@open-mercato/core 0.6.7-develop.6597.1.b8f069b7fe → 0.6.7-develop.6603.1.78e5b7a65d

package/dist/modules/api_keys/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/api_keys/data/entities.ts"],
-  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'api_keys' })\n@Unique({ properties: ['keyPrefix'] })\n@Index({\n  name: 'api_keys_opencode_session_id_uq',\n  expression:\n    'create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null',\n})\nexport class ApiKey {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'description', type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'key_hash', type: 'text' })\n  keyHash!: string\n\n  @Property({ name: 'key_prefix', type: 'text' })\n  keyPrefix!: string\n\n  @Property({ name: 'roles_json', type: 'json', nullable: true })\n  rolesJson?: string[] | null\n\n  @Property({ name: 'created_by', type: 'uuid', nullable: true })\n  createdBy?: string | null\n\n  /** Session token for ephemeral session-scoped keys (used by AI chat) */\n  @Property({ name: 'session_token', type: 'text', nullable: true })\n  sessionToken?: string | null\n\n  /** User ID who owns this session (for ephemeral keys) */\n  @Property({ name: 'session_user_id', type: 'uuid', nullable: true })\n  sessionUserId?: string | null\n\n  /** Encrypted API key secret for session keys (recoverable for API calls) */\n  @Property({ name: 'session_secret_encrypted', type: 'text', nullable: true })\n  sessionSecretEncrypted?: string | null\n\n  /**\n   * OpenCode session id bound to this api_key row. Set the first time the\n   * chat dispatcher receives a `done` event after minting a session token,\n   * then asserted on every subsequent resume to prevent cross-user session\n   * continuation (see security fix 2026-05-23).\n   */\n  @Property({ name: 'opencode_session_id', type: 'text', nullable: true })\n  opencodeSessionId?: string | null\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AASrD,IAAM,SAAN,MAAa;AAAA,EAAb;AAwDL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA7DE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,OAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,OAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPpD,OAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVlD,OAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,OAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,OAAO,CAAC;AAAA,GAhBjC,OAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAnBnC,OAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBnD,OAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBnD,OA0BX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BtD,OA8BX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjCxD,OAkCX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCjE,OAsCX;AASA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9C5D,OA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAjDnD,OAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GApDjD,OAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAvD7D,OAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA1D7E,OA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7DjD,OA8DX;AA9DW,SAAN;AAAA,EAPN,OAAO,EAAE,WAAW,WAAW,CAAC;AAAA,EAChC,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC;AAAA,EACpC,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,GACY;",
+  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'api_keys' })\n// The unique keyPrefix bounds the bcrypt candidate loop in findApiKeyBySecret to at\n// most one live row. Do not drop this constraint or widen the prefix space without\n// re-evaluating that loop's per-request cost (see #3812).\n@Unique({ properties: ['keyPrefix'] })\n@Index({\n  name: 'api_keys_opencode_session_id_uq',\n  expression:\n    'create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null',\n})\nexport class ApiKey {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'description', type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'key_hash', type: 'text' })\n  keyHash!: string\n\n  @Property({ name: 'key_prefix', type: 'text' })\n  keyPrefix!: string\n\n  @Property({ name: 'roles_json', type: 'json', nullable: true })\n  rolesJson?: string[] | null\n\n  @Property({ name: 'created_by', type: 'uuid', nullable: true })\n  createdBy?: string | null\n\n  /** Session token for ephemeral session-scoped keys (used by AI chat) */\n  @Property({ name: 'session_token', type: 'text', nullable: true })\n  sessionToken?: string | null\n\n  /** User ID who owns this session (for ephemeral keys) */\n  @Property({ name: 'session_user_id', type: 'uuid', nullable: true })\n  sessionUserId?: string | null\n\n  /** Encrypted API key secret for session keys (recoverable for API calls) */\n  @Property({ name: 'session_secret_encrypted', type: 'text', nullable: true })\n  sessionSecretEncrypted?: string | null\n\n  /**\n   * OpenCode session id bound to this api_key row. Set the first time the\n   * chat dispatcher receives a `done` event after minting a session token,\n   * then asserted on every subsequent resume to prevent cross-user session\n   * continuation (see security fix 2026-05-23).\n   */\n  @Property({ name: 'opencode_session_id', type: 'text', nullable: true })\n  opencodeSessionId?: string | null\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAYrD,IAAM,SAAN,MAAa;AAAA,EAAb;AAwDL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA7DE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,OAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,OAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPpD,OAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVlD,OAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,OAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,OAAO,CAAC;AAAA,GAhBjC,OAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAnBnC,OAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBnD,OAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBnD,OA0BX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BtD,OA8BX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjCxD,OAkCX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCjE,OAsCX;AASA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9C5D,OA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAjDnD,OAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GApDjD,OAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAvD7D,OAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA1D7E,OA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7DjD,OA8DX;AA9DW,SAAN;AAAA,EAVN,OAAO,EAAE,WAAW,WAAW,CAAC;AAAA,EAIhC,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC;AAAA,EACpC,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,GACY;",
   "names": []
 }

