@open-mercato/core 0.6.7-develop.6814.1.0627c7e9f1 → 0.6.7-develop.6825.1.85bbf320ad

package/dist/modules/auth/lib/backendChrome.js

@@ -34,14 +34,14 @@ function groupBackendRoutesByModule(routes) {
   ).map(([id, backendRoutes]) => ({ id, backendRoutes }));
 }
 const settingsSectionOrder = {
-  system: 1,
-  auth: 2,
-  "customer-portal": 3,
-  "data-designer": 4,
-  "module-configs": 5,
-  currencies: 6,
-  directory: 7,
-  "feature-toggles": 8
+  "settings.sections.system": 1,
+  "settings.sections.auth": 2,
+  "customer_accounts.settings.section": 3,
+  "settings.sections.dataDesigner": 4,
+  "settings.sections.moduleConfigs": 5,
+  "currencies.nav.group": 6,
+  "settings.sections.directory": 7,
+  "settings.sections.featureToggles": 8
 };
 let renderToStaticMarkupPromise = null;
 async function serializeIconMarkup(icon) {
@@ -338,6 +338,7 @@ async function resolveBackendChromePayload({
 }
 export {
   groupBackendRoutesByModule,
-  resolveBackendChromePayload
+  resolveBackendChromePayload,
+  settingsSectionOrder
 };
 //# sourceMappingURL=backendChrome.js.map

package/dist/modules/auth/lib/backendChrome.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/backendChrome.tsx"],
-  "sourcesContent": ["import * as React from 'react'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { BackendRouteManifestEntry } from '@open-mercato/shared/modules/registry'\nimport type {\n  BackendChromePayload,\n  BackendChromeNavGroup,\n  BackendChromeNavItem,\n  BackendChromeSectionGroup,\n  BackendChromeSectionItem,\n} from '@open-mercato/shared/modules/navigation/backendChrome'\nimport {\n  buildAdminNav,\n  buildSettingsSections,\n  computeSettingsPathPrefixes,\n  convertToSectionNavGroups,\n  type AdminNavItem,\n} from '@open-mercato/ui/backend/utils/nav'\nimport { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'\nimport { profilePathPrefixes, profileSections } from './profile-sections'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getNavGroupOrderOverride } from '@open-mercato/shared/modules/overrides'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveFeatureCheckContext,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  applySidebarPreference,\n  loadFirstRoleSidebarPreference,\n  loadSidebarPreference,\n} from '@open-mercato/core/modules/auth/services/sidebarPreferencesService'\nimport type { SidebarPreferencesSettings } from '@open-mercato/shared/modules/navigation/sidebarPreferences'\n\ntype TranslationFn = (key: string | undefined, fallback: string) => string\n\ntype RouteModule = {\n  id: string\n  backendRoutes?: BackendRouteManifestEntry[]\n}\n\nexport function groupBackendRoutesByModule(routes: BackendRouteManifestEntry[]): RouteModule[] {\n  return Array.from(\n    routes.reduce((grouped, route) => {\n      const list = grouped.get(route.moduleId) ?? []\n      list.push(route)\n      grouped.set(route.moduleId, list)\n      return grouped\n    }, new Map<string, BackendRouteManifestEntry[]>()),\n  ).map(([id, backendRoutes]) => ({ id, backendRoutes }))\n}\n\ntype SerializableSectionItem = {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}\n\ntype SerializableSectionGroup = {\n  id: string\n  label: string\n  labelKey?: string\n  order?: number\n  items: SerializableSectionItem[]\n}\n\ntype ResolvedNavItem = Omit<BackendChromeNavItem, 'defaultTitle' | 'children'> & {\n  defaultTitle: string\n  children?: ResolvedNavItem[]\n}\n\ntype ResolveBackendChromePayloadArgs = {\n  auth: Exclude<AuthContext, null>\n  locale: string\n  modules: RouteModule[]\n  translate: TranslationFn\n  request?: Request\n  selectedOrganizationId?: string | null\n  selectedTenantId?: string | null\n}\n\nconst settingsSectionOrder: Record<string, number> = {\n  system: 1,\n  auth: 2,\n  'customer-portal': 3,\n  'data-designer': 4,\n  'module-configs': 5,\n  currencies: 6,\n  directory: 7,\n  'feature-toggles': 8,\n}\n\ntype NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {\n  id: string\n  defaultName: string\n  items: ResolvedNavItem[]\n  weight: number\n}\n\nlet renderToStaticMarkupPromise: Promise<typeof import('react-dom/server')> | null = null\n\nasync function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<string | undefined> {\n  if (!icon) return undefined\n  if (!renderToStaticMarkupPromise) {\n    renderToStaticMarkupPromise = import('react-dom/server')\n  }\n  const { renderToStaticMarkup } = await renderToStaticMarkupPromise\n\n  const normalizedIcon = typeof icon === 'string'\n    ? resolveRegisteredLucideIconNode(icon, 'size-4')\n    : icon\n\n  if (!normalizedIcon) return undefined\n\n  try {\n    const markup = renderToStaticMarkup(<>{normalizedIcon}</>)\n    return markup.trim().length > 0 ? markup : undefined\n  } catch {\n    // Some icon values may be client-only component references after dependency upgrades.\n    // Avoid taking down the entire nav payload because one icon cannot be rendered server-side.\n    return undefined\n  }\n}\n\nasync function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {\n  return {\n    id: item.href,\n    href: item.href,\n    title: item.title,\n    defaultTitle: item.defaultTitle,\n    enabled: item.enabled,\n    hidden: item.hidden,\n    pageContext: item.pageContext,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : undefined,\n  }\n}\n\nconst defaultGroupOrder = [\n  'customers.nav.group',\n  'catalog.nav.group',\n  'customers~sales.nav.group',\n  'wms.nav.group',\n  'resources.nav.group',\n  'staff.nav.group',\n  'entities.nav.group',\n  'directory.nav.group',\n  'attachments.nav.group',\n]\n\n/**\n * Group ids ranked ahead of everything else, most significant first.\n *\n * An app may prepend its own ids via `overrides.nav.groupOrder` in `modules.ts`; ids it does not name\n * keep the ordering they have today. With no override configured this returns `defaultGroupOrder`\n * itself, so ordering is unchanged for every existing install.\n */\nfunction resolveGroupOrder(): string[] {\n  const override = getNavGroupOrderOverride()\n  if (!override || override.length === 0) return defaultGroupOrder\n  const overridden = new Set(override)\n  return [...override, ...defaultGroupOrder.filter((id) => !overridden.has(id))]\n}\n\nfunction normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const groupOrder = resolveGroupOrder()\n  const groupOrderIndex = new Map(groupOrder.map((id, index) => [id, index]))\n  groups.sort((a, b) => {\n    const aIndex = groupOrderIndex.get(a.id)\n    const bIndex = groupOrderIndex.get(b.id)\n    if (aIndex !== undefined || bIndex !== undefined) {\n      if (aIndex === undefined) return 1\n      if (bIndex === undefined) return -1\n      if (aIndex !== bIndex) return aIndex - bIndex\n    }\n    if (a.weight !== b.weight) return a.weight - b.weight\n    return a.name.localeCompare(b.name)\n  })\n  const defaultGroupCount = groupOrder.length\n  groups.forEach((group, index) => {\n    const rank = groupOrderIndex.get(group.id)\n    const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000\n    group.weight =\n      (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +\n      Math.min(Math.max(fallbackWeight, 0), 999_999)\n  })\n  return groups\n}\n\nasync function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {\n  const groupMap = new Map<string, NavGroupWithWeight>()\n  for (const entry of entries) {\n    const weight = entry.priority ?? entry.order ?? 10_000\n    const serializedItem = await serializeNavItem(entry)\n    const existing = groupMap.get(entry.groupId)\n    if (existing) {\n      existing.items.push(serializedItem)\n      if (weight < existing.weight) existing.weight = weight\n      continue\n    }\n    groupMap.set(entry.groupId, {\n      id: entry.groupId,\n      name: entry.group,\n      defaultName: entry.groupDefaultName,\n      items: [serializedItem],\n      weight,\n    })\n  }\n  return normalizeGroupWeights(Array.from(groupMap.values()))\n}\n\nfunction adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const adoptItems = (items: ResolvedNavItem[]): ResolvedNavItem[] =>\n    items.map((item) => ({\n      ...item,\n      defaultTitle: item.title,\n      children: item.children ? adoptItems(item.children) : undefined,\n    }))\n\n  return groups.map((group) => ({\n    ...group,\n    defaultName: group.name,\n    items: adoptItems(group.items),\n  }))\n}\n\nasync function serializeSectionItem(item: {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}): Promise<BackendChromeSectionItem> {\n  return {\n    id: item.id,\n    label: item.label,\n    labelKey: item.labelKey,\n    href: item.href,\n    order: item.order,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeSectionItem(child))) : undefined,\n  }\n}\n\nasync function serializeSectionGroups(groups: SerializableSectionGroup[]): Promise<BackendChromeSectionGroup[]> {\n  return Promise.all(groups.map(async (group) => ({\n    id: group.id,\n    label: group.label,\n    labelKey: group.labelKey,\n    order: group.order,\n    items: await Promise.all(group.items.map((item) => serializeSectionItem(item))),\n  })))\n}\n\nasync function loadScopedContainer(): Promise<AwilixContainer> {\n  return createRequestContainer()\n}\n\nexport async function resolveBackendChromePayload({\n  auth,\n  locale,\n  modules,\n  translate,\n  request,\n  selectedOrganizationId,\n  selectedTenantId,\n}: ResolveBackendChromePayloadArgs): Promise<BackendChromePayload> {\n  const container = await loadScopedContainer()\n  const em = container.resolve('em') as EntityManager\n  const rbac = container.resolve('rbacService') as {\n    getEffectiveFeatures: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>\n    userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>\n  }\n\n  let scopedOrganizationId: string | null = auth.orgId ?? null\n  let scopedTenantId: string | null = auth.tenantId ?? null\n  // The organization the caller actually *selected*, as distinct from the one the scope resolver fell\n  // back to. `resolveFeatureCheckContext` resolves `organizationId` to `auth.orgId` when no concrete\n  // organization is selected \u2014 which is precisely what an all-organizations view produces \u2014 so the\n  // resolved id cannot answer \"which organization am I viewing\".\n  let concretelySelectedOrganizationId: string | null = null\n  let allowNavigation = true\n\n  try {\n    const { organizationId, scope, allowedOrganizationIds } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      request,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n    })\n    scopedOrganizationId = organizationId\n    scopedTenantId = scope.tenantId ?? auth.tenantId ?? null\n    concretelySelectedOrganizationId = scope.selectedId ?? null\n    if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {\n      allowNavigation = false\n    }\n  } catch {\n    scopedOrganizationId = auth.orgId ?? null\n    scopedTenantId = auth.tenantId ?? null\n    concretelySelectedOrganizationId = null\n  }\n\n  const grantedFeatures = allowNavigation\n    ? await rbac.getEffectiveFeatures(auth.sub, {\n        tenantId: scopedTenantId,\n        organizationId: scopedOrganizationId,\n      })\n    : []\n  const featureChecker = async (features: string[]): Promise<string[]> => {\n    if (!allowNavigation || !features.length) return []\n    const context = {\n      tenantId: scopedTenantId ?? auth.tenantId ?? null,\n      organizationId: scopedOrganizationId ?? null,\n    }\n    const hasAll = await rbac.userHasAllFeatures(auth.sub, features, context)\n    if (hasAll) return features\n\n    const granted: string[] = []\n    for (const feature of features) {\n      const hasFeature = await rbac.userHasAllFeatures(auth.sub, [feature], context)\n      if (hasFeature) granted.push(feature)\n    }\n    return granted\n  }\n\n  let userEntities: Array<{ entityId: string; label: string; href: string }> = []\n  if (allowNavigation) {\n    try {\n      const where: FilterQuery<CustomEntity> = {\n        isActive: true,\n        showInSidebar: true,\n      }\n      where.$and = [\n        { $or: [{ organizationId: scopedOrganizationId ?? undefined }, { organizationId: null }] },\n        { $or: [{ tenantId: scopedTenantId ?? undefined }, { tenantId: null }] },\n      ]\n      const entities = await em.find(CustomEntity, where, { orderBy: { label: 'asc' } })\n      userEntities = entities.map((entity) => ({\n        entityId: entity.entityId,\n        label: entity.label,\n        href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      }))\n    } catch {\n      userEntities = []\n    }\n  }\n\n  const ctxAuth = {\n    roles: auth.roles || [],\n    sub: auth.sub,\n    tenantId: scopedTenantId,\n    orgId: scopedOrganizationId,\n  }\n  const entries = allowNavigation\n    ? await buildAdminNav(\n        modules,\n        { auth: ctxAuth },\n        userEntities,\n        translate,\n        { checkFeatures: featureChecker },\n      )\n    : []\n\n  let rolePreference: SidebarPreferencesSettings | null = null\n  let userPreference: SidebarPreferencesSettings | null = null\n\n  if (Array.isArray(auth.roles) && auth.roles.length > 0) {\n    const roleRecords = scopedTenantId\n      ? await em.find(Role, {\n          name: { $in: auth.roles },\n          tenantId: scopedTenantId,\n        })\n      : []\n    const roleIds = Array.isArray(roleRecords) ? roleRecords.map((role) => role.id) : []\n    if (roleIds.length > 0) {\n      rolePreference = await loadFirstRoleSidebarPreference(em, {\n        roleIds,\n        tenantId: scopedTenantId,\n        locale,\n      })\n    }\n  }\n\n  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub\n  if (effectiveUserId) {\n    userPreference = await loadSidebarPreference(em, {\n      userId: effectiveUserId,\n      tenantId: scopedTenantId,\n      organizationId: scopedOrganizationId,\n      locale,\n    })\n  }\n\n  const baseGroups = await groupEntries(entries)\n  const groupsWithRole = rolePreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseGroups, rolePreference)\n    : baseGroups\n  const baseForUser = adoptSidebarDefaults(groupsWithRole)\n  const appliedGroups = userPreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseForUser, userPreference)\n    : baseForUser\n\n  const settingsSections = await serializeSectionGroups(\n    convertToSectionNavGroups(\n      buildSettingsSections(entries, settingsSectionOrder),\n      translate,\n    ),\n  )\n\n  const requestOrganizationId = request ? getSelectedOrganizationFromRequest(request) : null\n  const fallbackOrganizationId = selectedOrganizationId ?? requestOrganizationId ?? auth.orgId ?? null\n  const brandOrganizationId = scopedOrganizationId\n    ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)\n\n  let brand: BackendChromePayload['brand'] = null\n  // Resolved here rather than left to callers. `brand` only populates when the organization has a\n  // logo, so it is a branding channel, not a dependable \"which organization am I viewing\" source.\n  // Without this field every downstream app has to fetch `/api/directory/organization-switcher` and\n  // walk its tree for the selected id. The row is already loaded below, so the name costs nothing.\n  let currentOrganization: BackendChromePayload['currentOrganization'] = null\n  if (brandOrganizationId && scopedTenantId) {\n    try {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: brandOrganizationId, tenant: scopedTenantId, deletedAt: null },\n        undefined,\n        { tenantId: scopedTenantId, organizationId: brandOrganizationId },\n      )\n      // Only when a concrete organization was selected. Under an all-organizations view\n      // `brandOrganizationId` still resolves (to the caller's own organization, which is what keeps\n      // branding working), so gating on the loaded row alone would misreport the scope.\n      if (organization && concretelySelectedOrganizationId === brandOrganizationId) {\n        currentOrganization = { id: String(organization.id), name: organization.name }\n      }\n      if (organization?.logoUrl) {\n        brand = {\n          name: organization.name,\n          logo: {\n            src: organization.logoUrl,\n            alt: `${organization.name} logo`,\n            preserveAspectRatio: !!organization.logoPreserveAspectRatio,\n          },\n        }\n      }\n    } catch {\n      // Fail soft, as before: a failed organization lookup must not take down the nav payload.\n      brand = null\n      currentOrganization = null\n    }\n  }\n\n  return {\n    groups: appliedGroups.map(({ weight: _weight, ...group }) => group),\n    settingsSections,\n    settingsPathPrefixes: computeSettingsPathPrefixes(buildSettingsSections(entries, settingsSectionOrder)),\n    profileSections: await serializeSectionGroups(profileSections),\n    profilePathPrefixes,\n    grantedFeatures,\n    roles: Array.isArray(auth.roles) ? auth.roles : [],\n    brand,\n    currentOrganization,\n  }\n}\n"],
-  "mappings": "AA6HwC;AAhHxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uCAAuC;AAChD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUA,SAAS,2BAA2B,QAAoD;AAC7F,SAAO,MAAM;AAAA,IACX,OAAO,OAAO,CAAC,SAAS,UAAU;AAChC,YAAM,OAAO,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC;AAC7C,WAAK,KAAK,KAAK;AACf,cAAQ,IAAI,MAAM,UAAU,IAAI;AAChC,aAAO;AAAA,IACT,GAAG,oBAAI,IAAyC,CAAC;AAAA,EACnD,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,OAAO,EAAE,IAAI,cAAc,EAAE;AACxD;AAmCA,MAAM,uBAA+C;AAAA,EACnD,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,mBAAmB;AACrB;AASA,IAAI,8BAAiF;AAErF,eAAe,oBAAoB,MAAgE;AACjG,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,6BAA6B;AAChC,kCAA8B,OAAO,kBAAkB;AAAA,EACzD;AACA,QAAM,EAAE,qBAAqB,IAAI,MAAM;AAEvC,QAAM,iBAAiB,OAAO,SAAS,WACnC,gCAAgC,MAAM,QAAQ,IAC9C;AAEJ,MAAI,CAAC,eAAgB,QAAO;AAE5B,MAAI;AACF,UAAM,SAAS,qBAAqB,gCAAG,0BAAe,CAAG;AACzD,WAAO,OAAO,KAAK,EAAE,SAAS,IAAI,SAAS;AAAA,EAC7C,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,MAA8C;AAC5E,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,cAAc,KAAK;AAAA,IACnB,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,IAAI;AAAA,EACvG;AACF;AAEA,MAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASA,SAAS,oBAA8B;AACrC,QAAM,WAAW,yBAAyB;AAC1C,MAAI,CAAC,YAAY,SAAS,WAAW,EAAG,QAAO;AAC/C,QAAM,aAAa,IAAI,IAAI,QAAQ;AACnC,SAAO,CAAC,GAAG,UAAU,GAAG,kBAAkB,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AAC/E;AAEA,SAAS,sBAAsB,QAAoD;AACjF,QAAM,aAAa,kBAAkB;AACrC,QAAM,kBAAkB,IAAI,IAAI,WAAW,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;AAC1E,SAAO,KAAK,CAAC,GAAG,MAAM;AACpB,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,QAAI,WAAW,UAAa,WAAW,QAAW;AAChD,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAQ,QAAO,SAAS;AAAA,IACzC;AACA,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,SAAS,EAAE;AAC/C,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACD,QAAM,oBAAoB,WAAW;AACrC,SAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,UAAM,OAAO,gBAAgB,IAAI,MAAM,EAAE;AACzC,UAAM,iBAAiB,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AACzE,UAAM,UACH,SAAS,SAAY,OAAO,oBAAoB,SAAS,MAC1D,KAAK,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,MAAO;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,aAAa,SAAwD;AAClF,QAAM,WAAW,oBAAI,IAAgC;AACrD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,MAAM,YAAY,MAAM,SAAS;AAChD,UAAM,iBAAiB,MAAM,iBAAiB,KAAK;AACnD,UAAM,WAAW,SAAS,IAAI,MAAM,OAAO;AAC3C,QAAI,UAAU;AACZ,eAAS,MAAM,KAAK,cAAc;AAClC,UAAI,SAAS,SAAS,OAAQ,UAAS,SAAS;AAChD;AAAA,IACF;AACA,aAAS,IAAI,MAAM,SAAS;AAAA,MAC1B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,OAAO,CAAC,cAAc;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,sBAAsB,MAAM,KAAK,SAAS,OAAO,CAAC,CAAC;AAC5D;AAEA,SAAS,qBAAqB,QAAoD;AAChF,QAAM,aAAa,CAAC,UAClB,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,UAAU,KAAK,WAAW,WAAW,KAAK,QAAQ,IAAI;AAAA,EACxD,EAAE;AAEJ,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,OAAO,WAAW,MAAM,KAAK;AAAA,EAC/B,EAAE;AACJ;AAEA,eAAe,qBAAqB,MAQE;AACpC,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,qBAAqB,KAAK,CAAC,CAAC,IAAI;AAAA,EAC3G;AACF;AAEA,eAAe,uBAAuB,QAA0E;AAC9G,SAAO,QAAQ,IAAI,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9C,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,CAAC;AAAA,EAChF,EAAE,CAAC;AACL;AAEA,eAAe,sBAAgD;AAC7D,SAAO,uBAAuB;AAChC;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAmE;AACjE,QAAM,YAAY,MAAM,oBAAoB;AAC5C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAK5C,MAAI,uBAAsC,KAAK,SAAS;AACxD,MAAI,iBAAgC,KAAK,YAAY;AAKrD,MAAI,mCAAkD;AACtD,MAAI,kBAAkB;AAEtB,MAAI;AACF,UAAM,EAAE,gBAAgB,OAAO,uBAAuB,IAAI,MAAM,2BAA2B;AAAA,MACzF;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AACD,2BAAuB;AACvB,qBAAiB,MAAM,YAAY,KAAK,YAAY;AACpD,uCAAmC,MAAM,cAAc;AACvD,QAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,WAAW,GAAG;AAChF,wBAAkB;AAAA,IACpB;AAAA,EACF,QAAQ;AACN,2BAAuB,KAAK,SAAS;AACrC,qBAAiB,KAAK,YAAY;AAClC,uCAAmC;AAAA,EACrC;AAEA,QAAM,kBAAkB,kBACpB,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACxC,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC,IACD,CAAC;AACL,QAAM,iBAAiB,OAAO,aAA0C;AACtE,QAAI,CAAC,mBAAmB,CAAC,SAAS,OAAQ,QAAO,CAAC;AAClD,UAAM,UAAU;AAAA,MACd,UAAU,kBAAkB,KAAK,YAAY;AAAA,MAC7C,gBAAgB,wBAAwB;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,OAAO;AACxE,QAAI,OAAQ,QAAO;AAEnB,UAAM,UAAoB,CAAC;AAC3B,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO;AAC7E,UAAI,WAAY,SAAQ,KAAK,OAAO;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAyE,CAAC;AAC9E,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AACA,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,CAAC,EAAE,gBAAgB,wBAAwB,OAAU,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AAAA,QACzF,EAAE,KAAK,CAAC,EAAE,UAAU,kBAAkB,OAAU,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,MACzE;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AACjF,qBAAe,SAAS,IAAI,CAAC,YAAY;AAAA,QACvC,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,MAAM,0BAA0B,mBAAmB,OAAO,QAAQ,CAAC;AAAA,MACrE,EAAE;AAAA,IACJ,QAAQ;AACN,qBAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACA,QAAM,UAAU,kBACZ,MAAM;AAAA,IACJ;AAAA,IACA,EAAE,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,EAAE,eAAe,eAAe;AAAA,EAClC,IACA,CAAC;AAEL,MAAI,iBAAoD;AACxD,MAAI,iBAAoD;AAExD,MAAI,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG;AACtD,UAAM,cAAc,iBAChB,MAAM,GAAG,KAAK,MAAM;AAAA,MAClB,MAAM,EAAE,KAAK,KAAK,MAAM;AAAA,MACxB,UAAU;AAAA,IACZ,CAAC,IACD,CAAC;AACL,UAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,uBAAiB,MAAM,+BAA+B,IAAI;AAAA,QACxD;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,WAAW,KAAK,SAAS,KAAK;AAC3D,MAAI,iBAAiB;AACnB,qBAAiB,MAAM,sBAAsB,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,QAAM,iBAAiB,iBACnB,uBAA2C,YAAY,cAAc,IACrE;AACJ,QAAM,cAAc,qBAAqB,cAAc;AACvD,QAAM,gBAAgB,iBAClB,uBAA2C,aAAa,cAAc,IACtE;AAEJ,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,MACE,sBAAsB,SAAS,oBAAoB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,wBAAwB,UAAU,mCAAmC,OAAO,IAAI;AACtF,QAAM,yBAAyB,0BAA0B,yBAAyB,KAAK,SAAS;AAChG,QAAM,sBAAsB,yBACtB,0BAA0B,CAAC,4BAA4B,sBAAsB,IAAI,yBAAyB;AAEhH,MAAI,QAAuC;AAK3C,MAAI,sBAAmE;AACvE,MAAI,uBAAuB,gBAAgB;AACzC,QAAI;AACF,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,QACnE;AAAA,QACA,EAAE,UAAU,gBAAgB,gBAAgB,oBAAoB;AAAA,MAClE;AAIA,UAAI,gBAAgB,qCAAqC,qBAAqB;AAC5E,8BAAsB,EAAE,IAAI,OAAO,aAAa,EAAE,GAAG,MAAM,aAAa,KAAK;AAAA,MAC/E;AACA,UAAI,cAAc,SAAS;AACzB,gBAAQ;AAAA,UACN,MAAM,aAAa;AAAA,UACnB,MAAM;AAAA,YACJ,KAAK,aAAa;AAAA,YAClB,KAAK,GAAG,aAAa,IAAI;AAAA,YACzB,qBAAqB,CAAC,CAAC,aAAa;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAEN,cAAQ;AACR,4BAAsB;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,cAAc,IAAI,CAAC,EAAE,QAAQ,SAAS,GAAG,MAAM,MAAM,KAAK;AAAA,IAClE;AAAA,IACA,sBAAsB,4BAA4B,sBAAsB,SAAS,oBAAoB,CAAC;AAAA,IACtG,iBAAiB,MAAM,uBAAuB,eAAe;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["import * as React from 'react'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { BackendRouteManifestEntry } from '@open-mercato/shared/modules/registry'\nimport type {\n  BackendChromePayload,\n  BackendChromeNavGroup,\n  BackendChromeNavItem,\n  BackendChromeSectionGroup,\n  BackendChromeSectionItem,\n} from '@open-mercato/shared/modules/navigation/backendChrome'\nimport {\n  buildAdminNav,\n  buildSettingsSections,\n  computeSettingsPathPrefixes,\n  convertToSectionNavGroups,\n  type AdminNavItem,\n} from '@open-mercato/ui/backend/utils/nav'\nimport { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'\nimport { profilePathPrefixes, profileSections } from './profile-sections'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getNavGroupOrderOverride } from '@open-mercato/shared/modules/overrides'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveFeatureCheckContext,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  applySidebarPreference,\n  loadFirstRoleSidebarPreference,\n  loadSidebarPreference,\n} from '@open-mercato/core/modules/auth/services/sidebarPreferencesService'\nimport type { SidebarPreferencesSettings } from '@open-mercato/shared/modules/navigation/sidebarPreferences'\n\ntype TranslationFn = (key: string | undefined, fallback: string) => string\n\ntype RouteModule = {\n  id: string\n  backendRoutes?: BackendRouteManifestEntry[]\n}\n\nexport function groupBackendRoutesByModule(routes: BackendRouteManifestEntry[]): RouteModule[] {\n  return Array.from(\n    routes.reduce((grouped, route) => {\n      const list = grouped.get(route.moduleId) ?? []\n      list.push(route)\n      grouped.set(route.moduleId, list)\n      return grouped\n    }, new Map<string, BackendRouteManifestEntry[]>()),\n  ).map(([id, backendRoutes]) => ({ id, backendRoutes }))\n}\n\ntype SerializableSectionItem = {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}\n\ntype SerializableSectionGroup = {\n  id: string\n  label: string\n  labelKey?: string\n  order?: number\n  items: SerializableSectionItem[]\n}\n\ntype ResolvedNavItem = Omit<BackendChromeNavItem, 'defaultTitle' | 'children'> & {\n  defaultTitle: string\n  children?: ResolvedNavItem[]\n}\n\ntype ResolveBackendChromePayloadArgs = {\n  auth: Exclude<AuthContext, null>\n  locale: string\n  modules: RouteModule[]\n  translate: TranslationFn\n  request?: Request\n  selectedOrganizationId?: string | null\n  selectedTenantId?: string | null\n}\n\n/**\n * Settings section weights, keyed by the untranslated group id each page declares as `pageGroupKey`.\n *\n * Mirrors `defaultGroupOrder` above: an id, never a rendered label, so the panel keeps its intended\n * order in every locale and an app-side module can place its own section deterministically (#4843).\n */\nexport const settingsSectionOrder: Record<string, number> = {\n  'settings.sections.system': 1,\n  'settings.sections.auth': 2,\n  'customer_accounts.settings.section': 3,\n  'settings.sections.dataDesigner': 4,\n  'settings.sections.moduleConfigs': 5,\n  'currencies.nav.group': 6,\n  'settings.sections.directory': 7,\n  'settings.sections.featureToggles': 8,\n}\n\ntype NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {\n  id: string\n  defaultName: string\n  items: ResolvedNavItem[]\n  weight: number\n}\n\nlet renderToStaticMarkupPromise: Promise<typeof import('react-dom/server')> | null = null\n\nasync function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<string | undefined> {\n  if (!icon) return undefined\n  if (!renderToStaticMarkupPromise) {\n    renderToStaticMarkupPromise = import('react-dom/server')\n  }\n  const { renderToStaticMarkup } = await renderToStaticMarkupPromise\n\n  const normalizedIcon = typeof icon === 'string'\n    ? resolveRegisteredLucideIconNode(icon, 'size-4')\n    : icon\n\n  if (!normalizedIcon) return undefined\n\n  try {\n    const markup = renderToStaticMarkup(<>{normalizedIcon}</>)\n    return markup.trim().length > 0 ? markup : undefined\n  } catch {\n    // Some icon values may be client-only component references after dependency upgrades.\n    // Avoid taking down the entire nav payload because one icon cannot be rendered server-side.\n    return undefined\n  }\n}\n\nasync function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {\n  return {\n    id: item.href,\n    href: item.href,\n    title: item.title,\n    defaultTitle: item.defaultTitle,\n    enabled: item.enabled,\n    hidden: item.hidden,\n    pageContext: item.pageContext,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : undefined,\n  }\n}\n\nconst defaultGroupOrder = [\n  'customers.nav.group',\n  'catalog.nav.group',\n  'customers~sales.nav.group',\n  'wms.nav.group',\n  'resources.nav.group',\n  'staff.nav.group',\n  'entities.nav.group',\n  'directory.nav.group',\n  'attachments.nav.group',\n]\n\n/**\n * Group ids ranked ahead of everything else, most significant first.\n *\n * An app may prepend its own ids via `overrides.nav.groupOrder` in `modules.ts`; ids it does not name\n * keep the ordering they have today. With no override configured this returns `defaultGroupOrder`\n * itself, so ordering is unchanged for every existing install.\n */\nfunction resolveGroupOrder(): string[] {\n  const override = getNavGroupOrderOverride()\n  if (!override || override.length === 0) return defaultGroupOrder\n  const overridden = new Set(override)\n  return [...override, ...defaultGroupOrder.filter((id) => !overridden.has(id))]\n}\n\nfunction normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const groupOrder = resolveGroupOrder()\n  const groupOrderIndex = new Map(groupOrder.map((id, index) => [id, index]))\n  groups.sort((a, b) => {\n    const aIndex = groupOrderIndex.get(a.id)\n    const bIndex = groupOrderIndex.get(b.id)\n    if (aIndex !== undefined || bIndex !== undefined) {\n      if (aIndex === undefined) return 1\n      if (bIndex === undefined) return -1\n      if (aIndex !== bIndex) return aIndex - bIndex\n    }\n    if (a.weight !== b.weight) return a.weight - b.weight\n    return a.name.localeCompare(b.name)\n  })\n  const defaultGroupCount = groupOrder.length\n  groups.forEach((group, index) => {\n    const rank = groupOrderIndex.get(group.id)\n    const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000\n    group.weight =\n      (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +\n      Math.min(Math.max(fallbackWeight, 0), 999_999)\n  })\n  return groups\n}\n\nasync function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {\n  const groupMap = new Map<string, NavGroupWithWeight>()\n  for (const entry of entries) {\n    const weight = entry.priority ?? entry.order ?? 10_000\n    const serializedItem = await serializeNavItem(entry)\n    const existing = groupMap.get(entry.groupId)\n    if (existing) {\n      existing.items.push(serializedItem)\n      if (weight < existing.weight) existing.weight = weight\n      continue\n    }\n    groupMap.set(entry.groupId, {\n      id: entry.groupId,\n      name: entry.group,\n      defaultName: entry.groupDefaultName,\n      items: [serializedItem],\n      weight,\n    })\n  }\n  return normalizeGroupWeights(Array.from(groupMap.values()))\n}\n\nfunction adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const adoptItems = (items: ResolvedNavItem[]): ResolvedNavItem[] =>\n    items.map((item) => ({\n      ...item,\n      defaultTitle: item.title,\n      children: item.children ? adoptItems(item.children) : undefined,\n    }))\n\n  return groups.map((group) => ({\n    ...group,\n    defaultName: group.name,\n    items: adoptItems(group.items),\n  }))\n}\n\nasync function serializeSectionItem(item: {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}): Promise<BackendChromeSectionItem> {\n  return {\n    id: item.id,\n    label: item.label,\n    labelKey: item.labelKey,\n    href: item.href,\n    order: item.order,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeSectionItem(child))) : undefined,\n  }\n}\n\nasync function serializeSectionGroups(groups: SerializableSectionGroup[]): Promise<BackendChromeSectionGroup[]> {\n  return Promise.all(groups.map(async (group) => ({\n    id: group.id,\n    label: group.label,\n    labelKey: group.labelKey,\n    order: group.order,\n    items: await Promise.all(group.items.map((item) => serializeSectionItem(item))),\n  })))\n}\n\nasync function loadScopedContainer(): Promise<AwilixContainer> {\n  return createRequestContainer()\n}\n\nexport async function resolveBackendChromePayload({\n  auth,\n  locale,\n  modules,\n  translate,\n  request,\n  selectedOrganizationId,\n  selectedTenantId,\n}: ResolveBackendChromePayloadArgs): Promise<BackendChromePayload> {\n  const container = await loadScopedContainer()\n  const em = container.resolve('em') as EntityManager\n  const rbac = container.resolve('rbacService') as {\n    getEffectiveFeatures: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>\n    userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>\n  }\n\n  let scopedOrganizationId: string | null = auth.orgId ?? null\n  let scopedTenantId: string | null = auth.tenantId ?? null\n  // The organization the caller actually *selected*, as distinct from the one the scope resolver fell\n  // back to. `resolveFeatureCheckContext` resolves `organizationId` to `auth.orgId` when no concrete\n  // organization is selected \u2014 which is precisely what an all-organizations view produces \u2014 so the\n  // resolved id cannot answer \"which organization am I viewing\".\n  let concretelySelectedOrganizationId: string | null = null\n  let allowNavigation = true\n\n  try {\n    const { organizationId, scope, allowedOrganizationIds } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      request,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n    })\n    scopedOrganizationId = organizationId\n    scopedTenantId = scope.tenantId ?? auth.tenantId ?? null\n    concretelySelectedOrganizationId = scope.selectedId ?? null\n    if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {\n      allowNavigation = false\n    }\n  } catch {\n    scopedOrganizationId = auth.orgId ?? null\n    scopedTenantId = auth.tenantId ?? null\n    concretelySelectedOrganizationId = null\n  }\n\n  const grantedFeatures = allowNavigation\n    ? await rbac.getEffectiveFeatures(auth.sub, {\n        tenantId: scopedTenantId,\n        organizationId: scopedOrganizationId,\n      })\n    : []\n  const featureChecker = async (features: string[]): Promise<string[]> => {\n    if (!allowNavigation || !features.length) return []\n    const context = {\n      tenantId: scopedTenantId ?? auth.tenantId ?? null,\n      organizationId: scopedOrganizationId ?? null,\n    }\n    const hasAll = await rbac.userHasAllFeatures(auth.sub, features, context)\n    if (hasAll) return features\n\n    const granted: string[] = []\n    for (const feature of features) {\n      const hasFeature = await rbac.userHasAllFeatures(auth.sub, [feature], context)\n      if (hasFeature) granted.push(feature)\n    }\n    return granted\n  }\n\n  let userEntities: Array<{ entityId: string; label: string; href: string }> = []\n  if (allowNavigation) {\n    try {\n      const where: FilterQuery<CustomEntity> = {\n        isActive: true,\n        showInSidebar: true,\n      }\n      where.$and = [\n        { $or: [{ organizationId: scopedOrganizationId ?? undefined }, { organizationId: null }] },\n        { $or: [{ tenantId: scopedTenantId ?? undefined }, { tenantId: null }] },\n      ]\n      const entities = await em.find(CustomEntity, where, { orderBy: { label: 'asc' } })\n      userEntities = entities.map((entity) => ({\n        entityId: entity.entityId,\n        label: entity.label,\n        href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      }))\n    } catch {\n      userEntities = []\n    }\n  }\n\n  const ctxAuth = {\n    roles: auth.roles || [],\n    sub: auth.sub,\n    tenantId: scopedTenantId,\n    orgId: scopedOrganizationId,\n  }\n  const entries = allowNavigation\n    ? await buildAdminNav(\n        modules,\n        { auth: ctxAuth },\n        userEntities,\n        translate,\n        { checkFeatures: featureChecker },\n      )\n    : []\n\n  let rolePreference: SidebarPreferencesSettings | null = null\n  let userPreference: SidebarPreferencesSettings | null = null\n\n  if (Array.isArray(auth.roles) && auth.roles.length > 0) {\n    const roleRecords = scopedTenantId\n      ? await em.find(Role, {\n          name: { $in: auth.roles },\n          tenantId: scopedTenantId,\n        })\n      : []\n    const roleIds = Array.isArray(roleRecords) ? roleRecords.map((role) => role.id) : []\n    if (roleIds.length > 0) {\n      rolePreference = await loadFirstRoleSidebarPreference(em, {\n        roleIds,\n        tenantId: scopedTenantId,\n        locale,\n      })\n    }\n  }\n\n  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub\n  if (effectiveUserId) {\n    userPreference = await loadSidebarPreference(em, {\n      userId: effectiveUserId,\n      tenantId: scopedTenantId,\n      organizationId: scopedOrganizationId,\n      locale,\n    })\n  }\n\n  const baseGroups = await groupEntries(entries)\n  const groupsWithRole = rolePreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseGroups, rolePreference)\n    : baseGroups\n  const baseForUser = adoptSidebarDefaults(groupsWithRole)\n  const appliedGroups = userPreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseForUser, userPreference)\n    : baseForUser\n\n  const settingsSections = await serializeSectionGroups(\n    convertToSectionNavGroups(\n      buildSettingsSections(entries, settingsSectionOrder),\n      translate,\n    ),\n  )\n\n  const requestOrganizationId = request ? getSelectedOrganizationFromRequest(request) : null\n  const fallbackOrganizationId = selectedOrganizationId ?? requestOrganizationId ?? auth.orgId ?? null\n  const brandOrganizationId = scopedOrganizationId\n    ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)\n\n  let brand: BackendChromePayload['brand'] = null\n  // Resolved here rather than left to callers. `brand` only populates when the organization has a\n  // logo, so it is a branding channel, not a dependable \"which organization am I viewing\" source.\n  // Without this field every downstream app has to fetch `/api/directory/organization-switcher` and\n  // walk its tree for the selected id. The row is already loaded below, so the name costs nothing.\n  let currentOrganization: BackendChromePayload['currentOrganization'] = null\n  if (brandOrganizationId && scopedTenantId) {\n    try {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: brandOrganizationId, tenant: scopedTenantId, deletedAt: null },\n        undefined,\n        { tenantId: scopedTenantId, organizationId: brandOrganizationId },\n      )\n      // Only when a concrete organization was selected. Under an all-organizations view\n      // `brandOrganizationId` still resolves (to the caller's own organization, which is what keeps\n      // branding working), so gating on the loaded row alone would misreport the scope.\n      if (organization && concretelySelectedOrganizationId === brandOrganizationId) {\n        currentOrganization = { id: String(organization.id), name: organization.name }\n      }\n      if (organization?.logoUrl) {\n        brand = {\n          name: organization.name,\n          logo: {\n            src: organization.logoUrl,\n            alt: `${organization.name} logo`,\n            preserveAspectRatio: !!organization.logoPreserveAspectRatio,\n          },\n        }\n      }\n    } catch {\n      // Fail soft, as before: a failed organization lookup must not take down the nav payload.\n      brand = null\n      currentOrganization = null\n    }\n  }\n\n  return {\n    groups: appliedGroups.map(({ weight: _weight, ...group }) => group),\n    settingsSections,\n    settingsPathPrefixes: computeSettingsPathPrefixes(buildSettingsSections(entries, settingsSectionOrder)),\n    profileSections: await serializeSectionGroups(profileSections),\n    profilePathPrefixes,\n    grantedFeatures,\n    roles: Array.isArray(auth.roles) ? auth.roles : [],\n    brand,\n    currentOrganization,\n  }\n}\n"],
+  "mappings": "AAmIwC;AAtHxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uCAAuC;AAChD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUA,SAAS,2BAA2B,QAAoD;AAC7F,SAAO,MAAM;AAAA,IACX,OAAO,OAAO,CAAC,SAAS,UAAU;AAChC,YAAM,OAAO,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC;AAC7C,WAAK,KAAK,KAAK;AACf,cAAQ,IAAI,MAAM,UAAU,IAAI;AAChC,aAAO;AAAA,IACT,GAAG,oBAAI,IAAyC,CAAC;AAAA,EACnD,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,OAAO,EAAE,IAAI,cAAc,EAAE;AACxD;AAyCO,MAAM,uBAA+C;AAAA,EAC1D,4BAA4B;AAAA,EAC5B,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,kCAAkC;AAAA,EAClC,mCAAmC;AAAA,EACnC,wBAAwB;AAAA,EACxB,+BAA+B;AAAA,EAC/B,oCAAoC;AACtC;AASA,IAAI,8BAAiF;AAErF,eAAe,oBAAoB,MAAgE;AACjG,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,6BAA6B;AAChC,kCAA8B,OAAO,kBAAkB;AAAA,EACzD;AACA,QAAM,EAAE,qBAAqB,IAAI,MAAM;AAEvC,QAAM,iBAAiB,OAAO,SAAS,WACnC,gCAAgC,MAAM,QAAQ,IAC9C;AAEJ,MAAI,CAAC,eAAgB,QAAO;AAE5B,MAAI;AACF,UAAM,SAAS,qBAAqB,gCAAG,0BAAe,CAAG;AACzD,WAAO,OAAO,KAAK,EAAE,SAAS,IAAI,SAAS;AAAA,EAC7C,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,MAA8C;AAC5E,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,cAAc,KAAK;AAAA,IACnB,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,IAAI;AAAA,EACvG;AACF;AAEA,MAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASA,SAAS,oBAA8B;AACrC,QAAM,WAAW,yBAAyB;AAC1C,MAAI,CAAC,YAAY,SAAS,WAAW,EAAG,QAAO;AAC/C,QAAM,aAAa,IAAI,IAAI,QAAQ;AACnC,SAAO,CAAC,GAAG,UAAU,GAAG,kBAAkB,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AAC/E;AAEA,SAAS,sBAAsB,QAAoD;AACjF,QAAM,aAAa,kBAAkB;AACrC,QAAM,kBAAkB,IAAI,IAAI,WAAW,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;AAC1E,SAAO,KAAK,CAAC,GAAG,MAAM;AACpB,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,QAAI,WAAW,UAAa,WAAW,QAAW;AAChD,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAQ,QAAO,SAAS;AAAA,IACzC;AACA,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,SAAS,EAAE;AAC/C,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACD,QAAM,oBAAoB,WAAW;AACrC,SAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,UAAM,OAAO,gBAAgB,IAAI,MAAM,EAAE;AACzC,UAAM,iBAAiB,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AACzE,UAAM,UACH,SAAS,SAAY,OAAO,oBAAoB,SAAS,MAC1D,KAAK,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,MAAO;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,aAAa,SAAwD;AAClF,QAAM,WAAW,oBAAI,IAAgC;AACrD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,MAAM,YAAY,MAAM,SAAS;AAChD,UAAM,iBAAiB,MAAM,iBAAiB,KAAK;AACnD,UAAM,WAAW,SAAS,IAAI,MAAM,OAAO;AAC3C,QAAI,UAAU;AACZ,eAAS,MAAM,KAAK,cAAc;AAClC,UAAI,SAAS,SAAS,OAAQ,UAAS,SAAS;AAChD;AAAA,IACF;AACA,aAAS,IAAI,MAAM,SAAS;AAAA,MAC1B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,OAAO,CAAC,cAAc;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,sBAAsB,MAAM,KAAK,SAAS,OAAO,CAAC,CAAC;AAC5D;AAEA,SAAS,qBAAqB,QAAoD;AAChF,QAAM,aAAa,CAAC,UAClB,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,UAAU,KAAK,WAAW,WAAW,KAAK,QAAQ,IAAI;AAAA,EACxD,EAAE;AAEJ,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,OAAO,WAAW,MAAM,KAAK;AAAA,EAC/B,EAAE;AACJ;AAEA,eAAe,qBAAqB,MAQE;AACpC,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,qBAAqB,KAAK,CAAC,CAAC,IAAI;AAAA,EAC3G;AACF;AAEA,eAAe,uBAAuB,QAA0E;AAC9G,SAAO,QAAQ,IAAI,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9C,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,CAAC;AAAA,EAChF,EAAE,CAAC;AACL;AAEA,eAAe,sBAAgD;AAC7D,SAAO,uBAAuB;AAChC;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAmE;AACjE,QAAM,YAAY,MAAM,oBAAoB;AAC5C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAK5C,MAAI,uBAAsC,KAAK,SAAS;AACxD,MAAI,iBAAgC,KAAK,YAAY;AAKrD,MAAI,mCAAkD;AACtD,MAAI,kBAAkB;AAEtB,MAAI;AACF,UAAM,EAAE,gBAAgB,OAAO,uBAAuB,IAAI,MAAM,2BAA2B;AAAA,MACzF;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AACD,2BAAuB;AACvB,qBAAiB,MAAM,YAAY,KAAK,YAAY;AACpD,uCAAmC,MAAM,cAAc;AACvD,QAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,WAAW,GAAG;AAChF,wBAAkB;AAAA,IACpB;AAAA,EACF,QAAQ;AACN,2BAAuB,KAAK,SAAS;AACrC,qBAAiB,KAAK,YAAY;AAClC,uCAAmC;AAAA,EACrC;AAEA,QAAM,kBAAkB,kBACpB,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACxC,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC,IACD,CAAC;AACL,QAAM,iBAAiB,OAAO,aAA0C;AACtE,QAAI,CAAC,mBAAmB,CAAC,SAAS,OAAQ,QAAO,CAAC;AAClD,UAAM,UAAU;AAAA,MACd,UAAU,kBAAkB,KAAK,YAAY;AAAA,MAC7C,gBAAgB,wBAAwB;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,OAAO;AACxE,QAAI,OAAQ,QAAO;AAEnB,UAAM,UAAoB,CAAC;AAC3B,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO;AAC7E,UAAI,WAAY,SAAQ,KAAK,OAAO;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAyE,CAAC;AAC9E,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AACA,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,CAAC,EAAE,gBAAgB,wBAAwB,OAAU,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AAAA,QACzF,EAAE,KAAK,CAAC,EAAE,UAAU,kBAAkB,OAAU,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,MACzE;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AACjF,qBAAe,SAAS,IAAI,CAAC,YAAY;AAAA,QACvC,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,MAAM,0BAA0B,mBAAmB,OAAO,QAAQ,CAAC;AAAA,MACrE,EAAE;AAAA,IACJ,QAAQ;AACN,qBAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACA,QAAM,UAAU,kBACZ,MAAM;AAAA,IACJ;AAAA,IACA,EAAE,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,EAAE,eAAe,eAAe;AAAA,EAClC,IACA,CAAC;AAEL,MAAI,iBAAoD;AACxD,MAAI,iBAAoD;AAExD,MAAI,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG;AACtD,UAAM,cAAc,iBAChB,MAAM,GAAG,KAAK,MAAM;AAAA,MAClB,MAAM,EAAE,KAAK,KAAK,MAAM;AAAA,MACxB,UAAU;AAAA,IACZ,CAAC,IACD,CAAC;AACL,UAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,uBAAiB,MAAM,+BAA+B,IAAI;AAAA,QACxD;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,WAAW,KAAK,SAAS,KAAK;AAC3D,MAAI,iBAAiB;AACnB,qBAAiB,MAAM,sBAAsB,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,QAAM,iBAAiB,iBACnB,uBAA2C,YAAY,cAAc,IACrE;AACJ,QAAM,cAAc,qBAAqB,cAAc;AACvD,QAAM,gBAAgB,iBAClB,uBAA2C,aAAa,cAAc,IACtE;AAEJ,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,MACE,sBAAsB,SAAS,oBAAoB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,wBAAwB,UAAU,mCAAmC,OAAO,IAAI;AACtF,QAAM,yBAAyB,0BAA0B,yBAAyB,KAAK,SAAS;AAChG,QAAM,sBAAsB,yBACtB,0BAA0B,CAAC,4BAA4B,sBAAsB,IAAI,yBAAyB;AAEhH,MAAI,QAAuC;AAK3C,MAAI,sBAAmE;AACvE,MAAI,uBAAuB,gBAAgB;AACzC,QAAI;AACF,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,QACnE;AAAA,QACA,EAAE,UAAU,gBAAgB,gBAAgB,oBAAoB;AAAA,MAClE;AAIA,UAAI,gBAAgB,qCAAqC,qBAAqB;AAC5E,8BAAsB,EAAE,IAAI,OAAO,aAAa,EAAE,GAAG,MAAM,aAAa,KAAK;AAAA,MAC/E;AACA,UAAI,cAAc,SAAS;AACzB,gBAAQ;AAAA,UACN,MAAM,aAAa;AAAA,UACnB,MAAM;AAAA,YACJ,KAAK,aAAa;AAAA,YAClB,KAAK,GAAG,aAAa,IAAI;AAAA,YACzB,qBAAqB,CAAC,CAAC,aAAa;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAEN,cAAQ;AACR,4BAAsB;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,cAAc,IAAI,CAAC,EAAE,QAAQ,SAAS,GAAG,MAAM,MAAM,KAAK;AAAA,IAClE;AAAA,IACA,sBAAsB,4BAA4B,sBAAsB,SAAS,oBAAoB,CAAC;AAAA,IACtG,iBAAiB,MAAM,uBAAuB,eAAe;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/lib/tenantAccess.js

