB;AACjC,QAAM,SAAS,iBAAiB,UAAU,MAAM;AAChD,MAAI,OAAO,GAAI,QAAO;AACtB,QAAM,eAAe,2BAA2B,QAAQ,CAAC,MAAM,aAAa,QAAQ;AACpF,QAAM,SAAS,eAAe,KAAK,YAAY,KAAK;AACpD,UAAQ,MAAM,0CAA0C,MAAM,GAAG;AACjE,SAAO;AACT;AAEA,eAAe,4BAA+B,IAAkC;AAC9E,QAAM,WAAW,QAAQ,IAAI;AAC7B,UAAQ,IAAI,+BAA+B;AAC3C,MAAI;AACF,WAAO,MAAM,GAAG;AAAA,EAClB,UAAE;AACA,QAAI,aAAa,QAAW;AAC1B,aAAO,QAAQ,IAAI;AAAA,IACrB,OAAO;AACL,cAAQ,IAAI,+BAA+B;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,MAAM,qBAA2C;AAAA,EAE/C,YAAY,QAAgB;AAC1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,kBAAkB,MAAM,CAAC,EAAE,OAAO;AAAA,EACnF;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEA,SAAS,eAAe,KAAsC;AAC5D,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9E;AAEA,SAAS,kBACP,SACA,KACe;AACf,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,kBAAkB,SAAS,IAAI,GAAG;AAC3C;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,MAAM,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACtC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,UAAI,MAAO,MAAK,GAAG,IAAI;AAAA,IACzB;AACA,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa;AACnE,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AACtC,QAAI,UAAU;AACZ,YAAM,YAAY,IAAI,EAAE,SAAS,CAAC;AAClC,cAAQ,IAAI,4CAAgC,QAAQ;AACpD;AAAA,IACF;AACA,UAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AACxC,QAAI,CAAC,QAAQ,QAAQ;AACnB,cAAQ,IAAI,oCAAoC;AAChD;AAAA,IACF;AACA,eAAW,UAAU,SAAS;AAC5B,YAAM,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI;AAC3C,UAAI,CAAC,GAAI;AACT,YAAM,YAAY,IAAI,EAAE,UAAU,GAAG,CAAC;AACtC,cAAQ,IAAI,4CAAgC,EAAE;AAAA,IAChD;AAAA,EACF;AACF;AAEA,MAAM,sBAAiC;AAAA,EACrC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,WAAY,KAAK,YAAwB,KAAK,UAAsB,KAAK,aAAwB;AACvG,UAAM,iBAAkB,KAAK,kBAA8B,KAAK,SAAqB,KAAK,OAAkB;AAC5G,UAAM,SAAU,KAAK,SAAS,KAAiB,KAAK,UAAqB;AACzE,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAClD,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,UAAU,CAAC,UAAU;AACvB,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,MAAM,+CAA+C;AAC7D;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AACtC,UAAM,oBAAoB,IAAI,4BAA4B,IAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;AAChG,UAAM,SAAS,UAAU,SAAS,IAAI,qBAAqB,MAAM,IAAI;AACrE,QAAI,OAAO;AACT,cAAQ,IAAI,2BAA2B;AAAA,QACrC,WAAW,QAAQ,MAAM;AAAA,QACzB;AAAA,QACA,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,MACpC,CAAC;AACD,cAAQ,IAAI,4CAA4C;AAAA,QACtD,QAAQ,WAAW,MAAM;AAAA,QACzB,YAAY,WAAW,QAAQ,IAAI,mCAAmC;AAAA,MACxE,CAAC;AAAA,IACH;AACA,QAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,cAAQ,MAAM,wEAAwE;AACtF;AAAA,IACF;AACA,UAAM,OAAa,GAAW,gBAAgB;AAC9C,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,4CAA4C;AAC1D;AAAA,IACF;AACA,UAAM,OAAQ,IAAY,cAAc,GAAG,MAAM,IAAI;AACrD,UAAM,YAAY,MAAM,aAAa;AACrC,UAAM,SAAS,MAAM;AACrB,UAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,UAAM,qBAAqB,CAAC,UAA4B;AACtD,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,aAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAAA,IAC5C;AACA,UAAM,aAAa,oBAAI,IAAY;AACnC,UAAM,cAAc,oBAAI,IAA8B;AACtD,UAAM,eAAe,OAAO,eAAuB,wBAAiD;AAClG,UAAI,SAAS,CAAC,WAAW,IAAI,aAAa,GAAG;AAC3C,mBAAW,IAAI,aAAa;AAC5B,cAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,UACzC,QAAQ,aAAa,aAAa,KAAK,QAAQ,QAAQ,IAAI;AAAA,UAC3D,kBAAkB,OAAO,aAAa;AAAA,QACxC,CAAC;AACD,gBAAQ,IAAI,4CAA4C;AAAA,UACtD,UAAU;AAAA,UACV,QAAQ,eAAe,MAAM;AAAA,UAC7B,YAAY,eAAe,MAAM;AAAA,QACnC,CAAC;AAAA,MACH;AACA,YAAM,UAAU,MAAM,KAAK;AAAA,QACzB,qCAAqC,cAAc;AAAA,QACnD,CAAC,eAAe,mBAAmB;AAAA,MACrC;AACA,YAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC;AACjD,YAAM,UAAU,SACZ,OACA,KAAK,OAAO,CAAC,QAAa,CAAC,mBAAmB,KAAK,KAAK,CAAC;AAC7D,UAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,cAAQ;AAAA,QACN,SAAS,QAAQ,MAAM,yCAAyC,mBAAmB,GAAG,SAAS,eAAe,EAAE;AAAA,MAClH;AACA,UAAI,OAAQ,QAAO;AACnB,YAAM,MAAM,QAAQ,IAAI,CAAC,QAAa,OAAO,IAAI,EAAE,CAAC;AACpD,YAAM,QAAQ,SACV,MAAM,GAAG;AAAA,QACT;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,MACnF,IACE,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,QACjF,CAAC;AAAA,QACD,EAAE,UAAU,eAAe,gBAAgB,qBAAqB,kBAAkB;AAAA,MACpF;AACF,YAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACtE,UAAI,UAAU;AACd,iBAAW,OAAO,SAAS;AACzB,cAAM,OAAO,UAAU,IAAI,OAAO,IAAI,EAAE,CAAC;AACzC,YAAI,CAAC,KAAM;AACX,cAAM,WAAW,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,OAAO,IAAI,SAAS,EAAE;AACnF,YAAI,CAAC,SAAU;AACf,YAAI,WAAW,CAAC,mBAAmB,QAAQ,KAAK,CAAC,SAAS;AACxD;AAAA,QACF;AACA,YAAI,aAAa;AACjB,YAAI,UAAU,mBAAmB,QAAQ,KAAK,QAAQ;AACpD,cAAI,OAAO;AACT,oBAAQ,IAAI,sCAAsC;AAAA,cAChD,QAAQ,IAAI;AAAA,cACZ,UAAU;AAAA,cACV,gBAAgB;AAAA,YAClB,CAAC;AAAA,UACH;AACA,cAAI,SAAS,YAAY,IAAI,aAAa,KAAK;AAC/C,cAAI,CAAC,YAAY,IAAI,aAAa,GAAG;AACnC,qBAAS,MAAM,OAAO,aAAa,aAAa;AAChD,wBAAY,IAAI,eAAe,MAAM;AAAA,UACvC;AACA,gBAAM,aAAa,kBAAkB,UAAU,MAAM;AACrD,cAAI,OAAO,eAAe,YAAY,mBAAmB,UAAU,EAAG;AACtE,uBAAa;AAAA,QACf;AACA,YAAI,CAAC,WAAY;AACjB,cAAM,YAAY,MAAM,kBAAkB;AAAA,UACxC;AAAA,UACA,EAAE,OAAO,WAAW;AAAA,UACpB;AAAA,UACA;AAAA,QACF;AACA,cAAM,YAAY,UAAU;AAC5B,YAAI,aAAa,cAAc,KAAK,OAAO;AACzC,eAAK,QAAQ;AACb,eAAK,YAAa,UAAkB,aAAa,iBAAiB,UAAU;AAC5E,aAAG,QAAQ,IAAI;AACf,qBAAW;AAAA,QACb;AAAA,MACF;AACA,UAAI,UAAU,GAAG;AACf,cAAM,GAAG,MAAM;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,QAAI,YAAY,gBAAgB;AAC9B,YAAM,UAAU,MAAM,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3E,UAAI,CAAC,SAAS;AACZ,gBAAQ,IAAI,gEAAgE;AAAA,MAC9E,OAAO;AACL,gBAAQ,IAAI,aAAa,OAAO,sBAAsB;AAAA,MACxD;AACA;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAM,GAAG,KAAK,cAAc,CAAC,CAAC;AACpD,QAAI,CAAC,cAAc,QAAQ;AACzB,cAAQ,IAAI,6CAA6C;AACzD;AAAA,IACF;AACA,QAAI,QAAQ;AACZ,eAAW,OAAO,eAAe;AAC/B,YAAM,gBAAgB,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,EAAE,IAAI;AACvG,YAAM,sBAAsB,IAAI,KAAK,OAAO,IAAI,EAAE,IAAI;AACtD,UAAI,CAAC,iBAAiB,CAAC,oBAAqB;AAC5C,eAAS,MAAM,aAAa,eAAe,mBAAmB;AAAA,IAChE;AACA,QAAI,QAAQ,GAAG;AACb,cAAQ,IAAI,aAAa,KAAK,+CAA+C;AAAA,IAC/E,OAAO;AACL,cAAQ,IAAI,kEAAkE;AAAA,IAChF;AAAA,EACF;AACF;AAIA,MAAM,kBAA6B;AAAA,EACjC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AACA,UAAM,OAAO,KAAK,QAAQ,KAAK;AAC/B,QAAI,CAAC,MAAM;AACT,cAAQ,MAAM,wDAAwD;AACtE;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AAEvB,UAAM,SAAS,GAAG,OAAO,QAAQ,EAAE,MAAM,GAAG,IAAI,UAAU,CAAC;AAC3D,UAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,UAAM,MAAM,GAAG,OAAO,cAAc,EAAE,MAAM,OAAO,CAAC;AACpD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAM,0BAA0B,IAAI,OAAO,OAAO,EAAE,CAAC;AACrD,YAAQ,IAAI,gCAAgC,IAAI,IAAI,aAAa,OAAO,EAAE;AAAA,EAC5E;AACF;AAEA,MAAM,cAAc;AAEpB,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,UAAU,OAAO,KAAK,YAAY,WACpC,KAAK,UACL,OAAO,KAAK,SAAS,WACnB,KAAK,OACL;AACN,UAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAC5D,UAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACrE,UAAM,aAAa,OAAO,KAAK,YAAY,WACvC,KAAK,UACL,OAAO,KAAK,SAAS,WACnB,KAAK,OACL;AACN,UAAM,UAAU,cAAc,WAAW,KAAK,EAAE,SAAS,WAAW,KAAK,IAAI;AAC7E,QAAI,YAAY,UAAa,CAAC,iBAAiB,KAAK,OAAO,GAAG;AAC5D,cAAQ,OAAO,MAAM,iCAAiC,iBAAiB,MAAM;AAAA,CAA6E;AAC1J,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,WAAW,OAAO,KAAK,UAAU,WACnC,KAAK,MAAM,KAAK,IAChB;AACJ,UAAM,wBACJ,KAAK,sBAAsB,KAC3B,KAAK,sBACL,KAAK,qBAAqB,KAC1B,KAAK;AACP,UAAM,qBAAqB,OAAO,0BAA0B,YACxD,wBACA,kBAAkB,OAAO,0BAA0B,WAAW,wBAAwB,IAAI,KAAK;AACnG,UAAM,kBAAkB,KAAK,eAAe,KAAK,KAAK;AACtD,UAAM,eAAe,OAAO,oBAAoB,YAC5C,kBACA,kBAAkB,OAAO,oBAAoB,WAAW,kBAAkB,IAAI,KAAK;AACvF,UAAM,sBAAsB,KAAK,oBAAoB,KAAK,KAAK;AAC/D,UAAM,mBAAmB,OAAO,wBAAwB,YACpD,sBACA,kBAAkB,OAAO,wBAAwB,WAAW,sBAAsB,IAAI,KAAK;AAC/F,UAAM,cAAc,KAAK;AACzB,UAAM,WAAW,OAAO,gBAAgB,YACpC,cACA,kBAAkB,OAAO,gBAAgB,WAAW,cAAc,IAAI,KAAK;AAC/E,QAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU;AACnC,cAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AACvC,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,CAAC,sBAAsB,CAAC,qBAAqB,QAAQ,GAAG;AAC1D,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,sBAAsB,CAAC,UAAU;AACnC,cAAQ,KAAK,6DAAmD;AAAA,IAClE;AACA,QAAI,iBAAsC;AAC1C,QAAI,UAAU;AASZ,cAAQ,IAAI,eAAe,QAAQ,IAAI,gBAAgB;AACvD,YAAM,cAAc,QAAQ;AAC5B,YAAM,eAAe,QAAQ;AAC7B,cAAQ,MAAM,MAAM;AACpB,cAAQ,OAAO,MAAM;AACrB,YAAM,mBAAmB,QAAQ,IAAI,gBAAgB;AACrD,cAAQ,IAAI,gBAAgB,IAAI;AAChC,yBAAmB;AACnB,6BAAuB;AACvB,uBAAiB,MAAM;AACrB,gBAAQ,MAAM;AACd,gBAAQ,OAAO;AACf,YAAI,qBAAqB,OAAW,QAAO,QAAQ,IAAI,gBAAgB;AAAA,YAClE,SAAQ,IAAI,gBAAgB,IAAI;AACrC,2BAAmB;AACnB,+BAAuB;AAAA,MACzB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,YAAY,WACd,SAAS,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACvD;AAEJ,QAAI;AACF,YAAM,UAAU,cAAc;AAC9B,YAAM,SAAS,MAAM,mBAAmB,IAAI;AAAA,QAC1C;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,EAAE,OAAO,UAAU,SAAS,KAAK;AAAA;AAAA;AAAA;AAAA,QAI9C,qBAAqB;AAAA;AAAA;AAAA;AAAA,QAIrB,2BAA2B;AAAA;AAAA;AAAA;AAAA,QAI3B,kBAAkB,YAAY;AAAA,QAC9B;AAAA,MACF,CAAC;AAED,UAAI,cAAc;AAChB,cAAM,UAAU;AAAA,UACd;AAAA,UACA,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB;AAAA,QACF;AACA,mBAAW,OAAO,SAAS;AACzB,cAAI,IAAI,OAAO,cAAc;AAC3B,kBAAM,IAAI,MAAM,aAAa,OAAc;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,cAAM,gBAAgB,kBAAkB,OAAO,OAAO,KAAK;AAC3D,cAAM,cAAc,iBAAiB,cAAc,KAAK,MAAM,OAC1D,OAAO,cAAc,KAAK,EAAE,IAC5B;AACJ,cAAM,UAAU;AAAA,UACd,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB;AAAA,UACA,YAAY;AAAA,UACZ,oBAAoB,OAAO;AAAA,QAC7B;AACA,YAAI,eAAgB,gBAAe;AACnC,gBAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,CAAI;AACnD;AAAA,MACF;AAEA,UAAI,OAAO,oBAAoB;AAC7B,gBAAQ,IAAI,4DAAkD;AAC9D,gBAAQ,IAAI,wBAAc,KAAK,EAAE;AACjC,gBAAQ,IAAI,wEAA8D;AAAA,MAC5E;AAEA,UAAI,IAAI,aAAa,QAAQ;AAC3B,mBAAW,YAAY,OAAO,OAAO;AACnC,cAAI,SAAS,SAAS;AACpB,gBAAI,SAAS,mBAAmB;AAC9B,sBAAQ,IAAI,kFAAmE;AAC/E,sBAAQ,IAAI,0BAAmB,SAAS,KAAK,OAAO,aAAa,SAAS,iBAAiB;AAAA,YAC7F,OAAO;AACL,sBAAQ,IAAI,0BAAmB,SAAS,KAAK,KAAK;AAAA,YACpD;AAAA,UACF,OAAO;AACL,oBAAQ,IAAI,gBAAgB,SAAS,KAAK,KAAK,EAAE;AAAA,UACnD;AAAA,QACF;AAAA,MACF;AAEA,UAAI,IAAI,aAAa,OAAQ,SAAQ,IAAI,0BAAqB,EAAE,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe,CAAC;AAAA,IACpI,SAAS,KAAK;AACZ,UAAI,eAAgB,gBAAe;AACnC,UAAI,eAAe,oBAAoB;AACrC,gBAAQ,OAAO,MAAM,GAAG,IAAI,OAAO;AAAA,CAAI;AACvC,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,UAAI,eAAe,kCAAkC;AACnD,gBAAQ,OAAO;AAAA,UACb,kBAAkB,IAAI,OAAO;AAAA;AAAA,QAC/B;AACA,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,UAAI,eAAe,SAAS,IAAI,YAAY,eAAe;AACzD,gBAAQ,OAAO,MAAM,+DAA+D;AACpF,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,YAAM;AAAA,IACR,UAAE;AACA,UAAI,eAAgB,gBAAe;AAAA,IACrC;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB;AAEzB,SAAS,kBACP,OACA,YACqD;AACrD,QAAM,kBAAkB,WAAW,YAAY;AAC/C,QAAM,QAAQ,MAAM;AAAA,IAClB,CAAC,aACC,SAAS,WACT,SAAS,MAAM,SAAS,YAAY,KACpC,OAAO,SAAS,KAAK,UAAU,YAC/B,SAAS,KAAK,MAAM,YAAY,MAAM;AAAA,EAC1C;AACA,MAAI,MAAO,QAAO;AAClB,SAAO,MAAM,KAAK,CAAC,aAAa,SAAS,MAAM,SAAS,YAAY,CAAC;AACvE;AAEA,MAAM,oBAA+B;AAAA,EACnC,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAEA,QAAI,KAAK,WAAW,GAAG;AACrB,cAAQ,IAAI,wBAAwB;AACpC;AAAA,IACF;AAEA,YAAQ,IAAI,SAAS,KAAK,MAAM,mBAAmB;AACnD,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,iHAAiH;AAC7H,YAAQ,IAAI,2HAA2H;AAEvI,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,IAAI,YAAY,IAAI,KAAK,IAAI,SAAS,EAAE,mBAAmB,IAAI;AAC/E,YAAM,KAAK,IAAI,MAAM;AACrB,YAAM,WAAW,IAAI,QAAQ,MAAM;AACnC,YAAM,QAAQ,IAAI,QAAQ,WAAW,OAAO,EAAE;AAC9C,cAAQ,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,IAAI,MAAM,SAAS,OAAO,EAAE,CAAC,MAAM,OAAO,EAAE;AAAA,IAChF;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AAExC,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,kBAAkB;AAC9B;AAAA,IACF;AAEA,YAAQ,IAAI,SAAS,QAAQ,MAAM,aAAa;AAChD,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,0EAA0E;AACtF,YAAQ,IAAI,qFAAqF;AAEjG,eAAW,UAAU,SAAS;AAC5B,YAAM,UAAU,OAAO,YAAY,IAAI,KAAK,OAAO,SAAS,EAAE,mBAAmB,IAAI;AACrF,YAAM,KAAK,OAAO,MAAM;AACxB,YAAM,QAAQ,OAAO,QAAQ,WAAW,OAAO,EAAE;AACjD,cAAQ,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,IAAI,MAAM,OAAO,EAAE;AAAA,IACvD;AAAA,EACF;AACF;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AAGvB,UAAM,QAAa,CAAC;AACpB,QAAI,KAAK,kBAAkB,KAAK,SAAS,KAAK,KAAK;AACjD,YAAM,iBAAiB,KAAK,kBAAkB,KAAK,SAAS,KAAK;AAAA,IACnE;AACA,QAAI,KAAK,YAAY,KAAK,QAAQ;AAChC,YAAM,WAAW,KAAK,YAAY,KAAK;AAAA,IACzC;AAEA,UAAM,QAAQ,MAAM,GAAG,KAAK,MAAM,KAAK;AAEvC,QAAI,MAAM,WAAW,GAAG;AACtB,cAAQ,IAAI,gBAAgB;AAC5B;AAAA,IACF;AAEA,YAAQ,IAAI,SAAS,MAAM,MAAM,WAAW;AAC5C,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,gJAAgJ;AAC5J,YAAQ,IAAI,2JAA2J;AAEvK,eAAW,QAAQ,OAAO;AAExB,YAAM,YAAY,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,MAAM,KAAK,GAAG;AAAA,QAChB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,QACrB,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,MACjF;AACA,YAAM,QAAQ,UAAU,IAAI,CAAC,OAAY,GAAG,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK;AAGtF,UAAI,UAAU;AACd,UAAI,aAAa;AAEjB,UAAI,KAAK,gBAAgB;AACvB,cAAM,MAAM,MAAM,GAAG,QAAQ,cAAc,EAAE,IAAI,KAAK,eAAe,CAAC;AACtE,kBAAU,KAAK,OAAO,GAAG,IAAI,KAAK,UAAU,GAAG,EAAE,CAAC,QAAQ,GAAG,KAAK,eAAe,UAAU,GAAG,CAAC,CAAC;AAAA,MAClG;AAEA,UAAI,KAAK,UAAU;AACjB,cAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC;AAC7D,qBAAa,QAAQ,OAAO,GAAG,OAAO,KAAK,UAAU,GAAG,EAAE,CAAC,QAAQ,GAAG,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC;AAAA,MACrG;AAEA,YAAM,KAAK,KAAK,MAAM;AACtB,YAAM,SAAS,KAAK,SAAS,OAAO,OAAO,EAAE;AAC7C,YAAM,QAAQ,KAAK,QAAQ,WAAW,OAAO,EAAE;AAE/C,cAAQ,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,CAAC,MAAM,WAAW,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE;AAAA,IACnH;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AAEA,UAAM,QAAQ,KAAK;AACnB,UAAM,WAAW,KAAK;AAEtB,QAAI,CAAC,SAAS,CAAC,UAAU;AACvB,cAAQ,MAAM,2EAA2E;AACzF;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB,QAAQ,EAAG;AAErC,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,sBAAsB,KAAK,EAAE,EAAE,CAAC,EAAE;AAAA,MACzE;AAAA,MACA,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAEA,QAAI,CAAC,MAAM;AACT,cAAQ,MAAM,oBAAoB,KAAK,aAAa;AACpD;AAAA,IACF;AAEA,SAAK,eAAe,MAAM,KAAK,UAAU,EAAE;AAC3C,UAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAE7B,YAAQ,IAAI,kDAA6C,KAAK,EAAE;AAAA,EAClE;AACF;AAEA,MAAM,eAA0B;AAAA,EAC9B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,UAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,QAAQ,KAAK,CAAC;AACpB,UAAI,CAAC,OAAO,WAAW,IAAI,EAAG;AAC9B,YAAM,MAAM,MAAM,QAAQ,OAAO,EAAE;AACnC,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,QAAQ,CAAC,KAAK,WAAW,IAAI,GAAG;AAClC,aAAK,GAAG,IAAI;AACZ;AAAA,MACF,OAAO;AACL,cAAM,IAAI,GAAG;AAAA,MACf;AAAA,IACF;AACA,UAAM,YAAY,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa;AACpE,UAAM,wBAAwB,CAAC,MAAM,IAAI,eAAe;AAExD,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,QAAQ,QAAQ;AACnB,cAAQ,MAAM,8DAAyD;AACvE;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AAEtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,WAAW;AACb,YAAM,aAAa,kBAAkB,SAAS;AAC9C,UAAI,CAAC,YAAY;AACf,gBAAQ,MAAM,kCAA6B,SAAS,EAAE;AACtD;AAAA,MACF;AACA,YAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,CAAC;AAC1D,UAAI,CAAC,QAAQ;AACX,gBAAQ,MAAM,4BAAuB,UAAU,EAAE;AACjD;AAAA,MACF;AACA,sBAAgB,KAAK,UAAU;AAAA,IACjC,OAAO;AACL,YAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AACxC,UAAI,CAAC,QAAQ,QAAQ;AACnB,gBAAQ,IAAI,oCAAoC;AAChD;AAAA,MACF;AACA,iBAAW,UAAU,SAAS;AAC5B,cAAM,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI;AAC3C,YAAI,GAAI,iBAAgB,KAAK,EAAE;AAAA,MACjC;AAAA,IACF;AAEA,eAAW,YAAY,iBAAiB;AACtC,YAAM,sBAAsB,IAAI,UAAU,SAAS,EAAE,sBAAsB,CAAC;AAC5E,YAAM,qBAAqB,IAAI,UAAU,OAAO;AAChD,cAAQ,IAAI,sCAAiC,QAAQ,EAAE;AAAA,IACzD;AAAA,EACF;AACF;AAGA,IAAO,cAAQ,CAAC,SAAS,WAAW,cAAc,qBAAqB,iBAAiB,UAAU,mBAAmB,aAAa,WAAW,WAAW;",
+  "sourcesContent": ["import type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { OM_LOG_LEVEL_ENV, resetLogLevelCache } from '@open-mercato/shared/lib/logger'\nimport { resetServerLoggerCache } from '@open-mercato/shared/lib/logger'\nimport { hash } from 'bcryptjs'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'\nimport { normalizeTenantId } from './lib/tenantAccess'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport { computeEmailHash, emailHashLookupValues } from './lib/emailHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { env } from 'process'\nimport type { KmsService, TenantDek } from '@open-mercato/shared/lib/encryption/kms'\nimport crypto from 'node:crypto'\nimport { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { getCliModules } from '@open-mercato/shared/modules/registry'\n\nasync function resolveTenantScopedRole(em: any, name: string, normalizedTenantId: string | null) {\n  const existing = await em.findOne(Role, { name, tenantId: normalizedTenantId })\n  if (existing) return existing\n  const role = em.create(Role, { name, tenantId: normalizedTenantId, createdAt: new Date() })\n  await em.persist(role).flush()\n  return role\n}\n\nconst addUser: ModuleCli = {\n  command: 'add-user',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n    const email = args.email\n    const password = args.password\n    const organizationId = String(args.organizationId ?? args.orgId ?? args.org)\n    const rolesCsv = (args.roles ?? '').trim()\n    if (!email || !password || !organizationId) {\n      console.error('Usage: mercato auth add-user --email <email> --password <password> --organizationId <id> [--roles customer,employee]')\n      return\n    }\n    if (!ensurePasswordPolicy(password)) return\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const org =\n      (await findOneWithDecryption(\n        em,\n        Organization,\n        { id: organizationId },\n        { populate: ['tenant'] },\n        { tenantId: null, organizationId },\n      )) ?? null\n    if (!org) throw new Error('Organization not found')\n    const orgTenantId = org.tenant?.id ? String(org.tenant.id) : null\n    const normalizedTenantId = normalizeTenantId(orgTenantId ?? null) ?? null\n    const u = em.create(User, {\n      email,\n      emailHash: computeEmailHash(email),\n      passwordHash: await hash(password, 10),\n      isConfirmed: true,\n      organizationId: org.id,\n      tenantId: org.tenant.id,\n    })\n    await em.persist(u).flush()\n    if (rolesCsv) {\n      const names = parseCommaSeparatedList(rolesCsv)\n      for (const name of names) {\n        const role = await resolveTenantScopedRole(em, name, normalizedTenantId)\n        const link = em.create(UserRole, { user: u, role })\n        await em.persist(link).flush()\n      }\n    }\n    console.log('User created with id', u.id)\n  },\n}\n\nfunction parseArgs(rest: string[]) {\n  const args: Record<string, string | boolean> = {}\n  for (let i = 0; i < rest.length; i++) {\n    const a = rest[i]\n    if (!a) continue\n    if (a.startsWith('--')) {\n      const [k, v] = a.replace(/^--/, '').split('=')\n      if (v !== undefined) args[k] = v\n      else if (rest[i + 1] && !rest[i + 1]!.startsWith('--')) { args[k] = rest[i + 1]!; i++ }\n      else args[k] = true\n    }\n  }\n  return args\n}\n\nfunction normalizeKeyInput(value: string): string {\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\nfunction hashSecret(value: string | null | undefined): string | null {\n  if (!value) return null\n  return crypto.createHash('sha256').update(normalizeKeyInput(value)).digest('hex').slice(0, 12)\n}\n\nfunction ensurePasswordPolicy(password: string): boolean {\n  const policy = getPasswordPolicy()\n  const result = validatePassword(password, policy)\n  if (result.ok) return true\n  const requirements = formatPasswordRequirements(policy, (_key, fallback) => fallback)\n  const suffix = requirements ? `: ${requirements}` : ''\n  console.error(`Password does not meet the requirements${suffix}.`)\n  return false\n}\n\nasync function withEncryptionDebugDisabled<T>(fn: () => Promise<T>): Promise<T> {\n  const previous = process.env.TENANT_DATA_ENCRYPTION_DEBUG\n  process.env.TENANT_DATA_ENCRYPTION_DEBUG = 'no'\n  try {\n    return await fn()\n  } finally {\n    if (previous === undefined) {\n      delete process.env.TENANT_DATA_ENCRYPTION_DEBUG\n    } else {\n      process.env.TENANT_DATA_ENCRYPTION_DEBUG = previous\n    }\n  }\n}\n\nclass DerivedKeyKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    this.root = crypto.createHash('sha256').update(normalizeKeyInput(secret)).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nfunction fingerprintDek(dek: TenantDek | null): string | null {\n  if (!dek?.key) return null\n  return crypto.createHash('sha256').update(dek.key).digest('hex').slice(0, 12)\n}\n\nfunction decryptWithOldKey(\n  payload: string,\n  dek: TenantDek | null,\n): string | null {\n  if (!dek?.key) return null\n  return decryptWithAesGcm(payload, dek.key)\n}\n\nconst seedRoles: ModuleCli = {\n  command: 'seed-roles',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const key = rest[i]?.replace(/^--/, '')\n      if (!key) continue\n      const value = rest[i + 1]\n      if (value) args[key] = value\n    }\n    const tenantId = args.tenantId ?? args.tenant ?? args.tenant_id ?? null\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n    if (tenantId) {\n      await ensureRoles(em, { tenantId })\n      console.log('\uD83D\uDEE1\uFE0F Roles ensured for tenant', tenantId)\n      return\n    }\n    const tenants = await em.find(Tenant, {})\n    if (!tenants.length) {\n      console.log('No tenants found; nothing to seed.')\n      return\n    }\n    for (const tenant of tenants) {\n      const id = tenant.id ? String(tenant.id) : null\n      if (!id) continue\n      await ensureRoles(em, { tenantId: id })\n      console.log('\uD83D\uDEE1\uFE0F Roles ensured for tenant', id)\n    }\n  },\n}\n\nconst rotateEncryptionKey: ModuleCli = {\n  command: 'rotate-encryption-key',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantId = (args.tenantId as string) ?? (args.tenant as string) ?? (args.tenant_id as string) ?? null\n    const organizationId = (args.organizationId as string) ?? (args.orgId as string) ?? (args.org as string) ?? null\n    const oldKey = (args['old-key'] as string) ?? (args.oldKey as string) ?? null\n    const dryRun = Boolean(args['dry-run'] || args.dry)\n    const debug = Boolean(args.debug)\n    const rotate = Boolean(oldKey)\n    if (rotate && !tenantId) {\n      console.warn(\n        '\u26A0\uFE0F  Rotating with --old-key across all tenants. A single old key should normally target one tenant; consider --tenant.',\n      )\n    }\n    if (!isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting.')\n      return\n    }\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n    const encryptionService = new TenantDataEncryptionService(em as any, { kms: createKmsService() })\n    const oldKms = rotate && oldKey ? new DerivedKeyKmsService(oldKey) : null\n    if (debug) {\n      console.log('[rotate-encryption-key]', {\n        hasOldKey: Boolean(oldKey),\n        rotate,\n        tenantId: tenantId ?? null,\n        organizationId: organizationId ?? null,\n      })\n      console.log('[rotate-encryption-key] key fingerprints', {\n        oldKey: hashSecret(oldKey),\n        currentKey: hashSecret(process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY),\n      })\n    }\n    if (!encryptionService.isEnabled()) {\n      console.error('Encryption service is not enabled (KMS unhealthy or no DEK). Aborting.')\n      return\n    }\n    const conn: any = (em as any).getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw connection; aborting.')\n      return\n    }\n    const meta = (em as any)?.getMetadata?.()?.get?.(User)\n    const tableName = meta?.tableName || 'users'\n    const schema = meta?.schema\n    const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n    const isEncryptedPayload = (value: unknown): boolean => {\n      if (typeof value !== 'string') return false\n      const parts = value.split(':')\n      return parts.length === 4 && parts[3] === 'v1'\n    }\n    const printedDek = new Set<string>()\n    const oldDekCache = new Map<string, TenantDek | null>()\n    const processScope = async (scopeTenantId: string, scopeOrganizationId: string): Promise<number> => {\n      if (debug && !printedDek.has(scopeTenantId)) {\n        printedDek.add(scopeTenantId)\n        const [oldDek, newDek] = await Promise.all([\n          oldKms?.getTenantDek(scopeTenantId) ?? Promise.resolve(null),\n          encryptionService.getDek(scopeTenantId),\n        ])\n        console.log('[rotate-encryption-key] dek fingerprints', {\n          tenantId: scopeTenantId,\n          oldKey: fingerprintDek(oldDek),\n          currentKey: fingerprintDek(newDek),\n        })\n      }\n      const rawRows = await conn.execute(\n        `select id, email, email_hash from ${qualifiedTable} where tenant_id = ? and organization_id = ?`,\n        [scopeTenantId, scopeOrganizationId],\n      )\n      const rows = Array.isArray(rawRows) ? rawRows : []\n      const pending = rotate\n        ? rows\n        : rows.filter((row: any) => !isEncryptedPayload(row?.email))\n      if (!pending.length) return 0\n      console.log(\n        `Found ${pending.length} auth user records to process for org=${scopeOrganizationId}${dryRun ? ' (dry-run)' : ''}.