package/dist/modules/api_keys/services/apiKeyService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/api_keys/services/apiKeyService.ts"],
-  "sourcesContent": ["import { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash, compare } from 'bcryptjs'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '../data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { encryptWithAesGcm, decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { getSharedApiKeyAuthCache } from '@open-mercato/shared/lib/auth/apiKeyAuthCache'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('api_keys').child({ component: 'api-key-service' })\n\nconst BCRYPT_COST = 10\n\n// =============================================================================\n// Session Secret Encryption Helpers\n// =============================================================================\n\n/**\n * Encrypt an API key secret for storage.\n * Uses tenant-specific DEK if available, otherwise returns null.\n */\nasync function encryptSessionSecret(\n  secret: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId) return null\n\n  const kms = createKmsService()\n  if (!kms.isHealthy()) return null\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) {\n    // Try to create a DEK if one doesn't exist\n    const created = await kms.createTenantDek(tenantId)\n    if (!created) return null\n    const encrypted = encryptWithAesGcm(secret, created.key)\n    return encrypted.value\n  }\n\n  const encrypted = encryptWithAesGcm(secret, dek.key)\n  return encrypted.value\n}\n\n/**\n * Decrypt an API key secret from storage.\n * Returns null if decryption fails or no DEK available.\n */\nasync function decryptSessionSecret(\n  encrypted: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId || !encrypted) return null\n\n  const kms = createKmsService()\n  if (!kms.isHealthy()) return null\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) return null\n\n  return decryptWithAesGcm(encrypted, dek.key)\n}\n\nexport type CreateApiKeyInput = {\n  name: string\n  description?: string | null\n  tenantId?: string | null\n  organizationId?: string | null\n  roles?: string[]\n  expiresAt?: Date | null\n  createdBy?: string | null\n}\n\nexport type ApiKeyWithSecret = {\n  record: ApiKey\n  secret: string\n}\n\nexport function generateApiKeySecret(): { secret: string; prefix: string } {\n  const short = randomBytes(4).toString('hex')\n  const body = randomBytes(24).toString('hex')\n  const secret = `omk_${short}.${body}`\n  const prefix = secret.slice(0, 12)\n  return { secret, prefix }\n}\n\nexport async function hashApiKey(secret: string): Promise<string> {\n  return hash(secret, BCRYPT_COST)\n}\n\nexport async function verifyApiKey(secret: string, keyHash: string): Promise<boolean> {\n  return compare(secret, keyHash)\n}\n\nexport async function createApiKey(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  opts: { rbac?: RbacService } = {},\n): Promise<ApiKeyWithSecret> {\n  const { secret, prefix } = generateApiKeySecret()\n  const keyHash = await hashApiKey(secret)\n  const record = em.create(ApiKey, {\n    name: input.name,\n    description: input.description ?? null,\n    tenantId: input.tenantId ?? null,\n    organizationId: input.organizationId ?? null,\n    keyHash,\n    keyPrefix: prefix,\n    rolesJson: Array.isArray(input.roles) ? input.roles : [],\n    createdBy: input.createdBy ?? null,\n    expiresAt: input.expiresAt ?? null,\n    createdAt: new Date(),\n  })\n  await em.persist(record).flush()\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${record.id}`)\n  }\n  return { record, secret }\n}\n\nexport async function deleteApiKey(\n  em: EntityManager,\n  id: string,\n  opts: { rbac?: RbacService } = {},\n): Promise<void> {\n  const record = await em.findOne(ApiKey, { id })\n  if (!record) return\n  record.deletedAt = new Date()\n  await em.persist(record).flush()\n  getSharedApiKeyAuthCache().invalidateByKeyId(record.id)\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${record.id}`)\n  }\n}\n\nexport async function findApiKeyBySecret(em: EntityManager, secret: string): Promise<ApiKey | null> {\n  if (!secret) return null\n  // Extract prefix from the secret for fast candidate lookup\n  const prefix = secret.slice(0, 12)\n  // Find candidates by prefix (fast index lookup)\n  const candidates = await em.find(ApiKey, { keyPrefix: prefix, deletedAt: null })\n  // Verify each candidate with bcrypt until we find a match\n  for (const candidate of candidates) {\n    if (candidate.expiresAt && candidate.expiresAt.getTime() < Date.now()) continue\n    const isValid = await verifyApiKey(secret, candidate.keyHash)\n    if (isValid) return candidate\n  }\n  return null\n}\n\n// =============================================================================\n// Session-scoped API Keys (for AI Chat ephemeral authorization)\n// =============================================================================\n\nexport type CreateSessionApiKeyInput = {\n  sessionToken: string\n  userId: string\n  userRoles: string[]\n  tenantId?: string | null\n  organizationId?: string | null\n  ttlMinutes?: number\n}\n\n/**\n * Generate a unique session token for ephemeral API keys.\n * Format: sess_{32 hex chars}\n */\nexport function generateSessionToken(): string {\n  return `sess_${randomBytes(16).toString('hex')}`\n}\n\n/**\n * Create an ephemeral API key scoped to a chat session.\n * The key inherits the user's roles and expires after ttlMinutes (default 30).\n * The API key secret is encrypted and stored so it can be recovered for API calls.\n */\nexport async function createSessionApiKey(\n  em: EntityManager,\n  input: CreateSessionApiKeyInput\n): Promise<{ keyId: string; secret: string; sessionToken: string }> {\n  const { secret, prefix } = generateApiKeySecret()\n  const ttl = input.ttlMinutes ?? 30\n  const expiresAt = new Date(Date.now() + ttl * 60 * 1000)\n  const keyHash = await hashApiKey(secret)\n\n  // Encrypt the secret for later retrieval (used by MCP server for API calls)\n  const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null)\n\n  const record = em.create(ApiKey, {\n    name: `__session_${input.sessionToken}__`,\n    description: 'Ephemeral session API key for AI chat',\n    tenantId: input.tenantId ?? null,\n    organizationId: input.organizationId ?? null,\n    keyHash,\n    keyPrefix: prefix,\n    rolesJson: input.userRoles,\n    createdBy: input.userId,\n    sessionToken: input.sessionToken,\n    sessionUserId: input.userId,\n    sessionSecretEncrypted: encryptedSecret,\n    expiresAt,\n    createdAt: new Date(),\n  })\n\n  await em.persist(record).flush()\n\n  return {\n    keyId: record.id,\n    secret,\n    sessionToken: input.sessionToken,\n  }\n}\n\n/**\n * Find an API key by its session token.\n * Returns null if not found, expired, or deleted.\n */\nexport async function findApiKeyBySessionToken(\n  em: EntityManager,\n  sessionToken: string\n): Promise<ApiKey | null> {\n  if (!sessionToken) return null\n\n  const record = await em.findOne(ApiKey, {\n    sessionToken,\n    deletedAt: null,\n  })\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Bind an OpenCode session id to the api_key row that owns this chat session.\n *\n * Called by the chat dispatcher the first time we see the `done` event for a\n * freshly minted session token. From that point on,\n * `findApiKeyByOpencodeSessionId(em, opencodeSessionId)` returns the same row,\n * which the ai-assistant runtime uses to assert ownership on every resume.\n *\n * Throws when the session token has been deleted/expired, and when the api_key\n * row is already bound to a DIFFERENT OpenCode session (defensive: this should\n * never happen in practice because each chat mints a new session token, but we\n * fail closed instead of silently overwriting).\n *\n * Idempotent when the row is already bound to the same OpenCode session id.\n */\nexport async function bindOpencodeSessionToApiKey(\n  em: EntityManager,\n  sessionToken: string,\n  opencodeSessionId: string\n): Promise<void> {\n  if (!sessionToken) throw new Error('Session token not found or expired')\n  if (!opencodeSessionId) throw new Error('OpenCode session id is required')\n\n  const row = await findApiKeyBySessionToken(em, sessionToken)\n  if (!row) throw new Error('Session token not found or expired')\n\n  if (row.opencodeSessionId === opencodeSessionId) return\n  if (row.opencodeSessionId && row.opencodeSessionId !== opencodeSessionId) {\n    throw new Error('Session token already bound to a different OpenCode session')\n  }\n\n  row.opencodeSessionId = opencodeSessionId\n  await em.persist(row).flush()\n}\n\n/**\n * Find an api_key row by its bound OpenCode session id.\n *\n * Returns null if no active row matches, or if the matched row is expired\n * (same contract as `findApiKeyBySessionToken`). Uses\n * `findOneWithDecryption` so encrypted-at-rest fields on the row are decrypted\n * before the ai-assistant runtime inspects `sessionUserId` / `tenantId` /\n * `organizationId` for the ownership check.\n */\nexport async function findApiKeyByOpencodeSessionId(\n  em: EntityManager,\n  opencodeSessionId: string\n): Promise<ApiKey | null> {\n  if (!opencodeSessionId) return null\n\n  const record = await findOneWithDecryption(\n    em,\n    ApiKey,\n    { opencodeSessionId, deletedAt: null } as any,\n  )\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Find a session API key with its decrypted secret.\n * Returns null if not found, expired, deleted, or decryption fails.\n * This is used by the MCP server to recover the API key secret for making\n * authenticated API calls on behalf of the user.\n */\nexport async function findSessionApiKeyWithSecret(\n  em: EntityManager,\n  sessionToken: string\n): Promise<{ key: ApiKey; secret: string } | null> {\n  const record = await findApiKeyBySessionToken(em, sessionToken)\n  if (!record) return null\n\n  // If no encrypted secret stored, cannot recover\n  if (!record.sessionSecretEncrypted) {\n    logger.warn('Session key has no encrypted secret', { apiKeyId: record.id })\n    return null\n  }\n\n  // Decrypt the secret\n  const secret = await decryptSessionSecret(record.sessionSecretEncrypted, record.tenantId ?? null)\n  if (!secret) {\n    logger.warn('Failed to decrypt session secret', { apiKeyId: record.id })\n    return null\n  }\n\n  return { key: record, secret }\n}\n\n/**\n * Delete an ephemeral API key by its session token.\n */\nexport async function deleteSessionApiKey(\n  em: EntityManager,\n  sessionToken: string\n): Promise<void> {\n  const record = await em.findOne(ApiKey, { sessionToken, deletedAt: null })\n  if (!record) return\n\n  record.deletedAt = new Date()\n  await em.persist(record).flush()\n  getSharedApiKeyAuthCache().invalidateByKeyId(record.id)\n}\n\n/**\n * Execute a function with a one-time API key\n *\n * Creates a temporary API key, executes the function, and deletes the key.\n * Perfect for workflow activities that need authenticated access without\n * storing long-lived credentials.