@@ -57,9 +57,16 @@ async function enforceTenantSelection(ctx, requested) {
   if (normalized === actorTenant) return actorTenant;
   throw forbidden("Not authorized to target this tenant.");
 }
+async function requireSuperAdmin(ctx) {
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx);
+  if (!isSuperAdmin) {
+    throw forbidden("Forbidden");
+  }
+}
 export {
   enforceTenantSelection,
   normalizeTenantId,
+  requireSuperAdmin,
   resolveIsSuperAdmin
 };
 //# sourceMappingURL=tenantAccess.js.map

package/dist/modules/auth/lib/tenantAccess.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/tenantAccess.ts"],
-  "sourcesContent": ["import { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'tenant-access' })\n\ntype TenantGuardCtx = {\n  auth: {\n    sub?: string | null\n    tenantId?: string | null\n    orgId?: string | null\n    roles?: string[]\n    isSuperAdmin?: boolean\n  } | null\n  container: { resolve<T = unknown>(name: string): T }\n}\n\nconst SUPER_ADMIN_SYMBOL = Symbol.for('auth.tenantGuard.isSuperAdmin')\n\nexport function normalizeTenantId(value: unknown): string | null | undefined {\n  if (value === undefined) return undefined\n  if (value === null) return null\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n  return null\n}\n\nexport async function resolveIsSuperAdmin(ctx: TenantGuardCtx): Promise<boolean> {\n  const cacheStore = ctx as { [SUPER_ADMIN_SYMBOL]?: boolean }\n  const cached = cacheStore[SUPER_ADMIN_SYMBOL]\n  if (typeof cached === 'boolean') return cached\n  const auth = ctx.auth\n  if (!auth?.sub) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n  if (auth.isSuperAdmin === true) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = true\n    return true\n  }\n  try {\n    const rbac = (ctx.container.resolve('rbacService') as RbacService)\n    const acl = await rbac.loadAcl(auth.sub, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    })\n    const value = !!acl?.isSuperAdmin\n    cacheStore[SUPER_ADMIN_SYMBOL] = value\n    return value\n  } catch (error) {\n    logger.error('Failed to resolve rbac', { err: error })\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n}\n\nexport async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unknown): Promise<string | null> {\n  const normalized = normalizeTenantId(requested)\n  const actorTenant = normalizeTenantId(ctx.auth?.tenantId ?? null) ?? null\n  const isSuperAdmin = await resolveIsSuperAdmin(ctx)\n\n  if (isSuperAdmin) {\n    if (normalized === undefined) return actorTenant\n    return normalized ?? null\n  }\n\n  if (!actorTenant) {\n    if (normalized && normalized !== null) {\n      throw forbidden('Not authorized to target this tenant.')\n    }\n    return actorTenant\n  }\n\n  if (normalized === undefined) return actorTenant\n  if (normalized === actorTenant) return actorTenant\n  throw forbidden('Not authorized to target this tenant.')\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiB;AAE1B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAaxE,MAAM,qBAAqB,uBAAO,IAAI,+BAA+B;AAE9D,SAAS,kBAAkB,OAA2C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AACA,SAAO;AACT;AAEA,eAAsB,oBAAoB,KAAuC;AAC/E,QAAM,aAAa;AACnB,QAAM,SAAS,WAAW,kBAAkB;AAC5C,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,MAAM,KAAK;AACd,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,iBAAiB,MAAM;AAC9B,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC,CAAC;AACD,UAAM,QAAQ,CAAC,CAAC,KAAK;AACrB,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,KAAqB,WAA4C;AAC5G,QAAM,aAAa,kBAAkB,SAAS;AAC9C,QAAM,cAAc,kBAAkB,IAAI,MAAM,YAAY,IAAI,KAAK;AACrE,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAElD,MAAI,cAAc;AAChB,QAAI,eAAe,OAAW,QAAO;AACrC,WAAO,cAAc;AAAA,EACvB;AAEA,MAAI,CAAC,aAAa;AAChB,QAAI,cAAc,eAAe,MAAM;AACrC,YAAM,UAAU,uCAAuC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,OAAW,QAAO;AACrC,MAAI,eAAe,YAAa,QAAO;AACvC,QAAM,UAAU,uCAAuC;AACzD;",
+  "sourcesContent": ["import { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'tenant-access' })\n\ntype TenantGuardCtx = {\n  auth: {\n    sub?: string | null\n    tenantId?: string | null\n    orgId?: string | null\n    roles?: string[]\n    isSuperAdmin?: boolean\n  } | null\n  container: { resolve<T = unknown>(name: string): T }\n}\n\nconst SUPER_ADMIN_SYMBOL = Symbol.for('auth.tenantGuard.isSuperAdmin')\n\nexport function normalizeTenantId(value: unknown): string | null | undefined {\n  if (value === undefined) return undefined\n  if (value === null) return null\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n  return null\n}\n\nexport async function resolveIsSuperAdmin(ctx: TenantGuardCtx): Promise<boolean> {\n  const cacheStore = ctx as { [SUPER_ADMIN_SYMBOL]?: boolean }\n  const cached = cacheStore[SUPER_ADMIN_SYMBOL]\n  if (typeof cached === 'boolean') return cached\n  const auth = ctx.auth\n  if (!auth?.sub) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n  if (auth.isSuperAdmin === true) {\n    cacheStore[SUPER_ADMIN_SYMBOL] = true\n    return true\n  }\n  try {\n    const rbac = (ctx.container.resolve('rbacService') as RbacService)\n    const acl = await rbac.loadAcl(auth.sub, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    })\n    const value = !!acl?.isSuperAdmin\n    cacheStore[SUPER_ADMIN_SYMBOL] = value\n    return value\n  } catch (error) {\n    logger.error('Failed to resolve rbac', { err: error })\n    cacheStore[SUPER_ADMIN_SYMBOL] = false\n    return false\n  }\n}\n\nexport async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unknown): Promise<string | null> {\n  const normalized = normalizeTenantId(requested)\n  const actorTenant = normalizeTenantId(ctx.auth?.tenantId ?? null) ?? null\n  const isSuperAdmin = await resolveIsSuperAdmin(ctx)\n\n  if (isSuperAdmin) {\n    if (normalized === undefined) return actorTenant\n    return normalized ?? null\n  }\n\n  if (!actorTenant) {\n    if (normalized && normalized !== null) {\n      throw forbidden('Not authorized to target this tenant.')\n    }\n    return actorTenant\n  }\n\n  if (normalized === undefined) return actorTenant\n  if (normalized === actorTenant) return actorTenant\n  throw forbidden('Not authorized to target this tenant.')\n}\n\nexport async function requireSuperAdmin(ctx: TenantGuardCtx): Promise<void> {\n  const isSuperAdmin = await resolveIsSuperAdmin(ctx)\n  if (!isSuperAdmin) {\n    throw forbidden('Forbidden')\n  }\n}\n\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAE1B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAaxE,MAAM,qBAAqB,uBAAO,IAAI,+BAA+B;AAE9D,SAAS,kBAAkB,OAA2C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AACA,SAAO;AACT;AAEA,eAAsB,oBAAoB,KAAuC;AAC/E,QAAM,aAAa;AACnB,QAAM,SAAS,WAAW,kBAAkB;AAC5C,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,MAAM,KAAK;AACd,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,iBAAiB,MAAM;AAC9B,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC,CAAC;AACD,UAAM,QAAQ,CAAC,CAAC,KAAK;AACrB,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,eAAW,kBAAkB,IAAI;AACjC,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,KAAqB,WAA4C;AAC5G,QAAM,aAAa,kBAAkB,SAAS;AAC9C,QAAM,cAAc,kBAAkB,IAAI,MAAM,YAAY,IAAI,KAAK;AACrE,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAElD,MAAI,cAAc;AAChB,QAAI,eAAe,OAAW,QAAO;AACrC,WAAO,cAAc;AAAA,EACvB;AAEA,MAAI,CAAC,aAAa;AAChB,QAAI,cAAc,eAAe,MAAM;AACrC,YAAM,UAAU,uCAAuC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,OAAW,QAAO;AACrC,MAAI,eAAe,YAAa,QAAO;AACvC,QAAM,UAAU,uCAAuC;AACzD;AAEA,eAAsB,kBAAkB,KAAoC;AAC1E,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,UAAM,UAAU,WAAW;AAAA,EAC7B;AACF;",
   "names": []
 }

package/dist/modules/directory/api/tenants/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { logCrudAccess, makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { Tenant } from "@open-mercato/core/modules/directory/data/entities";
 import { tenantCreateSchema, tenantUpdateSchema } from "@open-mercato/core/modules/directory/data/validators";
@@ -73,6 +74,11 @@ async function GET(req) {
   if (!auth) {
     return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 401 });
   }
+  const container = await createRequestContainer();
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container });
+  if (!isSuperAdmin) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
   const url = new URL(req.url);
   const parsed = listQuerySchema.safeParse({
     id: url.searchParams.get("id") ?? void 0,
@@ -89,7 +95,6 @@ async function GET(req) {
       { status: 400 }
     );
   }
-  const container = await createRequestContainer();
   const em = container.resolve("em");
   const { id, page, pageSize, search, sortField, sortDir, isActive } = parsed.data;
   const where = { deletedAt: null };
@@ -210,7 +215,8 @@ const tenantGetDoc = {
   ],
   errors: [
     { status: 400, description: "Invalid query parameters", schema: directoryErrorSchema },
-    { status: 401, description: "Authentication required", schema: directoryErrorSchema }
+    { status: 401, description: "Authentication required", schema: directoryErrorSchema },
+    { status: 403, description: "Requires super-admin", schema: directoryErrorSchema }
   ]
 };
 const tenantPostDoc = {

package/dist/modules/directory/api/tenants/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/directory/api/tenants/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { loadCustomFieldValues, buildCustomFieldFiltersFromQuery } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { resolveRecordIdsForCustomFieldFilters } from './tenant-cf-filter'\nimport { E } from '#generated/entities.ids.generated'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { tenantCrudEvents, tenantCrudIndexer } from '@open-mercato/core/modules/directory/commands/tenants'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { directoryTag, directoryErrorSchema, directoryOkSchema, tenantListResponseSchema } from '../openapi'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nconst listQuerySchema = z.object({\n  id: z.string().uuid().optional(),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  sortField: z.enum(['name', 'createdAt', 'updatedAt']).optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n  isActive: z.enum(['true', 'false']).optional(),\n}).passthrough()\n\ntype TenantRow = {\n  id: string\n  name: string\n  isActive: boolean\n  createdAt: string | null\n  updatedAt: string | null\n} & Record<string, unknown>\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['directory.tenants.view'] },\n  POST: { requireAuth: true, requireFeatures: ['directory.tenants.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['directory.tenants.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['directory.tenants.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\ntype CrudInput = Record<string, unknown>\n\nconst crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({\n  metadata: routeMetadata,\n  orm: {\n    entity: Tenant,\n    idField: 'id',\n    orgField: null,\n    tenantField: null,\n    softDeleteField: 'deletedAt',\n  },\n  events: tenantCrudEvents,\n  indexer: tenantCrudIndexer,\n  actions: {\n    create: {\n      commandId: 'directory.tenants.create',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: ({ result }) => ({ id: String(result.id) }),\n      status: 201,\n    },\n    update: {\n      commandId: 'directory.tenants.update',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'directory.tenants.delete',\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nconst toRow = (tenant: Tenant, cf: Record<string, unknown>): TenantRow => ({\n  id: String(tenant.id),\n  name: String(tenant.name),\n  isActive: !!tenant.isActive,\n  createdAt: tenant.createdAt ? tenant.createdAt.toISOString() : null,\n  updatedAt: tenant.updatedAt ? tenant.updatedAt.toISOString() : null,\n  ...cf,\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listQuerySchema.safeParse({\n    id: url.searchParams.get('id') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    sortField: url.searchParams.get('sortField') ?? undefined,\n    sortDir: url.searchParams.get('sortDir') ?? undefined,\n    isActive: url.searchParams.get('isActive') ?? undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Invalid query parameters', details: parsed.error.flatten() },\n      { status: 400 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n\n  const { id, page, pageSize, search, sortField, sortDir, isActive } = parsed.data\n  const where: FilterQuery<Tenant> = { deletedAt: null }\n  if (id) where.id = id\n  if (search) {\n    Object.assign(where, { name: { $ilike: `%${escapeLikePattern(search)}%` } })\n  }\n  const active = parseBooleanToken(isActive)\n  if (active !== null) where.isActive = active\n\n  const fieldMap: Record<string, string> = { name: 'name', createdAt: 'createdAt', updatedAt: 'updatedAt' }\n  const orderBy: Record<string, 'ASC' | 'DESC'> = {}\n  if (sortField) {\n    const mapped = fieldMap[sortField] || 'name'\n    orderBy[mapped] = sortDir === 'desc' ? 'DESC' : 'ASC'\n  } else {\n    orderBy.name = 'ASC'\n  }\n\n  const rawQuery = Array.from(url.searchParams.keys()).reduce<Record<string, unknown>>((acc, key) => {\n    const values = url.searchParams.getAll(key)\n    if (!values.length) return acc\n    acc[key] = values.length === 1 ? values[0] : values\n    return acc\n  }, {})\n\n  const cfFilters = await buildCustomFieldFiltersFromQuery({\n    entityId: E.directory.tenant,\n    query: rawQuery,\n    em,\n    tenantId: auth.tenantId ?? null,\n  })\n  const cfFilterEntries = Object.entries(cfFilters).map(([rawKey, condition]) => {\n    const normalizedKey = rawKey.startsWith('cf:') ? rawKey.slice(3) : rawKey.replace(/^cf_/, '')\n    return [normalizedKey, condition] as const\n  })\n\n  const loadCfValues = (tenants: Tenant[]): Promise<Record<string, Record<string, unknown>>> => {\n    const recordIds = tenants.map((tenant) => String(tenant.id))\n    if (!recordIds.length) return Promise.resolve({})\n    const tenantIdByRecord: Record<string, string | null> = {}\n    const organizationIdByRecord: Record<string, string | null> = {}\n    for (const rid of recordIds) {\n      tenantIdByRecord[rid] = null\n      organizationIdByRecord[rid] = null\n    }\n    return loadCustomFieldValues({\n      em,\n      entityId: E.directory.tenant,\n      recordIds,\n      tenantIdByRecord,\n      organizationIdByRecord,\n      tenantFallbacks: auth.tenantId ? [auth.tenantId] : [],\n    })\n  }\n\n  const start = (page - 1) * pageSize\n\n  let pageTenants: Tenant[]\n  let total: number\n  let cfValues: Record<string, Record<string, unknown>>\n\n  if (cfFilterEntries.length) {\n    // Custom-field values live in a separate store, so first resolve the bounded\n    // set of matching tenant ids from that store, then push pagination to the\n    // database via findAndCount instead of loading the whole tenant table.\n    const matchedIds = await resolveRecordIdsForCustomFieldFilters({\n      em,\n      entityId: E.directory.tenant,\n      tenantId: auth.tenantId ?? null,\n      filters: cfFilterEntries,\n    })\n    const existingId = where.id\n    const idFilter = typeof existingId === 'string'\n      ? (matchedIds.has(existingId) ? [existingId] : [])\n      : Array.from(matchedIds)\n\n    if (!idFilter.length) {\n      total = 0\n      pageTenants = []\n      cfValues = {}\n    } else {\n      where.id = { $in: idFilter }\n      const [rows, count] = await em.findAndCount(Tenant, where, { orderBy, limit: pageSize, offset: start })\n      total = count\n      pageTenants = rows\n      cfValues = await loadCfValues(rows)\n    }\n  } else {\n    // No JS-side filtering applies, so pagination is pushed to the database\n    // instead of fetching the whole table and slicing in memory.\n    const [rows, count] = await em.findAndCount(Tenant, where, { orderBy, limit: pageSize, offset: start })\n    total = count\n    pageTenants = rows\n    cfValues = await loadCfValues(rows)\n  }\n\n  const items = pageTenants.map((tenant) => {\n    const rid = String(tenant.id)\n    const cf = cfValues[rid] ?? {}\n    return toRow(tenant, cf)\n  })\n  const totalPages = Math.max(1, Math.ceil(total / pageSize))\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items,\n    idField: 'id',\n    resourceKind: 'directory.tenant',\n    organizationId: null,\n    tenantId: auth.tenantId ?? null,\n    query: rawQuery,\n    accessType: id ? 'read:item' : undefined,\n  })\n\n  return NextResponse.json({ items, total, page, pageSize, totalPages })\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst tenantCreateResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst tenantDeleteRequestSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst tenantGetDoc: OpenApiMethodDoc = {\n  summary: 'List tenants',\n  description: 'Returns tenants visible to the current user with optional search and pagination.',\n  tags: [directoryTag],\n  query: listQuerySchema,\n  responses: [\n    { status: 200, description: 'Paged list of tenants.', schema: tenantListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid query parameters', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n  ],\n}\n\nconst tenantPostDoc: OpenApiMethodDoc = {\n  summary: 'Create tenant',\n  description: 'Creates a new tenant and returns its identifier.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: tenantCreateSchema,\n    description: 'Tenant name and optional activation flag.',\n  },\n  responses: [\n    { status: 201, description: 'Tenant created.', schema: tenantCreateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.tenants.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst tenantPutDoc: OpenApiMethodDoc = {\n  summary: 'Update tenant',\n  description: 'Updates tenant properties such as name or activation state.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: tenantUpdateSchema,\n    description: 'Tenant identifier with fields to update.',\n  },\n  responses: [\n    { status: 200, description: 'Tenant updated.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.tenants.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst tenantDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete tenant',\n  description: 'Soft deletes the tenant identified by id.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: tenantDeleteRequestSchema,\n    description: 'Identifier of the tenant to remove.',\n  },\n  responses: [\n    { status: 200, description: 'Tenant removed.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.tenants.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: directoryTag,\n  summary: 'Manage tenants',\n  methods: {\n    GET: tenantGetDoc,\n    POST: tenantPostDoc,\n    PUT: tenantPutDoc,\n    DELETE: tenantDeleteDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,eAAe,qBAAqB;AAC7C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,cAAc;AACvB,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uBAAuB,wCAAwC;AACxE,SAAS,6CAA6C;AACtD,SAAS,SAAS;AAIlB,SAAS,kBAAkB,yBAAyB;AAEpD,SAAS,cAAc,sBAAsB,mBAAmB,gCAAgC;AAChG,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAElC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,KAAK,CAAC,QAAQ,aAAa,WAAW,CAAC,EAAE,SAAS;AAAA,EAC/D,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAC/C,CAAC,EAAE,YAAY;AAUf,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACtE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAAA,EACxE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC7E;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAG/C,MAAM,OAAO,cAA6D;AAAA,EACxE,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,MAC1B,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,EAAE,EAAE;AAAA,MACnD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,MAC1B,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,MAAM,QAAQ,CAAC,QAAgB,QAA4C;AAAA,EACzE,IAAI,OAAO,OAAO,EAAE;AAAA,EACpB,MAAM,OAAO,OAAO,IAAI;AAAA,EACxB,UAAU,CAAC,CAAC,OAAO;AAAA,EACnB,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EAC/D,GAAG;AACL;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,IAAI,YAAY,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,gBAAgB,UAAU;AAAA,IACvC,IAAI,IAAI,aAAa,IAAI,IAAI,KAAK;AAAA,IAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,EAAE,IAAI,MAAM,UAAU,QAAQ,WAAW,SAAS,SAAS,IAAI,OAAO;AAC5E,QAAM,QAA6B,EAAE,WAAW,KAAK;AACrD,MAAI,GAAI,OAAM,KAAK;AACnB,MAAI,QAAQ;AACV,WAAO,OAAO,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,EAC7E;AACA,QAAM,SAAS,kBAAkB,QAAQ;AACzC,MAAI,WAAW,KAAM,OAAM,WAAW;AAEtC,QAAM,WAAmC,EAAE,MAAM,QAAQ,WAAW,aAAa,WAAW,YAAY;AACxG,QAAM,UAA0C,CAAC;AACjD,MAAI,WAAW;AACb,UAAM,SAAS,SAAS,SAAS,KAAK;AACtC,YAAQ,MAAM,IAAI,YAAY,SAAS,SAAS;AAAA,EAClD,OAAO;AACL,YAAQ,OAAO;AAAA,EACjB;AAEA,QAAM,WAAW,MAAM,KAAK,IAAI,aAAa,KAAK,CAAC,EAAE,OAAgC,CAAC,KAAK,QAAQ;AACjG,UAAM,SAAS,IAAI,aAAa,OAAO,GAAG;AAC1C,QAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,QAAI,GAAG,IAAI,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI;AAC7C,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,YAAY,MAAM,iCAAiC;AAAA,IACvD,UAAU,EAAE,UAAU;AAAA,IACtB,OAAO;AAAA,IACP;AAAA,IACA,UAAU,KAAK,YAAY;AAAA,EAC7B,CAAC;AACD,QAAM,kBAAkB,OAAO,QAAQ,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,SAAS,MAAM;AAC7E,UAAM,gBAAgB,OAAO,WAAW,KAAK,IAAI,OAAO,MAAM,CAAC,IAAI,OAAO,QAAQ,QAAQ,EAAE;AAC5F,WAAO,CAAC,eAAe,SAAS;AAAA,EAClC,CAAC;AAED,QAAM,eAAe,CAAC,YAAwE;AAC5F,UAAM,YAAY,QAAQ,IAAI,CAAC,WAAW,OAAO,OAAO,EAAE,CAAC;AAC3D,QAAI,CAAC,UAAU,OAAQ,QAAO,QAAQ,QAAQ,CAAC,CAAC;AAChD,UAAM,mBAAkD,CAAC;AACzD,UAAM,yBAAwD,CAAC;AAC/D,eAAW,OAAO,WAAW;AAC3B,uBAAiB,GAAG,IAAI;AACxB,6BAAuB,GAAG,IAAI;AAAA,IAChC;AACA,WAAO,sBAAsB;AAAA,MAC3B;AAAA,MACA,UAAU,EAAE,UAAU;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,KAAK,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK;AAE3B,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,gBAAgB,QAAQ;AAI1B,UAAM,aAAa,MAAM,sCAAsC;AAAA,MAC7D;AAAA,MACA,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,KAAK,YAAY;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AACD,UAAM,aAAa,MAAM;AACzB,UAAM,WAAW,OAAO,eAAe,WAClC,WAAW,IAAI,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,IAC9C,MAAM,KAAK,UAAU;AAEzB,QAAI,CAAC,SAAS,QAAQ;AACpB,cAAQ;AACR,oBAAc,CAAC;AACf,iBAAW,CAAC;AAAA,IACd,OAAO;AACL,YAAM,KAAK,EAAE,KAAK,SAAS;AAC3B,YAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,SAAS,OAAO,UAAU,QAAQ,MAAM,CAAC;AACtG,cAAQ;AACR,oBAAc;AACd,iBAAW,MAAM,aAAa,IAAI;AAAA,IACpC;AAAA,EACF,OAAO;AAGL,UAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,SAAS,OAAO,UAAU,QAAQ,MAAM,CAAC;AACtG,YAAQ;AACR,kBAAc;AACd,eAAW,MAAM,aAAa,IAAI;AAAA,EACpC;AAEA,QAAM,QAAQ,YAAY,IAAI,CAAC,WAAW;AACxC,UAAM,MAAM,OAAO,OAAO,EAAE;AAC5B,UAAM,KAAK,SAAS,GAAG,KAAK,CAAC;AAC7B,WAAO,MAAM,QAAQ,EAAE;AAAA,EACzB,CAAC;AACD,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAE1D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,UAAU,KAAK,YAAY;AAAA,IAC3B,OAAO;AAAA,IACP,YAAY,KAAK,cAAc;AAAA,EACjC,CAAC;AAED,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW,CAAC;AACvE;AAEO,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,yBAAyB;AAAA,EACzF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEA,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,2BAA2B;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,qBAAqB;AAAA,EACvG;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,kBAAkB;AAAA,EAC3E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,qBAAqB;AAAA,EACvG;AACF;AAEA,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,kBAAkB;AAAA,EAC3E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,qBAAqB;AAAA,EACvG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\n\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { loadCustomFieldValues, buildCustomFieldFiltersFromQuery } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { resolveRecordIdsForCustomFieldFilters } from './tenant-cf-filter'\nimport { E } from '#generated/entities.ids.generated'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { tenantCrudEvents, tenantCrudIndexer } from '@open-mercato/core/modules/directory/commands/tenants'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { directoryTag, directoryErrorSchema, directoryOkSchema, tenantListResponseSchema } from '../openapi'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nconst listQuerySchema = z.object({\n  id: z.string().uuid().optional(),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  sortField: z.enum(['name', 'createdAt', 'updatedAt']).optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n  isActive: z.enum(['true', 'false']).optional(),\n}).passthrough()\n\ntype TenantRow = {\n  id: string\n  name: string\n  isActive: boolean\n  createdAt: string | null\n  updatedAt: string | null\n} & Record<string, unknown>\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['directory.tenants.view'] },\n  POST: { requireAuth: true, requireFeatures: ['directory.tenants.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['directory.tenants.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['directory.tenants.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\ntype CrudInput = Record<string, unknown>\n\nconst crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({\n  metadata: routeMetadata,\n  orm: {\n    entity: Tenant,\n    idField: 'id',\n    orgField: null,\n    tenantField: null,\n    softDeleteField: 'deletedAt',\n  },\n  events: tenantCrudEvents,\n  indexer: tenantCrudIndexer,\n  actions: {\n    create: {\n      commandId: 'directory.tenants.create',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: ({ result }) => ({ id: String(result.id) }),\n      status: 201,\n    },\n    update: {\n      commandId: 'directory.tenants.update',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'directory.tenants.delete',\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nconst toRow = (tenant: Tenant, cf: Record<string, unknown>): TenantRow => ({\n  id: String(tenant.id),\n  name: String(tenant.name),\n  isActive: !!tenant.isActive,\n  createdAt: tenant.createdAt ? tenant.createdAt.toISOString() : null,\n  updatedAt: tenant.updatedAt ? tenant.updatedAt.toISOString() : null,\n  ...cf,\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  if (!isSuperAdmin) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listQuerySchema.safeParse({\n    id: url.searchParams.get('id') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    sortField: url.searchParams.get('sortField') ?? undefined,\n    sortDir: url.searchParams.get('sortDir') ?? undefined,\n    isActive: url.searchParams.get('isActive') ?? undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Invalid query parameters', details: parsed.error.flatten() },\n      { status: 400 },\n    )\n  }\n\n  const em = container.resolve('em') as EntityManager\n\n  const { id, page, pageSize, search, sortField, sortDir, isActive } = parsed.data\n  const where: FilterQuery<Tenant> = { deletedAt: null }\n  if (id) where.id = id\n  if (search) {\n    Object.assign(where, { name: { $ilike: `%${escapeLikePattern(search)}%` } })\n  }\n  const active = parseBooleanToken(isActive)\n  if (active !== null) where.isActive = active\n\n  const fieldMap: Record<string, string> = { name: 'name', createdAt: 'createdAt', updatedAt: 'updatedAt' }\n  const orderBy: Record<string, 'ASC' | 'DESC'> = {}\n  if (sortField) {\n    const mapped = fieldMap[sortField] || 'name'\n    orderBy[mapped] = sortDir === 'desc' ? 'DESC' : 'ASC'\n  } else {\n    orderBy.name = 'ASC'\n  }\n\n  const rawQuery = Array.from(url.searchParams.keys()).reduce<Record<string, unknown>>((acc, key) => {\n    const values = url.searchParams.getAll(key)\n    if (!values.length) return acc\n    acc[key] = values.length === 1 ? values[0] : values\n    return acc\n  }, {})\n\n  const cfFilters = await buildCustomFieldFiltersFromQuery({\n    entityId: E.directory.tenant,\n    query: rawQuery,\n    em,\n    tenantId: auth.tenantId ?? null,\n  })\n  const cfFilterEntries = Object.entries(cfFilters).map(([rawKey, condition]) => {\n    const normalizedKey = rawKey.startsWith('cf:') ? rawKey.slice(3) : rawKey.replace(/^cf_/, '')\n    return [normalizedKey, condition] as const\n  })\n\n  const loadCfValues = (tenants: Tenant[]): Promise<Record<string, Record<string, unknown>>> => {\n    const recordIds = tenants.map((tenant) => String(tenant.id))\n    if (!recordIds.length) return Promise.resolve({})\n    const tenantIdByRecord: Record<string, string | null> = {}\n    const organizationIdByRecord: Record<string, string | null> = {}\n    for (const rid of recordIds) {\n      tenantIdByRecord[rid] = null\n      organizationIdByRecord[rid] = null\n    }\n    return loadCustomFieldValues({\n      em,\n      entityId: E.directory.tenant,\n      recordIds,\n      tenantIdByRecord,\n      organizationIdByRecord,\n      tenantFallbacks: auth.tenantId ? [auth.tenantId] : [],\n    })\n  }\n\n  const start = (page - 1) * pageSize\n\n  let pageTenants: Tenant[]\n  let total: number\n  let cfValues: Record<string, Record<string, unknown>>\n\n  if (cfFilterEntries.length) {\n    // Custom-field values live in a separate store, so first resolve the bounded\n    // set of matching tenant ids from that store, then push pagination to the\n    // database via findAndCount instead of loading the whole tenant table.\n    const matchedIds = await resolveRecordIdsForCustomFieldFilters({\n      em,\n      entityId: E.directory.tenant,\n      tenantId: auth.tenantId ?? null,\n      filters: cfFilterEntries,\n    })\n    const existingId = where.id\n    const idFilter = typeof existingId === 'string'\n      ? (matchedIds.has(existingId) ? [existingId] : [])\n      : Array.from(matchedIds)\n\n    if (!idFilter.length) {\n      total = 0\n      pageTenants = []\n      cfValues = {}\n    } else {\n      where.id = { $in: idFilter }\n      const [rows, count] = await em.findAndCount(Tenant, where, { orderBy, limit: pageSize, offset: start })\n      total = count\n      pageTenants = rows\n      cfValues = await loadCfValues(rows)\n    }\n  } else {\n    // No JS-side filtering applies, so pagination is pushed to the database\n    // instead of fetching the whole table and slicing in memory.\n    const [rows, count] = await em.findAndCount(Tenant, where, { orderBy, limit: pageSize, offset: start })\n    total = count\n    pageTenants = rows\n    cfValues = await loadCfValues(rows)\n  }\n\n  const items = pageTenants.map((tenant) => {\n    const rid = String(tenant.id)\n    const cf = cfValues[rid] ?? {}\n    return toRow(tenant, cf)\n  })\n  const totalPages = Math.max(1, Math.ceil(total / pageSize))\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items,\n    idField: 'id',\n    resourceKind: 'directory.tenant',\n    organizationId: null,\n    tenantId: auth.tenantId ?? null,\n    query: rawQuery,\n    accessType: id ? 'read:item' : undefined,\n  })\n\n  return NextResponse.json({ items, total, page, pageSize, totalPages })\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst tenantCreateResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst tenantDeleteRequestSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst tenantGetDoc: OpenApiMethodDoc = {\n  summary: 'List tenants',\n  description: 'Returns tenants visible to the current user with optional search and pagination.',\n  tags: [directoryTag],\n  query: listQuerySchema,\n  responses: [\n    { status: 200, description: 'Paged list of tenants.', schema: tenantListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid query parameters', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Requires super-admin', schema: directoryErrorSchema },\n  ],\n}\n\nconst tenantPostDoc: OpenApiMethodDoc = {\n  summary: 'Create tenant',\n  description: 'Creates a new tenant and returns its identifier.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: tenantCreateSchema,\n    description: 'Tenant name and optional activation flag.',\n  },\n  responses: [\n    { status: 201, description: 'Tenant created.', schema: tenantCreateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.tenants.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst tenantPutDoc: OpenApiMethodDoc = {\n  summary: 'Update tenant',\n  description: 'Updates tenant properties such as name or activation state.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: tenantUpdateSchema,\n    description: 'Tenant identifier with fields to update.',\n  },\n  responses: [\n    { status: 200, description: 'Tenant updated.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.tenants.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst tenantDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete tenant',\n  description: 'Soft deletes the tenant identified by id.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: tenantDeleteRequestSchema,\n    description: 'Identifier of the tenant to remove.',\n  },\n  responses: [\n    { status: 200, description: 'Tenant removed.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.tenants.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: directoryTag,\n  summary: 'Manage tenants',\n  methods: {\n    GET: tenantGetDoc,\n    POST: tenantPostDoc,\n    PUT: tenantPutDoc,\n    DELETE: tenantDeleteDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,eAAe,qBAAqB;AAC7C,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AAEvC,SAAS,cAAc;AACvB,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uBAAuB,wCAAwC;AACxE,SAAS,6CAA6C;AACtD,SAAS,SAAS;AAIlB,SAAS,kBAAkB,yBAAyB;AAEpD,SAAS,cAAc,sBAAsB,mBAAmB,gCAAgC;AAChG,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAElC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,KAAK,CAAC,QAAQ,aAAa,WAAW,CAAC,EAAE,SAAS;AAAA,EAC/D,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAC/C,CAAC,EAAE,YAAY;AAUf,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACtE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAAA,EACxE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC7E;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAG/C,MAAM,OAAO,cAA6D;AAAA,EACxE,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,MAC1B,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,EAAE,EAAE;AAAA,MACnD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,MAC1B,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,MAAM,QAAQ,CAAC,QAAgB,QAA4C;AAAA,EACzE,IAAI,OAAO,OAAO,EAAE;AAAA,EACpB,MAAM,OAAO,OAAO,IAAI;AAAA,EACxB,UAAU,CAAC,CAAC,OAAO;AAAA,EACnB,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EAC/D,GAAG;AACL;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,IAAI,YAAY,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,gBAAgB,UAAU;AAAA,IACvC,IAAI,IAAI,aAAa,IAAI,IAAI,KAAK;AAAA,IAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,EAAE,IAAI,MAAM,UAAU,QAAQ,WAAW,SAAS,SAAS,IAAI,OAAO;AAC5E,QAAM,QAA6B,EAAE,WAAW,KAAK;AACrD,MAAI,GAAI,OAAM,KAAK;AACnB,MAAI,QAAQ;AACV,WAAO,OAAO,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,EAC7E;AACA,QAAM,SAAS,kBAAkB,QAAQ;AACzC,MAAI,WAAW,KAAM,OAAM,WAAW;AAEtC,QAAM,WAAmC,EAAE,MAAM,QAAQ,WAAW,aAAa,WAAW,YAAY;AACxG,QAAM,UAA0C,CAAC;AACjD,MAAI,WAAW;AACb,UAAM,SAAS,SAAS,SAAS,KAAK;AACtC,YAAQ,MAAM,IAAI,YAAY,SAAS,SAAS;AAAA,EAClD,OAAO;AACL,YAAQ,OAAO;AAAA,EACjB;AAEA,QAAM,WAAW,MAAM,KAAK,IAAI,aAAa,KAAK,CAAC,EAAE,OAAgC,CAAC,KAAK,QAAQ;AACjG,UAAM,SAAS,IAAI,aAAa,OAAO,GAAG;AAC1C,QAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,QAAI,GAAG,IAAI,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI;AAC7C,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,YAAY,MAAM,iCAAiC;AAAA,IACvD,UAAU,EAAE,UAAU;AAAA,IACtB,OAAO;AAAA,IACP;AAAA,IACA,UAAU,KAAK,YAAY;AAAA,EAC7B,CAAC;AACD,QAAM,kBAAkB,OAAO,QAAQ,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,SAAS,MAAM;AAC7E,UAAM,gBAAgB,OAAO,WAAW,KAAK,IAAI,OAAO,MAAM,CAAC,IAAI,OAAO,QAAQ,QAAQ,EAAE;AAC5F,WAAO,CAAC,eAAe,SAAS;AAAA,EAClC,CAAC;AAED,QAAM,eAAe,CAAC,YAAwE;AAC5F,UAAM,YAAY,QAAQ,IAAI,CAAC,WAAW,OAAO,OAAO,EAAE,CAAC;AAC3D,QAAI,CAAC,UAAU,OAAQ,QAAO,QAAQ,QAAQ,CAAC,CAAC;AAChD,UAAM,mBAAkD,CAAC;AACzD,UAAM,yBAAwD,CAAC;AAC/D,eAAW,OAAO,WAAW;AAC3B,uBAAiB,GAAG,IAAI;AACxB,6BAAuB,GAAG,IAAI;AAAA,IAChC;AACA,WAAO,sBAAsB;AAAA,MAC3B;AAAA,MACA,UAAU,EAAE,UAAU;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,KAAK,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK;AAE3B,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,gBAAgB,QAAQ;AAI1B,UAAM,aAAa,MAAM,sCAAsC;AAAA,MAC7D;AAAA,MACA,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,KAAK,YAAY;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AACD,UAAM,aAAa,MAAM;AACzB,UAAM,WAAW,OAAO,eAAe,WAClC,WAAW,IAAI,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,IAC9C,MAAM,KAAK,UAAU;AAEzB,QAAI,CAAC,SAAS,QAAQ;AACpB,cAAQ;AACR,oBAAc,CAAC;AACf,iBAAW,CAAC;AAAA,IACd,OAAO;AACL,YAAM,KAAK,EAAE,KAAK,SAAS;AAC3B,YAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,SAAS,OAAO,UAAU,QAAQ,MAAM,CAAC;AACtG,cAAQ;AACR,oBAAc;AACd,iBAAW,MAAM,aAAa,IAAI;AAAA,IACpC;AAAA,EACF,OAAO;AAGL,UAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,SAAS,OAAO,UAAU,QAAQ,MAAM,CAAC;AACtG,YAAQ;AACR,kBAAc;AACd,eAAW,MAAM,aAAa,IAAI;AAAA,EACpC;AAEA,QAAM,QAAQ,YAAY,IAAI,CAAC,WAAW;AACxC,UAAM,MAAM,OAAO,OAAO,EAAE;AAC5B,UAAM,KAAK,SAAS,GAAG,KAAK,CAAC;AAC7B,WAAO,MAAM,QAAQ,EAAE;AAAA,EACzB,CAAC;AACD,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAE1D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,UAAU,KAAK,YAAY;AAAA,IAC3B,OAAO;AAAA,IACP,YAAY,KAAK,cAAc;AAAA,EACjC,CAAC;AAED,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW,CAAC;AACvE;AAEO,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,yBAAyB;AAAA,EACzF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,qBAAqB;AAAA,EACnF;AACF;AAEA,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,2BAA2B;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,qBAAqB;AAAA,EACvG;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,kBAAkB;AAAA,EAC3E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,qBAAqB;AAAA,EACvG;AACF;AAEA,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,kBAAkB;AAAA,EAC3E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,4CAA4C,QAAQ,qBAAqB;AAAA,EACvG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/directory/commands/tenants.js