`\n      )\n      if (dryRun) return 0\n      const ids = pending.map((row: any) => String(row.id))\n      const users = rotate\n        ? await em.find(\n          User,\n          { id: { $in: ids }, tenantId: scopeTenantId, organizationId: scopeOrganizationId },\n        )\n        : await findWithDecryption(\n          em,\n          User,\n          { id: { $in: ids }, tenantId: scopeTenantId, organizationId: scopeOrganizationId },\n          {},\n          { tenantId: scopeTenantId, organizationId: scopeOrganizationId, encryptionService },\n        )\n      const usersById = new Map(users.map((user) => [String(user.id), user]))\n      let updated = 0\n      for (const row of pending) {\n        const user = usersById.get(String(row.id))\n        if (!user) continue\n        const rawEmail = typeof row.email === 'string' ? row.email : String(row.email ?? '')\n        if (!rawEmail) continue\n        if (rotate && (!isEncryptedPayload(rawEmail) || !oldKms)) {\n          continue\n        }\n        let plainEmail = rawEmail\n        if (rotate && isEncryptedPayload(rawEmail) && oldKms) {\n          if (debug) {\n            console.log('[rotate-encryption-key] decrypting', {\n              userId: row.id,\n              tenantId: scopeTenantId,\n              organizationId: scopeOrganizationId,\n            })\n          }\n          let oldDek = oldDekCache.get(scopeTenantId) ?? null\n          if (!oldDekCache.has(scopeTenantId)) {\n            oldDek = await oldKms.getTenantDek(scopeTenantId)\n            oldDekCache.set(scopeTenantId, oldDek)\n          }\n          const maybeEmail = decryptWithOldKey(rawEmail, oldDek)\n          if (typeof maybeEmail !== 'string' || isEncryptedPayload(maybeEmail)) continue\n          plainEmail = maybeEmail\n        }\n        if (!plainEmail) continue\n        const encrypted = await encryptionService.encryptEntityPayload(\n          'auth:user',\n          { email: plainEmail },\n          scopeTenantId,\n          scopeOrganizationId,\n        )\n        const nextEmail = encrypted.email as string | undefined\n        if (nextEmail && nextEmail !== user.email) {\n          user.email = nextEmail as any\n          user.emailHash = (encrypted as any).emailHash ?? computeEmailHash(plainEmail)\n          em.persist(user)\n          updated += 1\n        }\n      }\n      if (updated > 0) {\n        await em.flush()\n      }\n      return updated\n    }\n\n    if (tenantId && organizationId) {\n      const updated = await processScope(String(tenantId), String(organizationId))\n      if (!updated) {\n        console.log('All auth user emails already encrypted for the selected scope.')\n      } else {\n        console.log(`Encrypted ${updated} auth user email(s).`)\n      }\n      return\n    }\n\n    const organizations = await em.find(Organization, {})\n    if (!organizations.length) {\n      console.log('No organizations found; nothing to encrypt.')\n      return\n    }\n    let total = 0\n    for (const org of organizations) {\n      const scopeTenantId = org.tenant?.id ? String(org.tenant.id) : org.tenant.id ? String(org.tenant.id) : null\n      const scopeOrganizationId = org.id ? String(org.id) : null\n      if (!scopeTenantId || !scopeOrganizationId) continue\n      total += await processScope(scopeTenantId, scopeOrganizationId)\n    }\n    if (total > 0) {\n      console.log(`Encrypted ${total} auth user email(s) across all organizations.`)\n    } else {\n      console.log('All auth user emails already encrypted across all organizations.')\n    }\n  },\n}\n\n// will be exported at the bottom with all commands\n\nconst addOrganization: ModuleCli = {\n  command: 'add-org',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n    const name = args.name || args.orgName\n    if (!name) {\n      console.error('Usage: mercato auth add-org --name <organization name>')\n      return\n    }\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    // Create tenant implicitly for simplicity\n    const tenant = em.create(Tenant, { name: `${name} Tenant` })\n    await em.persist(tenant).flush()\n    const org = em.create(Organization, { name, tenant })\n    await em.persist(org).flush()\n    await rebuildHierarchyForTenant(em, String(tenant.id))\n    console.log('Organization created with id', org.id, 'in tenant', tenant.id)\n  },\n}\n\nconst SETUP_USAGE = 'Usage: mercato auth setup --orgName <name> --email <email> --password <password> [--orgSlug <slug>] [--roles superadmin,admin,employee] [--skip-password-policy] [--include-demo-users] [--with-examples] [--json]'\n\nconst setupApp: ModuleCli = {\n  command: 'setup',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const orgName = typeof args.orgName === 'string'\n      ? args.orgName\n      : typeof args.name === 'string'\n        ? args.name\n        : undefined\n    const email = typeof args.email === 'string' ? args.email : undefined\n    const password = typeof args.password === 'string' ? args.password : undefined\n    const orgSlugRaw = typeof args.orgSlug === 'string'\n      ? args.orgSlug\n      : typeof args.slug === 'string'\n        ? args.slug\n        : undefined\n    const orgSlug = orgSlugRaw && orgSlugRaw.trim().length ? orgSlugRaw.trim() : undefined\n    if (orgSlug !== undefined && !ORG_SLUG_PATTERN.test(orgSlug)) {\n      process.stderr.write(`Invalid --orgSlug: must match ${ORG_SLUG_PATTERN.source} (lowercase, digits, dashes; 1-63 chars; cannot start or end with a dash)\\n`)\n      process.exitCode = 2\n      return\n    }\n    const rolesCsv = typeof args.roles === 'string'\n      ? args.roles.trim()\n      : 'superadmin,admin,employee'\n    const skipPasswordPolicyRaw =\n      args['skip-password-policy'] ??\n      args.skipPasswordPolicy ??\n      args['allow-weak-password'] ??\n      args.allowWeakPassword\n    const skipPasswordPolicy = typeof skipPasswordPolicyRaw === 'boolean'\n      ? skipPasswordPolicyRaw\n      : parseBooleanToken(typeof skipPasswordPolicyRaw === 'string' ? skipPasswordPolicyRaw : null) ?? false\n    const withExamplesRaw = args['with-examples'] ?? args.withExamples\n    const withExamples = typeof withExamplesRaw === 'boolean'\n      ? withExamplesRaw\n      : parseBooleanToken(typeof withExamplesRaw === 'string' ? withExamplesRaw : null) ?? false\n    const includeDemoUsersRaw = args['include-demo-users'] ?? args.includeDemoUsers\n    const includeDemoUsers = typeof includeDemoUsersRaw === 'boolean'\n      ? includeDemoUsersRaw\n      : parseBooleanToken(typeof includeDemoUsersRaw === 'string' ? includeDemoUsersRaw : null) ?? false\n    const jsonModeRaw = args.json\n    const jsonMode = typeof jsonModeRaw === 'boolean'\n      ? jsonModeRaw\n      : parseBooleanToken(typeof jsonModeRaw === 'string' ? jsonModeRaw : null) ?? false\n    if (!orgName || !email || !password) {\n      process.stderr.write(`${SETUP_USAGE}\\n`)\n      process.exitCode = 2\n      return\n    }\n    if (!skipPasswordPolicy && !ensurePasswordPolicy(password)) {\n      process.exitCode = 2\n      return\n    }\n    if (skipPasswordPolicy && !jsonMode) {\n      console.warn('\u26A0\uFE0F  Password policy validation skipped for setup.')\n    }\n    let restoreConsole: (() => void) | null = null\n    if (jsonMode) {\n      // Force quiet mode so module bootstrap / lifecycle hooks cannot pollute\n      // stdout. The JSON contract relies on a single line, so any console.log\n      // from setupInitialTenant or seedExamples would otherwise break the\n      // consumer's `jq` pipe. We additionally rebind console.log/info to a\n      // no-op for the duration of the call because OM_CLI_QUIET is honored\n      // unevenly across module setup hooks. Rebind AFTER early-return\n      // validation so the missing-args and password-policy paths can't\n      // leak the rebinding into a long-lived process (e.g. test runner).\n      process.env.OM_CLI_QUIET = process.env.OM_CLI_QUIET ?? '1'\n      const originalLog = console.log\n      const originalInfo = console.info\n      console.log = () => undefined\n      console.info = () => undefined\n      const originalLogLevel = process.env[OM_LOG_LEVEL_ENV]\n      process.env[OM_LOG_LEVEL_ENV] = 'error'\n      resetLogLevelCache()\n      resetServerLoggerCache()\n      restoreConsole = () => {\n        console.log = originalLog\n        console.info = originalInfo\n        if (originalLogLevel === undefined) delete process.env[OM_LOG_LEVEL_ENV]\n        else process.env[OM_LOG_LEVEL_ENV] = originalLogLevel\n        resetLogLevelCache()\n        resetServerLoggerCache()\n      }\n    }\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const roleNames = rolesCsv\n      ? parseCommaSeparatedList(rolesCsv)\n      : undefined\n\n    try {\n      const modules = getCliModules()\n      const result = await setupInitialTenant(em, {\n        orgName,\n        orgSlug,\n        roleNames,\n        primaryUser: { email, password, confirm: true },\n        // Derived admin/employee demo accounts only land when the operator\n        // explicitly opts in via --include-demo-users. Default-deny prevents\n        // production deployments from silently seeding well-known emails.\n        includeDerivedUsers: includeDemoUsers,\n        // When demo users are explicitly requested, the operator has consented\n        // to having admin@/employee@ accounts created with autogenerated\n        // passwords (surfaced in stdout) when no env override is provided.\n        allowDemoDerivedPasswords: includeDemoUsers,\n        // When the caller passes an explicit slug, treat it as a \"fresh tenant\"\n        // signal \u2014 silent reuse of an existing user's tenant defeats the point\n        // of slugging the new tenant for downstream tooling.\n        failIfUserExists: orgSlug !== undefined,\n        modules,\n      })\n\n      if (withExamples) {\n        const seedCtx = {\n          em,\n          tenantId: result.tenantId,\n          organizationId: result.organizationId,\n          container,\n        }\n        for (const mod of modules) {\n          if (mod.setup?.seedExamples) {\n            await mod.setup.seedExamples(seedCtx as any)\n          }\n        }\n      }\n\n      if (jsonMode) {\n        const adminSnapshot = pickAdminSnapshot(result.users, email)\n        const adminUserId = adminSnapshot && adminSnapshot.user.id != null\n          ? String(adminSnapshot.user.id)\n          : null\n        const payload = {\n          tenantId: result.tenantId,\n          organizationId: result.organizationId,\n          adminUserId,\n          adminEmail: email,\n          reusedExistingUser: result.reusedExistingUser,\n        }\n        if (restoreConsole) restoreConsole()\n        process.stdout.write(`${JSON.stringify(payload)}\\n`)\n        return\n      }\n\n      if (result.reusedExistingUser) {\n        console.log('\u26A0\uFE0F  Existing initial user detected during setup.')\n        console.log(`\u26A0\uFE0F  Email: ${email}`)\n        console.log('\u26A0\uFE0F  Updated roles if missing and reused tenant/organization.')\n      }\n\n      if (env.NODE_ENV !== 'test') {\n        for (const snapshot of result.users) {\n          if (snapshot.created) {\n            if (snapshot.generatedPassword) {\n              console.log('\u26A0\uFE0F  GENERATED password \u2014 copy now; it is not stored in plain text')\n              console.log('\uD83C\uDF89 Created user', snapshot.user.email, 'password:', snapshot.generatedPassword)\n            } else {\n              console.log('\uD83C\uDF89 Created user', snapshot.user.email)\n            }\n          } else {\n            console.log(`Updated user ${snapshot.user.email}`)\n          }\n        }\n      }\n\n      if (env.NODE_ENV !== 'test') console.log('\u2705 Setup complete:', { tenantId: result.tenantId, organizationId: result.organizationId })\n    } catch (err) {\n      if (restoreConsole) restoreConsole()\n      if (err instanceof OrgSlugExistsError) {\n        process.stderr.write(`${err.message}\\n`)\n        process.exitCode = 1\n        return\n      }\n      if (err instanceof DerivedUserPasswordRequiredError) {\n        process.stderr.write(\n          `Setup aborted: ${err.message}. In production, set OM_INIT_ADMIN_PASSWORD and OM_INIT_EMPLOYEE_PASSWORD before passing --include-demo-users, or omit --include-demo-users to skip derived demo accounts entirely.\\n`,\n        )\n        process.exitCode = 2\n        return\n      }\n      if (err instanceof Error && err.message === 'USER_EXISTS') {\n        process.stderr.write('Setup aborted: user already exists with the provided email.