\n *\n * @param em - Entity manager\n * @param input - API key configuration\n * @param fn - Function to execute with the API key secret\n * @returns Result of the function\n */\nconst ONETIME_KEY_MAX_TTL_MS = 5 * 60 * 1000\n\nexport async function withOnetimeApiKey<T>(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  fn: (secret: string) => Promise<T>\n): Promise<T> {\n  const maxExpiresAt = new Date(Date.now() + ONETIME_KEY_MAX_TTL_MS)\n  const safeExpiresAt = input.expiresAt && input.expiresAt < maxExpiresAt\n    ? input.expiresAt\n    : maxExpiresAt\n\n  const { record, secret } = await createApiKey(em, {\n    ...input,\n    name: input.name || '__onetime__',\n    description: input.description || 'One-time API key',\n    expiresAt: safeExpiresAt,\n  })\n\n  try {\n    const result = await fn(secret)\n    return result\n  } finally {\n    try {\n      record.deletedAt = new Date()\n      await em.persist(record).flush()\n      getSharedApiKeyAuthCache().invalidateByKeyId(record.id)\n    } catch (error) {\n      logger.error('Failed to soft-delete one-time API key', { err: error })\n    }\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,MAAM,eAAe;AAG9B,SAAS,cAAc;AACvB,SAAS,wBAAwB;AACjC,SAAS,mBAAmB,yBAAyB;AACrD,SAAS,gCAAgC;AACzC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAE9E,MAAM,cAAc;AAUpB,eAAe,qBACb,QACA,UACwB;AACxB,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAI,UAAU,EAAG,QAAO;AAE7B,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,KAAK;AAER,UAAM,UAAU,MAAM,IAAI,gBAAgB,QAAQ;AAClD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAMA,aAAY,kBAAkB,QAAQ,QAAQ,GAAG;AACvD,WAAOA,WAAU;AAAA,EACnB;AAEA,QAAM,YAAY,kBAAkB,QAAQ,IAAI,GAAG;AACnD,SAAO,UAAU;AACnB;AAMA,eAAe,qBACb,WACA,UACwB;AACxB,MAAI,CAAC,YAAY,CAAC,UAAW,QAAO;AAEpC,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAI,UAAU,EAAG,QAAO;AAE7B,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO,kBAAkB,WAAW,IAAI,GAAG;AAC7C;AAiBO,SAAS,uBAA2D;AACzE,QAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAC3C,QAAM,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAC3C,QAAM,SAAS,OAAO,KAAK,IAAI,IAAI;AACnC,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AACjC,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,WAAW,QAAiC;AAChE,SAAO,KAAK,QAAQ,WAAW;AACjC;AAEA,eAAsB,aAAa,QAAgB,SAAmC;AACpF,SAAO,QAAQ,QAAQ,OAAO;AAChC;AAEA,eAAsB,aACpB,IACA,OACA,OAA+B,CAAC,GACL;AAC3B,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,SAAS,GAAG,OAAO,QAAQ;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM,eAAe;AAAA,IAClC,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC;AAAA,IACA,WAAW;AAAA,IACX,WAAW,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,QAAQ,CAAC;AAAA,IACvD,WAAW,MAAM,aAAa;AAAA,IAC9B,WAAW,MAAM,aAAa;AAAA,IAC9B,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,EAC5D;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,aACpB,IACA,IACA,OAA+B,CAAC,GACjB;AACf,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,GAAG,CAAC;AAC9C,MAAI,CAAC,OAAQ;AACb,SAAO,YAAY,oBAAI,KAAK;AAC5B,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,2BAAyB,EAAE,kBAAkB,OAAO,EAAE;AACtD,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,EAC5D;AACF;AAEA,eAAsB,mBAAmB,IAAmB,QAAwC;AAClG,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AAEjC,QAAM,aAAa,MAAM,GAAG,KAAK,QAAQ,EAAE,WAAW,QAAQ,WAAW,KAAK,CAAC;AAE/E,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,aAAa,UAAU,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG;AACvE,UAAM,UAAU,MAAM,aAAa,QAAQ,UAAU,OAAO;AAC5D,QAAI,QAAS,QAAO;AAAA,EACtB;AACA,SAAO;AACT;AAmBO,SAAS,uBAA+B;AAC7C,SAAO,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAChD;AAOA,eAAsB,oBACpB,IACA,OACkE;AAClE,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,MAAM,MAAM,cAAc;AAChC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,GAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAGvC,QAAM,kBAAkB,MAAM,qBAAqB,QAAQ,MAAM,YAAY,IAAI;AAEjF,QAAM,SAAS,GAAG,OAAO,QAAQ;AAAA,IAC/B,MAAM,aAAa,MAAM,YAAY;AAAA,IACrC,aAAa;AAAA,IACb,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC;AAAA,IACA,WAAW;AAAA,IACX,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,wBAAwB;AAAA,IACxB;AAAA,IACA,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AAED,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAE/B,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd;AAAA,IACA,cAAc,MAAM;AAAA,EACtB;AACF;AAMA,eAAsB,yBACpB,IACA,cACwB;AACxB,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ;AAAA,IACtC;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAiBA,eAAsB,4BACpB,IACA,cACA,mBACe;AACf,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oCAAoC;AACvE,MAAI,CAAC,kBAAmB,OAAM,IAAI,MAAM,iCAAiC;AAEzE,QAAM,MAAM,MAAM,yBAAyB,IAAI,YAAY;AAC3D,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oCAAoC;AAE9D,MAAI,IAAI,sBAAsB,kBAAmB;AACjD,MAAI,IAAI,qBAAqB,IAAI,sBAAsB,mBAAmB;AACxE,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,MAAI,oBAAoB;AACxB,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC9B;AAWA,eAAsB,8BACpB,IACA,mBACwB;AACxB,MAAI,CAAC,kBAAmB,QAAO;AAE/B,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,mBAAmB,WAAW,KAAK;AAAA,EACvC;AAEA,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAQA,eAAsB,4BACpB,IACA,cACiD;AACjD,QAAM,SAAS,MAAM,yBAAyB,IAAI,YAAY;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAGpB,MAAI,CAAC,OAAO,wBAAwB;AAClC,WAAO,KAAK,uCAAuC,EAAE,UAAU,OAAO,GAAG,CAAC;AAC1E,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,MAAM,qBAAqB,OAAO,wBAAwB,OAAO,YAAY,IAAI;AAChG,MAAI,CAAC,QAAQ;AACX,WAAO,KAAK,oCAAoC,EAAE,UAAU,OAAO,GAAG,CAAC;AACvE,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,OAAO;AAC/B;AAKA,eAAsB,oBACpB,IACA,cACe;AACf,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,cAAc,WAAW,KAAK,CAAC;AACzE,MAAI,CAAC,OAAQ;AAEb,SAAO,YAAY,oBAAI,KAAK;AAC5B,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,2BAAyB,EAAE,kBAAkB,OAAO,EAAE;AACxD;AAcA,MAAM,yBAAyB,IAAI,KAAK;AAExC,eAAsB,kBACpB,IACA,OACA,IACY;AACZ,QAAM,eAAe,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,QAAM,gBAAgB,MAAM,aAAa,MAAM,YAAY,eACvD,MAAM,YACN;AAEJ,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,aAAa,IAAI;AAAA,IAChD,GAAG;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW;AAAA,EACb,CAAC;AAED,MAAI;AACF,UAAM,SAAS,MAAM,GAAG,MAAM;AAC9B,WAAO;AAAA,EACT,UAAE;AACA,QAAI;AACF,aAAO,YAAY,oBAAI,KAAK;AAC5B,YAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,+BAAyB,EAAE,kBAAkB,OAAO,EAAE;AAAA,IACxD,SAAS,OAAO;AACd,aAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash, compare } from 'bcryptjs'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '../data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { encryptWithAesGcm, decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { getSharedApiKeyAuthCache } from '@open-mercato/shared/lib/auth/apiKeyAuthCache'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('api_keys').child({ component: 'api-key-service' })\n\nconst BCRYPT_COST = 10\n\n// =============================================================================\n// Session Secret Encryption Helpers\n// =============================================================================\n\n/**\n * Encrypt an API key secret for storage.\n * Uses tenant-specific DEK if available, otherwise returns null.\n */\nasync function encryptSessionSecret(\n  secret: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId) return null\n\n  const kms = createKmsService()\n  if (!kms.isHealthy()) return null\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) {\n    // Try to create a DEK if one doesn't exist\n    const created = await kms.createTenantDek(tenantId)\n    if (!created) return null\n    const encrypted = encryptWithAesGcm(secret, created.key)\n    return encrypted.value\n  }\n\n  const encrypted = encryptWithAesGcm(secret, dek.key)\n  return encrypted.value\n}\n\n/**\n * Decrypt an API key secret from storage.\n * Returns null if decryption fails or no DEK available.\n */\nasync function decryptSessionSecret(\n  encrypted: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId || !encrypted) return null\n\n  const kms = createKmsService()\n  if (!kms.isHealthy()) return null\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) return null\n\n  return decryptWithAesGcm(encrypted, dek.key)\n}\n\nexport type CreateApiKeyInput = {\n  name: string\n  description?: string | null\n  tenantId?: string | null\n  organizationId?: string | null\n  roles?: string[]\n  expiresAt?: Date | null\n  createdBy?: string | null\n}\n\nexport type ApiKeyWithSecret = {\n  record: ApiKey\n  secret: string\n}\n\nexport function generateApiKeySecret(): { secret: string; prefix: string } {\n  const short = randomBytes(4).toString('hex')\n  const body = randomBytes(24).toString('hex')\n  const secret = `omk_${short}.${body}`\n  const prefix = secret.slice(0, 12)\n  return { secret, prefix }\n}\n\nexport async function hashApiKey(secret: string): Promise<string> {\n  return hash(secret, BCRYPT_COST)\n}\n\nexport async function verifyApiKey(secret: string, keyHash: string): Promise<boolean> {\n  return compare(secret, keyHash)\n}\n\nexport async function createApiKey(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  opts: { rbac?: RbacService } = {},\n): Promise<ApiKeyWithSecret> {\n  const { secret, prefix } = generateApiKeySecret()\n  const keyHash = await hashApiKey(secret)\n  const record = em.create(ApiKey, {\n    name: input.name,\n    description: input.description ?? null,\n    tenantId: input.tenantId ?? null,\n    organizationId: input.organizationId ?? null,\n    keyHash,\n    keyPrefix: prefix,\n    rolesJson: Array.isArray(input.roles) ? input.roles : [],\n    createdBy: input.createdBy ?? null,\n    expiresAt: input.expiresAt ?? null,\n    createdAt: new Date(),\n  })\n  await em.persist(record).flush()\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${record.id}`)\n  }\n  return { record, secret }\n}\n\nexport async function deleteApiKey(\n  em: EntityManager,\n  id: string,\n  opts: { rbac?: RbacService } = {},\n): Promise<void> {\n  const record = await em.findOne(ApiKey, { id })\n  if (!record) return\n  record.deletedAt = new Date()\n  await em.persist(record).flush()\n  getSharedApiKeyAuthCache().invalidateByKeyId(record.id)\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${record.id}`)\n  }\n}\n\nexport async function findApiKeyBySecret(em: EntityManager, secret: string): Promise<ApiKey | null> {\n  if (!secret) return null\n  // Extract prefix from the secret for fast candidate lookup\n  const prefix = secret.slice(0, 12)\n  // Find candidates by prefix (fast index lookup). Invariant: the unique keyPrefix\n  // constraint plus the deletedAt: null filter keep this to at most one live row, so\n  // the bcrypt loop below stays bounded. Do not widen the prefix space or relax either\n  // filter without re-evaluating that cost (see #3812).\n  const candidates = await em.find(ApiKey, { keyPrefix: prefix, deletedAt: null })\n  // Verify each candidate with bcrypt until we find a match\n  for (const candidate of candidates) {\n    if (candidate.expiresAt && candidate.expiresAt.getTime() < Date.now()) continue\n    const isValid = await verifyApiKey(secret, candidate.keyHash)\n    if (isValid) return candidate\n  }\n  return null\n}\n\n// =============================================================================\n// Session-scoped API Keys (for AI Chat ephemeral authorization)\n// =============================================================================\n\nexport type CreateSessionApiKeyInput = {\n  sessionToken: string\n  userId: string\n  userRoles: string[]\n  tenantId?: string | null\n  organizationId?: string | null\n  ttlMinutes?: number\n}\n\n/**\n * Generate a unique session token for ephemeral API keys.\n * Format: sess_{32 hex chars}\n */\nexport function generateSessionToken(): string {\n  return `sess_${randomBytes(16).toString('hex')}`\n}\n\n/**\n * Create an ephemeral API key scoped to a chat session.\n * The key inherits the user's roles and expires after ttlMinutes (default 30).\n * The API key secret is encrypted and stored so it can be recovered for API calls.\n */\nexport async function createSessionApiKey(\n  em: EntityManager,\n  input: CreateSessionApiKeyInput\n): Promise<{ keyId: string; secret: string; sessionToken: string }> {\n  const { secret, prefix } = generateApiKeySecret()\n  const ttl = input.ttlMinutes ?? 