@@ -2,6 +2,7 @@ import { registerCommand } from "@open-mercato/shared/lib/commands";
 import { tenantCreateSchema, tenantUpdateSchema } from "@open-mercato/core/modules/directory/data/validators";
 import { Tenant } from "@open-mercato/core/modules/directory/data/entities";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { requireSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import { E } from "../../../generated/entities.ids.generated.js";
 import {
   parseWithCustomFields,
@@ -36,6 +37,7 @@ function serializeTenant(entity) {
 const createTenantCommand = {
   id: "directory.tenants.create",
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx);
     const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput);
     const de = ctx.container.resolve("dataEngine");
     const tenant = await de.createOrmEntity({
@@ -107,6 +109,7 @@ const createTenantCommand = {
 const updateTenantCommand = {
   id: "directory.tenants.update",
   async prepare(rawInput, ctx) {
+    await requireSuperAdmin(ctx);
     const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput);
     const em = ctx.container.resolve("em");
     const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null });
@@ -114,6 +117,7 @@ const updateTenantCommand = {
     return { before: serializeTenant(current) };
   },
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx);
     const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput);
     const de = ctx.container.resolve("dataEngine");
     const tenant = await de.updateOrmEntity({
@@ -167,12 +171,14 @@ const updateTenantCommand = {
 const deleteTenantCommand = {
   id: "directory.tenants.delete",
   async prepare(input, ctx) {
+    await requireSuperAdmin(ctx);
     const id = requireId(input, "Tenant id required");
     const em = ctx.container.resolve("em");
     const existing = await em.findOne(Tenant, { id, deletedAt: null });
     return existing ? { before: serializeTenant(existing) } : {};
   },
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx);
     const id = requireId(rawInput, "Tenant id required");
     const de = ctx.container.resolve("dataEngine");
     const tenant = await de.deleteOrmEntity({

package/dist/modules/directory/commands/tenants.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/directory/commands/tenants.ts"],
-  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('directory').child({ component: 'tenants' })\n\nexport const tenantCrudEvents: CrudEventsConfig = {\n  module: 'directory',\n  entity: 'tenant',\n  persistent: true,\n}\n\nexport const tenantCrudIndexer: CrudIndexerConfig = {\n  entityType: E.directory.tenant,\n}\n\nfunction serializeTenant(entity: Tenant) {\n  return {\n    id: String(entity.id),\n    name: entity.name,\n    isActive: !!entity.isActive,\n    createdAt: entity.createdAt ? entity.createdAt.toISOString() : null,\n    updatedAt: entity.updatedAt ? entity.updatedAt.toISOString() : null,\n    deletedAt: entity.deletedAt ? entity.deletedAt.toISOString() : null,\n  }\n}\n\ntype TenantPayload = Record<string, unknown>\ntype SerializedTenant = ReturnType<typeof serializeTenant>\n\nconst createTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    const tenant = await de.createOrmEntity({\n      entity: Tenant,\n      data: {\n        name: parsed.name,\n        isActive: parsed.isActive ?? true,\n      },\n    })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    if (isTenantDataEncryptionEnabled()) {\n      try {\n        const kms = ctx.container.resolve('kmsService') as { createTenantDek?: (id: string) => Promise<unknown>; isHealthy?: () => boolean }\n        if (kms?.isHealthy?.()) {\n          await kms?.createTenantDek?.(String(tenant.id))\n          logger.info('Created tenant DEK', { tenantId: String(tenant.id) })\n        } else {\n          logger.warn('KMS not healthy, skipping tenant DEK provisioning', { tenantId: String(tenant.id) })\n        }\n      } catch (err) {\n        logger.warn('Failed to provision tenant key', { err })\n      }\n    }\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ snapshots, result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const after = (snapshots.after as SerializedTenant | undefined) ?? serializeTenant(result)\n    return {\n      actionLabel: translate('directory.audit.tenants.create', 'Create tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      tenantId: ctx.auth?.tenantId ?? null,\n      snapshotAfter: after,\n      payload: { undo: { after } },\n    }\n  },\n  redo: makeCreateRedo<Tenant, SerializedTenant, TenantPayload, Tenant>({\n    entityClass: Tenant,\n    buildResult: (entity) => entity,\n    events: tenantCrudEvents,\n    indexer: tenantCrudIndexer,\n    afterRestore: ({ entity }) => {\n      Reflect.set(entity, 'tenantId', String(entity.id))\n    },\n  }),\n}\n\nconst updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null })\n    if (!current) throw new CrudHttpError(404, { error: 'Tenant not found' })\n    return { before: serializeTenant(current) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.updateOrmEntity({\n      entity: Tenant,\n      where: { id: parsed.id, deletedAt: null } as FilterQuery<Tenant>,\n      apply: (entity) => {\n        if (parsed.name !== undefined) entity.name = parsed.name\n        if (parsed.isActive !== undefined) entity.isActive = parsed.isActive\n        entity.updatedAt = new Date()\n      },\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeRecord = (snapshots.before ?? null) as Record<string, unknown> | null\n    const after = serializeTenant(result)\n    const changes = buildChanges(beforeRecord, after as Record<string, unknown>, ['name', 'isActive'])\n    return {\n      actionLabel: translate('directory.audit.tenants.update', 'Update tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      changes,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nconst deleteTenantCommand: CommandHandler<{ body: any; query: Record<string, string> }, Tenant> = {\n  id: 'directory.tenants.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Tenant id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await em.findOne(Tenant, { id, deletedAt: null })\n    return existing ? { before: serializeTenant(existing) } : {}\n  },\n  async execute(rawInput, ctx) {\n    const id = requireId(rawInput, 'Tenant id required')\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.deleteOrmEntity({\n      entity: Tenant,\n      where: { id, deletedAt: null } as FilterQuery<Tenant>,\n      soft: true,\n      softDeleteField: 'deletedAt',\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    const identifiers = {\n      id: String(id),\n      organizationId: null,\n      tenantId: String(id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  buildLog: async ({ snapshots, input, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshot = (snapshots.before ?? null) as SerializedTenant | null\n    const id = String(input?.body?.id ?? input?.query?.id ?? '')\n    const fallbackId = beforeSnapshot?.id ?? null\n    return {\n      actionLabel: translate('directory.audit.tenants.delete', 'Delete tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: id || fallbackId || null,\n      snapshotBefore: beforeSnapshot ?? null,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nregisterCommand(createTenantCommand)\nregisterCommand(updateTenantCommand)\nregisterCommand(deleteTenantCommand)\n"],
-  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,cAAc;AAGvB,SAAS,qBAAqB;AAC9B,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,SAAS,qCAAqC;AAC9C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEhE,MAAM,mBAAqC;AAAA,EAChD,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AACd;AAEO,MAAM,oBAAuC;AAAA,EAClD,YAAY,EAAE,UAAU;AAC1B;AAEA,SAAS,gBAAgB,QAAgB;AACvC,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,EAAE;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,UAAU,CAAC,CAAC,OAAO;AAAA,IACnB,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EACjE;AACF;AAKA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAE9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO;AAAA,QACb,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,8BAA8B,GAAG;AACnC,UAAI;AACF,cAAM,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,YAAI,KAAK,YAAY,GAAG;AACtB,gBAAM,KAAK,kBAAkB,OAAO,OAAO,EAAE,CAAC;AAC9C,iBAAO,KAAK,sBAAsB,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QACnE,OAAO;AACL,iBAAO,KAAK,qDAAqD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QAClG;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,kCAAkC,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,WAAW,QAAQ,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,QAAS,UAAU,SAA0C,gBAAgB,MAAM;AACzF,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,eAAe;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,IAC7B;AAAA,EACF;AAAA,EACA,MAAM,eAAgE;AAAA,IACpE,aAAa;AAAA,IACb,aAAa,CAAC,WAAW;AAAA,IACzB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,cAAc,CAAC,EAAE,OAAO,MAAM;AAC5B,cAAQ,IAAI,QAAQ,YAAY,OAAO,OAAO,EAAE,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AACH;AAEA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AACrE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,UAAU,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,CAAC;AAC3E,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACxE,WAAO,EAAE,QAAQ,gBAAgB,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,YAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,YAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAC5D,eAAO,YAAY,oBAAI,KAAK;AAAA,MAC9B;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,eAAgB,UAAU,UAAU;AAC1C,UAAM,QAAQ,gBAAgB,MAAM;AACpC,UAAM,UAAU,aAAa,cAAc,OAAkC,CAAC,QAAQ,UAAU,CAAC;AACjG,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B;AAAA,MACA,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,MAAM,sBAA4F;AAAA,EAChG,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,WAAO,WAAW,EAAE,QAAQ,gBAAgB,QAAQ,EAAE,IAAI,CAAC;AAAA,EAC7D;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,KAAK,UAAU,UAAU,oBAAoB;AACnD,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,WAAW,KAAK;AAAA,MAC7B,MAAM;AAAA,MACN,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,EAAE;AAAA,MACb,gBAAgB;AAAA,MAChB,UAAU,OAAO,EAAE;AAAA,IACrB;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,OAAO,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,iBAAkB,UAAU,UAAU;AAC5C,UAAM,KAAK,OAAO,OAAO,MAAM,MAAM,OAAO,OAAO,MAAM,EAAE;AAC3D,UAAM,aAAa,gBAAgB,MAAM;AACzC,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,MAAM,cAAc;AAAA,MAChC,gBAAgB,kBAAkB;AAAA,MAClC,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;",
+  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { requireSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('directory').child({ component: 'tenants' })\n\nexport const tenantCrudEvents: CrudEventsConfig = {\n  module: 'directory',\n  entity: 'tenant',\n  persistent: true,\n}\n\nexport const tenantCrudIndexer: CrudIndexerConfig = {\n  entityType: E.directory.tenant,\n}\n\nfunction serializeTenant(entity: Tenant) {\n  return {\n    id: String(entity.id),\n    name: entity.name,\n    isActive: !!entity.isActive,\n    createdAt: entity.createdAt ? entity.createdAt.toISOString() : null,\n    updatedAt: entity.updatedAt ? entity.updatedAt.toISOString() : null,\n    deletedAt: entity.deletedAt ? entity.deletedAt.toISOString() : null,\n  }\n}\n\ntype TenantPayload = Record<string, unknown>\ntype SerializedTenant = ReturnType<typeof serializeTenant>\n\nconst createTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.create',\n  async execute(rawInput, ctx) {\n    await requireSuperAdmin(ctx)\n    const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    const tenant = await de.createOrmEntity({\n      entity: Tenant,\n      data: {\n        name: parsed.name,\n        isActive: parsed.isActive ?? true,\n      },\n    })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    if (isTenantDataEncryptionEnabled()) {\n      try {\n        const kms = ctx.container.resolve('kmsService') as { createTenantDek?: (id: string) => Promise<unknown>; isHealthy?: () => boolean }\n        if (kms?.isHealthy?.()) {\n          await kms?.createTenantDek?.(String(tenant.id))\n          logger.info('Created tenant DEK', { tenantId: String(tenant.id) })\n        } else {\n          logger.warn('KMS not healthy, skipping tenant DEK provisioning', { tenantId: String(tenant.id) })\n        }\n      } catch (err) {\n        logger.warn('Failed to provision tenant key', { err })\n      }\n    }\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ snapshots, result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const after = (snapshots.after as SerializedTenant | undefined) ?? serializeTenant(result)\n    return {\n      actionLabel: translate('directory.audit.tenants.create', 'Create tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      tenantId: ctx.auth?.tenantId ?? null,\n      snapshotAfter: after,\n      payload: { undo: { after } },\n    }\n  },\n  redo: makeCreateRedo<Tenant, SerializedTenant, TenantPayload, Tenant>({\n    entityClass: Tenant,\n    buildResult: (entity) => entity,\n    events: tenantCrudEvents,\n    indexer: tenantCrudIndexer,\n    afterRestore: ({ entity }) => {\n      Reflect.set(entity, 'tenantId', String(entity.id))\n    },\n  }),\n}\n\nconst updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {\n  id: 'directory.tenants.update',\n  async prepare(rawInput, ctx) {\n    await requireSuperAdmin(ctx)\n    const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null })\n    if (!current) throw new CrudHttpError(404, { error: 'Tenant not found' })\n    return { before: serializeTenant(current) }\n  },\n  async execute(rawInput, ctx) {\n    await requireSuperAdmin(ctx)\n    const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.updateOrmEntity({\n      entity: Tenant,\n      where: { id: parsed.id, deletedAt: null } as FilterQuery<Tenant>,\n      apply: (entity) => {\n        if (parsed.name !== undefined) entity.name = parsed.name\n        if (parsed.isActive !== undefined) entity.isActive = parsed.isActive\n        entity.updatedAt = new Date()\n      },\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.directory.tenant,\n      recordId: String(tenant.id),\n      organizationId: null,\n      tenantId: ctx.auth?.tenantId ?? null,\n      values: custom,\n    })\n\n    const identifiers = {\n      id: String(tenant.id),\n      organizationId: null,\n      tenantId: String(tenant.id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  captureAfter: (_input, result) => serializeTenant(result),\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeRecord = (snapshots.before ?? null) as Record<string, unknown> | null\n    const after = serializeTenant(result)\n    const changes = buildChanges(beforeRecord, after as Record<string, unknown>, ['name', 'isActive'])\n    return {\n      actionLabel: translate('directory.audit.tenants.update', 'Update tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: String(result.id),\n      changes,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nconst deleteTenantCommand: CommandHandler<{ body: any; query: Record<string, string> }, Tenant> = {\n  id: 'directory.tenants.delete',\n  async prepare(input, ctx) {\n    await requireSuperAdmin(ctx)\n    const id = requireId(input, 'Tenant id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await em.findOne(Tenant, { id, deletedAt: null })\n    return existing ? { before: serializeTenant(existing) } : {}\n  },\n  async execute(rawInput, ctx) {\n    await requireSuperAdmin(ctx)\n    const id = requireId(rawInput, 'Tenant id required')\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const tenant = await de.deleteOrmEntity({\n      entity: Tenant,\n      where: { id, deletedAt: null } as FilterQuery<Tenant>,\n      soft: true,\n      softDeleteField: 'deletedAt',\n    })\n    if (!tenant) throw new CrudHttpError(404, { error: 'Tenant not found' })\n\n    const identifiers = {\n      id: String(id),\n      organizationId: null,\n      tenantId: String(id),\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: tenant,\n      identifiers,\n      events: tenantCrudEvents,\n      indexer: tenantCrudIndexer,\n    })\n\n    return tenant\n  },\n  buildLog: async ({ snapshots, input, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshot = (snapshots.before ?? null) as SerializedTenant | null\n    const id = String(input?.body?.id ?? input?.query?.id ?? '')\n    const fallbackId = beforeSnapshot?.id ?? null\n    return {\n      actionLabel: translate('directory.audit.tenants.delete', 'Delete tenant'),\n      resourceKind: 'directory.tenant',\n      resourceId: id || fallbackId || null,\n      snapshotBefore: beforeSnapshot ?? null,\n      tenantId: ctx.auth?.tenantId ?? null,\n    }\n  },\n}\n\nregisterCommand(createTenantCommand)\nregisterCommand(updateTenantCommand)\nregisterCommand(deleteTenantCommand)\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,cAAc;AAGvB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,SAAS,qCAAqC;AAC9C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEhE,MAAM,mBAAqC;AAAA,EAChD,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AACd;AAEO,MAAM,oBAAuC;AAAA,EAClD,YAAY,EAAE,UAAU;AAC1B;AAEA,SAAS,gBAAgB,QAAgB;AACvC,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,EAAE;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,UAAU,CAAC,CAAC,OAAO;AAAA,IACnB,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EACjE;AACF;AAKA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,kBAAkB,GAAG;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAE9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO;AAAA,QACb,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,8BAA8B,GAAG;AACnC,UAAI;AACF,cAAM,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,YAAI,KAAK,YAAY,GAAG;AACtB,gBAAM,KAAK,kBAAkB,OAAO,OAAO,EAAE,CAAC;AAC9C,iBAAO,KAAK,sBAAsB,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QACnE,OAAO;AACL,iBAAO,KAAK,qDAAqD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,QAClG;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,kCAAkC,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,WAAW,QAAQ,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,QAAS,UAAU,SAA0C,gBAAgB,MAAM;AACzF,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,eAAe;AAAA,MACf,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,IAC7B;AAAA,EACF;AAAA,EACA,MAAM,eAAgE;AAAA,IACpE,aAAa;AAAA,IACb,aAAa,CAAC,WAAW;AAAA,IACzB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,cAAc,CAAC,EAAE,OAAO,MAAM;AAC5B,cAAQ,IAAI,QAAQ,YAAY,OAAO,OAAO,EAAE,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AACH;AAEA,MAAM,sBAA6D;AAAA,EACjE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,kBAAkB,GAAG;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AACrE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,UAAU,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,CAAC;AAC3E,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACxE,WAAO,EAAE,QAAQ,gBAAgB,OAAO,EAAE;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,kBAAkB,GAAG;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,oBAAoB,QAAQ;AAC7E,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,YAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,YAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAC5D,eAAO,YAAY,oBAAI,KAAK;AAAA,MAC9B;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,UAAU;AAAA,MACtB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,gBAAgB;AAAA,MAChB,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,gBAAgB;AAAA,MAChB,UAAU,OAAO,OAAO,EAAE;AAAA,IAC5B;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,CAAC,QAAQ,WAAW,gBAAgB,MAAM;AAAA,EACxD,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,eAAgB,UAAU,UAAU;AAC1C,UAAM,QAAQ,gBAAgB,MAAM;AACpC,UAAM,UAAU,aAAa,cAAc,OAAkC,CAAC,QAAQ,UAAU,CAAC;AACjG,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B;AAAA,MACA,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,MAAM,sBAA4F;AAAA,EAChG,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,kBAAkB,GAAG;AAC3B,UAAM,KAAK,UAAU,OAAO,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,WAAO,WAAW,EAAE,QAAQ,gBAAgB,QAAQ,EAAE,IAAI,CAAC;AAAA,EAC7D;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,kBAAkB,GAAG;AAC3B,UAAM,KAAK,UAAU,UAAU,oBAAoB;AACnD,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,SAAS,MAAM,GAAG,gBAAgB;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,WAAW,KAAK;AAAA,MAC7B,MAAM;AAAA,MACN,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAEvE,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,EAAE;AAAA,MACb,gBAAgB;AAAA,MAChB,UAAU,OAAO,EAAE;AAAA,IACrB;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,OAAO,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,iBAAkB,UAAU,UAAU;AAC5C,UAAM,KAAK,OAAO,OAAO,MAAM,MAAM,OAAO,OAAO,MAAM,EAAE;AAC3D,UAAM,aAAa,gBAAgB,MAAM;AACzC,WAAO;AAAA,MACL,aAAa,UAAU,kCAAkC,eAAe;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,MAAM,cAAc;AAAA,MAChC,gBAAgB,kBAAkB;AAAA,MAClC,UAAU,IAAI,MAAM,YAAY;AAAA,IAClC;AAAA,EACF;AACF;AAEA,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;AACnC,gBAAgB,mBAAmB;",
   "names": []
 }