\\n')\n        process.exitCode = 1\n        return\n      }\n      throw err\n    } finally {\n      if (restoreConsole) restoreConsole()\n    }\n  },\n}\n\nconst ORG_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/\n\nfunction pickAdminSnapshot(\n  users: Array<{ user: { id: string; email: string }; roles: string[]; created: boolean }>,\n  adminEmail: string,\n): { user: { id: string; email: string } } | undefined {\n  const normalizedEmail = adminEmail.toLowerCase()\n  const exact = users.find(\n    (snapshot) =>\n      snapshot.created &&\n      snapshot.roles.includes('superadmin') &&\n      typeof snapshot.user.email === 'string' &&\n      snapshot.user.email.toLowerCase() === normalizedEmail,\n  )\n  if (exact) return exact\n  return users.find((snapshot) => snapshot.roles.includes('superadmin'))\n}\n\nconst listOrganizations: ModuleCli = {\n  command: 'list-orgs',\n  async run() {\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const orgs = await findWithDecryption(\n      em,\n      Organization,\n      {},\n      { populate: ['tenant'] },\n      { tenantId: null, organizationId: null },\n    )\n\n    if (orgs.length === 0) {\n      console.log('No organizations found')\n      return\n    }\n\n    console.log(`Found ${orgs.length} organization(s):`)\n    console.log('')\n    console.log('ID                                   | Name                    | Tenant ID                            | Created')\n    console.log('-------------------------------------|-------------------------|-------------------------------------|-------------------')\n\n    for (const org of orgs) {\n      const created = org.createdAt ? new Date(org.createdAt).toLocaleDateString() : 'N/A'\n      const id = org.id || 'N/A'\n      const tenantId = org.tenant?.id || 'N/A'\n      const name = (org.name || 'Unnamed').padEnd(23)\n      console.log(`${id.padEnd(35)} | ${name} | ${tenantId.padEnd(35)} | ${created}`)\n    }\n  },\n}\n\nconst listTenants: ModuleCli = {\n  command: 'list-tenants',\n  async run() {\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const tenants = await em.find(Tenant, {})\n\n    if (tenants.length === 0) {\n      console.log('No tenants found')\n      return\n    }\n\n    console.log(`Found ${tenants.length} tenant(s):`)\n    console.log('')\n    console.log('ID                                   | Name                    | Created')\n    console.log('-------------------------------------|-------------------------|-------------------')\n\n    for (const tenant of tenants) {\n      const created = tenant.createdAt ? new Date(tenant.createdAt).toLocaleDateString() : 'N/A'\n      const id = tenant.id || 'N/A'\n      const name = (tenant.name || 'Unnamed').padEnd(23)\n      console.log(`${id.padEnd(35)} | ${name} | ${created}`)\n    }\n  },\n}\n\nconst listUsers: ModuleCli = {\n  command: 'list-users',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n\n    // Build query with optional filters\n    const where: any = {}\n    if (args.organizationId || args.orgId || args.org) {\n      where.organizationId = args.organizationId || args.orgId || args.org\n    }\n    if (args.tenantId || args.tenant) {\n      where.tenantId = args.tenantId || args.tenant\n    }\n\n    const users = await em.find(User, where)\n\n    if (users.length === 0) {\n      console.log('No users found')\n      return\n    }\n\n    console.log(`Found ${users.length} user(s):`)\n    console.log('')\n    console.log('ID                                   | Email                   | Name                    | Organization ID      | Tenant ID            | Roles')\n    console.log('-------------------------------------|-------------------------|-------------------------|---------------------|---------------------|-------------------')\n\n    for (const user of users) {\n      // Get user roles separately\n      const userRoles = await findWithDecryption(\n        em,\n        UserRole,\n        { user: user.id },\n        { populate: ['role'] },\n        { tenantId: user.tenantId ?? null, organizationId: user.organizationId ?? null },\n      )\n      const roles = userRoles.map((ur: any) => ur.role?.name).filter(Boolean).join(', ') || 'None'\n\n      // Get organization and tenant names if IDs exist\n      let orgName = 'N/A'\n      let tenantName = 'N/A'\n\n      if (user.organizationId) {\n        const org = await em.findOne(Organization, { id: user.organizationId })\n        orgName = org?.name ? `${org.name.substring(0, 19)}...` : `${user.organizationId.substring(0, 8)}...`\n      }\n\n      if (user.tenantId) {\n        const tenant = await em.findOne(Tenant, { id: user.tenantId })\n        tenantName = tenant?.name ? `${tenant.name.substring(0, 19)}...` : `${user.tenantId.substring(0, 8)}...`\n      }\n\n      const id = user.id || 'N/A'\n      const email = (user.email || 'N/A').padEnd(23)\n      const name = (user.name || 'Unnamed').padEnd(23)\n\n      console.log(`${id.padEnd(35)} | ${email} | ${name} | ${orgName.padEnd(19)} | ${tenantName.padEnd(19)} | ${roles}`)\n    }\n  },\n}\n\nconst setPassword: ModuleCli = {\n  command: 'set-password',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i += 2) {\n      const k = rest[i]?.replace(/^--/, '')\n      const v = rest[i + 1]\n      if (k) args[k] = v\n    }\n\n    const email = args.email\n    const password = args.password\n\n    if (!email || !password) {\n      console.error('Usage: mercato auth set-password --email <email> --password <newPassword>')\n      return\n    }\n    if (!ensurePasswordPolicy(password)) return\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { $or: [{ email }, { emailHash: { $in: emailHashLookupValues(email) } }] } as any,\n      undefined,\n      { tenantId: null, organizationId: null },\n    )\n\n    if (!user) {\n      console.error(`User with email \"${email}\" not found`)\n      return\n    }\n\n    user.passwordHash = await hash(password, 10)\n    await em.persist(user).flush()\n\n    console.log(`\u2705 Password updated successfully for user: ${email}`)\n  },\n}\n\nconst syncRoleAcls: ModuleCli = {\n  command: 'sync-role-acls',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    const flags = new Set<string>()\n    for (let i = 0; i < rest.length; i++) {\n      const token = rest[i]\n      if (!token?.startsWith('--')) continue\n      const key = token.replace(/^--/, '')\n      const next = rest[i + 1]\n      if (next && !next.startsWith('--')) {\n        args[key] = next\n        i++\n      } else {\n        flags.add(key)\n      }\n    }\n    const tenantArg = args.tenantId ?? args.tenant ?? args.tenant_id ?? null\n    const includeSuperadminRole = !flags.has('no-superadmin')\n\n    const modules = getCliModules()\n    if (!modules.length) {\n      console.error('\u274C No CLI modules registered. Run `yarn generate` first.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n\n    const targetTenantIds: string[] = []\n    if (tenantArg) {\n      const normalized = normalizeTenantId(tenantArg)\n      if (!normalized) {\n        console.error(`\u274C Invalid --tenant value: ${tenantArg}`)\n        return\n      }\n      const tenant = await em.findOne(Tenant, { id: normalized })\n      if (!tenant) {\n        console.error(`\u274C Tenant not found: ${normalized}`)\n        return\n      }\n      targetTenantIds.push(normalized)\n    } else {\n      const tenants = await em.find(Tenant, {})\n      if (!tenants.length) {\n        console.log('No tenants found; nothing to sync.')\n        return\n      }\n      for (const tenant of tenants) {\n        const id = tenant.id ? String(tenant.id) : null\n        if (id) targetTenantIds.push(id)\n      }\n    }\n\n    for (const tenantId of targetTenantIds) {\n      await ensureDefaultRoleAcls(em, tenantId, modules, { includeSuperadminRole })\n      await ensureCustomRoleAcls(em, tenantId, modules)\n      console.log(`\u2705 Synced role ACLs for tenant ${tenantId}`)\n    }\n  },\n}\n\n// Export the full CLI list\nexport default [addUser, seedRoles, syncRoleAcls, rotateEncryptionKey, addOrganization, setupApp, listOrganizations, listTenants, listUsers, setPassword]\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,kBAAkB,0BAA0B;AACrD,SAAS,8BAA8B;AACvC,SAAS,YAAY;AAErB,SAAS,MAAM,MAAM,gBAAgB;AACrC,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,aAAa,oBAAoB,uBAAuB,sBAAsB,oBAAoB,wCAAwC;AACnJ,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,qCAAqC;AAC9C,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,yBAAyB;AAClC,SAAS,WAAW;AAEpB,OAAO,YAAY;AACnB,SAAS,4BAA4B,mBAAmB,wBAAwB;AAChF,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAE9B,eAAe,wBAAwB,IAAS,MAAc,oBAAmC;AAC/F,QAAM,WAAW,MAAM,GAAG,QAAQ,MAAM,EAAE,MAAM,UAAU,mBAAmB,CAAC;AAC9E,MAAI,SAAU,QAAO;AACrB,QAAM,OAAO,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,oBAAoB,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC1F,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAC7B,SAAO;AACT;AAEA,MAAM,UAAqB;AAAA,EACzB,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AACA,UAAM,QAAQ,KAAK;AACnB,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,OAAO,KAAK,kBAAkB,KAAK,SAAS,KAAK,GAAG;AAC3E,UAAM,YAAY,KAAK,SAAS,IAAI,KAAK;AACzC,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,gBAAgB;AAC1C,cAAQ,MAAM,sHAAsH;AACpI;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB,QAAQ,EAAG;AACrC,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,MACH,MAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA,EAAE,IAAI,eAAe;AAAA,MACrB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,eAAe;AAAA,IACnC,KAAM;AACR,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,wBAAwB;AAClD,UAAM,cAAc,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,EAAE,IAAI;AAC7D,UAAM,qBAAqB,kBAAkB,eAAe,IAAI,KAAK;AACrE,UAAM,IAAI,GAAG,OAAO,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,iBAAiB,KAAK;AAAA,MACjC,cAAc,MAAM,KAAK,UAAU,EAAE;AAAA,MACrC,aAAa;AAAA,MACb,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI,OAAO;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,QAAQ,CAAC,EAAE,MAAM;AAC1B,QAAI,UAAU;AACZ,YAAM,QAAQ,wBAAwB,QAAQ;AAC9C,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAO,MAAM,wBAAwB,IAAI,MAAM,kBAAkB;AACvE,cAAM,OAAO,GAAG,OAAO,UAAU,EAAE,MAAM,GAAG,KAAK,CAAC;AAClD,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF;AACA,YAAQ,IAAI,wBAAwB,EAAE,EAAE;AAAA,EAC1C;AACF;AAEA,SAAS,UAAU,MAAgB;AACjC,QAAM,OAAyC,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,IAAI,GAAG;AACtB,YAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG;AAC7C,UAAI,MAAM,OAAW,MAAK,CAAC,IAAI;AAAA,eACtB,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAG,WAAW,IAAI,GAAG;AAAE,aAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAAI;AAAA,MAAI,MACjF,MAAK,CAAC,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAEA,SAAS,WAAW,OAAiD;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,kBAAkB,KAAK,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC/F;AAEA,SAAS,qBAAqB,UAA2B;AACvD,QAAM,SAAS,kBAAkB;AACjC,QAAM,SAAS,iBAAiB,UAAU,MAAM;AAChD,MAAI,OAAO,GAAI,QAAO;AACtB,QAAM,eAAe,2BAA2B,QAAQ,CAAC,MAAM,aAAa,QAAQ;AACpF,QAAM,SAAS,eAAe,KAAK,YAAY,KAAK;AACpD,UAAQ,MAAM,0CAA0C,MAAM,GAAG;AACjE,SAAO;AACT;AAEA,eAAe,4BAA+B,IAAkC;AAC9E,QAAM,WAAW,QAAQ,IAAI;AAC7B,UAAQ,IAAI,+BAA+B;AAC3C,MAAI;AACF,WAAO,MAAM,GAAG;AAAA,EAClB,UAAE;AACA,QAAI,aAAa,QAAW;AAC1B,aAAO,QAAQ,IAAI;AAAA,IACrB,OAAO;AACL,cAAQ,IAAI,+BAA+B;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,MAAM,qBAA2C;AAAA,EAE/C,YAAY,QAAgB;AAC1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,kBAAkB,MAAM,CAAC,EAAE,OAAO;AAAA,EACnF;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEA,SAAS,eAAe,KAAsC;AAC5D,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9E;AAEA,SAAS,kBACP,SACA,KACe;AACf,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,kBAAkB,SAAS,IAAI,GAAG;AAC3C;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,MAAM,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACtC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,UAAI,MAAO,MAAK,GAAG,IAAI;AAAA,IACzB;AACA,UAAM,WAAW,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa;AACnE,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AACtC,QAAI,UAAU;AACZ,YAAM,YAAY,IAAI,EAAE,SAAS,CAAC;AAClC,cAAQ,IAAI,4CAAgC,QAAQ;AACpD;AAAA,IACF;AACA,UAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AACxC,QAAI,CAAC,QAAQ,QAAQ;AACnB,cAAQ,IAAI,oCAAoC;AAChD;AAAA,IACF;AACA,eAAW,UAAU,SAAS;AAC5B,YAAM,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI;AAC3C,UAAI,CAAC,GAAI;AACT,YAAM,YAAY,IAAI,EAAE,UAAU,GAAG,CAAC;AACtC,cAAQ,IAAI,4CAAgC,EAAE;AAAA,IAChD;AAAA,EACF;AACF;AAEA,MAAM,sBAAiC;AAAA,EACrC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,WAAY,KAAK,YAAwB,KAAK,UAAsB,KAAK,aAAwB;AACvG,UAAM,iBAAkB,KAAK,kBAA8B,KAAK,SAAqB,KAAK,OAAkB;AAC5G,UAAM,SAAU,KAAK,SAAS,KAAiB,KAAK,UAAqB;AACzE,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAClD,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,UAAU,CAAC,UAAU;AACvB,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,MAAM,+CAA+C;AAC7D;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AACtC,UAAM,oBAAoB,IAAI,4BAA4B,IAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;AAChG,UAAM,SAAS,UAAU,SAAS,IAAI,qBAAqB,MAAM