30\n  const expiresAt = new Date(Date.now() + ttl * 60 * 1000)\n  const keyHash = await hashApiKey(secret)\n\n  // Encrypt the secret for later retrieval (used by MCP server for API calls)\n  const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null)\n\n  const record = em.create(ApiKey, {\n    name: `__session_${input.sessionToken}__`,\n    description: 'Ephemeral session API key for AI chat',\n    tenantId: input.tenantId ?? null,\n    organizationId: input.organizationId ?? null,\n    keyHash,\n    keyPrefix: prefix,\n    rolesJson: input.userRoles,\n    createdBy: input.userId,\n    sessionToken: input.sessionToken,\n    sessionUserId: input.userId,\n    sessionSecretEncrypted: encryptedSecret,\n    expiresAt,\n    createdAt: new Date(),\n  })\n\n  await em.persist(record).flush()\n\n  return {\n    keyId: record.id,\n    secret,\n    sessionToken: input.sessionToken,\n  }\n}\n\n/**\n * Find an API key by its session token.\n * Returns null if not found, expired, or deleted.\n */\nexport async function findApiKeyBySessionToken(\n  em: EntityManager,\n  sessionToken: string\n): Promise<ApiKey | null> {\n  if (!sessionToken) return null\n\n  const record = await em.findOne(ApiKey, {\n    sessionToken,\n    deletedAt: null,\n  })\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Bind an OpenCode session id to the api_key row that owns this chat session.\n *\n * Called by the chat dispatcher the first time we see the `done` event for a\n * freshly minted session token. From that point on,\n * `findApiKeyByOpencodeSessionId(em, opencodeSessionId)` returns the same row,\n * which the ai-assistant runtime uses to assert ownership on every resume.\n *\n * Throws when the session token has been deleted/expired, and when the api_key\n * row is already bound to a DIFFERENT OpenCode session (defensive: this should\n * never happen in practice because each chat mints a new session token, but we\n * fail closed instead of silently overwriting).\n *\n * Idempotent when the row is already bound to the same OpenCode session id.\n */\nexport async function bindOpencodeSessionToApiKey(\n  em: EntityManager,\n  sessionToken: string,\n  opencodeSessionId: string\n): Promise<void> {\n  if (!sessionToken) throw new Error('Session token not found or expired')\n  if (!opencodeSessionId) throw new Error('OpenCode session id is required')\n\n  const row = await findApiKeyBySessionToken(em, sessionToken)\n  if (!row) throw new Error('Session token not found or expired')\n\n  if (row.opencodeSessionId === opencodeSessionId) return\n  if (row.opencodeSessionId && row.opencodeSessionId !== opencodeSessionId) {\n    throw new Error('Session token already bound to a different OpenCode session')\n  }\n\n  row.opencodeSessionId = opencodeSessionId\n  await em.persist(row).flush()\n}\n\n/**\n * Find an api_key row by its bound OpenCode session id.\n *\n * Returns null if no active row matches, or if the matched row is expired\n * (same contract as `findApiKeyBySessionToken`). Uses\n * `findOneWithDecryption` so encrypted-at-rest fields on the row are decrypted\n * before the ai-assistant runtime inspects `sessionUserId` / `tenantId` /\n * `organizationId` for the ownership check.\n */\nexport async function findApiKeyByOpencodeSessionId(\n  em: EntityManager,\n  opencodeSessionId: string\n): Promise<ApiKey | null> {\n  if (!opencodeSessionId) return null\n\n  const record = await findOneWithDecryption(\n    em,\n    ApiKey,\n    { opencodeSessionId, deletedAt: null } as any,\n  )\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Find a session API key with its decrypted secret.\n * Returns null if not found, expired, deleted, or decryption fails.\n * This is used by the MCP server to recover the API key secret for making\n * authenticated API calls on behalf of the user.\n */\nexport async function findSessionApiKeyWithSecret(\n  em: EntityManager,\n  sessionToken: string\n): Promise<{ key: ApiKey; secret: string } | null> {\n  const record = await findApiKeyBySessionToken(em, sessionToken)\n  if (!record) return null\n\n  // If no encrypted secret stored, cannot recover\n  if (!record.sessionSecretEncrypted) {\n    logger.warn('Session key has no encrypted secret', { apiKeyId: record.id })\n    return null\n  }\n\n  // Decrypt the secret\n  const secret = await decryptSessionSecret(record.sessionSecretEncrypted, record.tenantId ?? null)\n  if (!secret) {\n    logger.warn('Failed to decrypt session secret', { apiKeyId: record.id })\n    return null\n  }\n\n  return { key: record, secret }\n}\n\n/**\n * Delete an ephemeral API key by its session token.\n */\nexport async function deleteSessionApiKey(\n  em: EntityManager,\n  sessionToken: string\n): Promise<void> {\n  const record = await em.findOne(ApiKey, { sessionToken, deletedAt: null })\n  if (!record) return\n\n  record.deletedAt = new Date()\n  await em.persist(record).flush()\n  getSharedApiKeyAuthCache().invalidateByKeyId(record.id)\n}\n\n/**\n * Execute a function with a one-time API key\n *\n * Creates a temporary API key, executes the function, and deletes the key.\n * Perfect for workflow activities that need authenticated access without\n * storing long-lived credentials.\n *\n * @param em - Entity manager\n * @param input - API key configuration\n * @param fn - Function to execute with the API key secret\n * @returns Result of the function\n */\nconst ONETIME_KEY_MAX_TTL_MS = 5 * 60 * 1000\n\nexport async function withOnetimeApiKey<T>(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  fn: (secret: string) => Promise<T>\n): Promise<T> {\n  const maxExpiresAt = new Date(Date.now() + ONETIME_KEY_MAX_TTL_MS)\n  const safeExpiresAt = input.expiresAt && input.expiresAt < maxExpiresAt\n    ? input.expiresAt\n    : maxExpiresAt\n\n  const { record, secret } = await createApiKey(em, {\n    ...input,\n    name: input.name || '__onetime__',\n    description: input.description || 'One-time API key',\n    expiresAt: safeExpiresAt,\n  })\n\n  try {\n    const result = await fn(secret)\n    return result\n  } finally {\n    try {\n      record.deletedAt = new Date()\n      await em.persist(record).flush()\n      getSharedApiKeyAuthCache().invalidateByKeyId(record.id)\n    } catch (error) {\n      logger.error('Failed to soft-delete one-time API key', { err: error })\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,MAAM,eAAe;AAG9B,SAAS,cAAc;AACvB,SAAS,wBAAwB;AACjC,SAAS,mBAAmB,yBAAyB;AACrD,SAAS,gCAAgC;AACzC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAE9E,MAAM,cAAc;AAUpB,eAAe,qBACb,QACA,UACwB;AACxB,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAI,UAAU,EAAG,QAAO;AAE7B,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,KAAK;AAER,UAAM,UAAU,MAAM,IAAI,gBAAgB,QAAQ;AAClD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAMA,aAAY,kBAAkB,QAAQ,QAAQ,GAAG;AACvD,WAAOA,WAAU;AAAA,EACnB;AAEA,QAAM,YAAY,kBAAkB,QAAQ,IAAI,GAAG;AACnD,SAAO,UAAU;AACnB;AAMA,eAAe,qBACb,WACA,UACwB;AACxB,MAAI,CAAC,YAAY,CAAC,UAAW,QAAO;AAEpC,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAI,UAAU,EAAG,QAAO;AAE7B,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO,kBAAkB,WAAW,IAAI,GAAG;AAC7C;AAiBO,SAAS,uBAA2D;AACzE,QAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAC3C,QAAM,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAC3C,QAAM,SAAS,OAAO,KAAK,IAAI,IAAI;AACnC,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AACjC,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,WAAW,QAAiC;AAChE,SAAO,KAAK,QAAQ,WAAW;AACjC;AAEA,eAAsB,aAAa,QAAgB,SAAmC;AACpF,SAAO,QAAQ,QAAQ,OAAO;AAChC;AAEA,eAAsB,aACpB,IACA,OACA,OAA+B,CAAC,GACL;AAC3B,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,SAAS,GAAG,OAAO,QAAQ;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM,eAAe;AAAA,IAClC,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC;AAAA,IACA,WAAW;AAAA,IACX,WAAW,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,QAAQ,CAAC;AAAA,IACvD,WAAW,MAAM,aAAa;AAAA,IAC9B,WAAW,MAAM,aAAa;AAAA,IAC9B,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,EAC5D;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,aACpB,IACA,IACA,OAA+B,CAAC,GACjB;AACf,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,GAAG,CAAC;AAC9C,MAAI,CAAC,OAAQ;AACb,SAAO,YAAY,oBAAI,KAAK;AAC5B,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,2BAAyB,EAAE,kBAAkB,OAAO,EAAE;AACtD,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,EAC5D;AACF;AAEA,eAAsB,mBAAmB,IAAmB,QAAwC;AAClG,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AAKjC,QAAM,aAAa,MAAM,GAAG,KAAK,QAAQ,EAAE,WAAW,QAAQ,WAAW,KAAK,CAAC;AAE/E,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,aAAa,UAAU,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG;AACvE,UAAM,UAAU,MAAM,aAAa,QAAQ,UAAU,OAAO;AAC5D,QAAI,QAAS,QAAO;AAAA,EACtB;AACA,SAAO;AACT;AAmBO,SAAS,uBAA+B;AAC7C,SAAO,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAChD;AAOA,eAAsB,oBACpB,IACA,OACkE;AAClE,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,MAAM,MAAM,cAAc;AAChC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,GAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAGvC,QAAM,kBAAkB,MAAM,qBAAqB,QAAQ,MAAM,YAAY,IAAI;AAEjF,QAAM,SAAS,GAAG,OAAO,QAAQ;AAAA,IAC/B,MAAM,aAAa,MAAM,YAAY;AAAA,IACrC,aAAa;AAAA,IACb,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC;AAAA,IACA,WAAW;AAAA,IACX,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,wBAAwB;AAAA,IACxB;AAAA,IACA,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AAED,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAE/B,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd;AAAA,IACA,cAAc,MAAM;AAAA,EACtB;AACF;AAMA,eAAsB,yBACpB,IACA,cACwB;AACxB,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ;AAAA,IACtC;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAiBA,eAAsB,4BACpB,IACA,cACA,mBACe;AACf,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oCAAoC;AACvE,MAAI,CAAC,kBAAmB,OAAM,IAAI,MAAM,iCAAiC;AAEzE,QAAM,MAAM,MAAM,yBAAyB,IAAI,YAAY;AAC3D,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oCAAoC;AAE9D,MAAI,IAAI,sBAAsB,kBAAmB;AACjD,MAAI,IAAI,qBAAqB,IAAI,sBAAsB,mBAAmB;AACxE,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,MAAI,oBAAoB;AACxB,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC9B;AAWA,eAAsB,8BACpB,IACA,mBACwB;AACxB,MAAI,CAAC,kBAAmB,QAAO;AAE/B,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,mBAAmB,WAAW,KAAK;AAAA,EACvC;AAEA,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAQA,eAAsB,4BACpB,IACA,cACiD;AACjD,QAAM,SAAS,MAAM,yBAAyB,IAAI,YAAY;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAGpB,MAAI,CAAC,OAAO,wBAAwB;AAClC,WAAO,KAAK,uCAAuC,EAAE,UAAU,OAAO,GAAG,CAAC;AAC1E,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,MAAM,qBAAqB,OAAO,wBAAwB,OAAO,YAAY,IAAI;AAChG,MAAI,CAAC,QAAQ;AACX,WAAO,KAAK,oCAAoC,EAAE,UAAU,OAAO,GAAG,CAAC;AACvE,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,OAAO;AAC/B;AAKA,eAAsB,oBACpB,IACA,cACe;AACf,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,cAAc,WAAW,KAAK,CAAC;AACzE,MAAI,CAAC,OAAQ;AAEb,SAAO,YAAY,oBAAI,KAAK;AAC5B,QAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,2BAAyB,EAAE,kBAAkB,OAAO,EAAE;AACxD;AAcA,MAAM,yBAAyB,IAAI,KAAK;AAExC,eAAsB,kBACpB,IACA,OACA,IACY;AACZ,QAAM,eAAe,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,QAAM,gBAAgB,MAAM,aAAa,MAAM,YAAY,eACvD,MAAM,YACN;AAEJ,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,aAAa,IAAI;AAAA,IAChD,GAAG;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW;AAAA,EACb,CAAC;AAED,MAAI;AACF,UAAM,SAAS,MAAM,GAAG,MAAM;AAC9B,WAAO;AAAA,EACT,UAAE;AACA,QAAI;AACF,aAAO,YAAY,oBAAI,KAAK;AAC5B,YAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,+BAAyB,EAAE,kBAAkB,OAAO,EAAE;AAAA,IACxD,SAAS,OAAO;AACd,aAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AACF;",
   "names": ["encrypted"]
 }