package/dist/modules/payment_gateways/api/sessions/route.js

@@ -90,9 +90,7 @@ async function POST(req) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
-    const message = err instanceof Error ? err.message : "Failed to create payment session";
-    const status = message.includes("No gateway adapter") ? 422 : 502;
-    return NextResponse.json({ error: message }, { status });
+    return NextResponse.json({ error: "Failed to create payment session" }, { status: 502 });
   }
 }
 const openApi = {

package/dist/modules/payment_gateways/api/sessions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/payment_gateways/api/sessions/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createSessionSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\nimport {\n  resolveUserFeatures,\n  runPaymentGatewayMutationGuardAfterSuccess,\n  runPaymentGatewayMutationGuards,\n} from '../guards'\n\nconst gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'\n\nexport const metadata = {\n  path: '/payment_gateways/sessions',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.manage'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = createSessionSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runPaymentGatewayMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: null,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const { transaction, session } = await service.createPaymentSession({\n      providerKey: parsed.data.providerKey,\n      paymentId: crypto.randomUUID(),\n      orderId: parsed.data.orderId,\n      amount: parsed.data.amount,\n      currencyCode: parsed.data.currencyCode,\n      captureMethod: parsed.data.captureMethod,\n      description: parsed.data.description,\n      successUrl: parsed.data.successUrl,\n      cancelUrl: parsed.data.cancelUrl,\n      metadata: parsed.data.metadata,\n      presentation: parsed.data.presentation,\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    })\n\n    const redirectUrl = session.redirectUrl\n      ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null)\n\n    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: transaction.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n    return NextResponse.json({\n      transactionId: transaction.id,\n      sessionId: session.sessionId,\n      providerKey: transaction.providerKey,\n      clientSecret: session.clientSecret,\n      redirectUrl,\n      providerData: session.providerData ?? null,\n      clientSession: session.clientSession ?? null,\n      status: session.status,\n      paymentId: transaction.paymentId,\n    }, { status: 201 })\n  } catch (err: unknown) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const message = err instanceof Error ? err.message : 'Failed to create payment session'\n    const status = message.includes('No gateway adapter') ? 422 : 502\n    return NextResponse.json({ error: message }, { status })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Create a payment session via a gateway provider',\n  methods: {\n    POST: {\n      summary: 'Create payment session',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 201, description: 'Payment session created' },\n        { status: 409, description: 'Amount or currency does not match the referenced order' },\n        { status: 422, description: 'Invalid payload or unknown provider' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,2BAA2B;AAEpC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,oBAAoB,UAAU,OAAO;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,EAAE,aAAa,QAAQ,IAAI,MAAM,QAAQ,qBAAqB;AAAA,MAClE,aAAa,OAAO,KAAK;AAAA,MACzB,WAAW,OAAO,WAAW;AAAA,MAC7B,SAAS,OAAO,KAAK;AAAA,MACrB,QAAQ,OAAO,KAAK;AAAA,MACpB,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK;AAAA,MAC3B,aAAa,OAAO,KAAK;AAAA,MACzB,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW,OAAO,KAAK;AAAA,MACvB,UAAU,OAAO,KAAK;AAAA,MACtB,cAAc,OAAO,KAAK;AAAA,MAC1B,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,UAAM,cAAc,QAAQ,gBACtB,QAAQ,eAAe,SAAS,aAAa,QAAQ,cAAc,cAAc;AAEvF,UAAM,2CAA2C,YAAY,uBAAuB;AAAA,MAClF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,eAAe,YAAY;AAAA,MAC3B,WAAW,QAAQ;AAAA,MACnB,aAAa,YAAY;AAAA,MACzB,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA,cAAc,QAAQ,gBAAgB;AAAA,MACtC,eAAe,QAAQ,iBAAiB;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,WAAW,YAAY;AAAA,IACzB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB,SAAS,KAAc;AACrB,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,UAAM,SAAS,QAAQ,SAAS,oBAAoB,IAAI,MAAM;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,EACzD;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createSessionSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\nimport {\n  resolveUserFeatures,\n  runPaymentGatewayMutationGuardAfterSuccess,\n  runPaymentGatewayMutationGuards,\n} from '../guards'\n\nconst gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'\n\nexport const metadata = {\n  path: '/payment_gateways/sessions',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.manage'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = createSessionSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runPaymentGatewayMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: null,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const { transaction, session } = await service.createPaymentSession({\n      providerKey: parsed.data.providerKey,\n      paymentId: crypto.randomUUID(),\n      orderId: parsed.data.orderId,\n      amount: parsed.data.amount,\n      currencyCode: parsed.data.currencyCode,\n      captureMethod: parsed.data.captureMethod,\n      description: parsed.data.description,\n      successUrl: parsed.data.successUrl,\n      cancelUrl: parsed.data.cancelUrl,\n      metadata: parsed.data.metadata,\n      presentation: parsed.data.presentation,\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    })\n\n    const redirectUrl = session.redirectUrl\n      ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null)\n\n    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: transaction.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n    return NextResponse.json({\n      transactionId: transaction.id,\n      sessionId: session.sessionId,\n      providerKey: transaction.providerKey,\n      clientSecret: session.clientSecret,\n      redirectUrl,\n      providerData: session.providerData ?? null,\n      clientSession: session.clientSession ?? null,\n      status: session.status,\n      paymentId: transaction.paymentId,\n    }, { status: 201 })\n  } catch (err: unknown) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    return NextResponse.json({ error: 'Failed to create payment session' }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Create a payment session via a gateway provider',\n  methods: {\n    POST: {\n      summary: 'Create payment session',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 201, description: 'Payment session created' },\n        { status: 409, description: 'Amount or currency does not match the referenced order' },\n        { status: 422, description: 'Invalid payload or unknown provider' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,2BAA2B;AAEpC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,oBAAoB,UAAU,OAAO;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,EAAE,aAAa,QAAQ,IAAI,MAAM,QAAQ,qBAAqB;AAAA,MAClE,aAAa,OAAO,KAAK;AAAA,MACzB,WAAW,OAAO,WAAW;AAAA,MAC7B,SAAS,OAAO,KAAK;AAAA,MACrB,QAAQ,OAAO,KAAK;AAAA,MACpB,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK;AAAA,MAC3B,aAAa,OAAO,KAAK;AAAA,MACzB,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW,OAAO,KAAK;AAAA,MACvB,UAAU,OAAO,KAAK;AAAA,MACtB,cAAc,OAAO,KAAK;AAAA,MAC1B,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,UAAM,cAAc,QAAQ,gBACtB,QAAQ,eAAe,SAAS,aAAa,QAAQ,cAAc,cAAc;AAEvF,UAAM,2CAA2C,YAAY,uBAAuB;AAAA,MAClF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,eAAe,YAAY;AAAA,MAC3B,WAAW,QAAQ;AAAA,MACnB,aAAa,YAAY;AAAA,MACzB,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA,cAAc,QAAQ,gBAAgB;AAAA,MACtC,eAAe,QAAQ,iBAAiB;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,WAAW,YAAY;AAAA,IACzB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB,SAAS,KAAc;AACrB,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/payment_gateways/lib/gateway-service.js

@@ -4,7 +4,7 @@ import { createLogger } from "@open-mercato/shared/lib/logger";
 import {
   getGatewayAdapter
 } from "@open-mercato/shared/modules/payment_gateways/types";
-import { conflict } from "@open-mercato/shared/lib/crud/errors";
+import { conflict, CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { GatewaySessionInitialization, GatewayTransaction } from "../data/entities.js";
 import { canApplyManualAction, isValidTransition } from "./status-machine.js";
 import { emitPaymentGatewayEvent } from "../events.js";
@@ -114,9 +114,8 @@ function createPaymentGatewayService(deps) {
     const selectedVersion = deps.integrationStateService ? await deps.integrationStateService.resolveApiVersion(integrationId, scope) : void 0;
     const adapter = getGatewayAdapter(providerKey, selectedVersion);
     if (!adapter) {
-      throw new Error(
-        selectedVersion ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})` : `No gateway adapter registered for provider: ${providerKey}`
-      );
+      const message = selectedVersion ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})` : `No gateway adapter registered for provider: ${providerKey}`;
+      throw new CrudHttpError(422, { error: message });
     }
     const credentials = await integrationCredentialsService.resolve(integrationId, scope) ?? {};
     return { adapter, credentials };