,IAAI;AACrE,QAAI,OAAO;AACT,cAAQ,IAAI,2BAA2B;AAAA,QACrC,WAAW,QAAQ,MAAM;AAAA,QACzB;AAAA,QACA,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,MACpC,CAAC;AACD,cAAQ,IAAI,4CAA4C;AAAA,QACtD,QAAQ,WAAW,MAAM;AAAA,QACzB,YAAY,WAAW,QAAQ,IAAI,mCAAmC;AAAA,MACxE,CAAC;AAAA,IACH;AACA,QAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,cAAQ,MAAM,wEAAwE;AACtF;AAAA,IACF;AACA,UAAM,OAAa,GAAW,gBAAgB;AAC9C,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,4CAA4C;AAC1D;AAAA,IACF;AACA,UAAM,OAAQ,IAAY,cAAc,GAAG,MAAM,IAAI;AACrD,UAAM,YAAY,MAAM,aAAa;AACrC,UAAM,SAAS,MAAM;AACrB,UAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,UAAM,qBAAqB,CAAC,UAA4B;AACtD,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,aAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAAA,IAC5C;AACA,UAAM,aAAa,oBAAI,IAAY;AACnC,UAAM,cAAc,oBAAI,IAA8B;AACtD,UAAM,eAAe,OAAO,eAAuB,wBAAiD;AAClG,UAAI,SAAS,CAAC,WAAW,IAAI,aAAa,GAAG;AAC3C,mBAAW,IAAI,aAAa;AAC5B,cAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,UACzC,QAAQ,aAAa,aAAa,KAAK,QAAQ,QAAQ,IAAI;AAAA,UAC3D,kBAAkB,OAAO,aAAa;AAAA,QACxC,CAAC;AACD,gBAAQ,IAAI,4CAA4C;AAAA,UACtD,UAAU;AAAA,UACV,QAAQ,eAAe,MAAM;AAAA,UAC7B,YAAY,eAAe,MAAM;AAAA,QACnC,CAAC;AAAA,MACH;AACA,YAAM,UAAU,MAAM,KAAK;AAAA,QACzB,qCAAqC,cAAc;AAAA,QACnD,CAAC,eAAe,mBAAmB;AAAA,MACrC;AACA,YAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC;AACjD,YAAM,UAAU,SACZ,OACA,KAAK,OAAO,CAAC,QAAa,CAAC,mBAAmB,KAAK,KAAK,CAAC;AAC7D,UAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,cAAQ;AAAA,QACN,SAAS,QAAQ,MAAM,yCAAyC,mBAAmB,GAAG,SAAS,eAAe,EAAE;AAAA,MAClH;AACA,UAAI,OAAQ,QAAO;AACnB,YAAM,MAAM,QAAQ,IAAI,CAAC,QAAa,OAAO,IAAI,EAAE,CAAC;AACpD,YAAM,QAAQ,SACV,MAAM,GAAG;AAAA,QACT;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,MACnF,IACE,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,QACjF,CAAC;AAAA,QACD,EAAE,UAAU,eAAe,gBAAgB,qBAAqB,kBAAkB;AAAA,MACpF;AACF,YAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACtE,UAAI,UAAU;AACd,iBAAW,OAAO,SAAS;AACzB,cAAM,OAAO,UAAU,IAAI,OAAO,IAAI,EAAE,CAAC;AACzC,YAAI,CAAC,KAAM;AACX,cAAM,WAAW,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,OAAO,IAAI,SAAS,EAAE;AACnF,YAAI,CAAC,SAAU;AACf,YAAI,WAAW,CAAC,mBAAmB,QAAQ,KAAK,CAAC,SAAS;AACxD;AAAA,QACF;AACA,YAAI,aAAa;AACjB,YAAI,UAAU,mBAAmB,QAAQ,KAAK,QAAQ;AACpD,cAAI,OAAO;AACT,oBAAQ,IAAI,sCAAsC;AAAA,cAChD,QAAQ,IAAI;AAAA,cACZ,UAAU;AAAA,cACV,gBAAgB;AAAA,YAClB,CAAC;AAAA,UACH;AACA,cAAI,SAAS,YAAY,IAAI,aAAa,KAAK;AAC/C,cAAI,CAAC,YAAY,IAAI,aAAa,GAAG;AACnC,qBAAS,MAAM,OAAO,aAAa,aAAa;AAChD,wBAAY,IAAI,eAAe,MAAM;AAAA,UACvC;AACA,gBAAM,aAAa,kBAAkB,UAAU,MAAM;AACrD,cAAI,OAAO,eAAe,YAAY,mBAAmB,UAAU,EAAG;AACtE,uBAAa;AAAA,QACf;AACA,YAAI,CAAC,WAAY;AACjB,cAAM,YAAY,MAAM,kBAAkB;AAAA,UACxC;AAAA,UACA,EAAE,OAAO,WAAW;AAAA,UACpB;AAAA,UACA;AAAA,QACF;AACA,cAAM,YAAY,UAAU;AAC5B,YAAI,aAAa,cAAc,KAAK,OAAO;AACzC,eAAK,QAAQ;AACb,eAAK,YAAa,UAAkB,aAAa,iBAAiB,UAAU;AAC5E,aAAG,QAAQ,IAAI;AACf,qBAAW;AAAA,QACb;AAAA,MACF;AACA,UAAI,UAAU,GAAG;AACf,cAAM,GAAG,MAAM;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,QAAI,YAAY,gBAAgB;AAC9B,YAAM,UAAU,MAAM,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3E,UAAI,CAAC,SAAS;AACZ,gBAAQ,IAAI,gEAAgE;AAAA,MAC9E,OAAO;AACL,gBAAQ,IAAI,aAAa,OAAO,sBAAsB;AAAA,MACxD;AACA;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAM,GAAG,KAAK,cAAc,CAAC,CAAC;AACpD,QAAI,CAAC,cAAc,QAAQ;AACzB,cAAQ,IAAI,6CAA6C;AACzD;AAAA,IACF;AACA,QAAI,QAAQ;AACZ,eAAW,OAAO,eAAe;AAC/B,YAAM,gBAAgB,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,EAAE,IAAI;AACvG,YAAM,sBAAsB,IAAI,KAAK,OAAO,IAAI,EAAE,IAAI;AACtD,UAAI,CAAC,iBAAiB,CAAC,oBAAqB;AAC5C,eAAS,MAAM,aAAa,eAAe,mBAAmB;AAAA,IAChE;AACA,QAAI,QAAQ,GAAG;AACb,cAAQ,IAAI,aAAa,KAAK,+CAA+C;AAAA,IAC/E,OAAO;AACL,cAAQ,IAAI,kEAAkE;AAAA,IAChF;AAAA,EACF;AACF;AAIA,MAAM,kBAA6B;AAAA,EACjC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AACA,UAAM,OAAO,KAAK,QAAQ,KAAK;AAC/B,QAAI,CAAC,MAAM;AACT,cAAQ,MAAM,wDAAwD;AACtE;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AAEvB,UAAM,SAAS,GAAG,OAAO,QAAQ,EAAE,MAAM,GAAG,IAAI,UAAU,CAAC;AAC3D,UAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,UAAM,MAAM,GAAG,OAAO,cAAc,EAAE,MAAM,OAAO,CAAC;AACpD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAM,0BAA0B,IAAI,OAAO,OAAO,EAAE,CAAC;AACrD,YAAQ,IAAI,gCAAgC,IAAI,IAAI,aAAa,OAAO,EAAE;AAAA,EAC5E;AACF;AAEA,MAAM,cAAc;AAEpB,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,UAAU,OAAO,KAAK,YAAY,WACpC,KAAK,UACL,OAAO,KAAK,SAAS,WACnB,KAAK,OACL;AACN,UAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAC5D,UAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;AACrE,UAAM,aAAa,OAAO,KAAK,YAAY,WACvC,KAAK,UACL,OAAO,KAAK,SAAS,WACnB,KAAK,OACL;AACN,UAAM,UAAU,cAAc,WAAW,KAAK,EAAE,SAAS,WAAW,KAAK,IAAI;AAC7E,QAAI,YAAY,UAAa,CAAC,iBAAiB,KAAK,OAAO,GAAG;AAC5D,cAAQ,OAAO,MAAM,iCAAiC,iBAAiB,MAAM;AAAA,CAA6E;AAC1J,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,WAAW,OAAO,KAAK,UAAU,WACnC,KAAK,MAAM,KAAK,IAChB;AACJ,UAAM,wBACJ,KAAK,sBAAsB,KAC3B,KAAK,sBACL,KAAK,qBAAqB,KAC1B,KAAK;AACP,UAAM,qBAAqB,OAAO,0BAA0B,YACxD,wBACA,kBAAkB,OAAO,0BAA0B,WAAW,wBAAwB,IAAI,KAAK;AACnG,UAAM,kBAAkB,KAAK,eAAe,KAAK,KAAK;AACtD,UAAM,eAAe,OAAO,oBAAoB,YAC5C,kBACA,kBAAkB,OAAO,oBAAoB,WAAW,kBAAkB,IAAI,KAAK;AACvF,UAAM,sBAAsB,KAAK,oBAAoB,KAAK,KAAK;AAC/D,UAAM,mBAAmB,OAAO,wBAAwB,YACpD,sBACA,kBAAkB,OAAO,wBAAwB,WAAW,sBAAsB,IAAI,KAAK;AAC/F,UAAM,cAAc,KAAK;AACzB,UAAM,WAAW,OAAO,gBAAgB,YACpC,cACA,kBAAkB,OAAO,gBAAgB,WAAW,cAAc,IAAI,KAAK;AAC/E,QAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU;AACnC,cAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AACvC,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,CAAC,sBAAsB,CAAC,qBAAqB,QAAQ,GAAG;AAC1D,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,QAAI,sBAAsB,CAAC,UAAU;AACnC,cAAQ,KAAK,6DAAmD;AAAA,IAClE;AACA,QAAI,iBAAsC;AAC1C,QAAI,UAAU;AASZ,cAAQ,IAAI,eAAe,QAAQ,IAAI,gBAAgB;AACvD,YAAM,cAAc,QAAQ;AAC5B,YAAM,eAAe,QAAQ;AAC7B,cAAQ,MAAM,MAAM;AACpB,cAAQ,OAAO,MAAM;AACrB,YAAM,mBAAmB,QAAQ,IAAI,gBAAgB;AACrD,cAAQ,IAAI,gBAAgB,IAAI;AAChC,yBAAmB;AACnB,6BAAuB;AACvB,uBAAiB,MAAM;AACrB,gBAAQ,MAAM;AACd,gBAAQ,OAAO;AACf,YAAI,qBAAqB,OAAW,QAAO,QAAQ,IAAI,gBAAgB;AAAA,YAClE,SAAQ,IAAI,gBAAgB,IAAI;AACrC,2BAAmB;AACnB,+BAAuB;AAAA,MACzB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,YAAY,WACd,wBAAwB,QAAQ,IAChC;AAEJ,QAAI;AACF,YAAM,UAAU,cAAc;AAC9B,YAAM,SAAS,MAAM,mBAAmB,IAAI;AAAA,QAC1C;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,EAAE,OAAO,UAAU,SAAS,KAAK;AAAA;AAAA;AAAA;AAAA,QAI9C,qBAAqB;AAAA;AAAA;AAAA;AAAA,QAIrB,2BAA2B;AAAA;AAAA;AAAA;AAAA,QAI3B,kBAAkB,YAAY;AAAA,QAC9B;AAAA,MACF,CAAC;AAED,UAAI,cAAc;AAChB,cAAM,UAAU;AAAA,UACd;AAAA,UACA,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB;AAAA,QACF;AACA,mBAAW,OAAO,SAAS;AACzB,cAAI,IAAI,OAAO,cAAc;AAC3B,kBAAM,IAAI,MAAM,aAAa,OAAc;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,cAAM,gBAAgB,kBAAkB,OAAO,OAAO,KAAK;AAC3D,cAAM,cAAc,iBAAiB,cAAc,KAAK,MAAM,OAC1D,OAAO,cAAc,KAAK,EAAE,IAC5B;AACJ,cAAM,UAAU;AAAA,UACd,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB;AAAA,UACA,YAAY;AAAA,UACZ,oBAAoB,OAAO;AAAA,QAC7B;AACA,YAAI,eAAgB,gBAAe;AACnC,gBAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,CAAI;AACnD;AAAA,MACF;AAEA,UAAI,OAAO,oBAAoB;AAC7B,gBAAQ,IAAI,4DAAkD;AAC9D,gBAAQ,IAAI,wBAAc,KAAK,EAAE;AACjC,gBAAQ,IAAI,wEAA8D;AAAA,MAC5E;AAEA,UAAI,IAAI,aAAa,QAAQ;AAC3B,mBAAW,YAAY,OAAO,OAAO;AACnC,cAAI,SAAS,SAAS;AACpB,gBAAI,SAAS,mBAAmB;AAC9B,sBAAQ,IAAI,kFAAmE;AAC/E,sBAAQ,IAAI,0BAAmB,SAAS,KAAK,OAAO,aAAa,SAAS,iBAAiB;AAAA,YAC7F,OAAO;AACL,sBAAQ,IAAI,0BAAmB,SAAS,KAAK,KAAK;AAAA,YACpD;AAAA,UACF,OAAO;AACL,oBAAQ,IAAI,gBAAgB,SAAS,KAAK,KAAK,EAAE;AAAA,UACnD;AAAA,QACF;AAAA,MACF;AAEA,UAAI,IAAI,aAAa,OAAQ,SAAQ,IAAI,0BAAqB,EAAE,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe,CAAC;AAAA,IACpI,SAAS,KAAK;AACZ,UAAI,eAAgB,gBAAe;AACnC,UAAI,eAAe,oBAAoB;AACrC,gBAAQ,OAAO,MAAM,GAAG,IAAI,OAAO;AAAA,CAAI;AACvC,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,UAAI,eAAe,kCAAkC;AACnD,gBAAQ,OAAO;AAAA,UACb,kBAAkB,IAAI,OAAO;AAAA;AAAA,QAC/B;AACA,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,UAAI,eAAe,SAAS,IAAI,YAAY,eAAe;AACzD,gBAAQ,OAAO,MAAM,+DAA+D;AACpF,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,YAAM;AAAA,IACR,UAAE;AACA,UAAI,eAAgB,gBAAe;AAAA,IACrC;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB;AAEzB,SAAS,kBACP,OACA,YACqD;AACrD,QAAM,kBAAkB,WAAW,YAAY;AAC/C,QAAM,QAAQ,MAAM;AAAA,IAClB,CAAC,aACC,SAAS,WACT,SAAS,MAAM,SAAS,YAAY,KACpC,OAAO,SAAS,KAAK,UAAU,YAC/B,SAAS,KAAK,MAAM,YAAY,MAAM;AAAA,EAC1C;AACA,MAAI,MAAO,QAAO;AAClB,SAAO,MAAM,KAAK,CAAC,aAAa,SAAS,MAAM,SAAS,YAAY,CAAC;AACvE;AAEA,MAAM,oBAA+B;AAAA,EACnC,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAEA,QAAI,KAAK,WAAW,GAAG;AACrB,cAAQ,IAAI,wBAAwB;AACpC;AAAA,IACF;AAEA,YAAQ,IAAI,SAAS,KAAK,MAAM,mBAAmB;AACnD,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,iHAAiH;AAC7H,YAAQ,IAAI,2HAA2H;AAEvI,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,IAAI,YAAY,IAAI,KAAK,IAAI,SAAS,EAAE,mBAAmB,IAAI;AAC/E,YAAM,KAAK,IAAI,MAAM;AACrB,YAAM,WAAW,IAAI,QAAQ,MAAM;AACnC,YAAM,QAAQ,IAAI,QAAQ,WAAW,OAAO,EAAE;AAC9C,cAAQ,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,IAAI,MAAM,SAAS,OAAO,EAAE,CAAC,MAAM,OAAO,EAAE;AAAA,IAChF;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AAExC,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,kBAAkB;AAC9B;AAAA,IACF;AAEA,YAAQ,IAAI,SAAS,QAAQ,MAAM,aAAa;AAChD,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,0EAA0E;AACtF,YAAQ,IAAI,qFAAqF;AAEjG,eAAW,UAAU,SAAS;AAC5B,YAAM,UAAU,OAAO,YAAY,IAAI,KAAK,OAAO,SAAS,EAAE,mBAAmB,IAAI;AACrF,YAAM,KAAK,OAAO,MAAM;AACxB,YAAM,QAAQ,OAAO,QAAQ,WAAW,OAAO,EAAE;AACjD,cAAQ,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,IAAI,MAAM,OAAO,EAAE;AAAA,IACvD;AAAA,EACF;AACF;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AAGvB,UAAM,QAAa,CAAC;AACpB,QAAI,KAAK,kBAAkB,KAAK,SAAS,KAAK,KAAK;AACjD,YAAM,iBAAiB,KAAK,kBAAkB,KAAK,SAAS,KAAK;AAAA,IACnE;AACA,QAAI,KAAK,YAAY,KAAK,QAAQ;AAChC,YAAM,WAAW,KAAK,YAAY,KAAK;AAAA,IACzC;AAEA,UAAM,QAAQ,MAAM,GAAG,KAAK,MAAM,KAAK;AAEvC,QAAI,MAAM,WAAW,GAAG;AACtB,cAAQ,IAAI,gBAAgB;AAC5B;AAAA,IACF;AAEA,YAAQ,IAAI,SAAS,MAAM,MAAM,WAAW;AAC5C,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,gJAAgJ;AAC5J,YAAQ,IAAI,2JAA2J;AAEvK,eAAW,QAAQ,OAAO;AAExB,YAAM,YAAY,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,MAAM,KAAK,GAAG;AAAA,QAChB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,QACrB,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,MACjF;AACA,YAAM,QAAQ,UAAU,IAAI,CAAC,OAAY,GAAG,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK;AAGtF,UAAI,UAAU;AACd,UAAI,aAAa;AAEjB,UAAI,KAAK,gBAAgB;AACvB,cAAM,MAAM,MAAM,GAAG,QAAQ,cAAc,EAAE,IAAI,KAAK,eAAe,CAAC;AACtE,kBAAU,KAAK,OAAO,GAAG,IAAI,KAAK,UAAU,GAAG,EAAE,CAAC,QAAQ,GAAG,KAAK,eAAe,UAAU,GAAG,CAAC,CAAC;AAAA,MAClG;AAEA,UAAI,KAAK,UAAU;AACjB,cAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC;AAC7D,qBAAa,QAAQ,OAAO,GAAG,OAAO,KAAK,UAAU,GAAG,EAAE,CAAC,QAAQ,GAAG,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC;AAAA,MACrG;AAEA,YAAM,KAAK,KAAK,MAAM;AACtB,YAAM,SAAS,KAAK,SAAS,OAAO,OAAO,EAAE;AAC7C,YAAM,QAAQ,KAAK,QAAQ,WAAW,OAAO,EAAE;AAE/C,cAAQ,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,CAAC,MAAM,WAAW,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE;AAAA,IACnH;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,YAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,OAAO,EAAE;AACpC,YAAM,IAAI,KAAK,IAAI,CAAC;AACpB,UAAI,EAAG,MAAK,CAAC,IAAI;AAAA,IACnB;AAEA,UAAM,QAAQ,KAAK;AACnB,UAAM,WAAW,KAAK;AAEtB,QAAI,CAAC,SAAS,CAAC,UAAU;AACvB,cAAQ,MAAM,2EAA2E;AACzF;AAAA,IACF;AACA,QAAI,CAAC,qBAAqB,QAAQ,EAAG;AAErC,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,sBAAsB,KAAK,EAAE,EAAE,CAAC,EAAE;AAAA,MACzE;AAAA,MACA,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AAEA,QAAI,CAAC,MAAM;AACT,cAAQ,MAAM,oBAAoB,KAAK,aAAa;AACpD;AAAA,IACF;AAEA,SAAK,eAAe,MAAM,KAAK,UAAU,EAAE;AAC3C,UAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAE7B,YAAQ,IAAI,kDAA6C,KAAK,EAAE;AAAA,EAClE;AACF;AAEA,MAAM,eAA0B;AAAA,EAC9B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,UAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,QAAQ,KAAK,CAAC;AACpB,UAAI,CAAC,OAAO,WAAW,IAAI,EAAG;AAC9B,YAAM,MAAM,MAAM,QAAQ,OAAO,EAAE;AACnC,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,QAAQ,CAAC,KAAK,WAAW,IAAI,GAAG;AAClC,aAAK,GAAG,IAAI;AACZ;AAAA,MACF,OAAO;AACL,cAAM,IAAI,GAAG;AAAA,MACf;AAAA,IACF;AACA,UAAM,YAAY,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa;AACpE,UAAM,wBAAwB,CAAC,MAAM,IAAI,eAAe;AAExD,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,QAAQ,QAAQ;AACnB,cAAQ,MAAM,8DAAyD;AACvE;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AAEtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,WAAW;AACb,YAAM,aAAa,kBAAkB,SAAS;AAC9C,UAAI,CAAC,YAAY;AACf,gBAAQ,MAAM,kCAA6B,SAAS,EAAE;AACtD;AAAA,MACF;AACA,YAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,CAAC;AAC1D,UAAI,CAAC,QAAQ;AACX,gBAAQ,MAAM,4BAAuB,UAAU,EAAE;AACjD;AAAA,MACF;AACA,sBAAgB,KAAK,UAAU;AAAA,IACjC,OAAO;AACL,YAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AACxC,UAAI,CAAC,QAAQ,QAAQ;AACnB,gBAAQ,IAAI,oCAAoC;AAChD;AAAA,MACF;AACA,iBAAW,UAAU,SAAS;AAC5B,cAAM,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI;AAC3C,YAAI,GAAI,iBAAgB,KAAK,EAAE;AAAA,MACjC;AAAA,IACF;AAEA,eAAW,YAAY,iBAAiB;AACtC,YAAM,sBAAsB,IAAI,UAAU,SAAS,EAAE,sBAAsB,CAAC;AAC5E,YAAM,qBAAqB,IAAI,UAAU,OAAO;AAChD,cAAQ,IAAI,sCAAiC,QAAQ,EAAE;AAAA,IACzD;AAAA,EACF;AACF;AAGA,IAAO,cAAQ,CAAC,SAAS,WAAW,cAAc,qBAAqB,iBAAiB,UAAU,mBAAmB,aAAa,WAAW,WAAW;",