package/dist/modules/attachments/backend/storage/attachments/page.meta.js

@@ -3,8 +3,8 @@ const metadata = {
   requireFeatures: ["attachments.view"],
   pageTitle: "Attachments",
   pageTitleKey: "attachments.library.title",
-  pageGroup: "Storage",
-  pageGroupKey: "customers.storage.nav.group",
+  pageGroup: "Media",
+  pageGroupKey: "attachments.nav.group",
   pagePriority: 20,
   pageOrder: 110,
   icon: "archive",

package/dist/modules/attachments/backend/storage/attachments/page.meta.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/attachments/backend/storage/attachments/page.meta.ts"],
-  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['attachments.view'],\n  pageTitle: 'Attachments',\n  pageTitleKey: 'attachments.library.title',\n  pageGroup: 'Storage',\n  pageGroupKey: 'customers.storage.nav.group',\n  pagePriority: 20,\n  pageOrder: 110,\n  icon: 'archive',\n  breadcrumb: [\n    { label: 'Attachments', labelKey: 'attachments.library.title' },\n  ],\n} as const\n"],
+  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['attachments.view'],\n  pageTitle: 'Attachments',\n  pageTitleKey: 'attachments.library.title',\n  pageGroup: 'Media',\n  pageGroupKey: 'attachments.nav.group',\n  pagePriority: 20,\n  pageOrder: 110,\n  icon: 'archive',\n  breadcrumb: [\n    { label: 'Attachments', labelKey: 'attachments.library.title' },\n  ],\n} as const\n"],
   "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,kBAAkB;AAAA,EACpC,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAAA,EACd,cAAc;AAAA,EACd,WAAW;AAAA,EACX,MAAM;AAAA,EACN,YAAY;AAAA,IACV,EAAE,OAAO,eAAe,UAAU,4BAA4B;AAAA,EAChE;AACF;",
   "names": []
 }

package/dist/modules/auth/lib/backendChrome.js

@@ -82,7 +82,7 @@ function normalizeGroupWeights(groups) {
     "staff.nav.group",
     "entities.nav.group",
     "directory.nav.group",
-    "customers.storage.nav.group"
+    "attachments.nav.group"
   ];
   const groupOrderIndex = new Map(defaultGroupOrder.map((id, index) => [id, index]));
   groups.sort((a, b) => {