package/dist/modules/payment_gateways/lib/gateway-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/payment_gateways/lib/gateway-service.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  getGatewayAdapter,\n  type CreateSessionInput,\n  type CreateSessionResult,\n  type CaptureResult,\n  type RefundResult,\n  type CancelResult,\n  type GatewayAdapter,\n  type GatewayPaymentStatus,\n  type PaymentGatewayPresentationRequest,\n  type PaymentOrderTotalResolver,\n  type UnifiedPaymentStatus,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { IntegrationLogService } from '../../integrations/lib/log-service'\nimport { conflict } from '@open-mercato/shared/lib/crud/errors'\nimport { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'\nimport { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'\nimport { emitPaymentGatewayEvent } from '../events'\nimport { readGatewayMetadata, readWebhookLog } from './transaction-fields'\nimport { reconcileSessionAmountWithOrder } from './order-amount-reconciliation'\nimport {\n  alignCapturedAmountWithStatus,\n  assertCaptureWithinRemaining,\n  formatAmountUnits,\n  parseAmountUnits,\n  releaseCaptureAmount,\n  reserveCaptureAmount,\n  settleCapturedAmount,\n} from './capture-ledger'\nimport {\n  completePaymentOperation,\n  failPaymentOperation,\n  preparePaymentOperation,\n} from './payment-operation-idempotency'\nimport {\n  buildPaymentSessionOperationKey,\n  claimPaymentSessionInitialization,\n  findPaymentSessionInitialization,\n  reclaimPaymentSessionInitialization,\n  refreshPaymentSessionInitialization,\n  releasePaymentSessionInitialization,\n} from './session-idempotency'\n\nconst PAYMENT_SESSION_CLAIM_STALE_MS = 30_000\nconst PAYMENT_SESSION_WAIT_INTERVAL_MS = 25\nconst logger = createLogger('payment_gateways').child({ component: 'gateway-service' })\n\nfunction assertManualActionAllowed(action: ManualGatewayAction, transaction: GatewayTransaction): void {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (!canApplyManualAction(action, current)) {\n    throw conflict(`Cannot ${action} a payment in status \"${current}\"`)\n  }\n}\n\nfunction applyAdapterResultStatus(\n  action: ManualGatewayAction,\n  transaction: GatewayTransaction,\n  resultStatus: UnifiedPaymentStatus,\n): boolean {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (resultStatus === current) return false\n  if (isValidTransition(resultStatus, current)) return false\n  if (!isValidTransition(current, resultStatus)) {\n    throw conflict(\n      `Gateway returned status \"${resultStatus}\" which is not a valid transition from \"${current}\" for ${action}`,\n    )\n  }\n  transaction.unifiedStatus = resultStatus\n  return true\n}\n\nexport interface PaymentGatewayServiceDeps {\n  em: EntityManager\n  integrationCredentialsService: CredentialsService\n  integrationStateService?: IntegrationStateService\n  integrationLogService?: IntegrationLogService\n  /**\n   * Optional seam supplied by the module that owns orders (`sales` by default).\n   * When absent, session amounts cannot be reconciled and are accepted as-is.\n   */\n  paymentOrderTotalResolver?: PaymentOrderTotalResolver | null\n  sessionClaimOptions?: {\n    staleAfterMs?: number\n    heartbeatIntervalMs?: number\n    pollIntervalMs?: number\n  }\n}\n\nexport interface CreatePaymentSessionInput {\n  providerKey: string\n  paymentId: string\n  idempotencyKey?: string\n  orderId?: string\n  amount: number\n  currencyCode: string\n  captureMethod?: 'automatic' | 'manual'\n  paymentTypes?: string[]\n  description?: string\n  successUrl?: string\n  cancelUrl?: string\n  metadata?: Record<string, unknown>\n  presentation?: PaymentGatewayPresentationRequest\n  organizationId: string\n  tenantId: string\n}\n\nexport function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {\n  const { em, integrationCredentialsService, integrationLogService } = deps\n  const claimStaleAfterMs = Math.max(1, deps.sessionClaimOptions?.staleAfterMs ?? PAYMENT_SESSION_CLAIM_STALE_MS)\n  const claimHeartbeatIntervalMs = Math.max(\n    1,\n    deps.sessionClaimOptions?.heartbeatIntervalMs ?? Math.floor(claimStaleAfterMs / 3),\n  )\n  const claimPollIntervalMs = Math.max(1, deps.sessionClaimOptions?.pollIntervalMs ?? PAYMENT_SESSION_WAIT_INTERVAL_MS)\n\n  async function findTransactionOrThrow(\n    transactionId: string,\n    scope: { organizationId: string; tenantId: string },\n    targetEm: EntityManager = em,\n  ): Promise<GatewayTransaction> {\n    const transaction = await findOneWithDecryption(\n      targetEm,\n      GatewayTransaction,\n      {\n        id: transactionId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n    if (!transaction) {\n      throw new Error('Transaction not found')\n    }\n    return transaction\n  }\n\n  function readProviderSessionId(transaction: GatewayTransaction): string {\n    if (typeof transaction.providerSessionId === 'string' && transaction.providerSessionId.trim().length > 0) {\n      return transaction.providerSessionId\n    }\n    throw new Error('Transaction is missing provider session id')\n  }\n\n  async function emitStatusEvent(status: UnifiedPaymentStatus, payload: Record<string, unknown>) {\n    type PaymentGatewayEventId = Parameters<typeof emitPaymentGatewayEvent>[0]\n    const eventMap: Partial<Record<UnifiedPaymentStatus, PaymentGatewayEventId>> = {\n      authorized: 'payment_gateways.payment.authorized',\n      captured: 'payment_gateways.payment.captured',\n      failed: 'payment_gateways.payment.failed',\n      refunded: 'payment_gateways.payment.refunded',\n      cancelled: 'payment_gateways.payment.cancelled',\n    }\n    const eventId = eventMap[status]\n    if (!eventId) return\n    await emitPaymentGatewayEvent(eventId, payload)\n  }\n\n  async function writeTransactionLog(\n    providerKey: string,\n    scope: { organizationId: string; tenantId: string },\n    transactionId: string,\n    level: 'info' | 'warn' | 'error',\n    message: string,\n    payload?: Record<string, unknown> | null,\n    code?: string | null,\n  ) {\n    if (!integrationLogService) return\n    await integrationLogService.write({\n      integrationId: `gateway_${providerKey}`,\n      scopeEntityType: 'payment_transaction',\n      scopeEntityId: transactionId,\n      level,\n      message,\n      code,\n      payload: payload ?? null,\n    }, scope)\n  }\n\n  async function resolveAdapterAndCredentials(providerKey: string, scope: { organizationId: string; tenantId: string }) {\n    const integrationId = `gateway_${providerKey}`\n    const selectedVersion = deps.integrationStateService\n      ? await deps.integrationStateService.resolveApiVersion(integrationId, scope)\n      : undefined\n    const adapter = getGatewayAdapter(providerKey, selectedVersion)\n    if (!adapter) {\n      throw new Error(\n        selectedVersion\n          ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})`\n          : `No gateway adapter registered for provider: ${providerKey}`,\n      )\n    }\n    const credentials = await integrationCredentialsService.resolve(integrationId, scope) ?? {}\n\n    return { adapter, credentials }\n  }\n\n  type ManualOperationResult = CaptureResult | RefundResult | CancelResult\n\n  async function executeManualOperation<TResult extends ManualOperationResult>(input: {\n    action: ManualGatewayAction\n    transactionId: string\n    operationId?: string\n    payload: Record<string, unknown>\n    scope: { organizationId: string; tenantId: string }\n    assertInitialAllowed?: (transaction: GatewayTransaction) => void\n    beforeInvoke?: (context: { transaction: GatewayTransaction; operation: GatewayPaymentOperation }) => Promise<void>\n    releaseOnFailure?: (context: {\n      transaction: GatewayTransaction\n      operation: GatewayPaymentOperation\n      providerInvoked: boolean\n    }) => Promise<void>\n    invoke: (context: {\n      adapter: GatewayAdapter\n      credentials: Record<string, unknown>\n      transaction: GatewayTransaction\n      idempotencyKey: string\n    }) => Promise<TResult>\n    applyResult: (transaction: GatewayTransaction, result: TResult) => void\n    afterCommit: (transaction: GatewayTransaction, result: TResult) => Promise<void>\n  }): Promise<TResult> {\n    const transaction = await findTransactionOrThrow(input.transactionId, input.scope)\n    const prepared = await preparePaymentOperation({\n      em,\n      transactionId: transaction.id,\n      providerKey: transaction.providerKey,\n      action: input.action,\n      operationId: input.operationId,\n      payload: input.payload,\n      scope: input.scope,\n      assertInitialAllowed: () => {\n        assertManualActionAllowed(input.action, transaction)\n        input.assertInitialAllowed?.(transaction)\n      },\n    })\n    if (prepared.kind === 'completed') {\n      if (prepared.result.status !== transaction.unifiedStatus) {\n        throw conflict(\n          `Cannot replay ${input.action} because the payment status has changed since the operation completed`,\n        )\n      }\n      return prepared.result as unknown as TResult\n    }\n\n    const operation = prepared.claim.record\n    // Everything after this flips to true is post-settlement: the provider moved the money and the\n    // completion transaction committed it. A later event or logging failure must not undo either,\n    // so the failure path below only runs while the operation can still be rolled back.\n    let settled = false\n    // Flips once the provider call returned, so the failure path can tell \"the provider never\n    // moved the money\" from \"the provider moved it and only our bookkeeping failed\" \u2014 the two\n    // cases need opposite rollback decisions.\n    let providerInvoked = false\n    try {\n      await input.beforeInvoke?.({ transaction, operation })\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n      const result = await input.invoke({\n        adapter,\n        credentials,\n        transaction,\n        idempotencyKey: prepared.claim.providerIdempotencyKey,\n      })\n      providerInvoked = true\n      const statusChanged = await completePaymentOperation(\n        em,\n        prepared.claim,\n        result as unknown as Record<string, unknown>,\n        async (tx) => {\n          const current = await findTransactionOrThrow(input.transactionId, input.scope, tx)\n          const changed = applyAdapterResultStatus(input.action, current, result.status)\n          input.applyResult(current, result)\n          return changed\n        },\n      )\n      settled = true\n      if (statusChanged) {\n        await emitStatusEvent(result.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await input.afterCommit(transaction, result)\n      return result\n    } catch (error: unknown) {\n      if (!settled) {\n        if (input.releaseOnFailure) {\n          await input.releaseOnFailure({ transaction, operation, providerInvoked }).catch(() => undefined)\n        }\n        await Promise.allSettled([failPaymentOperation(em, prepared.claim)])\n      }\n      throw error\n    }\n  }\n\n  function createGatewayTransaction(\n    manager: EntityManager,\n    input: CreatePaymentSessionInput,\n    session: CreateSessionResult,\n    id?: string,\n  ): GatewayTransaction {\n    const data = {\n      paymentId: input.paymentId,\n      providerKey: input.providerKey,\n      providerSessionId: session.sessionId,\n      unifiedStatus: session.status,\n      redirectUrl: session.redirectUrl\n        ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null),\n      clientSecret: session.clientSecret ?? null,\n      amount: String(input.amount),\n      // An automatic-capture session comes back already captured, so the ledger has to start\n      // at the full amount \u2014 otherwise a later manual capture would look like the first one.\n      capturedAmount: session.status === 'captured' ? String(input.amount) : '0',\n      currencyCode: input.currencyCode,\n      gatewayMetadata: {\n        ...(session.providerData ?? {}),\n        ...(session.clientSession ? { clientSession: session.clientSession } : {}),\n      },\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      deletedAt: null,\n    }\n    return id\n      ? manager.create(GatewayTransaction, { id, ...data })\n      : manager.create(GatewayTransaction, data)\n  }\n\n  function restoreSession(transaction: GatewayTransaction): CreateSessionResult {\n    const metadata = readGatewayMetadata(transaction.gatewayMetadata)\n    const { clientSession, ...providerData } = metadata\n    return {\n      sessionId: readProviderSessionId(transaction),\n      status: transaction.unifiedStatus as UnifiedPaymentStatus,\n      ...(transaction.clientSecret ? { clientSecret: transaction.clientSecret } : {}),\n      ...(transaction.redirectUrl ? { redirectUrl: transaction.redirectUrl } : {}),\n      ...(Object.keys(providerData).length > 0 ? { providerData } : {}),\n      ...(clientSession && typeof clientSession === 'object'\n        ? { clientSession: clientSession as CreateSessionResult['clientSession'] }\n        : {}),\n    }\n  }\n\n  async function recordCreatedSession(\n    transaction: GatewayTransaction,\n    input: CreatePaymentSessionInput,\n    scope: { organizationId: string; tenantId: string },\n  ): Promise<void> {\n    await emitPaymentGatewayEvent('payment_gateways.session.created', {\n      transactionId: transaction.id,\n      paymentId: transaction.paymentId,\n      providerKey: transaction.providerKey,\n      status: transaction.unifiedStatus,\n      organizationId: transaction.organizationId,\n      tenantId: transaction.tenantId,\n    })\n    await writeTransactionLog(\n      transaction.providerKey,\n      scope,\n      transaction.id,\n      'info',\n      'Payment session created',\n      {\n        paymentId: transaction.paymentId,\n        providerSessionId: transaction.providerSessionId,\n        status: transaction.unifiedStatus,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n      },\n    )\n  }\n\n  function startClaimHeartbeat(\n    ownership: { id: string; claimToken: string },\n    scope: { organizationId: string; tenantId: string },\n  ): () => Promise<void> {\n    let stopped = false\n    let timer: ReturnType<typeof setTimeout> | null = null\n    let pendingRefresh = Promise.resolve()\n\n    const schedule = () => {\n      timer = setTimeout(() => {\n        pendingRefresh = refreshPaymentSessionInitialization(em, ownership, scope, new Date())\n          .then(\n            (refreshed) => {\n              if (refreshed && !stopped) schedule()\n            },\n            () => {\n              if (!stopped) schedule()\n            },\n          )\n      }, claimHeartbeatIntervalMs)\n    }\n    schedule()\n\n    return async () => {\n      stopped = true\n      if (timer) clearTimeout(timer)\n      await pendingRefresh\n    }\n  }\n\n  return {\n    async createPaymentSession(input: CreatePaymentSessionInput): Promise<{ transaction: GatewayTransaction; session: CreateSessionResult }> {\n      const scope = { organizationId: input.organizationId, tenantId: input.tenantId }\n      await reconcileSessionAmountWithOrder({\n        orderId: input.orderId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        scope,\n        resolver: deps.paymentOrderTotalResolver,\n      })\n      const { adapter, credentials } = await resolveAdapterAndCredentials(input.providerKey, scope)\n\n      const sessionInput: CreateSessionInput = {\n        paymentId: input.paymentId,\n        orderId: input.orderId,\n        idempotencyKey: input.idempotencyKey,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        captureMethod: input.captureMethod,\n        paymentTypes: input.paymentTypes,\n        description: input.description,\n        successUrl: input.successUrl,\n        cancelUrl: input.cancelUrl,\n        metadata: input.metadata,\n        presentation: input.presentation,\n        credentials,\n      }\n\n      if (!input.idempotencyKey) {\n        const session = await adapter.createSession(sessionInput)\n        const transaction = createGatewayTransaction(em, input, session)\n        await em.persist(transaction).flush()\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n\n      const operationKey = buildPaymentSessionOperationKey({\n        idempotencyKey: input.idempotencyKey,\n        paymentId: input.paymentId,\n        providerKey: input.providerKey,\n        scope,\n      })\n      while (true) {\n        const existing = await findPaymentSessionInitialization(em, operationKey, input.providerKey, scope)\n        if (existing?.gatewayTransactionId) {\n          const transaction = await findOneWithDecryption(\n            em.fork(),\n            GatewayTransaction,\n            {\n              id: existing.gatewayTransactionId,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n              deletedAt: null,\n            },\n            undefined,\n            scope,\n          )\n          if (!transaction) {\n            throw new Error('[internal] Completed payment session is missing its gateway transaction')\n          }\n          return { transaction, session: restoreSession(transaction) }\n        }\n\n        const claimedAt = new Date()\n        const staleBefore = new Date(claimedAt.getTime() - claimStaleAfterMs)\n        const ownership = existing\n          ? await reclaimPaymentSessionInitialization(em, existing, scope, claimedAt, staleBefore)\n          : await claimPaymentSessionInitialization(em, operationKey, input.providerKey, scope, claimedAt)\n\n        if (!ownership) {\n          await new Promise((resolve) => setTimeout(resolve, claimPollIntervalMs))\n          continue\n        }\n\n        let session: CreateSessionResult\n        const stopHeartbeat = startClaimHeartbeat(ownership, scope)\n        try {\n          session = await adapter.createSession({ ...sessionInput, idempotencyKey: operationKey })\n        } catch (error) {\n          try {\n            await releasePaymentSessionInitialization(em, ownership, scope)\n          } catch (releaseError) {\n            logger.warn('Failed to release payment session initialization claim', {\n              claimId: ownership.id,\n              providerKey: input.providerKey,\n              err: releaseError,\n            })\n          }\n          throw error\n        } finally {\n          await stopHeartbeat()\n        }\n\n        const transactionId = randomUUID()\n        const transaction = await em.fork().transactional(async (transactionEm) => {\n          const finalizedRows = await transactionEm.nativeUpdate(\n            GatewaySessionInitialization,\n            {\n              id: ownership.id,\n              claimToken: ownership.claimToken,\n              gatewayTransactionId: null,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n            },\n            {\n              gatewayTransactionId: transactionId,\n              claimToken: null,\n              claimedAt: null,\n              updatedAt: new Date(),\n            },\n          )\n          if (finalizedRows === 0) return null\n          const created = createGatewayTransaction(transactionEm, input, session, transactionId)\n          await transactionEm.persist(created).flush()\n          return created\n        })\n\n        if (!transaction) {\n          continue\n        }\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n    },\n\n    async capturePayment(\n      transactionId: string,\n      amount: number | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CaptureResult> {\n      let reservedUnits: bigint | null = null\n      let providerAmount = amount\n      return executeManualOperation({\n        action: 'capture',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null },\n        scope,\n        assertInitialAllowed: (transaction) => { assertCaptureWithinRemaining(transaction, amount) },\n        beforeInvoke: async ({ transaction, operation }) => {\n          const alreadyCapturedUnits = parseAmountUnits(transaction.capturedAmount)\n          reservedUnits = await reserveCaptureAmount(em, { transaction, operation, amount, scope })\n          // \"Capture the rest\" has to name the remaining amount once part of the authorization is\n          // already captured, otherwise the provider would capture the full amount a second time.\n          if (amount === undefined && alreadyCapturedUnits > 0n) {\n            providerAmount = Number(formatAmountUnits(reservedUnits))\n          }\n        },\n        // The slice goes back only while the provider has not been called yet. Once the capture\n        // call returned, the money may already have moved and only the completion transaction\n        // failed, so releasing would reopen the authorization for a fresh operation id and allow an\n        // over-capture. Holding the reservation is the conservative outcome: a retry of this same\n        // operation id reuses both the reservation and the provider idempotency key, so the provider\n        // itself collapses the duplicate.\n        releaseOnFailure: async ({ transaction, operation, providerInvoked }) => {\n          if (reservedUnits === null) return\n          if (providerInvoked) {\n            await writeTransactionLog(\n              transaction.providerKey,\n              { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n              transaction.id,\n              'warn',\n              'Capture reservation stays outstanding because the provider call already returned',\n              { operationId: operation.operationId, reservedAmount: formatAmountUnits(reservedUnits) },\n            )\n            return\n          }\n          const released = await releaseCaptureAmount(em, { transactionId, operation, reservedUnits, scope })\n          if (released) return\n          await writeTransactionLog(\n            transaction.providerKey,\n            { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n            transaction.id,\n            'warn',\n            'Capture reservation stays outstanding after a failed capture',\n            { operationId: operation.operationId, reservedAmount: formatAmountUnits(reservedUnits) },\n          )\n        },\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.capture({\n          sessionId: readProviderSessionId(transaction),\n          amount: providerAmount,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            captureResult: result.providerData,\n          }\n          if (reservedUnits !== null) settleCapturedAmount(transaction, reservedUnits, result.capturedAmount)\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment captured',\n          { amount: amount ?? null, status: result.status, capturedAmount: result.capturedAmount },\n        ),\n      })\n    },\n\n    async refundPayment(\n      transactionId: string,\n      amount: number | undefined,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<RefundResult> {\n      return executeManualOperation({\n        action: 'refund',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null, reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.refund({\n          sessionId: readProviderSessionId(transaction),\n          amount,\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayRefundId = result.refundId\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            refundResult: result.providerData,\n          }\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment refunded',\n          { amount: amount ?? null, reason: reason ?? null, status: result.status, refundId: result.refundId },\n        ),\n      })\n    },\n\n    async cancelPayment(\n      transactionId: string,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CancelResult> {\n      return executeManualOperation({\n        action: 'cancel',\n        transactionId,\n        operationId,\n        payload: { reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.cancel({\n          sessionId: readProviderSessionId(transaction),\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: () => {},\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment cancelled',\n          { reason: reason ?? null, status: result.status },\n        ),\n      })\n    },\n\n    async getPaymentStatus(transactionId: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayPaymentStatus> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n\n      const status = await adapter.getStatus({\n        sessionId: readProviderSessionId(transaction),\n        credentials,\n      })\n\n      if (status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus as UnifiedPaymentStatus, status.status)) {\n        const previousStatus = transaction.unifiedStatus\n        transaction.unifiedStatus = status.status\n        alignCapturedAmountWithStatus(transaction, status.status)\n        transaction.gatewayStatus = status.status\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), statusResult: status.providerData ?? null }\n        transaction.lastPolledAt = new Date()\n        await em.flush()\n        await emitStatusEvent(status.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n        await writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment status updated by poller',\n          {\n            previousStatus,\n            nextStatus: status.status,\n          },\n        )\n      }\n\n      return status\n    },\n\n    async syncTransactionStatus(transactionId: string, update: {\n      unifiedStatus: UnifiedPaymentStatus\n      providerStatus?: string\n      providerData?: Record<string, unknown>\n      webhookEvent?: {\n        eventType: string\n        idempotencyKey: string\n        processed: boolean\n        receivedAt?: string\n      }\n    }, scope: { organizationId: string; tenantId: string }): Promise<void> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus\n      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)\n      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus\n      const previousStatus = transaction.unifiedStatus\n      if (shouldApplyStatus) {\n        transaction.unifiedStatus = update.unifiedStatus\n        alignCapturedAmountWithStatus(transaction, update.unifiedStatus)\n      }\n      if (update.providerStatus) {\n        transaction.gatewayStatus = update.providerStatus\n      }\n      if (update.providerData) {\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }\n      }\n      if (update.webhookEvent) {\n        const webhookLog = readWebhookLog(transaction.webhookLog)\n        webhookLog.push({\n          eventType: update.webhookEvent.eventType,\n          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),\n          idempotencyKey: update.webhookEvent.idempotencyKey,\n          unifiedStatus: update.unifiedStatus,\n          processed: update.webhookEvent.processed,\n        })\n        transaction.webhookLog = webhookLog\n      }\n      transaction.lastWebhookAt = new Date()\n      await em.flush()\n      if (shouldApplyStatus) {\n        await emitStatusEvent(update.unifiedStatus, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await writeTransactionLog(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n        transaction.id,\n        shouldApplyStatus ? 'info' : 'warn',\n        shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',\n        {\n          previousStatus,\n          nextStatus: update.unifiedStatus,\n          providerStatus: update.providerStatus ?? null,\n          eventType: update.webhookEvent?.eventType ?? null,\n          idempotencyKey: update.webhookEvent?.idempotencyKey ?? null,\n        },\n      )\n    },\n\n    async findTransaction(id: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          id,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async findTransactionBySessionId(\n      providerSessionId: string,\n      scope: { organizationId: string; tenantId: string },\n      providerKey?: string,\n    ): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerSessionId,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n          ...