   "names": []
 }

package/dist/modules/auth/lib/autologin.js

@@ -0,0 +1,19 @@
+function readEnvValue(env, key) {
+  const value = env[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+function resolveAutoLoginCredentials(env = process.env) {
+  const email = readEnvValue(env, "OM_AUTOLOGIN_EMAIL");
+  const password = env.OM_AUTOLOGIN_PASSWORD ?? "";
+  if (!email || !password) return null;
+  const tenantId = readEnvValue(env, "OM_AUTOLOGIN_TENANT");
+  return { email, password, tenantId: tenantId || null };
+}
+function isAutoLoginEnabled(env = process.env) {
+  return resolveAutoLoginCredentials(env) !== null;
+}
+export {
+  isAutoLoginEnabled,
+  resolveAutoLoginCredentials
+};
+//# sourceMappingURL=autologin.js.map

package/dist/modules/auth/lib/autologin.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/autologin.ts"],
+  "sourcesContent": ["export type AutoLoginCredentials = {\n  email: string\n  password: string\n  tenantId: string | null\n}\n\nfunction readEnvValue(env: Record<string, string | undefined>, key: string): string {\n  const value = env[key]\n  return typeof value === 'string' ? value.trim() : ''\n}\n\n/**\n * Reads the optional demo-autologin credentials from env. When both\n * `OM_AUTOLOGIN_EMAIL` and `OM_AUTOLOGIN_PASSWORD` are set, the homepage hands\n * unauthenticated visitors to the autologin route which signs them in and drops\n * them into the app. Unset (the default) \u2192 `null` \u2192 normal login flow.\n *\n * `OM_AUTOLOGIN_TENANT` is optional and only needed when the same email exists\n * across multiple tenants. Pure: pass the env bag so it stays testable.\n */\nexport function resolveAutoLoginCredentials(\n  env: Record<string, string | undefined> = process.env,\n): AutoLoginCredentials | null {\n  const email = readEnvValue(env, 'OM_AUTOLOGIN_EMAIL')\n  const password = env.OM_AUTOLOGIN_PASSWORD ?? ''\n  if (!email || !password) return null\n  const tenantId = readEnvValue(env, 'OM_AUTOLOGIN_TENANT')\n  return { email, password, tenantId: tenantId || null }\n}\n\n/** True when demo autologin credentials are configured via env. */\nexport function isAutoLoginEnabled(\n  env: Record<string, string | undefined> = process.env,\n): boolean {\n  return resolveAutoLoginCredentials(env) !== null\n}\n"],
+  "mappings": "AAMA,SAAS,aAAa,KAAyC,KAAqB;AAClF,QAAM,QAAQ,IAAI,GAAG;AACrB,SAAO,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACpD;AAWO,SAAS,4BACd,MAA0C,QAAQ,KACrB;AAC7B,QAAM,QAAQ,aAAa,KAAK,oBAAoB;AACpD,QAAM,WAAW,IAAI,yBAAyB;AAC9C,MAAI,CAAC,SAAS,CAAC,SAAU,QAAO;AAChC,QAAM,WAAW,aAAa,KAAK,qBAAqB;AACxD,SAAO,EAAE,OAAO,UAAU,UAAU,YAAY,KAAK;AACvD;AAGO,SAAS,mBACd,MAA0C,QAAQ,KACzC;AACT,SAAO,4BAA4B,GAAG,MAAM;AAC9C;",
+  "names": []
+}

package/dist/modules/configs/lib/upgrade-actions.js

@@ -1,4 +1,7 @@
 import * as semver from "semver";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { reconcileAttachmentOrganizations } from "@open-mercato/core/modules/attachments/lib/reconcileOrganization";
+const logger = createLogger("configs").child({ component: "upgrade-actions" });
 function compareVersions(a, b) {
   const cleanA = semver.valid(semver.coerce(a));
   const cleanB = semver.valid(semver.coerce(b));
@@ -11,6 +14,25 @@ function compareVersions(a, b) {
   return semver.compare(cleanA, cleanB);
 }
 const upgradeActions = [
+  {
+    id: "attachments.reconcile-organization",
+    version: "0.6.6",
+    messageKey: "configs.upgrades.attachmentsOrgReconcile.message",
+    ctaKey: "configs.upgrades.attachmentsOrgReconcile.cta",
+    successKey: "configs.upgrades.attachmentsOrgReconcile.success",
+    loadingKey: "configs.upgrades.attachmentsOrgReconcile.loading",
+    async run({ container, em, tenantId }) {
+      const queryEngine = container.resolve("queryEngine");
+      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId });
+      logger.info("attachments organization reconcile completed", {
+        tenantId,
+        scanned: report.scanned,
+        updated: report.updated,
+        unresolved: report.unresolved,
+        skippedVirtual: report.skippedVirtual
+      });
+    }
+  },
   {
     id: "customers.seed-interaction-statuses",
     version: "0.6.5",

package/dist/modules/configs/lib/upgrade-actions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/configs/lib/upgrade-actions.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport * as semver from 'semver'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\n\nexport type UpgradeActionContext = {\n  tenantId: string\n  organizationId: string\n  container: AppContainer\n  em: EntityManager\n}\n\nexport type UpgradeActionDefinition = {\n  id: string\n  version: string\n  messageKey: string\n  ctaKey: string\n  successKey: string\n  loadingKey?: string\n  run: (ctx: UpgradeActionContext) => Promise<void>\n}\n\n/**\n * Compare two semantic version strings.\n * Uses the semver library for robust version comparison.\n * Returns negative if a < b, positive if a > b, 0 if equal.\n * Throws an error if either version string is invalid.\n */\nexport function compareVersions(a: string, b: string): number {\n  const cleanA = semver.valid(semver.coerce(a))\n  const cleanB = semver.valid(semver.coerce(b))\n  if (!cleanA) {\n    throw new Error(`Invalid version string: \"${a}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  if (!cleanB) {\n    throw new Error(`Invalid version string: \"${b}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  return semver.compare(cleanA, cleanB)\n}\n\nexport const upgradeActions: UpgradeActionDefinition[] = [\n  {\n    id: 'customers.seed-interaction-statuses',\n    version: '0.6.5',\n    messageKey: 'customers.config.upgradeActions.interactionStatuses.message',\n    ctaKey: 'customers.config.upgradeActions.interactionStatuses.cta',\n    successKey: 'customers.config.upgradeActions.interactionStatuses.success',\n    loadingKey: 'customers.config.upgradeActions.interactionStatuses.loading',\n    // Existing tenants predate the `interaction_status` dictionary, so their status\n    // dropdown is empty until seeded. New tenants get it via customers `seedDefaults`.\n    // Lazy-imported so configs stays decoupled from customers (the catalog of actions\n    // lives here, but customers code only loads when the action actually runs).\n    run: async ({ em, tenantId, organizationId }) => {\n      const [{ INTERACTION_STATUS_DEFAULTS }, { ensureDictionaryEntry }] = await Promise.all([\n        import('@open-mercato/core/modules/customers/cli'),\n        import('@open-mercato/core/modules/customers/commands/shared'),\n      ])\n      for (const entry of INTERACTION_STATUS_DEFAULTS) {\n        await ensureDictionaryEntry(em, {\n          tenantId,\n          organizationId,\n          kind: 'interaction_status',\n          value: entry.value,\n          label: entry.label,\n          color: entry.color,\n          icon: entry.icon,\n        })\n      }\n    },\n  },\n]\n\nexport function actionsUpToVersion(version: string): UpgradeActionDefinition[] {\n  return upgradeActions // NOSONAR \u2014 upgradeActions is populated at boot time by modules\n    .filter((action) => compareVersions(action.version, version) <= 0)\n    .sort((a, b) => compareVersions(a.version, b.version) || a.id.localeCompare(b.id))\n}\n\nexport function findUpgradeAction(actionId: string, maxVersion: string): UpgradeActionDefinition | undefined {\n  const matches = actionsUpToVersion(maxVersion).filter((action) => action.id === actionId)\n  if (!matches.length) return undefined\n  return matches[matches.length - 1]\n}\n"],
-  "mappings": "AACA,YAAY,YAAY;AA0BjB,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,SAAO,OAAO,QAAQ,QAAQ,MAAM;AACtC;AAEO,MAAM,iBAA4C;AAAA,EACvD;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,KAAK,OAAO,EAAE,IAAI,UAAU,eAAe,MAAM;AAC/C,YAAM,CAAC,EAAE,4BAA4B,GAAG,EAAE,sBAAsB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrF,OAAO,0CAA0C;AAAA,QACjD,OAAO,sDAAsD;AAAA,MAC/D,CAAC;AACD,iBAAW,SAAS,6BAA6B;AAC/C,cAAM,sBAAsB,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,SAA4C;AAC7E,SAAO,eACJ,OAAO,CAAC,WAAW,gBAAgB,OAAO,SAAS,OAAO,KAAK,CAAC,EAChE,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AACrF;AAEO,SAAS,kBAAkB,UAAkB,YAAyD;AAC3G,QAAM,UAAU,mBAAmB,UAAU,EAAE,OAAO,CAAC,WAAW,OAAO,OAAO,QAAQ;AACxF,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,QAAQ,QAAQ,SAAS,CAAC;AACnC;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport * as semver from 'semver'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { reconcileAttachmentOrganizations } from '@open-mercato/core/modules/attachments/lib/reconcileOrganization'\n\nconst logger = createLogger('configs').child({ component: 'upgrade-actions' })\n\nexport type UpgradeActionContext = {\n  tenantId: string\n  organizationId: string\n  container: AppContainer\n  em: EntityManager\n}\n\nexport type UpgradeActionDefinition = {\n  id: string\n  version: string\n  messageKey: string\n  ctaKey: string\n  successKey: string\n  loadingKey?: string\n  run: (ctx: UpgradeActionContext) => Promise<void>\n}\n\n/**\n * Compare two semantic version strings.\n * Uses the semver library for robust version comparison.\n * Returns negative if a < b, positive if a > b, 0 if equal.\n * Throws an error if either version string is invalid.\n */\nexport function compareVersions(a: string, b: string): number {\n  const cleanA = semver.valid(semver.coerce(a))\n  const cleanB = semver.valid(semver.coerce(b))\n  if (!cleanA) {\n    throw new Error(`Invalid version string: \"${a}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  if (!cleanB) {\n    throw new Error(`Invalid version string: \"${b}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  return semver.compare(cleanA, cleanB)\n}\n\nexport const upgradeActions: UpgradeActionDefinition[] = [\n  {\n    id: 'attachments.reconcile-organization',\n    version: '0.6.6',\n    messageKey: 'configs.upgrades.attachmentsOrgReconcile.message',\n    ctaKey: 'configs.upgrades.attachmentsOrgReconcile.cta',\n    successKey: 'configs.upgrades.attachmentsOrgReconcile.success',\n    loadingKey: 'configs.upgrades.attachmentsOrgReconcile.loading',\n    async run({ container, em, tenantId }) {\n      const queryEngine = container.resolve('queryEngine') as QueryEngine\n      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId })\n      logger.info('attachments organization reconcile completed', {\n        tenantId,\n        scanned: report.scanned,\n        updated: report.updated,\n        unresolved: report.unresolved,\n        skippedVirtual: report.skippedVirtual,\n      })\n    },\n  },\n  {\n    id: 'customers.seed-interaction-statuses',\n    version: '0.6.5',\n    messageKey: 'customers.config.upgradeActions.interactionStatuses.message',\n    ctaKey: 'customers.config.upgradeActions.interactionStatuses.cta',\n    successKey: 'customers.config.upgradeActions.interactionStatuses.success',\n    loadingKey: 'customers.config.upgradeActions.interactionStatuses.loading',\n    // Existing tenants predate the `interaction_status` dictionary, so their status\n    // dropdown is empty until seeded. New tenants get it via customers `seedDefaults`.\n    // Lazy-imported so configs stays decoupled from customers (the catalog of actions\n    // lives here, but customers code only loads when the action actually runs).\n    run: async ({ em, tenantId, organizationId }) => {\n      const [{ INTERACTION_STATUS_DEFAULTS }, { ensureDictionaryEntry }] = await Promise.all([\n        import('@open-mercato/core/modules/customers/cli'),\n        import('@open-mercato/core/modules/customers/commands/shared'),\n      ])\n      for (const entry of INTERACTION_STATUS_DEFAULTS) {\n        await ensureDictionaryEntry(em, {\n          tenantId,\n          organizationId,\n          kind: 'interaction_status',\n          value: entry.value,\n          label: entry.label,\n          color: entry.color,\n          icon: entry.icon,\n        })\n      }\n    },\n  },\n]\n\nexport function actionsUpToVersion(version: string): UpgradeActionDefinition[] {\n  return upgradeActions // NOSONAR \u2014 upgradeActions is populated at boot time by modules\n    .filter((action) => compareVersions(action.version, version) <= 0)\n    .sort((a, b) => compareVersions(a.version, b.version) || a.id.localeCompare(b.id))\n}\n\nexport function findUpgradeAction(actionId: string, maxVersion: string): UpgradeActionDefinition | undefined {\n  const matches = actionsUpToVersion(maxVersion).filter((action) => action.id === actionId)\n  if (!matches.length) return undefined\n  return matches[matches.length - 1]\n}\n"],