package/dist/modules/auth/lib/backendChrome.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/backendChrome.tsx"],
-  "sourcesContent": ["import * as React from 'react'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { BackendRouteManifestEntry } from '@open-mercato/shared/modules/registry'\nimport type {\n  BackendChromePayload,\n  BackendChromeNavGroup,\n  BackendChromeNavItem,\n  BackendChromeSectionGroup,\n  BackendChromeSectionItem,\n} from '@open-mercato/shared/modules/navigation/backendChrome'\nimport {\n  buildAdminNav,\n  buildSettingsSections,\n  computeSettingsPathPrefixes,\n  convertToSectionNavGroups,\n  type AdminNavItem,\n} from '@open-mercato/ui/backend/utils/nav'\nimport { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'\nimport { profilePathPrefixes, profileSections } from './profile-sections'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveFeatureCheckContext,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  applySidebarPreference,\n  loadFirstRoleSidebarPreference,\n  loadSidebarPreference,\n} from '@open-mercato/core/modules/auth/services/sidebarPreferencesService'\nimport type { SidebarPreferencesSettings } from '@open-mercato/shared/modules/navigation/sidebarPreferences'\n\ntype TranslationFn = (key: string | undefined, fallback: string) => string\n\ntype RouteModule = {\n  id: string\n  backendRoutes?: BackendRouteManifestEntry[]\n}\n\nexport function groupBackendRoutesByModule(routes: BackendRouteManifestEntry[]): RouteModule[] {\n  return Array.from(\n    routes.reduce((grouped, route) => {\n      const list = grouped.get(route.moduleId) ?? []\n      list.push(route)\n      grouped.set(route.moduleId, list)\n      return grouped\n    }, new Map<string, BackendRouteManifestEntry[]>()),\n  ).map(([id, backendRoutes]) => ({ id, backendRoutes }))\n}\n\ntype SerializableSectionItem = {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}\n\ntype SerializableSectionGroup = {\n  id: string\n  label: string\n  labelKey?: string\n  order?: number\n  items: SerializableSectionItem[]\n}\n\ntype ResolvedNavItem = Omit<BackendChromeNavItem, 'defaultTitle' | 'children'> & {\n  defaultTitle: string\n  children?: ResolvedNavItem[]\n}\n\ntype ResolveBackendChromePayloadArgs = {\n  auth: Exclude<AuthContext, null>\n  locale: string\n  modules: RouteModule[]\n  translate: TranslationFn\n  request?: Request\n  selectedOrganizationId?: string | null\n  selectedTenantId?: string | null\n}\n\nconst settingsSectionOrder: Record<string, number> = {\n  system: 1,\n  auth: 2,\n  'customer-portal': 3,\n  'data-designer': 4,\n  'module-configs': 5,\n  currencies: 6,\n  directory: 7,\n  'feature-toggles': 8,\n}\n\ntype NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {\n  id: string\n  defaultName: string\n  items: ResolvedNavItem[]\n  weight: number\n}\n\nlet renderToStaticMarkupPromise: Promise<typeof import('react-dom/server')> | null = null\n\nasync function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<string | undefined> {\n  if (!icon) return undefined\n  if (!renderToStaticMarkupPromise) {\n    renderToStaticMarkupPromise = import('react-dom/server')\n  }\n  const { renderToStaticMarkup } = await renderToStaticMarkupPromise\n\n  const normalizedIcon = typeof icon === 'string'\n    ? resolveRegisteredLucideIconNode(icon, 'size-4')\n    : icon\n\n  if (!normalizedIcon) return undefined\n\n  try {\n    const markup = renderToStaticMarkup(<>{normalizedIcon}</>)\n    return markup.trim().length > 0 ? markup : undefined\n  } catch {\n    // Some icon values may be client-only component references after dependency upgrades.\n    // Avoid taking down the entire nav payload because one icon cannot be rendered server-side.\n    return undefined\n  }\n}\n\nasync function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {\n  return {\n    id: item.href,\n    href: item.href,\n    title: item.title,\n    defaultTitle: item.defaultTitle,\n    enabled: item.enabled,\n    hidden: item.hidden,\n    pageContext: item.pageContext,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : undefined,\n  }\n}\n\nfunction normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const defaultGroupOrder = [\n    'customers.nav.group',\n    'catalog.nav.group',\n    'customers~sales.nav.group',\n    'resources.nav.group',\n    'staff.nav.group',\n    'entities.nav.group',\n    'directory.nav.group',\n    'customers.storage.nav.group',\n  ]\n  const groupOrderIndex = new Map(defaultGroupOrder.map((id, index) => [id, index]))\n  groups.sort((a, b) => {\n    const aIndex = groupOrderIndex.get(a.id)\n    const bIndex = groupOrderIndex.get(b.id)\n    if (aIndex !== undefined || bIndex !== undefined) {\n      if (aIndex === undefined) return 1\n      if (bIndex === undefined) return -1\n      if (aIndex !== bIndex) return aIndex - bIndex\n    }\n    if (a.weight !== b.weight) return a.weight - b.weight\n    return a.name.localeCompare(b.name)\n  })\n  const defaultGroupCount = defaultGroupOrder.length\n  groups.forEach((group, index) => {\n    const rank = groupOrderIndex.get(group.id)\n    const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000\n    group.weight =\n      (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +\n      Math.min(Math.max(fallbackWeight, 0), 999_999)\n  })\n  return groups\n}\n\nasync function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {\n  const groupMap = new Map<string, NavGroupWithWeight>()\n  for (const entry of entries) {\n    const weight = entry.priority ?? entry.order ?? 10_000\n    const serializedItem = await serializeNavItem(entry)\n    const existing = groupMap.get(entry.groupId)\n    if (existing) {\n      existing.items.push(serializedItem)\n      if (weight < existing.weight) existing.weight = weight\n      continue\n    }\n    groupMap.set(entry.groupId, {\n      id: entry.groupId,\n      name: entry.group,\n      defaultName: entry.groupDefaultName,\n      items: [serializedItem],\n      weight,\n    })\n  }\n  return normalizeGroupWeights(Array.from(groupMap.values()))\n}\n\nfunction adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const adoptItems = (items: ResolvedNavItem[]): ResolvedNavItem[] =>\n    items.map((item) => ({\n      ...item,\n      defaultTitle: item.title,\n      children: item.children ? adoptItems(item.children) : undefined,\n    }))\n\n  return groups.map((group) => ({\n    ...group,\n    defaultName: group.name,\n    items: adoptItems(group.items),\n  }))\n}\n\nasync function serializeSectionItem(item: {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}): Promise<BackendChromeSectionItem> {\n  return {\n    id: item.id,\n    label: item.label,\n    labelKey: item.labelKey,\n    href: item.href,\n    order: item.order,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeSectionItem(child))) : undefined,\n  }\n}\n\nasync function serializeSectionGroups(groups: SerializableSectionGroup[]): Promise<BackendChromeSectionGroup[]> {\n  return Promise.all(groups.map(async (group) => ({\n    id: group.id,\n    label: group.label,\n    labelKey: group.labelKey,\n    order: group.order,\n    items: await Promise.all(group.items.map((item) => serializeSectionItem(item))),\n  })))\n}\n\nasync function loadScopedContainer(): Promise<AwilixContainer> {\n  return createRequestContainer()\n}\n\nexport async function resolveBackendChromePayload({\n  auth,\n  locale,\n  modules,\n  translate,\n  request,\n  selectedOrganizationId,\n  selectedTenantId,\n}: ResolveBackendChromePayloadArgs): Promise<BackendChromePayload> {\n  const container = await loadScopedContainer()\n  const em = container.resolve('em') as EntityManager\n  const rbac = container.resolve('rbacService') as {\n    loadAcl: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<{\n      isSuperAdmin: boolean\n      features: string[]\n    }>\n    userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>\n  }\n\n  let scopedOrganizationId: string | null = auth.orgId ?? null\n  let scopedTenantId: string | null = auth.tenantId ?? null\n  let allowNavigation = true\n\n  try {\n    const { organizationId, scope, allowedOrganizationIds } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      request,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n    })\n    scopedOrganizationId = organizationId\n    scopedTenantId = scope.tenantId ?? auth.tenantId ?? null\n    if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {\n      allowNavigation = false\n    }\n  } catch {\n    scopedOrganizationId = auth.orgId ?? null\n    scopedTenantId = auth.tenantId ?? null\n  }\n\n  const acl = allowNavigation\n    ? await rbac.loadAcl(auth.sub, {\n        tenantId: scopedTenantId,\n        organizationId: scopedOrganizationId,\n      })\n    : { isSuperAdmin: false, features: [] }\n\n  const rawGrantedFeatures = acl.isSuperAdmin ? ['*'] : acl.features\n  const grantedFeatures = filterGrantsByEnabledModules(rawGrantedFeatures)\n  const featureChecker = async (features: string[]): Promise<string[]> => {\n    if (!allowNavigation || !features.length) return []\n    const context = {\n      tenantId: scopedTenantId ?? auth.tenantId ?? null,\n      organizationId: scopedOrganizationId ?? null,\n    }\n    const hasAll = await rbac.userHasAllFeatures(auth.sub, features, context)\n    if (hasAll) return features\n\n    const granted: string[] = []\n    for (const feature of features) {\n      const hasFeature = await rbac.userHasAllFeatures(auth.sub, [feature], context)\n      if (hasFeature) granted.push(feature)\n    }\n    return granted\n  }\n\n  let userEntities: Array<{ entityId: string; label: string; href: string }> = []\n  if (allowNavigation) {\n    try {\n      const where: FilterQuery<CustomEntity> = {\n        isActive: true,\n        showInSidebar: true,\n      }\n      where.$and = [\n        { $or: [{ organizationId: scopedOrganizationId ?? undefined }, { organizationId: null }] },\n        { $or: [{ tenantId: scopedTenantId ?? undefined }, { tenantId: null }] },\n      ]\n      const entities = await em.find(CustomEntity, where, { orderBy: { label: 'asc' } })\n      userEntities = entities.map((entity) => ({\n        entityId: entity.entityId,\n        label: entity.label,\n        href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      }))\n    } catch {\n      userEntities = []\n    }\n  }\n\n  const ctxAuth = {\n    roles: auth.roles || [],\n    sub: auth.sub,\n    tenantId: scopedTenantId,\n    orgId: scopedOrganizationId,\n  }\n  const entries = allowNavigation\n    ? await buildAdminNav(\n        modules,\n        { auth: ctxAuth },\n        userEntities,\n        translate,\n        { checkFeatures: featureChecker },\n      )\n    : []\n\n  let rolePreference: SidebarPreferencesSettings | null = null\n  let userPreference: SidebarPreferencesSettings | null = null\n\n  if (Array.isArray(auth.roles) && auth.roles.length > 0) {\n    const roleRecords = scopedTenantId\n      ? await em.find(Role, {\n          name: { $in: auth.roles },\n          tenantId: scopedTenantId,\n        })\n      : []\n    const roleIds = Array.isArray(roleRecords) ? roleRecords.map((role) => role.id) : []\n    if (roleIds.length > 0) {\n      rolePreference = await loadFirstRoleSidebarPreference(em, {\n        roleIds,\n        tenantId: scopedTenantId,\n        locale,\n      })\n    }\n  }\n\n  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub\n  if (effectiveUserId) {\n    userPreference = await loadSidebarPreference(em, {\n      userId: effectiveUserId,\n      tenantId: scopedTenantId,\n      organizationId: scopedOrganizationId,\n      locale,\n    })\n  }\n\n  const baseGroups = await groupEntries(entries)\n  const groupsWithRole = rolePreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseGroups, rolePreference)\n    : baseGroups\n  const baseForUser = adoptSidebarDefaults(groupsWithRole)\n  const appliedGroups = userPreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseForUser, userPreference)\n    : baseForUser\n\n  const settingsSections = await serializeSectionGroups(\n    convertToSectionNavGroups(\n      buildSettingsSections(entries, settingsSectionOrder),\n      translate,\n    ),\n  )\n\n  const requestOrganizationId = request ? getSelectedOrganizationFromRequest(request) : null\n  const fallbackOrganizationId = selectedOrganizationId ?? requestOrganizationId ?? auth.orgId ?? null\n  const brandOrganizationId = scopedOrganizationId\n    ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)\n\n  let brand: BackendChromePayload['brand'] = null\n  if (brandOrganizationId && scopedTenantId) {\n    try {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: brandOrganizationId, tenant: scopedTenantId, deletedAt: null },\n        undefined,\n        { tenantId: scopedTenantId, organizationId: brandOrganizationId },\n      )\n      if (organization?.logoUrl) {\n        brand = {\n          name: organization.name,\n          logo: {\n            src: organization.logoUrl,\n            alt: `${organization.name} logo`,\n          },\n        }\n      }\n    } catch {\n      brand = null\n    }\n  }\n\n  return {\n    groups: appliedGroups.map(({ weight: _weight, ...group }) => group),\n    settingsSections,\n    settingsPathPrefixes: computeSettingsPathPrefixes(buildSettingsSections(entries, settingsSectionOrder)),\n    profileSections: await serializeSectionGroups(profileSections),\n    profilePathPrefixes,\n    grantedFeatures,\n    roles: Array.isArray(auth.roles) ? auth.roles : [],\n    brand,\n  }\n}\n"],
+  "sourcesContent": ["import * as React from 'react'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { BackendRouteManifestEntry } from '@open-mercato/shared/modules/registry'\nimport type {\n  BackendChromePayload,\n  BackendChromeNavGroup,\n  BackendChromeNavItem,\n  BackendChromeSectionGroup,\n  BackendChromeSectionItem,\n} from '@open-mercato/shared/modules/navigation/backendChrome'\nimport {\n  buildAdminNav,\n  buildSettingsSections,\n  computeSettingsPathPrefixes,\n  convertToSectionNavGroups,\n  type AdminNavItem,\n} from '@open-mercato/ui/backend/utils/nav'\nimport { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'\nimport { profilePathPrefixes, profileSections } from './profile-sections'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveFeatureCheckContext,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  applySidebarPreference,\n  loadFirstRoleSidebarPreference,\n  loadSidebarPreference,\n} from '@open-mercato/core/modules/auth/services/sidebarPreferencesService'\nimport type { SidebarPreferencesSettings } from '@open-mercato/shared/modules/navigation/sidebarPreferences'\n\ntype TranslationFn = (key: string | undefined, fallback: string) => string\n\ntype RouteModule = {\n  id: string\n  backendRoutes?: BackendRouteManifestEntry[]\n}\n\nexport function groupBackendRoutesByModule(routes: BackendRouteManifestEntry[]): RouteModule[] {\n  return Array.from(\n    routes.reduce((grouped, route) => {\n      const list = grouped.get(route.moduleId) ?? []\n      list.push(route)\n      grouped.set(route.moduleId, list)\n      return grouped\n    }, new Map<string, BackendRouteManifestEntry[]>()),\n  ).map(([id, backendRoutes]) => ({ id, backendRoutes }))\n}\n\ntype SerializableSectionItem = {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}\n\ntype SerializableSectionGroup = {\n  id: string\n  label: string\n  labelKey?: string\n  order?: number\n  items: SerializableSectionItem[]\n}\n\ntype ResolvedNavItem = Omit<BackendChromeNavItem, 'defaultTitle' | 'children'> & {\n  defaultTitle: string\n  children?: ResolvedNavItem[]\n}\n\ntype ResolveBackendChromePayloadArgs = {\n  auth: Exclude<AuthContext, null>\n  locale: string\n  modules: RouteModule[]\n  translate: TranslationFn\n  request?: Request\n  selectedOrganizationId?: string | null\n  selectedTenantId?: string | null\n}\n\nconst settingsSectionOrder: Record<string, number> = {\n  system: 1,\n  auth: 2,\n  'customer-portal': 3,\n  'data-designer': 4,\n  'module-configs': 5,\n  currencies: 6,\n  directory: 7,\n  'feature-toggles': 8,\n}\n\ntype NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {\n  id: string\n  defaultName: string\n  items: ResolvedNavItem[]\n  weight: number\n}\n\nlet renderToStaticMarkupPromise: Promise<typeof import('react-dom/server')> | null = null\n\nasync function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<string | undefined> {\n  if (!icon) return undefined\n  if (!renderToStaticMarkupPromise) {\n    renderToStaticMarkupPromise = import('react-dom/server')\n  }\n  const { renderToStaticMarkup } = await renderToStaticMarkupPromise\n\n  const normalizedIcon = typeof icon === 'string'\n    ? resolveRegisteredLucideIconNode(icon, 'size-4')\n    : icon\n\n  if (!normalizedIcon) return undefined\n\n  try {\n    const markup = renderToStaticMarkup(<>{normalizedIcon}</>)\n    return markup.trim().length > 0 ? markup : undefined\n  } catch {\n    // Some icon values may be client-only component references after dependency upgrades.\n    // Avoid taking down the entire nav payload because one icon cannot be rendered server-side.