(providerKey ? { providerKey } : {}),\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async listTransactionsForStatusPolling(scope?: {\n      organizationId?: string\n      tenantId?: string\n      providerKey?: string\n      limit?: number\n    }): Promise<GatewayTransaction[]> {\n      const where: Record<string, unknown> = {\n        unifiedStatus: { $in: ['pending', 'authorized', 'partially_captured'] },\n        deletedAt: null,\n      }\n      if (scope?.organizationId) where.organizationId = scope.organizationId\n      if (scope?.tenantId) where.tenantId = scope.tenantId\n      if (scope?.providerKey) where.providerKey = scope.providerKey\n\n      return findWithDecryption(\n        em,\n        GatewayTransaction,\n        where,\n        {\n          orderBy: { updatedAt: 'asc' },\n          limit: scope?.limit ?? 100,\n        },\n        scope,\n      )\n    },\n  }\n}\n\nexport type PaymentGatewayService = ReturnType<typeof createPaymentGatewayService>\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,OAWK;AAIP,SAAS,gBAAgB;AACzB,SAAkC,8BAA8B,0BAA0B;AAC1F,SAAS,sBAAsB,yBAAmD;AAClF,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,sBAAsB;AACpD,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AACzC,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAEtF,SAAS,0BAA0B,QAA6B,aAAuC;AACrG,QAAM,UAAU,YAAY;AAC5B,MAAI,CAAC,qBAAqB,QAAQ,OAAO,GAAG;AAC1C,UAAM,SAAS,UAAU,MAAM,yBAAyB,OAAO,GAAG;AAAA,EACpE;AACF;AAEA,SAAS,yBACP,QACA,aACA,cACS;AACT,QAAM,UAAU,YAAY;AAC5B,MAAI,iBAAiB,QAAS,QAAO;AACrC,MAAI,kBAAkB,cAAc,OAAO,EAAG,QAAO;AACrD,MAAI,CAAC,kBAAkB,SAAS,YAAY,GAAG;AAC7C,UAAM;AAAA,MACJ,4BAA4B,YAAY,2CAA2C,OAAO,SAAS,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,cAAY,gBAAgB;AAC5B,SAAO;AACT;AAqCO,SAAS,4BAA4B,MAAiC;AAC3E,QAAM,EAAE,IAAI,+BAA+B,sBAAsB,IAAI;AACrE,QAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,qBAAqB,gBAAgB,8BAA8B;AAC9G,QAAM,2BAA2B,KAAK;AAAA,IACpC;AAAA,IACA,KAAK,qBAAqB,uBAAuB,KAAK,MAAM,oBAAoB,CAAC;AAAA,EACnF;AACA,QAAM,sBAAsB,KAAK,IAAI,GAAG,KAAK,qBAAqB,kBAAkB,gCAAgC;AAEpH,iBAAe,uBACb,eACA,OACA,WAA0B,IACG;AAC7B,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,sBAAsB,aAAyC;AACtE,QAAI,OAAO,YAAY,sBAAsB,YAAY,YAAY,kBAAkB,KAAK,EAAE,SAAS,GAAG;AACxG,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,iBAAe,gBAAgB,QAA8B,SAAkC;AAE7F,UAAM,WAAyE;AAAA,MAC7E,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AACA,UAAM,UAAU,SAAS,MAAM;AAC/B,QAAI,CAAC,QAAS;AACd,UAAM,wBAAwB,SAAS,OAAO;AAAA,EAChD;AAEA,iBAAe,oBACb,aACA,OACA,eACA,OACA,SACA,SACA,MACA;AACA,QAAI,CAAC,sBAAuB;AAC5B,UAAM,sBAAsB,MAAM;AAAA,MAChC,eAAe,WAAW,WAAW;AAAA,MACrC,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,GAAG,KAAK;AAAA,EACV;AAEA,iBAAe,6BAA6B,aAAqB,OAAqD;AACpH,UAAM,gBAAgB,WAAW,WAAW;AAC5C,UAAM,kBAAkB,KAAK,0BACzB,MAAM,KAAK,wBAAwB,kBAAkB,eAAe,KAAK,IACzE;AACJ,UAAM,UAAU,kBAAkB,aAAa,eAAe;AAC9D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,kBACI,+CAA+C,WAAW,cAAc,eAAe,MACvF,+CAA+C,WAAW;AAAA,MAChE;AAAA,IACF;AACA,UAAM,cAAc,MAAM,8BAA8B,QAAQ,eAAe,KAAK,KAAK,CAAC;AAE1F,WAAO,EAAE,SAAS,YAAY;AAAA,EAChC;AAIA,iBAAe,uBAA8D,OAqBxD;AACnB,UAAM,cAAc,MAAM,uBAAuB,MAAM,eAAe,MAAM,KAAK;AACjF,UAAM,WAAW,MAAM,wBAAwB;AAAA,MAC7C;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B,aAAa,YAAY;AAAA,MACzB,QAAQ,MAAM;AAAA,MACd,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,MACb,sBAAsB,MAAM;AAC1B,kCAA0B,MAAM,QAAQ,WAAW;AACnD,cAAM,uBAAuB,WAAW;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,QAAI,SAAS,SAAS,aAAa;AACjC,UAAI,SAAS,OAAO,WAAW,YAAY,eAAe;AACxD,cAAM;AAAA,UACJ,iBAAiB,MAAM,MAAM;AAAA,QAC/B;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,YAAY,SAAS,MAAM;AAIjC,QAAI,UAAU;AAId,QAAI,kBAAkB;AACtB,QAAI;AACF,YAAM,MAAM,eAAe,EAAE,aAAa,UAAU,CAAC;AACrD,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AACA,YAAM,SAAS,MAAM,MAAM,OAAO;AAAA,QAChC;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,SAAS,MAAM;AAAA,MACjC,CAAC;AACD,wBAAkB;AAClB,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,OAAO,OAAO;AACZ,gBAAM,UAAU,MAAM,uBAAuB,MAAM,eAAe,MAAM,OAAO,EAAE;AACjF,gBAAM,UAAU,yBAAyB,MAAM,QAAQ,SAAS,OAAO,MAAM;AAC7E,gBAAM,YAAY,SAAS,MAAM;AACjC,iBAAO;AAAA,QACT;AAAA,MACF;AACA,gBAAU;AACV,UAAI,eAAe;AACjB,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,YAAY,aAAa,MAAM;AAC3C,aAAO;AAAA,IACT,SAAS,OAAgB;AACvB,UAAI,CAAC,SAAS;AACZ,YAAI,MAAM,kBAAkB;AAC1B,gBAAM,MAAM,iBAAiB,EAAE,aAAa,WAAW,gBAAgB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QACjG;AACA,cAAM,QAAQ,WAAW,CAAC,qBAAqB,IAAI,SAAS,KAAK,CAAC,CAAC;AAAA,MACrE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,WAAS,yBACP,SACA,OACA,SACA,IACoB;AACpB,UAAM,OAAO;AAAA,MACX,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,mBAAmB,QAAQ;AAAA,MAC3B,eAAe,QAAQ;AAAA,MACvB,aAAa,QAAQ,gBACf,QAAQ,eAAe,SAAS,aAAa,QAAQ,cAAc,cAAc;AAAA,MACvF,cAAc,QAAQ,gBAAgB;AAAA,MACtC,QAAQ,OAAO,MAAM,MAAM;AAAA;AAAA;AAAA,MAG3B,gBAAgB,QAAQ,WAAW,aAAa,OAAO,MAAM,MAAM,IAAI;AAAA,MACvE,cAAc,MAAM;AAAA,MACpB,iBAAiB;AAAA,QACf,GAAI,QAAQ,gBAAgB,CAAC;AAAA,QAC7B,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,MAC1E;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AACA,WAAO,KACH,QAAQ,OAAO,oBAAoB,EAAE,IAAI,GAAG,KAAK,CAAC,IAClD,QAAQ,OAAO,oBAAoB,IAAI;AAAA,EAC7C;AAEA,WAAS,eAAe,aAAsD;AAC5E,UAAM,WAAW,oBAAoB,YAAY,eAAe;AAChE,UAAM,EAAE,eAAe,GAAG,aAAa,IAAI;AAC3C,WAAO;AAAA,MACL,WAAW,sBAAsB,WAAW;AAAA,MAC5C,QAAQ,YAAY;AAAA,MACpB,GAAI,YAAY,eAAe,EAAE,cAAc,YAAY,aAAa,IAAI,CAAC;AAAA,MAC7E,GAAI,YAAY,cAAc,EAAE,aAAa,YAAY,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,iBAAiB,OAAO,kBAAkB,WAC1C,EAAE,cAAqE,IACvE,CAAC;AAAA,IACP;AAAA,EACF;AAEA,iBAAe,qBACb,aACA,OACA,OACe;AACf,UAAM,wBAAwB,oCAAoC;AAAA,MAChE,eAAe,YAAY;AAAA,MAC3B,WAAW,YAAY;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,QAAQ,YAAY;AAAA,MACpB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,UAAM;AAAA,MACJ,YAAY;AAAA,MACZ;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,YAAY;AAAA,QACvB,mBAAmB,YAAY;AAAA,QAC/B,QAAQ,YAAY;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,oBACP,WACA,OACqB;AACrB,QAAI,UAAU;AACd,QAAI,QAA8C;AAClD,QAAI,iBAAiB,QAAQ,QAAQ;AAErC,UAAM,WAAW,MAAM;AACrB,cAAQ,WAAW,MAAM;AACvB,yBAAiB,oCAAoC,IAAI,WAAW,OAAO,oBAAI,KAAK,CAAC,EAClF;AAAA,UACC,CAAC,cAAc;AACb,gBAAI,aAAa,CAAC,QAAS,UAAS;AAAA,UACtC;AAAA,UACA,MAAM;AACJ,gBAAI,CAAC,QAAS,UAAS;AAAA,UACzB;AAAA,QACF;AAAA,MACJ,GAAG,wBAAwB;AAAA,IAC7B;AACA,aAAS;AAET,WAAO,YAAY;AACjB,gBAAU;AACV,UAAI,MAAO,cAAa,KAAK;AAC7B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,qBAAqB,OAA8G;AACvI,YAAM,QAAQ,EAAE,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAC/E,YAAM,gCAAgC;AAAA,QACpC,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB;AAAA,QACA,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM,6BAA6B,MAAM,aAAa,KAAK;AAE5F,YAAM,eAAmC;AAAA,QACvC,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB,eAAe,MAAM;AAAA,QACrB,cAAc,MAAM;AAAA,QACpB,aAAa,MAAM;AAAA,QACnB,YAAY,MAAM;AAAA,QAClB,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,QAChB,cAAc,MAAM;AAAA,QACpB;AAAA,MACF;AAEA,UAAI,CAAC,MAAM,gBAAgB;AACzB,cAAM,UAAU,MAAM,QAAQ,cAAc,YAAY;AACxD,cAAM,cAAc,yBAAyB,IAAI,OAAO,OAAO;AAC/D,cAAM,GAAG,QAAQ,WAAW,EAAE,MAAM;AACpC,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAEA,YAAM,eAAe,gCAAgC;AAAA,QACnD,gBAAgB,MAAM;AAAA,QACtB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB;AAAA,MACF,CAAC;AACD,aAAO,MAAM;AACX,cAAM,WAAW,MAAM,iCAAiC,IAAI,cAAc,MAAM,aAAa,KAAK;AAClG,YAAI,UAAU,sBAAsB;AAClC,gBAAMA,eAAc,MAAM;AAAA,YACxB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,IAAI,SAAS;AAAA,cACb,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,cAChB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,CAACA,cAAa;AAChB,kBAAM,IAAI,MAAM,yEAAyE;AAAA,UAC3F;AACA,iBAAO,EAAE,aAAAA,cAAa,SAAS,eAAeA,YAAW,EAAE;AAAA,QAC7D;AAEA,cAAM,YAAY,oBAAI,KAAK;AAC3B,cAAM,cAAc,IAAI,KAAK,UAAU,QAAQ,IAAI,iBAAiB;AACpE,cAAM,YAAY,WACd,MAAM,oCAAoC,IAAI,UAAU,OAAO,WAAW,WAAW,IACrF,MAAM,kCAAkC,IAAI,cAAc,MAAM,aAAa,OAAO,SAAS;AAEjG,YAAI,CAAC,WAAW;AACd,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,mBAAmB,CAAC;AACvE;AAAA,QACF;AAEA,YAAI;AACJ,cAAM,gBAAgB,oBAAoB,WAAW,KAAK;AAC1D,YAAI;AACF,oBAAU,MAAM,QAAQ,cAAc,EAAE,GAAG,cAAc,gBAAgB,aAAa,CAAC;AAAA,QACzF,SAAS,OAAO;AACd,cAAI;AACF,kBAAM,oCAAoC,IAAI,WAAW,KAAK;AAAA,UAChE,SAAS,cAAc;AACrB,mBAAO,KAAK,0DAA0D;AAAA,cACpE,SAAS,UAAU;AAAA,cACnB,aAAa,MAAM;AAAA,cACnB,KAAK;AAAA,YACP,CAAC;AAAA,UACH;AACA,gBAAM;AAAA,QACR,UAAE;AACA,gBAAM,cAAc;AAAA,QACtB;AAEA,cAAM,gBAAgB,WAAW;AACjC,cAAM,cAAc,MAAM,GAAG,KAAK,EAAE,cAAc,OAAO,kBAAkB;AACzE,gBAAM,gBAAgB,MAAM,cAAc;AAAA,YACxC;AAAA,YACA;AAAA,cACE,IAAI,UAAU;AAAA,cACd,YAAY,UAAU;AAAA,cACtB,sBAAsB;AAAA,cACtB,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,YAClB;AAAA,YACA;AAAA,cACE,sBAAsB;AAAA,cACtB,YAAY;AAAA,cACZ,WAAW;AAAA,cACX,WAAW,oBAAI,KAAK;AAAA,YACtB;AAAA,UACF;AACA,cAAI,kBAAkB,EAAG,QAAO;AAChC,gBAAM,UAAU,yBAAyB,eAAe,OAAO,SAAS,aAAa;AACrF,gBAAM,cAAc,QAAQ,OAAO,EAAE,MAAM;AAC3C,iBAAO;AAAA,QACT,CAAC;AAED,YAAI,CAAC,aAAa;AAChB;AAAA,QACF;AACA,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAAA,IACF;AAAA,IAEA,MAAM,eACJ,eACA,QACA,OACA,aACwB;AACxB,UAAI,gBAA+B;AACnC,UAAI,iBAAiB;AACrB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,sBAAsB,CAAC,gBAAgB;AAAE,uCAA6B,aAAa,MAAM;AAAA,QAAE;AAAA,QAC3F,cAAc,OAAO,EAAE,aAAa,UAAU,MAAM;AAClD,gBAAM,uBAAuB,iBAAiB,YAAY,cAAc;AACxE,0BAAgB,MAAM,qBAAqB,IAAI,EAAE,aAAa,WAAW,QAAQ,MAAM,CAAC;AAGxF,cAAI,WAAW,UAAa,uBAAuB,IAAI;AACrD,6BAAiB,OAAO,kBAAkB,aAAa,CAAC;AAAA,UAC1D;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,kBAAkB,OAAO,EAAE,aAAa,WAAW,gBAAgB,MAAM;AACvE,cAAI,kBAAkB,KAAM;AAC5B,cAAI,iBAAiB;AACnB,kBAAM;AAAA,cACJ,YAAY;AAAA,cACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,cAC7E,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACA,EAAE,aAAa,UAAU,aAAa,gBAAgB,kBAAkB,aAAa,EAAE;AAAA,YACzF;AACA;AAAA,UACF;AACA,gBAAM,WAAW,MAAM,qBAAqB,IAAI,EAAE,eAAe,WAAW,eAAe,MAAM,CAAC;AAClG,cAAI,SAAU;AACd,gBAAM;AAAA,YACJ,YAAY;AAAA,YACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,YAC7E,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,EAAE,aAAa,UAAU,aAAa,gBAAgB,kBAAkB,aAAa,EAAE;AAAA,UACzF;AAAA,QACF;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,QAAQ;AAAA,UACjF,WAAW,sBAAsB,WAAW;AAAA,UAC5C,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,eAAe,OAAO;AAAA,UACxB;AACA,cAAI,kBAAkB,KAAM,sBAAqB,aAAa,eAAe,OAAO,cAAc;AAAA,QACpG;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,gBAAgB,OAAO,eAAe;AAAA,QACzF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,KAAK;AAAA,QAC1D;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB,OAAO;AACrC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,cAAc,OAAO;AAAA,UACvB;AAAA,QACF;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,QACrG;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,MAAM;AAAA,QAAC;AAAA,QACpB,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,OAAO;AAAA,QAClD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,eAAuB,OAAoF;AAChI,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AAEA,YAAM,SAAS,MAAM,QAAQ,UAAU;AAAA,QACrC,WAAW,sBAAsB,WAAW;AAAA,QAC5C;AAAA,MACF,CAAC;AAED,UAAI,OAAO,WAAW,YAAY,iBAAiB,kBAAkB,YAAY,eAAuC,OAAO,MAAM,GAAG;AACtI,cAAM,iBAAiB,YAAY;AACnC,oBAAY,gBAAgB,OAAO;AACnC,sCAA8B,aAAa,OAAO,MAAM;AACxD,oBAAY,gBAAgB,OAAO;AACnC,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,cAAc,OAAO,gBAAgB,KAAK;AAC/H,oBAAY,eAAe,oBAAI,KAAK;AACpC,cAAM,GAAG,MAAM;AACf,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AACD,cAAM;AAAA,UACJ,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,YAAY,OAAO;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,sBAAsB,eAAuB,QAUhD,OAAoE;AACrE,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,gBAAgB,YAAY;AAClC,YAAM,gBAAgB,kBAAkB,eAAe,OAAO,aAAa;AAC3E,YAAM,oBAAoB,iBAAiB,OAAO,kBAAkB;AACpE,YAAM,iBAAiB,YAAY;AACnC,UAAI,mBAAmB;AACrB,oBAAY,gBAAgB,OAAO;AACnC,sCAA8B,aAAa,OAAO,aAAa;AAAA,MACjE;AACA,UAAI,OAAO,gBAAgB;AACzB,oBAAY,gBAAgB,OAAO;AAAA,MACrC;AACA,UAAI,OAAO,cAAc;AACvB,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,GAAG,OAAO,aAAa;AAAA,MAC9G;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,aAAa,eAAe,YAAY,UAAU;AACxD,mBAAW,KAAK;AAAA,UACd,WAAW,OAAO,aAAa;AAAA,UAC/B,YAAY,OAAO,aAAa,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,UACrE,gBAAgB,OAAO,aAAa;AAAA,UACpC,eAAe,OAAO;AAAA,UACtB,WAAW,OAAO,aAAa;AAAA,QACjC,CAAC;AACD,oBAAY,aAAa;AAAA,MAC3B;AACA,kBAAY,gBAAgB,oBAAI,KAAK;AACrC,YAAM,GAAG,MAAM;AACf,UAAI,mBAAmB;AACrB,cAAM,gBAAgB,OAAO,eAAe;AAAA,UAC1C,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM;AAAA,QACJ,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,QAC7E,YAAY;AAAA,QACZ,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB,6CAA6C;AAAA,QACjE;AAAA,UACE;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,WAAW,OAAO,cAAc,aAAa;AAAA,UAC7C,gBAAgB,OAAO,cAAc,kBAAkB;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,IAAY,OAAyF;AACzH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,2BACJ,mBACA,OACA,aACoC;AACpC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,UACX,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,iCAAiC,OAKL;AAChC,YAAM,QAAiC;AAAA,QACrC,eAAe,EAAE,KAAK,CAAC,WAAW,cAAc,oBAAoB,EAAE;AAAA,QACtE,WAAW;AAAA,MACb;AACA,UAAI,OAAO,eAAgB,OAAM,iBAAiB,MAAM;AACxD,UAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAI,OAAO,YAAa,OAAM,cAAc,MAAM;AAElD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,SAAS,EAAE,WAAW,MAAM;AAAA,UAC5B,OAAO,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  getGatewayAdapter,\n  type CreateSessionInput,\n  type CreateSessionResult,\n  type CaptureResult,\n  type RefundResult,\n  type CancelResult,\n  type GatewayAdapter,\n  type GatewayPaymentStatus,\n  type PaymentGatewayPresentationRequest,\n  type PaymentOrderTotalResolver,\n  type UnifiedPaymentStatus,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { IntegrationLogService } from '../../integrations/lib/log-service'\nimport { conflict, CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'\nimport { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'\nimport { emitPaymentGatewayEvent } from '../events'\nimport { readGatewayMetadata, readWebhookLog } from './transaction-fields'\nimport { reconcileSessionAmountWithOrder } from './order-amount-reconciliation'\nimport {\n  alignCapturedAmountWithStatus,\n  assertCaptureWithinRemaining,\n  formatAmountUnits,\n  parseAmountUnits,\n  releaseCaptureAmount,\n  reserveCaptureAmount,\n  settleCapturedAmount,\n} from './capture-ledger'\nimport {\n  completePaymentOperation,\n  failPaymentOperation,\n  preparePaymentOperation,\n} from './payment-operation-idempotency'\nimport {\n  buildPaymentSessionOperationKey,\n  claimPaymentSessionInitialization,\n  findPaymentSessionInitialization,\n  reclaimPaymentSessionInitialization,\n  refreshPaymentSessionInitialization,\n  releasePaymentSessionInitialization,\n} from './session-idempotency'\n\nconst PAYMENT_SESSION_CLAIM_STALE_MS = 30_000\nconst PAYMENT_SESSION_WAIT_INTERVAL_MS = 25\nconst logger = createLogger('payment_gateways').child({ component: 'gateway-service' })\n\nfunction assertManualActionAllowed(action: ManualGatewayAction, transaction: GatewayTransaction): void {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (!canApplyManualAction(action, current)) {\n    throw conflict(`Cannot ${action} a payment in status \"${current}\"`)\n  }\n}\n\nfunction applyAdapterResultStatus(\n  action: ManualGatewayAction,\n  transaction: GatewayTransaction,\n  resultStatus: UnifiedPaymentStatus,\n): boolean {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (resultStatus === current) return false\n  if (isValidTransition(resultStatus, current)) return false\n  if (!isValidTransition(current, resultStatus)) {\n    throw conflict(\n      `Gateway returned status \"${resultStatus}\" which is not a valid transition from \"${current}\" for ${action}`,\n    )\n  }\n  transaction.unifiedStatus = resultStatus\n  return true\n}\n\nexport interface PaymentGatewayServiceDeps {\n  em: EntityManager\n  integrationCredentialsService: CredentialsService\n  integrationStateService?: IntegrationStateService\n  integrationLogService?: IntegrationLogService\n  /**\n   * Optional seam supplied by the module that owns orders (`sales` by default).\n   * When absent, session amounts cannot be reconciled and are accepted as-is.\n   */\n  paymentOrderTotalResolver?: PaymentOrderTotalResolver | null\n  sessionClaimOptions?: {\n    staleAfterMs?: number\n    heartbeatIntervalMs?: number\n    pollIntervalMs?: number\n  }\n}\n\nexport interface CreatePaymentSessionInput {\n  providerKey: string\n  paymentId: string\n  idempotencyKey?: string\n  orderId?: string\n  amount: number\n  currencyCode: string\n  captureMethod?: 'automatic' | 'manual'\n  paymentTypes?: string[]\n  description?: string\n  successUrl?: string\n  cancelUrl?: string\n  metadata?: Record<string, unknown>\n  presentation?: PaymentGatewayPresentationRequest\n  organizationId: string\n  tenantId: string\n}\n\nexport function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {\n  const { em, integrationCredentialsService, integrationLogService } = deps\n  const claimStaleAfterMs = Math.max(1, deps.sessionClaimOptions?.staleAfterMs ?? PAYMENT_SESSION_CLAIM_STALE_MS)\n  const claimHeartbeatIntervalMs = Math.max(\n    1,\n    deps.sessionClaimOptions?.heartbeatIntervalMs ?? Math.floor(claimStaleAfterMs / 3),\n  )\n  const claimPollIntervalMs = Math.max(1, deps.sessionClaimOptions?.pollIntervalMs ?? PAYMENT_SESSION_WAIT_INTERVAL_MS)\n\n  async function findTransactionOrThrow(\n    transactionId: string,\n    scope: { organizationId: string; tenantId: string },\n    targetEm: EntityManager = em,\n  ): Promise<GatewayTransaction> {\n    const transaction = await findOneWithDecryption(\n      targetEm,\n      GatewayTransaction,\n      {\n        id: transactionId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n    if (!transaction) {\n      throw new Error('Transaction not found')\n    }\n    return transaction\n  }\n\n  function readProviderSessionId(transaction: GatewayTransaction): string {\n    if (typeof transaction.providerSessionId === 'string' && transaction.providerSessionId.trim().length > 0) {\n      return transaction.providerSessionId\n    }\n    throw new Error('Transaction is missing provider session id')\n  }\n\n  async function emitStatusEvent(status: UnifiedPaymentStatus, payload: Record<string, unknown>) {\n    type PaymentGatewayEventId = Parameters<typeof emitPaymentGatewayEvent>[0]\n    const eventMap: Partial<Record<UnifiedPaymentStatus, PaymentGatewayEventId>> = {\n      authorized: 'payment_gateways.payment.authorized',\n      captured: 'payment_gateways.payment.captured',\n      failed: 'payment_gateways.payment.failed',\n      refunded: 'payment_gateways.payment.refunded',\n      cancelled: 'payment_gateways.payment.cancelled',\n    }\n    const eventId = eventMap[status]\n    if (!eventId) return\n    await emitPaymentGatewayEvent(eventId, payload)\n  }\n\n  async function writeTransactionLog(\n    providerKey: string,\n    scope: { organizationId: string; tenantId: string },\n    transactionId: string,\n    level: 'info' | 'warn' | 'error',\n    message: string,\n    payload?: Record<string, unknown> | null,\n    code?: string | null,\n  ) {\n    if (!integrationLogService) return\n    await integrationLogService.write({\n      integrationId: `gateway_${providerKey}`,\n      scopeEntityType: 'payment_transaction',\n      scopeEntityId: transactionId,\n      level,\n      message,\n      code,\n      payload: payload ?? null,\n    }, scope)\n  }\n\n  async function resolveAdapterAndCredentials(providerKey: string, scope: { organizationId: string; tenantId: string }) {\n    const integrationId = `gateway_${providerKey}`\n    const selectedVersion = deps.integrationStateService\n      ? await deps.integrationStateService.resolveApiVersion(integrationId, scope)\n      : undefined\n    const adapter = getGatewayAdapter(providerKey, selectedVersion)\n    if (!adapter) {\n      const message = selectedVersion\n        ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})`\n        : `No gateway adapter registered for provider: ${providerKey}`\n      throw new CrudHttpError(422, { error: message })\n    }\n    const credentials = await integrationCredentialsService.resolve(integrationId, scope) ?? {}\n\n    return { adapter, credentials }\n  }\n\n  type ManualOperationResult = CaptureResult | RefundResult | CancelResult\n\n  async function executeManualOperation<TResult extends ManualOperationResult>(input: {\n    action: ManualGatewayAction\n    transactionId: string\n    operationId?: string\n    payload: Record<string, unknown>\n    scope: { organizationId: string; tenantId: string }\n    assertInitialAllowed?: (transaction: GatewayTransaction) => void\n    beforeInvoke?: (context: { transaction: GatewayTransaction; operation: GatewayPaymentOperation }) => Promise<void>\n    releaseOnFailure?: (context: {\n      transaction: GatewayTransaction\n      operation: GatewayPaymentOperation\n      providerInvoked: boolean\n    }) => Promise<void>\n    invoke: (context: {\n      adapter: GatewayAdapter\n      credentials: Record<string, unknown>\n      transaction: GatewayTransaction\n      idempotencyKey: string\n    }) => Promise<TResult>\n    applyResult: (transaction: GatewayTransaction, result: TResult) => void\n    afterCommit: (transaction: GatewayTransaction, result: TResult) => Promise<void>\n  }): Promise<TResult> {\n    const transaction = await findTransactionOrThrow(input.transactionId, input.scope)\n    const prepared = await preparePaymentOperation({\n      em,\n      transactionId: transaction.id,\n      providerKey: transaction.providerKey,\n      action: input.action,\n      operationId: input.operationId,\n      payload: input.payload,\n      scope: input.scope,\n      assertInitialAllowed: () => {\n        assertManualActionAllowed(input.action, transaction)\n        input.assertInitialAllowed?.(transaction)\n      },\n    })\n    if (prepared.kind === 'completed') {\n      if (prepared.result.status !== transaction.unifiedStatus) {\n        throw conflict(\n          `Cannot replay ${input.action} because the payment status has changed since the operation completed`,\n        )\n      }\n      return prepared.result as unknown as TResult\n    }\n\n    const operation = prepared.claim.record\n    // Everything after this flips to true is post-settlement: the provider moved the money and the\n    // completion transaction committed it. A later event or logging failure must not undo either,\n    // so the failure path below only runs while the operation can still be rolled back.\n    let settled = false\n    // Flips once the provider call returned, so the failure path can tell \"the provider never\n    // moved the money\" from \"the provider moved it and only our bookkeeping failed\" \u2014 the two\n    // cases need opposite rollback decisions.\n    let providerInvoked = false\n    try {\n      await input.beforeInvoke?.({ transaction, operation })\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n      const result = await input.invoke({\n        adapter,\n        credentials,\n        transaction,\n        idempotencyKey: prepared.claim.providerIdempotencyKey,\n      })\n      providerInvoked = true\n      const statusChanged = await completePaymentOperation(\n        em,\n        prepared.claim,\n        result as unknown as Record<string, unknown>,\n        async (tx) => {\n          const current = await findTransactionOrThrow(input.transactionId, input.scope, tx)\n          const changed = applyAdapterResultStatus(input.action, current, result.status)\n          input.applyResult(current, result)\n          return changed\n        },\n      )\n      settled = true\n      if (statusChanged) {\n        await emitStatusEvent(result.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await input.afterCommit(transaction, result)\n      return result\n    } catch (error: unknown) {\n      if (!settled) {\n        if (input.releaseOnFailure) {\n          await input.releaseOnFailure({ transaction, operation, providerInvoked }).catch(() => undefined)\n        }\n        await Promise.allSettled([failPaymentOperation(em, prepared.claim)])\n      }\n      throw error\n    }\n  }\n\n  function createGatewayTransaction(\n    manager: EntityManager,\n    input: CreatePaymentSessionInput,\n    session: CreateSessionResult,\n    id?: string,\n  ): GatewayTransaction {\n    const data = {\n      paymentId: input.paymentId,\n      providerKey: input.providerKey,\n      providerSessionId: session.sessionId,\n      unifiedStatus: session.status,\n      redirectUrl: session.redirectUrl\n        ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null),\n      clientSecret: session.clientSecret ?? null,\n      amount: String(input.amount),\n      // An automatic-capture session comes back already captured, so the ledger has to start\n      // at the full amount \u2014 otherwise a later manual capture would look like the first one.\n      capturedAmount: session.status === 'captured' ? String(input.amount) : '0',\n      currencyCode: input.currencyCode,\n      gatewayMetadata: {\n        ...(session.providerData ?? {}),\n        ...(session.clientSession ? { clientSession: session.clientSession } : {}),\n      },\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      deletedAt: null,\n    }\n    return id\n      ? manager.create(GatewayTransaction, { id, ...data })\n      : manager.create(GatewayTransaction, data)\n  }\n\n  function restoreSession(transaction: GatewayTransaction): CreateSessionResult {\n    const metadata = readGatewayMetadata(transaction.gatewayMetadata)\n    const { clientSession, ...providerData } = metadata\n    return {\n      sessionId: readProviderSessionId(transaction),\n      status: transaction.unifiedStatus as UnifiedPaymentStatus,\n      ...(transaction.clientSecret ? { clientSecret: transaction.clientSecret } : {}),\n      ...(transaction.redirectUrl ? { redirectUrl: transaction.redirectUrl } : {}),\n      ...(Object.keys(providerData).length > 0 ? { providerData } : {}),\n      ...