+  "mappings": "AACA,YAAY,YAAY;AAExB,SAAS,oBAAoB;AAE7B,SAAS,wCAAwC;AAEjD,MAAM,SAAS,aAAa,SAAS,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAyBtE,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,SAAO,OAAO,QAAQ,QAAQ,MAAM;AACtC;AAEO,MAAM,iBAA4C;AAAA,EACvD;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,MAAM,IAAI,EAAE,WAAW,IAAI,SAAS,GAAG;AACrC,YAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,YAAM,SAAS,MAAM,iCAAiC,EAAE,IAAI,aAAa,SAAS,CAAC;AACnF,aAAO,KAAK,gDAAgD;AAAA,QAC1D;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,SAAS,OAAO;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,gBAAgB,OAAO;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,KAAK,OAAO,EAAE,IAAI,UAAU,eAAe,MAAM;AAC/C,YAAM,CAAC,EAAE,4BAA4B,GAAG,EAAE,sBAAsB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrF,OAAO,0CAA0C;AAAA,QACjD,OAAO,sDAAsD;AAAA,MAC/D,CAAC;AACD,iBAAW,SAAS,6BAA6B;AAC/C,cAAM,sBAAsB,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,SAA4C;AAC7E,SAAO,eACJ,OAAO,CAAC,WAAW,gBAAgB,OAAO,SAAS,OAAO,KAAK,CAAC,EAChE,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AACrF;AAEO,SAAS,kBAAkB,UAAkB,YAAyD;AAC3G,QAAM,UAAU,mBAAmB,UAAU,EAAE,OAAO,CAAC,WAAW,OAAO,OAAO,QAAQ;AACxF,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,QAAQ,QAAQ,SAAS,CAAC;AACnC;",
   "names": []
 }

package/dist/modules/customer_accounts/api/admin/roles/[id]/acl.js

@@ -38,6 +38,7 @@ async function PUT(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {

package/dist/modules/customer_accounts/api/admin/roles/[id]/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/api/admin/roles/%5Bid%5D/acl.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {}\n\nconst ROLE_RESOURCE_KIND = 'customer_accounts.role'\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleAclSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // The ACL is part of the role aggregate: the role-edit screen loads and saves\n  // the role and its permissions together. Guard the write against the parent\n  // role's `updatedAt` so two admins editing the same role cannot silently\n  // overwrite each other's permission changes (#3194). Strictly additive \u2014 when\n  // the client sends no expected-version header the helper is a no-op.\n  try {\n    enforceCommandOptimisticLock({\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n    resourceKind: ROLE_RESOURCE_KIND,\n    resourceId: role.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId,\n  })\n\n  if (acl) {\n    await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? acl.isPortalAdmin,\n    })\n  } else {\n    const newAcl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId,\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? false,\n      createdAt: new Date(),\n    } as any)\n    em.persist(newAcl)\n    await em.flush()\n  }\n\n  // Bump the aggregate version so a stale role-edit screen (which holds the role's\n  // pre-edit `updatedAt`) cannot save old permission arrays afterwards. `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt })\n\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n  await customerRbacService.invalidateRoleCache(role.id)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nconst successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role ACL (admin)',\n  description: 'Updates the ACL (features and portal admin flag) for a customer role. Invalidates RBAC cache after update.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleAclSchema },\n  responses: [{ status: 200, description: 'ACL updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n    { status: 409, description: 'Stale ACL write (optimistic-lock conflict)', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update customer role ACL (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,uBAAuB;AAE9C,SAAS,2BAA2B;AACpC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW,CAAC;AAEzB,MAAM,qBAAqB;AAE3B,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC7I,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAOA,MAAI;AACF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AAED,MAAI,KAAK;AACP,UAAM,GAAG,aAAa,iBAAiB,EAAE,IAAI,IAAI,GAAG,GAAG;AAAA,MACrD,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB,IAAI;AAAA,IAClD,CAAC;AAAA,EACH,OAAO;AACL,UAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,MACxC;AAAA,MACA;AAAA,MACA,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB;AAAA,MAC5C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,MAAM;AACjB,UAAM,GAAG,MAAM;AAAA,EACjB;AAKA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,cAAc,CAAC;AAEjF,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,oBAAoB,oBAAoB,KAAK,EAAE;AAErD,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxF,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,cAAc,CAAC;AAAA,EAC9E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,EAChG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {}\n\nconst ROLE_RESOURCE_KIND = 'customer_accounts.role'\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleAclSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // The ACL is part of the role aggregate: the role-edit screen loads and saves\n  // the role and its permissions together. Guard the write against the parent\n  // role's `updatedAt` so two admins editing the same role cannot silently\n  // overwrite each other's permission changes (#3194). Strictly additive \u2014 when\n  // the client sends no expected-version header the helper is a no-op.\n  try {\n    enforceCommandOptimisticLock({\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n    resourceKind: ROLE_RESOURCE_KIND,\n    resourceId: role.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId,\n  })\n\n  if (acl) {\n    await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? acl.isPortalAdmin,\n    })\n  } else {\n    const newAcl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId,\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? false,\n      createdAt: new Date(),\n    } as any)\n    em.persist(newAcl)\n    await em.flush()\n  }\n\n  // Bump the aggregate version so a stale role-edit screen (which holds the role's\n  // pre-edit `updatedAt`) cannot save old permission arrays afterwards. `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt })\n\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n  await customerRbacService.invalidateRoleCache(role.id)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nconst successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role ACL (admin)',\n  description: 'Updates the ACL (features and portal admin flag) for a customer role. Invalidates RBAC cache after update.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleAclSchema },\n  responses: [{ status: 200, description: 'ACL updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n    { status: 409, description: 'Stale ACL write (optimistic-lock conflict)', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update customer role ACL (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,uBAAuB;AAE9C,SAAS,2BAA2B;AACpC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW,CAAC;AAEzB,MAAM,qBAAqB;AAE3B,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC7I,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAOA,MAAI;AACF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AAED,MAAI,KAAK;AACP,UAAM,GAAG,aAAa,iBAAiB,EAAE,IAAI,IAAI,GAAG,GAAG;AAAA,MACrD,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB,IAAI;AAAA,IAClD,CAAC;AAAA,EACH,OAAO;AACL,UAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,MACxC;AAAA,MACA;AAAA,MACA,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB;AAAA,MAC5C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,MAAM;AACjB,UAAM,GAAG,MAAM;AAAA,EACjB;AAKA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,cAAc,CAAC;AAEjF,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,oBAAoB,oBAAoB,KAAK,EAAE;AAErD,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxF,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,cAAc,CAAC;AAAA,EAC9E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,EAChG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/admin/roles/[id].js

@@ -27,6 +27,7 @@ async function GET(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {
@@ -76,6 +77,7 @@ async function PUT(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {
@@ -101,7 +103,11 @@ async function PUT(req, { params }) {
   if (parsed.data.description !== void 0) updates.description = parsed.data.description;
   if (parsed.data.isDefault !== void 0) updates.isDefault = parsed.data.isDefault;
   if (parsed.data.customerAssignable !== void 0) updates.customerAssignable = parsed.data.customerAssignable;
-  await em.nativeUpdate(CustomerRole, { id: role.id }, updates);
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  }, updates);
   void emitCustomerAccountsEvent("customer_accounts.role.updated", {
     id: role.id,
     name: updates.name || role.name,
@@ -125,6 +131,7 @@ async function DELETE(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {
@@ -151,8 +158,15 @@ async function DELETE(req, { params }) {
   if (assignedUsersCount > 0) {
     return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 });
   }
-  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: /* @__PURE__ */ new Date() });
-  await em.nativeUpdate(CustomerRoleAcl, { role: role.id }, { deletedAt: /* @__PURE__ */ new Date() });
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  }, { deletedAt: /* @__PURE__ */ new Date() });
+  await em.nativeUpdate(CustomerRoleAcl, {
+    role: role.id,
+    tenantId: auth.tenantId
+  }, { deletedAt: /* @__PURE__ */ new Date() });
   void emitCustomerAccountsEvent("customer_accounts.role.deleted", {
     id: role.id,
     name: role.name,

package/dist/modules/customer_accounts/api/admin/roles/[id].js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/api/admin/roles/%5Bid%5D.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { updateRoleSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nexport const metadata = {}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  if (!UUID_RE.test(params.id)) {\n    return NextResponse.json({ ok: false, error: 'Invalid role ID' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  })\n\n  const features = acl && Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n\n  return NextResponse.json({\n    ok: true,\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    description: role.description || null,\n    isDefault: role.isDefault,\n    isSystem: role.isSystem,\n    customerAssignable: role.customerAssignable,\n    createdAt: role.createdAt,\n    updatedAt: role.updatedAt || null,\n    features,\n  })\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  if (role.isSystem && parsed.data.name !== undefined && parsed.data.name !== role.name) {\n    return NextResponse.json({ ok: false, error: 'Cannot change name of a system role' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale overwrite so two admins editing the same role\n  // in parallel cannot silently clobber each other (#2055). Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // Always bump updated_at so the lock version advances on every save \u2014 `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  const updates: Record<string, unknown> = { updatedAt: nextUpdatedAt }\n  if (parsed.data.name !== undefined) updates.name = parsed.data.name\n  if (parsed.data.description !== undefined) updates.description = parsed.data.description\n  if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault\n  if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable\n\n  await em.nativeUpdate(CustomerRole, { id: role.id }, updates)\n\n  void emitCustomerAccountsEvent('customer_accounts.role.updated', {\n    id: role.id,\n    name: updates.name as string || role.name,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // System roles are seed-provided defaults but may still be removed once they are no\n  // longer needed (#3556). Only the default role is hard-protected here because signup\n  // auto-assigns it to new portal users \u2014 reassign the default first, then delete.