\n    return undefined\n  }\n}\n\nasync function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {\n  return {\n    id: item.href,\n    href: item.href,\n    title: item.title,\n    defaultTitle: item.defaultTitle,\n    enabled: item.enabled,\n    hidden: item.hidden,\n    pageContext: item.pageContext,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : undefined,\n  }\n}\n\nfunction normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const defaultGroupOrder = [\n    'customers.nav.group',\n    'catalog.nav.group',\n    'customers~sales.nav.group',\n    'resources.nav.group',\n    'staff.nav.group',\n    'entities.nav.group',\n    'directory.nav.group',\n    'attachments.nav.group',\n  ]\n  const groupOrderIndex = new Map(defaultGroupOrder.map((id, index) => [id, index]))\n  groups.sort((a, b) => {\n    const aIndex = groupOrderIndex.get(a.id)\n    const bIndex = groupOrderIndex.get(b.id)\n    if (aIndex !== undefined || bIndex !== undefined) {\n      if (aIndex === undefined) return 1\n      if (bIndex === undefined) return -1\n      if (aIndex !== bIndex) return aIndex - bIndex\n    }\n    if (a.weight !== b.weight) return a.weight - b.weight\n    return a.name.localeCompare(b.name)\n  })\n  const defaultGroupCount = defaultGroupOrder.length\n  groups.forEach((group, index) => {\n    const rank = groupOrderIndex.get(group.id)\n    const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000\n    group.weight =\n      (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +\n      Math.min(Math.max(fallbackWeight, 0), 999_999)\n  })\n  return groups\n}\n\nasync function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {\n  const groupMap = new Map<string, NavGroupWithWeight>()\n  for (const entry of entries) {\n    const weight = entry.priority ?? entry.order ?? 10_000\n    const serializedItem = await serializeNavItem(entry)\n    const existing = groupMap.get(entry.groupId)\n    if (existing) {\n      existing.items.push(serializedItem)\n      if (weight < existing.weight) existing.weight = weight\n      continue\n    }\n    groupMap.set(entry.groupId, {\n      id: entry.groupId,\n      name: entry.group,\n      defaultName: entry.groupDefaultName,\n      items: [serializedItem],\n      weight,\n    })\n  }\n  return normalizeGroupWeights(Array.from(groupMap.values()))\n}\n\nfunction adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const adoptItems = (items: ResolvedNavItem[]): ResolvedNavItem[] =>\n    items.map((item) => ({\n      ...item,\n      defaultTitle: item.title,\n      children: item.children ? adoptItems(item.children) : undefined,\n    }))\n\n  return groups.map((group) => ({\n    ...group,\n    defaultName: group.name,\n    items: adoptItems(group.items),\n  }))\n}\n\nasync function serializeSectionItem(item: {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}): Promise<BackendChromeSectionItem> {\n  return {\n    id: item.id,\n    label: item.label,\n    labelKey: item.labelKey,\n    href: item.href,\n    order: item.order,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeSectionItem(child))) : undefined,\n  }\n}\n\nasync function serializeSectionGroups(groups: SerializableSectionGroup[]): Promise<BackendChromeSectionGroup[]> {\n  return Promise.all(groups.map(async (group) => ({\n    id: group.id,\n    label: group.label,\n    labelKey: group.labelKey,\n    order: group.order,\n    items: await Promise.all(group.items.map((item) => serializeSectionItem(item))),\n  })))\n}\n\nasync function loadScopedContainer(): Promise<AwilixContainer> {\n  return createRequestContainer()\n}\n\nexport async function resolveBackendChromePayload({\n  auth,\n  locale,\n  modules,\n  translate,\n  request,\n  selectedOrganizationId,\n  selectedTenantId,\n}: ResolveBackendChromePayloadArgs): Promise<BackendChromePayload> {\n  const container = await loadScopedContainer()\n  const em = container.resolve('em') as EntityManager\n  const rbac = container.resolve('rbacService') as {\n    loadAcl: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<{\n      isSuperAdmin: boolean\n      features: string[]\n    }>\n    userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>\n  }\n\n  let scopedOrganizationId: string | null = auth.orgId ?? null\n  let scopedTenantId: string | null = auth.tenantId ?? null\n  let allowNavigation = true\n\n  try {\n    const { organizationId, scope, allowedOrganizationIds } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      request,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n    })\n    scopedOrganizationId = organizationId\n    scopedTenantId = scope.tenantId ?? auth.tenantId ?? null\n    if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {\n      allowNavigation = false\n    }\n  } catch {\n    scopedOrganizationId = auth.orgId ?? null\n    scopedTenantId = auth.tenantId ?? null\n  }\n\n  const acl = allowNavigation\n    ? await rbac.loadAcl(auth.sub, {\n        tenantId: scopedTenantId,\n        organizationId: scopedOrganizationId,\n      })\n    : { isSuperAdmin: false, features: [] }\n\n  const rawGrantedFeatures = acl.isSuperAdmin ? ['*'] : acl.features\n  const grantedFeatures = filterGrantsByEnabledModules(rawGrantedFeatures)\n  const featureChecker = async (features: string[]): Promise<string[]> => {\n    if (!allowNavigation || !features.length) return []\n    const context = {\n      tenantId: scopedTenantId ?? auth.tenantId ?? null,\n      organizationId: scopedOrganizationId ?? null,\n    }\n    const hasAll = await rbac.userHasAllFeatures(auth.sub, features, context)\n    if (hasAll) return features\n\n    const granted: string[] = []\n    for (const feature of features) {\n      const hasFeature = await rbac.userHasAllFeatures(auth.sub, [feature], context)\n      if (hasFeature) granted.push(feature)\n    }\n    return granted\n  }\n\n  let userEntities: Array<{ entityId: string; label: string; href: string }> = []\n  if (allowNavigation) {\n    try {\n      const where: FilterQuery<CustomEntity> = {\n        isActive: true,\n        showInSidebar: true,\n      }\n      where.$and = [\n        { $or: [{ organizationId: scopedOrganizationId ?? undefined }, { organizationId: null }] },\n        { $or: [{ tenantId: scopedTenantId ?? undefined }, { tenantId: null }] },\n      ]\n      const entities = await em.find(CustomEntity, where, { orderBy: { label: 'asc' } })\n      userEntities = entities.map((entity) => ({\n        entityId: entity.entityId,\n        label: entity.label,\n        href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      }))\n    } catch {\n      userEntities = []\n    }\n  }\n\n  const ctxAuth = {\n    roles: auth.roles || [],\n    sub: auth.sub,\n    tenantId: scopedTenantId,\n    orgId: scopedOrganizationId,\n  }\n  const entries = allowNavigation\n    ? await buildAdminNav(\n        modules,\n        { auth: ctxAuth },\n        userEntities,\n        translate,\n        { checkFeatures: featureChecker },\n      )\n    : []\n\n  let rolePreference: SidebarPreferencesSettings | null = null\n  let userPreference: SidebarPreferencesSettings | null = null\n\n  if (Array.isArray(auth.roles) && auth.roles.length > 0) {\n    const roleRecords = scopedTenantId\n      ? await em.find(Role, {\n          name: { $in: auth.roles },\n          tenantId: scopedTenantId,\n        })\n      : []\n    const roleIds = Array.isArray(roleRecords) ? roleRecords.map((role) => role.id) : []\n    if (roleIds.length > 0) {\n      rolePreference = await loadFirstRoleSidebarPreference(em, {\n        roleIds,\n        tenantId: scopedTenantId,\n        locale,\n      })\n    }\n  }\n\n  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub\n  if (effectiveUserId) {\n    userPreference = await loadSidebarPreference(em, {\n      userId: effectiveUserId,\n      tenantId: scopedTenantId,\n      organizationId: scopedOrganizationId,\n      locale,\n    })\n  }\n\n  const baseGroups = await groupEntries(entries)\n  const groupsWithRole = rolePreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseGroups, rolePreference)\n    : baseGroups\n  const baseForUser = adoptSidebarDefaults(groupsWithRole)\n  const appliedGroups = userPreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseForUser, userPreference)\n    : baseForUser\n\n  const settingsSections = await serializeSectionGroups(\n    convertToSectionNavGroups(\n      buildSettingsSections(entries, settingsSectionOrder),\n      translate,\n    ),\n  )\n\n  const requestOrganizationId = request ? getSelectedOrganizationFromRequest(request) : null\n  const fallbackOrganizationId = selectedOrganizationId ?? requestOrganizationId ?? auth.orgId ?? null\n  const brandOrganizationId = scopedOrganizationId\n    ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)\n\n  let brand: BackendChromePayload['brand'] = null\n  if (brandOrganizationId && scopedTenantId) {\n    try {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: brandOrganizationId, tenant: scopedTenantId, deletedAt: null },\n        undefined,\n        { tenantId: scopedTenantId, organizationId: brandOrganizationId },\n      )\n      if (organization?.logoUrl) {\n        brand = {\n          name: organization.name,\n          logo: {\n            src: organization.logoUrl,\n            alt: `${organization.name} logo`,\n          },\n        }\n      }\n    } catch {\n      brand = null\n    }\n  }\n\n  return {\n    groups: appliedGroups.map(({ weight: _weight, ...group }) => group),\n    settingsSections,\n    settingsPathPrefixes: computeSettingsPathPrefixes(buildSettingsSections(entries, settingsSectionOrder)),\n    profileSections: await serializeSectionGroups(profileSections),\n    profilePathPrefixes,\n    grantedFeatures,\n    roles: Array.isArray(auth.roles) ? auth.roles : [],\n    brand,\n  }\n}\n"],
   "mappings": "AA6HwC;AAhHxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uCAAuC;AAChD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUA,SAAS,2BAA2B,QAAoD;AAC7F,SAAO,MAAM;AAAA,IACX,OAAO,OAAO,CAAC,SAAS,UAAU;AAChC,YAAM,OAAO,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC;AAC7C,WAAK,KAAK,KAAK;AACf,cAAQ,IAAI,MAAM,UAAU,IAAI;AAChC,aAAO;AAAA,IACT,GAAG,oBAAI,IAAyC,CAAC;AAAA,EACnD,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,OAAO,EAAE,IAAI,cAAc,EAAE;AACxD;AAmCA,MAAM,uBAA+C;AAAA,EACnD,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,mBAAmB;AACrB;AASA,IAAI,8BAAiF;AAErF,eAAe,oBAAoB,MAAgE;AACjG,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,6BAA6B;AAChC,kCAA8B,OAAO,kBAAkB;AAAA,EACzD;AACA,QAAM,EAAE,qBAAqB,IAAI,MAAM;AAEvC,QAAM,iBAAiB,OAAO,SAAS,WACnC,gCAAgC,MAAM,QAAQ,IAC9C;AAEJ,MAAI,CAAC,eAAgB,QAAO;AAE5B,MAAI;AACF,UAAM,SAAS,qBAAqB,gCAAG,0BAAe,CAAG;AACzD,WAAO,OAAO,KAAK,EAAE,SAAS,IAAI,SAAS;AAAA,EAC7C,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,MAA8C;AAC5E,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,cAAc,KAAK;AAAA,IACnB,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,IAAI;AAAA,EACvG;AACF;AAEA,SAAS,sBAAsB,QAAoD;AACjF,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,kBAAkB,IAAI,IAAI,kBAAkB,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;AACjF,SAAO,KAAK,CAAC,GAAG,MAAM;AACpB,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,QAAI,WAAW,UAAa,WAAW,QAAW;AAChD,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAQ,QAAO,SAAS;AAAA,IACzC;AACA,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,SAAS,EAAE;AAC/C,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACD,QAAM,oBAAoB,kBAAkB;AAC5C,SAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,UAAM,OAAO,gBAAgB,IAAI,MAAM,EAAE;AACzC,UAAM,iBAAiB,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AACzE,UAAM,UACH,SAAS,SAAY,OAAO,oBAAoB,SAAS,MAC1D,KAAK,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,MAAO;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,aAAa,SAAwD;AAClF,QAAM,WAAW,oBAAI,IAAgC;AACrD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,MAAM,YAAY,MAAM,SAAS;AAChD,UAAM,iBAAiB,MAAM,iBAAiB,KAAK;AACnD,UAAM,WAAW,SAAS,IAAI,MAAM,OAAO;AAC3C,QAAI,UAAU;AACZ,eAAS,MAAM,KAAK,cAAc;AAClC,UAAI,SAAS,SAAS,OAAQ,UAAS,SAAS;AAChD;AAAA,IACF;AACA,aAAS,IAAI,MAAM,SAAS;AAAA,MAC1B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,OAAO,CAAC,cAAc;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,sBAAsB,MAAM,KAAK,SAAS,OAAO,CAAC,CAAC;AAC5D;AAEA,SAAS,qBAAqB,QAAoD;AAChF,QAAM,aAAa,CAAC,UAClB,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,UAAU,KAAK,WAAW,WAAW,KAAK,QAAQ,IAAI;AAAA,EACxD,EAAE;AAEJ,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,OAAO,WAAW,MAAM,KAAK;AAAA,EAC/B,EAAE;AACJ;AAEA,eAAe,qBAAqB,MAQE;AACpC,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,qBAAqB,KAAK,CAAC,CAAC,IAAI;AAAA,EAC3G;AACF;AAEA,eAAe,uBAAuB,QAA0E;AAC9G,SAAO,QAAQ,IAAI,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9C,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,CAAC;AAAA,EAChF,EAAE,CAAC;AACL;AAEA,eAAe,sBAAgD;AAC7D,SAAO,uBAAuB;AAChC;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAmE;AACjE,QAAM,YAAY,MAAM,oBAAoB;AAC5C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAQ5C,MAAI,uBAAsC,KAAK,SAAS;AACxD,MAAI,iBAAgC,KAAK,YAAY;AACrD,MAAI,kBAAkB;AAEtB,MAAI;AACF,UAAM,EAAE,gBAAgB,OAAO,uBAAuB,IAAI,MAAM,2BAA2B;AAAA,MACzF;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AACD,2BAAuB;AACvB,qBAAiB,MAAM,YAAY,KAAK,YAAY;AACpD,QAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,WAAW,GAAG;AAChF,wBAAkB;AAAA,IACpB;AAAA,EACF,QAAQ;AACN,2BAAuB,KAAK,SAAS;AACrC,qBAAiB,KAAK,YAAY;AAAA,EACpC;AAEA,QAAM,MAAM,kBACR,MAAM,KAAK,QAAQ,KAAK,KAAK;AAAA,IAC3B,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC,IACD,EAAE,cAAc,OAAO,UAAU,CAAC,EAAE;AAExC,QAAM,qBAAqB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI;AAC1D,QAAM,kBAAkB,6BAA6B,kBAAkB;AACvE,QAAM,iBAAiB,OAAO,aAA0C;AACtE,QAAI,CAAC,mBAAmB,CAAC,SAAS,OAAQ,QAAO,CAAC;AAClD,UAAM,UAAU;AAAA,MACd,UAAU,kBAAkB,KAAK,YAAY;AAAA,MAC7C,gBAAgB,wBAAwB;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,OAAO;AACxE,QAAI,OAAQ,QAAO;AAEnB,UAAM,UAAoB,CAAC;AAC3B,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO;AAC7E,UAAI,WAAY,SAAQ,KAAK,OAAO;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAyE,CAAC;AAC9E,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AACA,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,CAAC,EAAE,gBAAgB,wBAAwB,OAAU,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AAAA,QACzF,EAAE,KAAK,CAAC,EAAE,UAAU,kBAAkB,OAAU,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,MACzE;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AACjF,qBAAe,SAAS,IAAI,CAAC,YAAY;AAAA,QACvC,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,MAAM,0BAA0B,mBAAmB,OAAO,QAAQ,CAAC;AAAA,MACrE,EAAE;AAAA,IACJ,QAAQ;AACN,qBAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACA,QAAM,UAAU,kBACZ,MAAM;AAAA,IACJ;AAAA,IACA,EAAE,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,EAAE,eAAe,eAAe;AAAA,EAClC,IACA,CAAC;AAEL,MAAI,iBAAoD;AACxD,MAAI,iBAAoD;AAExD,MAAI,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG;AACtD,UAAM,cAAc,iBAChB,MAAM,GAAG,KAAK,MAAM;AAAA,MAClB,MAAM,EAAE,KAAK,KAAK,MAAM;AAAA,MACxB,UAAU;AAAA,IACZ,CAAC,IACD,CAAC;AACL,UAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,uBAAiB,MAAM,+BAA+B,IAAI;AAAA,QACxD;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,WAAW,KAAK,SAAS,KAAK;AAC3D,MAAI,iBAAiB;AACnB,qBAAiB,MAAM,sBAAsB,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,QAAM,iBAAiB,iBACnB,uBAA2C,YAAY,cAAc,IACrE;AACJ,QAAM,cAAc,qBAAqB,cAAc;AACvD,QAAM,gBAAgB,iBAClB,uBAA2C,aAAa,cAAc,IACtE;AAEJ,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,MACE,sBAAsB,SAAS,oBAAoB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,wBAAwB,UAAU,mCAAmC,OAAO,IAAI;AACtF,QAAM,yBAAyB,0BAA0B,yBAAyB,KAAK,SAAS;AAChG,QAAM,sBAAsB,yBACtB,0BAA0B,CAAC,4BAA4B,sBAAsB,IAAI,yBAAyB;AAEhH,MAAI,QAAuC;AAC3C,MAAI,uBAAuB,gBAAgB;AACzC,QAAI;AACF,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,QACnE;AAAA,QACA,EAAE,UAAU,gBAAgB,gBAAgB,oBAAoB;AAAA,MAClE;AACA,UAAI,cAAc,SAAS;AACzB,gBAAQ;AAAA,UACN,MAAM,aAAa;AAAA,UACnB,MAAM;AAAA,YACJ,KAAK,aAAa;AAAA,YAClB,KAAK,GAAG,aAAa,IAAI;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AACN,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,cAAc,IAAI,CAAC,EAAE,QAAQ,SAAS,GAAG,MAAM,MAAM,KAAK;AAAA,IAClE;AAAA,IACA,sBAAsB,4BAA4B,sBAAsB,SAAS,oBAAoB,CAAC;AAAA,IACtG,iBAAiB,MAAM,uBAAuB,eAAe;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,IACjD;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.7-develop.6597.1.b8f069b7fe",
+  "version": "0.6.7-develop.6603.1.78e5b7a65d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6597.1.b8f069b7fe",
-    "@open-mercato/shared": "0.6.7-develop.6597.1.b8f069b7fe",
-    "@open-mercato/ui": "0.6.7-develop.6597.1.b8f069b7fe",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6603.1.78e5b7a65d",
+    "@open-mercato/shared": "0.6.7-develop.6603.1.78e5b7a65d",
+    "@open-mercato/ui": "0.6.7-develop.6603.1.78e5b7a65d",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6597.1.b8f069b7fe",
-    "@open-mercato/shared": "0.6.7-develop.6597.1.b8f069b7fe",
-    "@open-mercato/ui": "0.6.7-develop.6597.1.b8f069b7fe",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6603.1.78e5b7a65d",
+    "@open-mercato/shared": "0.6.7-develop.6603.1.78e5b7a65d",
+    "@open-mercato/ui": "0.6.7-develop.6603.1.78e5b7a65d",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/api_keys/data/entities.ts