(clientSession && typeof clientSession === 'object'\n        ? { clientSession: clientSession as CreateSessionResult['clientSession'] }\n        : {}),\n    }\n  }\n\n  async function recordCreatedSession(\n    transaction: GatewayTransaction,\n    input: CreatePaymentSessionInput,\n    scope: { organizationId: string; tenantId: string },\n  ): Promise<void> {\n    await emitPaymentGatewayEvent('payment_gateways.session.created', {\n      transactionId: transaction.id,\n      paymentId: transaction.paymentId,\n      providerKey: transaction.providerKey,\n      status: transaction.unifiedStatus,\n      organizationId: transaction.organizationId,\n      tenantId: transaction.tenantId,\n    })\n    await writeTransactionLog(\n      transaction.providerKey,\n      scope,\n      transaction.id,\n      'info',\n      'Payment session created',\n      {\n        paymentId: transaction.paymentId,\n        providerSessionId: transaction.providerSessionId,\n        status: transaction.unifiedStatus,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n      },\n    )\n  }\n\n  function startClaimHeartbeat(\n    ownership: { id: string; claimToken: string },\n    scope: { organizationId: string; tenantId: string },\n  ): () => Promise<void> {\n    let stopped = false\n    let timer: ReturnType<typeof setTimeout> | null = null\n    let pendingRefresh = Promise.resolve()\n\n    const schedule = () => {\n      timer = setTimeout(() => {\n        pendingRefresh = refreshPaymentSessionInitialization(em, ownership, scope, new Date())\n          .then(\n            (refreshed) => {\n              if (refreshed && !stopped) schedule()\n            },\n            () => {\n              if (!stopped) schedule()\n            },\n          )\n      }, claimHeartbeatIntervalMs)\n    }\n    schedule()\n\n    return async () => {\n      stopped = true\n      if (timer) clearTimeout(timer)\n      await pendingRefresh\n    }\n  }\n\n  return {\n    async createPaymentSession(input: CreatePaymentSessionInput): Promise<{ transaction: GatewayTransaction; session: CreateSessionResult }> {\n      const scope = { organizationId: input.organizationId, tenantId: input.tenantId }\n      await reconcileSessionAmountWithOrder({\n        orderId: input.orderId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        scope,\n        resolver: deps.paymentOrderTotalResolver,\n      })\n      const { adapter, credentials } = await resolveAdapterAndCredentials(input.providerKey, scope)\n\n      const sessionInput: CreateSessionInput = {\n        paymentId: input.paymentId,\n        orderId: input.orderId,\n        idempotencyKey: input.idempotencyKey,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        captureMethod: input.captureMethod,\n        paymentTypes: input.paymentTypes,\n        description: input.description,\n        successUrl: input.successUrl,\n        cancelUrl: input.cancelUrl,\n        metadata: input.metadata,\n        presentation: input.presentation,\n        credentials,\n      }\n\n      if (!input.idempotencyKey) {\n        const session = await adapter.createSession(sessionInput)\n        const transaction = createGatewayTransaction(em, input, session)\n        await em.persist(transaction).flush()\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n\n      const operationKey = buildPaymentSessionOperationKey({\n        idempotencyKey: input.idempotencyKey,\n        paymentId: input.paymentId,\n        providerKey: input.providerKey,\n        scope,\n      })\n      while (true) {\n        const existing = await findPaymentSessionInitialization(em, operationKey, input.providerKey, scope)\n        if (existing?.gatewayTransactionId) {\n          const transaction = await findOneWithDecryption(\n            em.fork(),\n            GatewayTransaction,\n            {\n              id: existing.gatewayTransactionId,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n              deletedAt: null,\n            },\n            undefined,\n            scope,\n          )\n          if (!transaction) {\n            throw new Error('[internal] Completed payment session is missing its gateway transaction')\n          }\n          return { transaction, session: restoreSession(transaction) }\n        }\n\n        const claimedAt = new Date()\n        const staleBefore = new Date(claimedAt.getTime() - claimStaleAfterMs)\n        const ownership = existing\n          ? await reclaimPaymentSessionInitialization(em, existing, scope, claimedAt, staleBefore)\n          : await claimPaymentSessionInitialization(em, operationKey, input.providerKey, scope, claimedAt)\n\n        if (!ownership) {\n          await new Promise((resolve) => setTimeout(resolve, claimPollIntervalMs))\n          continue\n        }\n\n        let session: CreateSessionResult\n        const stopHeartbeat = startClaimHeartbeat(ownership, scope)\n        try {\n          session = await adapter.createSession({ ...sessionInput, idempotencyKey: operationKey })\n        } catch (error) {\n          try {\n            await releasePaymentSessionInitialization(em, ownership, scope)\n          } catch (releaseError) {\n            logger.warn('Failed to release payment session initialization claim', {\n              claimId: ownership.id,\n              providerKey: input.providerKey,\n              err: releaseError,\n            })\n          }\n          throw error\n        } finally {\n          await stopHeartbeat()\n        }\n\n        const transactionId = randomUUID()\n        const transaction = await em.fork().transactional(async (transactionEm) => {\n          const finalizedRows = await transactionEm.nativeUpdate(\n            GatewaySessionInitialization,\n            {\n              id: ownership.id,\n              claimToken: ownership.claimToken,\n              gatewayTransactionId: null,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n            },\n            {\n              gatewayTransactionId: transactionId,\n              claimToken: null,\n              claimedAt: null,\n              updatedAt: new Date(),\n            },\n          )\n          if (finalizedRows === 0) return null\n          const created = createGatewayTransaction(transactionEm, input, session, transactionId)\n          await transactionEm.persist(created).flush()\n          return created\n        })\n\n        if (!transaction) {\n          continue\n        }\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n    },\n\n    async capturePayment(\n      transactionId: string,\n      amount: number | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CaptureResult> {\n      let reservedUnits: bigint | null = null\n      let providerAmount = amount\n      return executeManualOperation({\n        action: 'capture',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null },\n        scope,\n        assertInitialAllowed: (transaction) => { assertCaptureWithinRemaining(transaction, amount) },\n        beforeInvoke: async ({ transaction, operation }) => {\n          const alreadyCapturedUnits = parseAmountUnits(transaction.capturedAmount)\n          reservedUnits = await reserveCaptureAmount(em, { transaction, operation, amount, scope })\n          // \"Capture the rest\" has to name the remaining amount once part of the authorization is\n          // already captured, otherwise the provider would capture the full amount a second time.\n          if (amount === undefined && alreadyCapturedUnits > 0n) {\n            providerAmount = Number(formatAmountUnits(reservedUnits))\n          }\n        },\n        // The slice goes back only while the provider has not been called yet. Once the capture\n        // call returned, the money may already have moved and only the completion transaction\n        // failed, so releasing would reopen the authorization for a fresh operation id and allow an\n        // over-capture. Holding the reservation is the conservative outcome: a retry of this same\n        // operation id reuses both the reservation and the provider idempotency key, so the provider\n        // itself collapses the duplicate.\n        releaseOnFailure: async ({ transaction, operation, providerInvoked }) => {\n          if (reservedUnits === null) return\n          if (providerInvoked) {\n            await writeTransactionLog(\n              transaction.providerKey,\n              { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n              transaction.id,\n              'warn',\n              'Capture reservation stays outstanding because the provider call already returned',\n              { operationId: operation.operationId, reservedAmount: formatAmountUnits(reservedUnits) },\n            )\n            return\n          }\n          const released = await releaseCaptureAmount(em, { transactionId, operation, reservedUnits, scope })\n          if (released) return\n          await writeTransactionLog(\n            transaction.providerKey,\n            { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n            transaction.id,\n            'warn',\n            'Capture reservation stays outstanding after a failed capture',\n            { operationId: operation.operationId, reservedAmount: formatAmountUnits(reservedUnits) },\n          )\n        },\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.capture({\n          sessionId: readProviderSessionId(transaction),\n          amount: providerAmount,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            captureResult: result.providerData,\n          }\n          if (reservedUnits !== null) settleCapturedAmount(transaction, reservedUnits, result.capturedAmount)\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment captured',\n          { amount: amount ?? null, status: result.status, capturedAmount: result.capturedAmount },\n        ),\n      })\n    },\n\n    async refundPayment(\n      transactionId: string,\n      amount: number | undefined,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<RefundResult> {\n      return executeManualOperation({\n        action: 'refund',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null, reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.refund({\n          sessionId: readProviderSessionId(transaction),\n          amount,\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayRefundId = result.refundId\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            refundResult: result.providerData,\n          }\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment refunded',\n          { amount: amount ?? null, reason: reason ?? null, status: result.status, refundId: result.refundId },\n        ),\n      })\n    },\n\n    async cancelPayment(\n      transactionId: string,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CancelResult> {\n      return executeManualOperation({\n        action: 'cancel',\n        transactionId,\n        operationId,\n        payload: { reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.cancel({\n          sessionId: readProviderSessionId(transaction),\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: () => {},\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment cancelled',\n          { reason: reason ?? null, status: result.status },\n        ),\n      })\n    },\n\n    async getPaymentStatus(transactionId: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayPaymentStatus> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n\n      const status = await adapter.getStatus({\n        sessionId: readProviderSessionId(transaction),\n        credentials,\n      })\n\n      if (status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus as UnifiedPaymentStatus, status.status)) {\n        const previousStatus = transaction.unifiedStatus\n        transaction.unifiedStatus = status.status\n        alignCapturedAmountWithStatus(transaction, status.status)\n        transaction.gatewayStatus = status.status\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), statusResult: status.providerData ?? null }\n        transaction.lastPolledAt = new Date()\n        await em.flush()\n        await emitStatusEvent(status.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n        await writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment status updated by poller',\n          {\n            previousStatus,\n            nextStatus: status.status,\n          },\n        )\n      }\n\n      return status\n    },\n\n    async syncTransactionStatus(transactionId: string, update: {\n      unifiedStatus: UnifiedPaymentStatus\n      providerStatus?: string\n      providerData?: Record<string, unknown>\n      webhookEvent?: {\n        eventType: string\n        idempotencyKey: string\n        processed: boolean\n        receivedAt?: string\n      }\n    }, scope: { organizationId: string; tenantId: string }): Promise<void> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus\n      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)\n      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus\n      const previousStatus = transaction.unifiedStatus\n      if (shouldApplyStatus) {\n        transaction.unifiedStatus = update.unifiedStatus\n        alignCapturedAmountWithStatus(transaction, update.unifiedStatus)\n      }\n      if (update.providerStatus) {\n        transaction.gatewayStatus = update.providerStatus\n      }\n      if (update.providerData) {\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }\n      }\n      if (update.webhookEvent) {\n        const webhookLog = readWebhookLog(transaction.webhookLog)\n        webhookLog.push({\n          eventType: update.webhookEvent.eventType,\n          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),\n          idempotencyKey: update.webhookEvent.idempotencyKey,\n          unifiedStatus: update.unifiedStatus,\n          processed: update.webhookEvent.processed,\n        })\n        transaction.webhookLog = webhookLog\n      }\n      transaction.lastWebhookAt = new Date()\n      await em.flush()\n      if (shouldApplyStatus) {\n        await emitStatusEvent(update.unifiedStatus, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await writeTransactionLog(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n        transaction.id,\n        shouldApplyStatus ? 'info' : 'warn',\n        shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',\n        {\n          previousStatus,\n          nextStatus: update.unifiedStatus,\n          providerStatus: update.providerStatus ?? null,\n          eventType: update.webhookEvent?.eventType ?? null,\n          idempotencyKey: update.webhookEvent?.idempotencyKey ?? null,\n        },\n      )\n    },\n\n    async findTransaction(id: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          id,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async findTransactionBySessionId(\n      providerSessionId: string,\n      scope: { organizationId: string; tenantId: string },\n      providerKey?: string,\n    ): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerSessionId,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n          ...(providerKey ? { providerKey } : {}),\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async listTransactionsForStatusPolling(scope?: {\n      organizationId?: string\n      tenantId?: string\n      providerKey?: string\n      limit?: number\n    }): Promise<GatewayTransaction[]> {\n      const where: Record<string, unknown> = {\n        unifiedStatus: { $in: ['pending', 'authorized', 'partially_captured'] },\n        deletedAt: null,\n      }\n      if (scope?.organizationId) where.organizationId = scope.organizationId\n      if (scope?.tenantId) where.tenantId = scope.tenantId\n      if (scope?.providerKey) where.providerKey = scope.providerKey\n\n      return findWithDecryption(\n        em,\n        GatewayTransaction,\n        where,\n        {\n          orderBy: { updatedAt: 'asc' },\n          limit: scope?.limit ?? 100,\n        },\n        scope,\n      )\n    },\n  }\n}\n\nexport type PaymentGatewayService = ReturnType<typeof createPaymentGatewayService>\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,OAWK;AAIP,SAAS,UAAU,qBAAqB;AACxC,SAAkC,8BAA8B,0BAA0B;AAC1F,SAAS,sBAAsB,yBAAmD;AAClF,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,sBAAsB;AACpD,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AACzC,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAEtF,SAAS,0BAA0B,QAA6B,aAAuC;AACrG,QAAM,UAAU,YAAY;AAC5B,MAAI,CAAC,qBAAqB,QAAQ,OAAO,GAAG;AAC1C,UAAM,SAAS,UAAU,MAAM,yBAAyB,OAAO,GAAG;AAAA,EACpE;AACF;AAEA,SAAS,yBACP,QACA,aACA,cACS;AACT,QAAM,UAAU,YAAY;AAC5B,MAAI,iBAAiB,QAAS,QAAO;AACrC,MAAI,kBAAkB,cAAc,OAAO,EAAG,QAAO;AACrD,MAAI,CAAC,kBAAkB,SAAS,YAAY,GAAG;AAC7C,UAAM;AAAA,MACJ,4BAA4B,YAAY,2CAA2C,OAAO,SAAS,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,cAAY,gBAAgB;AAC5B,SAAO;AACT;AAqCO,SAAS,4BAA4B,MAAiC;AAC3E,QAAM,EAAE,IAAI,+BAA+B,sBAAsB,IAAI;AACrE,QAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,qBAAqB,gBAAgB,8BAA8B;AAC9G,QAAM,2BAA2B,KAAK;AAAA,IACpC;AAAA,IACA,KAAK,qBAAqB,uBAAuB,KAAK,MAAM,oBAAoB,CAAC;AAAA,EACnF;AACA,QAAM,sBAAsB,KAAK,IAAI,GAAG,KAAK,qBAAqB,kBAAkB,gCAAgC;AAEpH,iBAAe,uBACb,eACA,OACA,WAA0B,IACG;AAC7B,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,sBAAsB,aAAyC;AACtE,QAAI,OAAO,YAAY,sBAAsB,YAAY,YAAY,kBAAkB,KAAK,EAAE,SAAS,GAAG;AACxG,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,iBAAe,gBAAgB,QAA8B,SAAkC;AAE7F,UAAM,WAAyE;AAAA,MAC7E,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AACA,UAAM,UAAU,SAAS,MAAM;AAC/B,QAAI,CAAC,QAAS;AACd,UAAM,wBAAwB,SAAS,OAAO;AAAA,EAChD;AAEA,iBAAe,oBACb,aACA,OACA,eACA,OACA,SACA,SACA,MACA;AACA,QAAI,CAAC,sBAAuB;AAC5B,UAAM,sBAAsB,MAAM;AAAA,MAChC,eAAe,WAAW,WAAW;AAAA,MACrC,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,GAAG,KAAK;AAAA,EACV;AAEA,iBAAe,6BAA6B,aAAqB,OAAqD;AACpH,UAAM,gBAAgB,WAAW,WAAW;AAC5C,UAAM,kBAAkB,KAAK,0BACzB,MAAM,KAAK,wBAAwB,kBAAkB,eAAe,KAAK,IACzE;AACJ,UAAM,UAAU,kBAAkB,aAAa,eAAe;AAC9D,QAAI,CAAC,SAAS;AACZ,YAAM,UAAU,kBACZ,+CAA+C,WAAW,cAAc,eAAe,MACvF,+CAA+C,WAAW;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,IACjD;AACA,UAAM,cAAc,MAAM,8BAA8B,QAAQ,eAAe,KAAK,KAAK,CAAC;AAE1F,WAAO,EAAE,SAAS,YAAY;AAAA,EAChC;AAIA,iBAAe,uBAA8D,OAqBxD;AACnB,UAAM,cAAc,MAAM,uBAAuB,MAAM,eAAe,MAAM,KAAK;AACjF,UAAM,WAAW,MAAM,wBAAwB;AAAA,MAC7C;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B,aAAa,YAAY;AAAA,MACzB,QAAQ,MAAM;AAAA,MACd,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,MACb,sBAAsB,MAAM;AAC1B,kCAA0B,MAAM,QAAQ,WAAW;AACnD,cAAM,uBAAuB,WAAW;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,QAAI,SAAS,SAAS,aAAa;AACjC,UAAI,SAAS,OAAO,WAAW,YAAY,eAAe;AACxD,cAAM;AAAA,UACJ,iBAAiB,MAAM,MAAM;AAAA,QAC/B;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,YAAY,SAAS,MAAM;AAIjC,QAAI,UAAU;AAId,QAAI,kBAAkB;AACtB,QAAI;AACF,YAAM,MAAM,eAAe,EAAE,aAAa,UAAU,CAAC;AACrD,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AACA,YAAM,SAAS,MAAM,MAAM,OAAO;AAAA,QAChC;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,SAAS,MAAM;AAAA,MACjC,CAAC;AACD,wBAAkB;AAClB,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,OAAO,OAAO;AACZ,gBAAM,UAAU,MAAM,uBAAuB,MAAM,eAAe,MAAM,OAAO,EAAE;AACjF,gBAAM,UAAU,yBAAyB,MAAM,QAAQ,SAAS,OAAO,MAAM;AAC7E,gBAAM,YAAY,SAAS,MAAM;AACjC,iBAAO;AAAA,QACT;AAAA,MACF;AACA,gBAAU;AACV,UAAI,eAAe;AACjB,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,YAAY,aAAa,MAAM;AAC3C,aAAO;AAAA,IACT,SAAS,OAAgB;AACvB,UAAI,CAAC,SAAS;AACZ,YAAI,MAAM,kBAAkB;AAC1B,gBAAM,MAAM,iBAAiB,EAAE,aAAa,WAAW,gBAAgB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QACjG;AACA,cAAM,QAAQ,WAAW,CAAC,qBAAqB,IAAI,SAAS,KAAK,CAAC,CAAC;AAAA,MACrE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,WAAS,yBACP,SACA,OACA,SACA,IACoB;AACpB,UAAM,OAAO;AAAA,MACX,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,mBAAmB,QAAQ;AAAA,MAC3B,eAAe,QAAQ;AAAA,MACvB,aAAa,QAAQ,gBACf,QAAQ,eAAe,SAAS,aAAa,QAAQ,cAAc,cAAc;AAAA,MACvF,cAAc,QAAQ,gBAAgB;AAAA,MACtC,QAAQ,OAAO,MAAM,MAAM;AAAA;AAAA;AAAA,MAG3B,gBAAgB,QAAQ,WAAW,aAAa,OAAO,MAAM,MAAM,IAAI;AAAA,MACvE,cAAc,MAAM;AAAA,MACpB,iBAAiB;AAAA,QACf,GAAI,QAAQ,gBAAgB,CAAC;AAAA,QAC7B,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,MAC1E;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AACA,WAAO,KACH,QAAQ,OAAO,oBAAoB,EAAE,IAAI,GAAG,KAAK,CAAC,IAClD,QAAQ,OAAO,oBAAoB,IAAI;AAAA,EAC7C;AAEA,WAAS,eAAe,aAAsD;AAC5E,UAAM,WAAW,oBAAoB,YAAY,eAAe;AAChE,UAAM,EAAE,eAAe,GAAG,aAAa,IAAI;AAC3C,WAAO;AAAA,MACL,WAAW,sBAAsB,WAAW;AAAA,MAC5C,QAAQ,YAAY;AAAA,MACpB,GAAI,YAAY,eAAe,EAAE,cAAc,YAAY,aAAa,IAAI,CAAC;AAAA,MAC7E,GAAI,YAAY,cAAc,EAAE,aAAa,YAAY,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,iBAAiB,OAAO,kBAAkB,WAC1C,EAAE,cAAqE,IACvE,CAAC;AAAA,IACP;AAAA,EACF;AAEA,iBAAe,qBACb,aACA,OACA,OACe;AACf,UAAM,wBAAwB,oCAAoC;AAAA,MAChE,eAAe,YAAY;AAAA,MAC3B,WAAW,YAAY;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,QAAQ,YAAY;AAAA,MACpB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,UAAM;AAAA,MACJ,YAAY;AAAA,MACZ;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,YAAY;AAAA,QACvB,mBAAmB,YAAY;AAAA,QAC/B,QAAQ,YAAY;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,oBACP,WACA,OACqB;AACrB,QAAI,UAAU;AACd,QAAI,QAA8C;AAClD,QAAI,iBAAiB,QAAQ,QAAQ;AAErC,UAAM,WAAW,MAAM;AACrB,cAAQ,WAAW,MAAM;AACvB,yBAAiB,oCAAoC,IAAI,WAAW,OAAO,oBAAI,KAAK,CAAC,EAClF;AAAA,UACC,CAAC,cAAc;AACb,gBAAI,aAAa,CAAC,QAAS,UAAS;AAAA,UACtC;AAAA,UACA,MAAM;AACJ,gBAAI,CAAC,QAAS,UAAS;AAAA,UACzB;AAAA,QACF;AAAA,MACJ,GAAG,wBAAwB;AAAA,IAC7B;AACA,aAAS;AAET,WAAO,YAAY;AACjB,gBAAU;AACV,UAAI,MAAO,cAAa,KAAK;AAC7B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,qBAAqB,OAA8G;AACvI,YAAM,QAAQ,EAAE,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAC/E,YAAM,gCAAgC;AAAA,QACpC,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB;AAAA,QACA,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM,6BAA6B,MAAM,aAAa,KAAK;AAE5F,YAAM,eAAmC;AAAA,QACvC,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB,eAAe,MAAM;AAAA,QACrB,cAAc,MAAM;AAAA,QACpB,aAAa,MAAM;AAAA,QACnB,YAAY,MAAM;AAAA,QAClB,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,QAChB,cAAc,MAAM;AAAA,QACpB;AAAA,MACF;AAEA,UAAI,CAAC,MAAM,gBAAgB;AACzB,cAAM,UAAU,MAAM,QAAQ,cAAc,YAAY;AACxD,cAAM,cAAc,yBAAyB,IAAI,OAAO,OAAO;AAC/D,cAAM,GAAG,QAAQ,WAAW,EAAE,MAAM;AACpC,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAEA,YAAM,eAAe,gCAAgC;AAAA,QACnD,gBAAgB,MAAM;AAAA,QACtB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB;AAAA,MACF,CAAC;AACD,aAAO,MAAM;AACX,cAAM,WAAW,MAAM,iCAAiC,IAAI,cAAc,MAAM,aAAa,KAAK;AAClG,YAAI,UAAU,sBAAsB;AAClC,gBAAMA,eAAc,MAAM;AAAA,YACxB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,IAAI,SAAS;AAAA,cACb,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,cAChB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,CAACA,cAAa;AAChB,kBAAM,IAAI,MAAM,yEAAyE;AAAA,UAC3F;AACA,iBAAO,EAAE,aAAAA,cAAa,SAAS,eAAeA,YAAW,EAAE;AAAA,QAC7D;AAEA,cAAM,YAAY,oBAAI,KAAK;AAC3B,cAAM,cAAc,IAAI,KAAK,UAAU,QAAQ,IAAI,iBAAiB;AACpE,cAAM,YAAY,WACd,MAAM,oCAAoC,IAAI,UAAU,OAAO,WAAW,WAAW,IACrF,MAAM,kCAAkC,IAAI,cAAc,MAAM,aAAa,OAAO,SAAS;AAEjG,YAAI,CAAC,WAAW;AACd,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,mBAAmB,CAAC;AACvE;AAAA,QACF;AAEA,YAAI;AACJ,cAAM,gBAAgB,oBAAoB,WAAW,KAAK;AAC1D,YAAI;AACF,oBAAU,MAAM,QAAQ,cAAc,EAAE,GAAG,cAAc,gBAAgB,aAAa,CAAC;AAAA,QACzF,SAAS,OAAO;AACd,cAAI;AACF,kBAAM,oCAAoC,IAAI,WAAW,KAAK;AAAA,UAChE,SAAS,cAAc;AACrB,mBAAO,KAAK,0DAA0D;AAAA,cACpE,SAAS,UAAU;AAAA,cACnB,aAAa,MAAM;AAAA,cACnB,KAAK;AAAA,YACP,CAAC;AAAA,UACH;AACA,gBAAM;AAAA,QACR,UAAE;AACA,gBAAM,cAAc;AAAA,QACtB;AAEA,cAAM,gBAAgB,WAAW;AACjC,cAAM,cAAc,MAAM,GAAG,KAAK,EAAE,cAAc,OAAO,kBAAkB;AACzE,gBAAM,gBAAgB,MAAM,cAAc;AAAA,YACxC;AAAA,YACA;AAAA,cACE,IAAI,UAAU;AAAA,cACd,YAAY,UAAU;AAAA,cACtB,sBAAsB;AAAA,cACtB,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,YAClB;AAAA,YACA;AAAA,cACE,sBAAsB;AAAA,cACtB,YAAY;AAAA,cACZ,WAAW;AAAA,cACX,WAAW,oBAAI,KAAK;AAAA,YACtB;AAAA,UACF;AACA,cAAI,kBAAkB,EAAG,QAAO;AAChC,gBAAM,UAAU,yBAAyB,eAAe,OAAO,SAAS,aAAa;AACrF,gBAAM,cAAc,QAAQ,OAAO,EAAE,MAAM;AAC3C,iBAAO;AAAA,QACT,CAAC;AAED,YAAI,CAAC,aAAa;AAChB;AAAA,QACF;AACA,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAAA,IACF;AAAA,IAEA,MAAM,eACJ,eACA,QACA,OACA,aACwB;AACxB,UAAI,gBAA+B;AACnC,UAAI,iBAAiB;AACrB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,sBAAsB,CAAC,gBAAgB;AAAE,uCAA6B,aAAa,MAAM;AAAA,QAAE;AAAA,QAC3F,cAAc,OAAO,EAAE,aAAa,UAAU,MAAM;AAClD,gBAAM,uBAAuB,iBAAiB,YAAY,cAAc;AACxE,0BAAgB,MAAM,qBAAqB,IAAI,EAAE,aAAa,WAAW,QAAQ,MAAM,CAAC;AAGxF,cAAI,WAAW,UAAa,uBAAuB,IAAI;AACrD,6BAAiB,OAAO,kBAAkB,aAAa,CAAC;AAAA,UAC1D;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,kBAAkB,OAAO,EAAE,aAAa,WAAW,gBAAgB,MAAM;AACvE,cAAI,kBAAkB,KAAM;AAC5B,cAAI,iBAAiB;AACnB,kBAAM;AAAA,cACJ,YAAY;AAAA,cACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,cAC7E,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACA,EAAE,aAAa,UAAU,aAAa,gBAAgB,kBAAkB,aAAa,EAAE;AAAA,YACzF;AACA;AAAA,UACF;AACA,gBAAM,WAAW,MAAM,qBAAqB,IAAI,EAAE,eAAe,WAAW,eAAe,MAAM,CAAC;AAClG,cAAI,SAAU;AACd,gBAAM;AAAA,YACJ,YAAY;AAAA,YACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,YAC7E,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,EAAE,aAAa,UAAU,aAAa,gBAAgB,kBAAkB,aAAa,EAAE;AAAA,UACzF;AAAA,QACF;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,QAAQ;AAAA,UACjF,WAAW,sBAAsB,WAAW;AAAA,UAC5C,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,eAAe,OAAO;AAAA,UACxB;AACA,cAAI,kBAAkB,KAAM,sBAAqB,aAAa,eAAe,OAAO,cAAc;AAAA,QACpG;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,gBAAgB,OAAO,eAAe;AAAA,QACzF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,KAAK;AAAA,QAC1D;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB,OAAO;AACrC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,cAAc,OAAO;AAAA,UACvB;AAAA,QACF;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,QACrG;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,MAAM;AAAA,QAAC;AAAA,QACpB,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,OAAO;AAAA,QAClD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,eAAuB,OAAoF;AAChI,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AAEA,YAAM,SAAS,MAAM,QAAQ,UAAU;AAAA,QACrC,WAAW,sBAAsB,WAAW;AAAA,QAC5C;AAAA,MACF,CAAC;AAED,UAAI,OAAO,WAAW,YAAY,iBAAiB,kBAAkB,YAAY,eAAuC,OAAO,MAAM,GAAG;AACtI,cAAM,iBAAiB,YAAY;AACnC,oBAAY,gBAAgB,OAAO;AACnC,sCAA8B,aAAa,OAAO,MAAM;AACxD,oBAAY,gBAAgB,OAAO;AACnC,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,cAAc,OAAO,gBAAgB,KAAK;AAC/H,oBAAY,eAAe,oBAAI,KAAK;AACpC,cAAM,GAAG,MAAM;AACf,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AACD,cAAM;AAAA,UACJ,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,YAAY,OAAO;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,sBAAsB,eAAuB,QAUhD,OAAoE;AACrE,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,gBAAgB,YAAY;AAClC,YAAM,gBAAgB,kBAAkB,eAAe,OAAO,aAAa;AAC3E,YAAM,oBAAoB,iBAAiB,OAAO,kBAAkB;AACpE,YAAM,iBAAiB,YAAY;AACnC,UAAI,mBAAmB;AACrB,oBAAY,gBAAgB,OAAO;AACnC,sCAA8B,aAAa,OAAO,aAAa;AAAA,MACjE;AACA,UAAI,OAAO,gBAAgB;AACzB,oBAAY,gBAAgB,OAAO;AAAA,MACrC;AACA,UAAI,OAAO,cAAc;AACvB,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,GAAG,OAAO,aAAa;AAAA,MAC9G;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,aAAa,eAAe,YAAY,UAAU;AACxD,mBAAW,KAAK;AAAA,UACd,WAAW,OAAO,aAAa;AAAA,UAC/B,YAAY,OAAO,aAAa,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,UACrE,gBAAgB,OAAO,aAAa;AAAA,UACpC,eAAe,OAAO;AAAA,UACtB,WAAW,OAAO,aAAa;AAAA,QACjC,CAAC;AACD,oBAAY,aAAa;AAAA,MAC3B;AACA,kBAAY,gBAAgB,oBAAI,KAAK;AACrC,YAAM,GAAG,MAAM;AACf,UAAI,mBAAmB;AACrB,cAAM,gBAAgB,OAAO,eAAe;AAAA,UAC1C,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM;AAAA,QACJ,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,QAC7E,YAAY;AAAA,QACZ,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB,6CAA6C;AAAA,QACjE;AAAA,UACE;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,WAAW,OAAO,cAAc,aAAa;AAAA,UAC7C,gBAAgB,OAAO,cAAc,kBAAkB;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,IAAY,OAAyF;AACzH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,2BACJ,mBACA,OACA,aACoC;AACpC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,UACX,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,iCAAiC,OAKL;AAChC,YAAM,QAAiC;AAAA,QACrC,eAAe,EAAE,KAAK,CAAC,WAAW,cAAc,oBAAoB,EAAE;AAAA,QACtE,WAAW;AAAA,MACb;AACA,UAAI,OAAO,eAAgB,OAAM,iBAAiB,MAAM;AACxD,UAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAI,OAAO,YAAa,OAAM,cAAc,MAAM;AAElD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,SAAS,EAAE,WAAW,MAAM;AAAA,UAC5B,OAAO,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["transaction"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.7-develop.6814.1.0627c7e9f1",
+  "version": "0.6.7-develop.6825.1.85bbf320ad",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6814.1.0627c7e9f1",
-    "@open-mercato/shared": "0.6.7-develop.6814.1.0627c7e9f1",
-    "@open-mercato/ui": "0.6.7-develop.6814.1.0627c7e9f1",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6825.1.85bbf320ad",
+    "@open-mercato/shared": "0.6.7-develop.6825.1.85bbf320ad",
+    "@open-mercato/ui": "0.6.7-develop.6825.1.85bbf320ad",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6814.1.0627c7e9f1",
-    "@open-mercato/shared": "0.6.7-develop.6814.1.0627c7e9f1",
-    "@open-mercato/ui": "0.6.7-develop.6814.1.0627c7e9f1",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6825.1.85bbf320ad",
+    "@open-mercato/shared": "0.6.7-develop.6825.1.85bbf320ad",
+    "@open-mercato/ui": "0.6.7-develop.6825.1.85bbf320ad",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/auth/lib/backendChrome.tsx