\n  if (role.isDefault) {\n    return NextResponse.json({ ok: false, error: 'Cannot delete the default role. Set another role as default first.' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale delete. Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const assignedUsersCount = await em.count(CustomerUserRole, {\n    role: role.id as any,\n    deletedAt: null,\n  })\n  if (assignedUsersCount > 0) {\n    return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })\n  }\n\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: new Date() })\n  await em.nativeUpdate(CustomerRoleAcl, { role: role.id as any }, { deletedAt: new Date() })\n\n  void emitCustomerAccountsEvent('customer_accounts.role.deleted', {\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst aclSchema = z.object({\n  features: z.array(z.string()),\n  isPortalAdmin: z.boolean(),\n})\nconst roleDetailSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  slug: z.string(),\n  description: z.string().nullable(),\n  isDefault: z.boolean(),\n  isSystem: z.boolean(),\n  customerAssignable: z.boolean(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime().nullable(),\n  acl: aclSchema,\n})\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get customer role detail (admin)',\n  description: 'Returns full customer role details including ACL features.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{\n    status: 200,\n    description: 'Role detail with ACL',\n    schema: z.object({ ok: z.literal(true), role: roleDetailSchema }),\n  }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst putMethodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role (admin)',\n  description: 'Updates a customer role. System roles are protected from name changes.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleSchema },\n  responses: [{ status: 200, description: 'Role updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed or system role restriction', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst deleteMethodDoc: OpenApiMethodDoc = {\n  summary: 'Delete customer role (admin)',\n  description: 'Soft deletes a customer role and its ACL. The default role (auto-assigned to new portal users) and roles with assigned users cannot be deleted.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{ status: 200, description: 'Role deleted', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Default role or has assigned users', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer role detail management (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: getMethodDoc,\n    PUT: putMethodDoc,\n    DELETE: deleteMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,iBAAiB,wBAAwB;AAChE,SAAS,wBAAwB;AACjC,SAAS,iCAAiC;AAC1C,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAEzB,MAAM,WAAW,CAAC;AAEzB,MAAM,UAAU;AAEhB,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,GAAG;AAC5B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,QAAM,WAAW,OAAO,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAE9E,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe;AAAA,IACjC,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK,aAAa;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI,KAAK,YAAY,OAAO,KAAK,SAAS,UAAa,OAAO,KAAK,SAAS,KAAK,MAAM;AACrF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAIA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAIA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,UAAmC,EAAE,WAAW,cAAc;AACpE,MAAI,OAAO,KAAK,SAAS,OAAW,SAAQ,OAAO,OAAO,KAAK;AAC/D,MAAI,OAAO,KAAK,gBAAgB,OAAW,SAAQ,cAAc,OAAO,KAAK;AAC7E,MAAI,OAAO,KAAK,cAAc,OAAW,SAAQ,YAAY,OAAO,KAAK;AACzE,MAAI,OAAO,KAAK,uBAAuB,OAAW,SAAQ,qBAAqB,OAAO,KAAK;AAE3F,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,OAAO;AAE5D,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,QAAQ,QAAkB,KAAK;AAAA,IACrC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,MAAI,KAAK,WAAW;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qEAAqE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtI;AAGA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,qBAAqB,MAAM,GAAG,MAAM,kBAAkB;AAAA,IAC1D,MAAM,KAAK;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,qBAAqB,GAAG;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,kBAAkB,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzJ;AAEA,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC9E,QAAM,GAAG,aAAa,iBAAiB,EAAE,MAAM,KAAK,GAAU,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAE1F,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,QAAQ;AAC3B,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,QAAQ;AAAA,EACpB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,KAAK;AACP,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC;AAAA,IACV,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,iBAAiB,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,IACtF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { updateRoleSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nexport const metadata = {}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  if (!UUID_RE.test(params.id)) {\n    return NextResponse.json({ ok: false, error: 'Invalid role ID' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  })\n\n  const features = acl && Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n\n  return NextResponse.json({\n    ok: true,\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    description: role.description || null,\n    isDefault: role.isDefault,\n    isSystem: role.isSystem,\n    customerAssignable: role.customerAssignable,\n    createdAt: role.createdAt,\n    updatedAt: role.updatedAt || null,\n    features,\n  })\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  if (role.isSystem && parsed.data.name !== undefined && parsed.data.name !== role.name) {\n    return NextResponse.json({ ok: false, error: 'Cannot change name of a system role' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale overwrite so two admins editing the same role\n  // in parallel cannot silently clobber each other (#2055). Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // Always bump updated_at so the lock version advances on every save \u2014 `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  const updates: Record<string, unknown> = { updatedAt: nextUpdatedAt }\n  if (parsed.data.name !== undefined) updates.name = parsed.data.name\n  if (parsed.data.description !== undefined) updates.description = parsed.data.description\n  if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault\n  if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable\n\n  await em.nativeUpdate(CustomerRole, {\n    id: role.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }, updates)\n\n  void emitCustomerAccountsEvent('customer_accounts.role.updated', {\n    id: role.id,\n    name: updates.name as string || role.name,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // System roles are seed-provided defaults but may still be removed once they are no\n  // longer needed (#3556). Only the default role is hard-protected here because signup\n  // auto-assigns it to new portal users \u2014 reassign the default first, then delete.\n  if (role.isDefault) {\n    return NextResponse.json({ ok: false, error: 'Cannot delete the default role. Set another role as default first.' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale delete. Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const assignedUsersCount = await em.count(CustomerUserRole, {\n    role: role.id as any,\n    deletedAt: null,\n  })\n  if (assignedUsersCount > 0) {\n    return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })\n  }\n\n  await em.nativeUpdate(CustomerRole, {\n    id: role.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }, { deletedAt: new Date() })\n  await em.nativeUpdate(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  }, { deletedAt: new Date() })\n\n  void emitCustomerAccountsEvent('customer_accounts.role.deleted', {\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst aclSchema = z.object({\n  features: z.array(z.string()),\n  isPortalAdmin: z.boolean(),\n})\nconst roleDetailSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  slug: z.string(),\n  description: z.string().nullable(),\n  isDefault: z.boolean(),\n  isSystem: z.boolean(),\n  customerAssignable: z.boolean(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime().nullable(),\n  acl: aclSchema,\n})\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get customer role detail (admin)',\n  description: 'Returns full customer role details including ACL features.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{\n    status: 200,\n    description: 'Role detail with ACL',\n    schema: z.object({ ok: z.literal(true), role: roleDetailSchema }),\n  }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst putMethodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role (admin)',\n  description: 'Updates a customer role. System roles are protected from name changes.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleSchema },\n  responses: [{ status: 200, description: 'Role updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed or system role restriction', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst deleteMethodDoc: OpenApiMethodDoc = {\n  summary: 'Delete customer role (admin)',\n  description: 'Soft deletes a customer role and its ACL. The default role (auto-assigned to new portal users) and roles with assigned users cannot be deleted.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{ status: 200, description: 'Role deleted', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Default role or has assigned users', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer role detail management (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: getMethodDoc,\n    PUT: putMethodDoc,\n    DELETE: deleteMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,iBAAiB,wBAAwB;AAChE,SAAS,wBAAwB;AACjC,SAAS,iCAAiC;AAC1C,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAEzB,MAAM,WAAW,CAAC;AAEzB,MAAM,UAAU;AAEhB,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,GAAG;AAC5B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,QAAM,WAAW,OAAO,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAE9E,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe;AAAA,IACjC,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK,aAAa;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI,KAAK,YAAY,OAAO,KAAK,SAAS,UAAa,OAAO,KAAK,SAAS,KAAK,MAAM;AACrF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAIA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAIA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,UAAmC,EAAE,WAAW,cAAc;AACpE,MAAI,OAAO,KAAK,SAAS,OAAW,SAAQ,OAAO,OAAO,KAAK;AAC/D,MAAI,OAAO,KAAK,gBAAgB,OAAW,SAAQ,cAAc,OAAO,KAAK;AAC7E,MAAI,OAAO,KAAK,cAAc,OAAW,SAAQ,YAAY,OAAO,KAAK;AACzE,MAAI,OAAO,KAAK,uBAAuB,OAAW,SAAQ,qBAAqB,OAAO,KAAK;AAE3F,QAAM,GAAG,aAAa,cAAc;AAAA,IAClC,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,GAAG,OAAO;AAEV,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,QAAQ,QAAkB,KAAK;AAAA,IACrC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,MAAI,KAAK,WAAW;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qEAAqE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtI;AAGA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,qBAAqB,MAAM,GAAG,MAAM,kBAAkB;AAAA,IAC1D,MAAM,KAAK;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,qBAAqB,GAAG;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,kBAAkB,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzJ;AAEA,QAAM,GAAG,aAAa,cAAc;AAAA,IAClC,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC5B,QAAM,GAAG,aAAa,iBAAiB;AAAA,IACrC,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAE5B,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,QAAQ;AAC3B,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,QAAQ;AAAA,EACpB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,KAAK;AACP,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC;AAAA,IACV,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,iBAAiB,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,IACtF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/api/portal/users/[id]/roles.js

@@ -45,7 +45,12 @@ async function PUT(req, { params }) {
   const fetchedRoles = requestedRoleIds.length > 0 ? await findWithDecryption(
     em,
     CustomerRole,
-    { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null },
+    {
+      id: { $in: requestedRoleIds },
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      deletedAt: null
+    },
     void 0,
     { tenantId: auth.tenantId, organizationId: auth.orgId }
   ) : [];