@@ -1,6 +1,9 @@
 import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'
 
 @Entity({ tableName: 'api_keys' })
+// The unique keyPrefix bounds the bcrypt candidate loop in findApiKeyBySecret to at
+// most one live row. Do not drop this constraint or widen the prefix space without
+// re-evaluating that loop's per-request cost (see #3812).
 @Unique({ properties: ['keyPrefix'] })
 @Index({
   name: 'api_keys_opencode_session_id_uq',

package/src/modules/api_keys/services/apiKeyService.ts

@@ -139,7 +139,10 @@ export async function findApiKeyBySecret(em: EntityManager, secret: string): Pro
   if (!secret) return null
   // Extract prefix from the secret for fast candidate lookup
   const prefix = secret.slice(0, 12)
-  // Find candidates by prefix (fast index lookup)
+  // Find candidates by prefix (fast index lookup). Invariant: the unique keyPrefix
+  // constraint plus the deletedAt: null filter keep this to at most one live row, so
+  // the bcrypt loop below stays bounded. Do not widen the prefix space or relax either
+  // filter without re-evaluating that cost (see #3812).
   const candidates = await em.find(ApiKey, { keyPrefix: prefix, deletedAt: null })
   // Verify each candidate with bcrypt until we find a match
   for (const candidate of candidates) {

package/src/modules/attachments/backend/storage/attachments/page.meta.ts

@@ -3,8 +3,8 @@ export const metadata = {
   requireFeatures: ['attachments.view'],
   pageTitle: 'Attachments',
   pageTitleKey: 'attachments.library.title',
-  pageGroup: 'Storage',
-  pageGroupKey: 'customers.storage.nav.group',
+  pageGroup: 'Media',
+  pageGroupKey: 'attachments.nav.group',
   pagePriority: 20,
   pageOrder: 110,
   icon: 'archive',

package/src/modules/attachments/i18n/de.json

@@ -1,5 +1,4 @@
 {
-  "attachments.customers.storage.nav.group": "Speicher",
   "attachments.errors.activeContentBlocked": "Das Hochladen aktiver Inhalte ist nicht erlaubt.",
   "attachments.errors.dangerousExecutable": "Ausführbare Dateitypen sind als Anhänge nicht erlaubt.",
   "attachments.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
@@ -94,6 +93,7 @@
   "attachments.library.upload.success": "Anhang hochgeladen.",
   "attachments.library.upload.tagsPlaceholder": "Tags hinzufügen",
   "attachments.library.upload.title": "Anhang hochladen",
+  "attachments.nav.group": "Medien",
   "attachments.partitions.actions.add": "Partition hinzufügen",
   "attachments.partitions.actions.cancel": "Abbrechen",
   "attachments.partitions.actions.create": "Partition erstellen",

package/src/modules/attachments/i18n/en.json

@@ -1,5 +1,4 @@
 {
-  "attachments.customers.storage.nav.group": "Storage",
   "attachments.errors.activeContentBlocked": "Active content uploads are not allowed.",
   "attachments.errors.dangerousExecutable": "Executable file types are not allowed as attachments.",
   "attachments.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
@@ -94,6 +93,7 @@
   "attachments.library.upload.success": "Attachment uploaded.",
   "attachments.library.upload.tagsPlaceholder": "Add tags",
   "attachments.library.upload.title": "Upload attachment",
+  "attachments.nav.group": "Media",
   "attachments.partitions.actions.add": "Add partition",
   "attachments.partitions.actions.cancel": "Cancel",
   "attachments.partitions.actions.create": "Create partition",

package/src/modules/attachments/i18n/es.json

@@ -1,5 +1,4 @@
 {
-  "attachments.customers.storage.nav.group": "Almacenamiento",
   "attachments.errors.activeContentBlocked": "No se permite la carga de contenido activo.",
   "attachments.errors.dangerousExecutable": "No se permiten archivos ejecutables como adjuntos.",
   "attachments.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
@@ -94,6 +93,7 @@
   "attachments.library.upload.success": "Archivo adjunto subido.",
   "attachments.library.upload.tagsPlaceholder": "Agregar etiquetas",
   "attachments.library.upload.title": "Subir archivo adjunto",
+  "attachments.nav.group": "Medios",
   "attachments.partitions.actions.add": "Agregar partición",
   "attachments.partitions.actions.cancel": "Cancelar",
   "attachments.partitions.actions.create": "Crear partición",

package/src/modules/attachments/i18n/pl.json

@@ -1,5 +1,4 @@
 {
-  "attachments.customers.storage.nav.group": "Magazyn",
   "attachments.errors.activeContentBlocked": "Przesyłanie treści aktywnych nie jest dozwolone.",
   "attachments.errors.dangerousExecutable": "Pliki wykonywalne nie są dozwolone jako załączniki.",
   "attachments.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
@@ -94,6 +93,7 @@
   "attachments.library.upload.success": "Załącznik przesłany.",
   "attachments.library.upload.tagsPlaceholder": "Dodaj tagi",
   "attachments.library.upload.title": "Prześlij załącznik",
+  "attachments.nav.group": "Media",
   "attachments.partitions.actions.add": "Dodaj partycję",
   "attachments.partitions.actions.cancel": "Anuluj",
   "attachments.partitions.actions.create": "Utwórz partycję",

package/src/modules/auth/lib/backendChrome.tsx

@@ -156,7 +156,7 @@ function normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight
     'staff.nav.group',
     'entities.nav.group',
     'directory.nav.group',
-    'customers.storage.nav.group',
+    'attachments.nav.group',
   ]
   const groupOrderIndex = new Map(defaultGroupOrder.map((id, index) => [id, index]))
   groups.sort((a, b) => {

package/src/modules/customers/i18n/de.json

@@ -2607,7 +2607,6 @@
   "customers.schedule.visibility": "Visibility",
   "customers.schedule.visibility.public": "Public",
   "customers.schedule.visibility.team": "Team only",
-  "customers.storage.nav.group": "Speicher",
   "customers.tags.manage.addCategory": "Neue Kategorie",
   "customers.tags.manage.addCategoryPlaceholder": "Kategoriename...",
   "customers.tags.manage.addCategoryRequired": "Geben Sie zuerst einen Kategorienamen ein.",

package/src/modules/customers/i18n/en.json

@@ -2607,7 +2607,6 @@
   "customers.schedule.visibility": "Visibility",
   "customers.schedule.visibility.public": "Public",
   "customers.schedule.visibility.team": "Team only",
-  "customers.storage.nav.group": "Storage",
   "customers.tags.manage.addCategory": "New category",
   "customers.tags.manage.addCategoryPlaceholder": "Category name...",
   "customers.tags.manage.addCategoryRequired": "Enter a category name first.",

package/src/modules/customers/i18n/es.json

@@ -2607,7 +2607,6 @@
   "customers.schedule.visibility": "Visibility",
   "customers.schedule.visibility.public": "Public",
   "customers.schedule.visibility.team": "Team only",
-  "customers.storage.nav.group": "Almacenamiento",
   "customers.tags.manage.addCategory": "Nueva categoría",
   "customers.tags.manage.addCategoryPlaceholder": "Nombre de la categoría...",
   "customers.tags.manage.addCategoryRequired": "Primero introduce un nombre de categoría.",

package/src/modules/customers/i18n/pl.json

@@ -2607,7 +2607,6 @@
   "customers.schedule.visibility": "Widoczność",
   "customers.schedule.visibility.public": "Publiczny",
   "customers.schedule.visibility.team": "Tylko zespół",
-  "customers.storage.nav.group": "Magazyn",
   "customers.tags.manage.addCategory": "Nowa kategoria",
   "customers.tags.manage.addCategoryPlaceholder": "Nazwa kategorii...",
   "customers.tags.manage.addCategoryRequired": "Najpierw wpisz nazwę kategorii.",