@@ -89,15 +89,21 @@ type ResolveBackendChromePayloadArgs = {
   selectedTenantId?: string | null
 }
 
-const settingsSectionOrder: Record<string, number> = {
-  system: 1,
-  auth: 2,
-  'customer-portal': 3,
-  'data-designer': 4,
-  'module-configs': 5,
-  currencies: 6,
-  directory: 7,
-  'feature-toggles': 8,
+/**
+ * Settings section weights, keyed by the untranslated group id each page declares as `pageGroupKey`.
+ *
+ * Mirrors `defaultGroupOrder` above: an id, never a rendered label, so the panel keeps its intended
+ * order in every locale and an app-side module can place its own section deterministically (#4843).
+ */
+export const settingsSectionOrder: Record<string, number> = {
+  'settings.sections.system': 1,
+  'settings.sections.auth': 2,
+  'customer_accounts.settings.section': 3,
+  'settings.sections.dataDesigner': 4,
+  'settings.sections.moduleConfigs': 5,
+  'currencies.nav.group': 6,
+  'settings.sections.directory': 7,
+  'settings.sections.featureToggles': 8,
 }
 
 type NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {

package/src/modules/auth/lib/tenantAccess.ts

@@ -77,3 +77,11 @@ export async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unk
   if (normalized === actorTenant) return actorTenant
   throw forbidden('Not authorized to target this tenant.')
 }
+
+export async function requireSuperAdmin(ctx: TenantGuardCtx): Promise<void> {
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
+  if (!isSuperAdmin) {
+    throw forbidden('Forbidden')
+  }
+}
+

package/src/modules/directory/api/tenants/route.ts

@@ -2,7 +2,9 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+
 import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'
 import { loadCustomFieldValues, buildCustomFieldFiltersFromQuery } from '@open-mercato/shared/lib/crud/custom-fields'
@@ -94,6 +96,12 @@ export async function GET(req: Request) {
     return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 401 })
   }
 
+  const container = await createRequestContainer()
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })
+  if (!isSuperAdmin) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   const url = new URL(req.url)
   const parsed = listQuerySchema.safeParse({
     id: url.searchParams.get('id') ?? undefined,
@@ -111,7 +119,6 @@ export async function GET(req: Request) {
     )
   }
 
-  const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
 
   const { id, page, pageSize, search, sortField, sortDir, isActive } = parsed.data
@@ -256,6 +263,7 @@ const tenantGetDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Invalid query parameters', schema: directoryErrorSchema },
     { status: 401, description: 'Authentication required', schema: directoryErrorSchema },
+    { status: 403, description: 'Requires super-admin', schema: directoryErrorSchema },
   ],
 }
 

package/src/modules/directory/commands/tenants.ts

@@ -5,6 +5,7 @@ import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { requireSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { E } from '#generated/entities.ids.generated'
 import {
   parseWithCustomFields,
@@ -48,6 +49,7 @@ type SerializedTenant = ReturnType<typeof serializeTenant>
 const createTenantCommand: CommandHandler<TenantPayload, Tenant> = {
   id: 'directory.tenants.create',
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const { parsed, custom } = parseWithCustomFields(tenantCreateSchema, rawInput)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
 
@@ -126,6 +128,7 @@ const createTenantCommand: CommandHandler<TenantPayload, Tenant> = {
 const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {
   id: 'directory.tenants.update',
   async prepare(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const { parsed } = parseWithCustomFields(tenantUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
     const current = await em.findOne(Tenant, { id: parsed.id, deletedAt: null })
@@ -133,6 +136,7 @@ const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {
     return { before: serializeTenant(current) }
   },
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const { parsed, custom } = parseWithCustomFields(tenantUpdateSchema, rawInput)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const tenant = await de.updateOrmEntity({
@@ -191,12 +195,14 @@ const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {
 const deleteTenantCommand: CommandHandler<{ body: any; query: Record<string, string> }, Tenant> = {
   id: 'directory.tenants.delete',
   async prepare(input, ctx) {
+    await requireSuperAdmin(ctx)
     const id = requireId(input, 'Tenant id required')
     const em = (ctx.container.resolve('em') as EntityManager)
     const existing = await em.findOne(Tenant, { id, deletedAt: null })
     return existing ? { before: serializeTenant(existing) } : {}
   },
   async execute(rawInput, ctx) {
+    await requireSuperAdmin(ctx)
     const id = requireId(rawInput, 'Tenant id required')
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const tenant = await de.deleteOrmEntity({

package/src/modules/payment_gateways/api/sessions/route.ts

@@ -102,9 +102,7 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
-    const message = err instanceof Error ? err.message : 'Failed to create payment session'
-    const status = message.includes('No gateway adapter') ? 422 : 502
-    return NextResponse.json({ error: message }, { status })
+    return NextResponse.json({ error: 'Failed to create payment session' }, { status: 502 })
   }
 }
 

package/src/modules/payment_gateways/lib/gateway-service.ts

@@ -18,7 +18,7 @@ import {
 import type { CredentialsService } from '../../integrations/lib/credentials-service'
 import type { IntegrationStateService } from '../../integrations/lib/state-service'
 import type { IntegrationLogService } from '../../integrations/lib/log-service'
-import { conflict } from '@open-mercato/shared/lib/crud/errors'
+import { conflict, CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'
 import { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'
 import { emitPaymentGatewayEvent } from '../events'
@@ -191,11 +191,10 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
       : undefined
     const adapter = getGatewayAdapter(providerKey, selectedVersion)
     if (!adapter) {
-      throw new Error(
-        selectedVersion
-          ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})`
-          : `No gateway adapter registered for provider: ${providerKey}`,
-      )
+      const message = selectedVersion
+        ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})`
+        : `No gateway adapter registered for provider: ${providerKey}`
+      throw new CrudHttpError(422, { error: message })
     }
     const credentials = await integrationCredentialsService.resolve(integrationId, scope) ?? {}