@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/modules/customer_accounts/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/data/entities.ts"],
-  "sourcesContent": ["import { Check, Entity, Enum, Index, ManyToOne, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\nexport type DomainProvider = 'traefik'\nexport type DomainStatus = 'pending' | 'verified' | 'active' | 'dns_failed' | 'tls_failed'\n\nexport const DOMAIN_PROVIDERS: readonly DomainProvider[] = ['traefik'] as const\nexport const DOMAIN_STATUSES: readonly DomainStatus[] = [\n  'pending',\n  'verified',\n  'active',\n  'dns_failed',\n  'tls_failed',\n] as const\n\n@Entity({ tableName: 'customer_users' })\n@Unique({ properties: ['tenantId', 'emailHash'], name: 'customer_users_tenant_email_hash_uniq' })\nexport class CustomerUser {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ type: 'text' })\n  email!: string\n\n  @Property({ name: 'email_hash', type: 'text' })\n  @Index({ name: 'customer_users_email_hash_idx' })\n  emailHash!: string\n\n  @Property({ name: 'password_hash', type: 'text', nullable: true })\n  passwordHash?: string | null\n\n  @Property({ name: 'display_name', type: 'text' })\n  displayName!: string\n\n  @Property({ name: 'email_verified_at', type: Date, nullable: true })\n  emailVerifiedAt?: Date | null\n\n  @Property({ name: 'failed_login_attempts', type: 'int', default: 0 })\n  failedLoginAttempts: number = 0\n\n  @Property({ name: 'locked_until', type: Date, nullable: true })\n  lockedUntil?: Date | null\n\n  @Property({ name: 'last_login_at', type: Date, nullable: true })\n  lastLoginAt?: Date | null\n\n  @Property({ name: 'sessions_revoked_at', type: Date, nullable: true })\n  sessionsRevokedAt?: Date | null\n\n  @Property({ name: 'person_entity_id', type: 'uuid', nullable: true })\n  @Index({ name: 'customer_users_person_entity_idx' })\n  personEntityId?: string | null\n\n  @Property({ name: 'customer_entity_id', type: 'uuid', nullable: true })\n  @Index({ name: 'customer_users_customer_entity_idx' })\n  customerEntityId?: string | null\n\n  @Property({ name: 'is_active', type: 'boolean', default: true })\n  isActive: boolean = true\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_roles' })\n@Unique({ properties: ['tenantId', 'slug'], name: 'customer_roles_tenant_slug_uniq' })\nexport class CustomerRole {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ type: 'text' })\n  slug!: string\n\n  @Property({ type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'is_default', type: 'boolean', default: false })\n  isDefault: boolean = false\n\n  @Property({ name: 'is_system', type: 'boolean', default: false })\n  isSystem: boolean = false\n\n  @Property({ name: 'customer_assignable', type: 'boolean', default: false })\n  customerAssignable: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_role_acls' })\n@Unique({ properties: ['role', 'tenantId'], name: 'customer_role_acls_role_tenant_uniq' })\nexport class CustomerRoleAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerRole)\n  role!: CustomerRole\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  @Property({ name: 'is_portal_admin', type: 'boolean', default: false })\n  isPortalAdmin: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_roles' })\n@Unique({ properties: ['user', 'role'], name: 'customer_user_roles_user_role_uniq' })\nexport class CustomerUserRole {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @ManyToOne(() => CustomerRole)\n  role!: CustomerRole\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_acls' })\n@Unique({ properties: ['user', 'tenantId'], name: 'customer_user_acls_user_tenant_uniq' })\nexport class CustomerUserAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  @Property({ name: 'is_portal_admin', type: 'boolean', default: false })\n  isPortalAdmin: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_sessions' })\n@Index({ properties: ['tokenHash'], name: 'customer_user_sessions_token_hash_idx' })\nexport class CustomerUserSession {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ name: 'token_hash', type: 'text' })\n  tokenHash!: string\n\n  @Property({ name: 'ip_address', type: 'text', nullable: true })\n  ipAddress?: string | null\n\n  @Property({ name: 'user_agent', type: 'text', nullable: true })\n  userAgent?: string | null\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_email_verifications' })\n@Index({ properties: ['token'], name: 'customer_user_email_verifications_token_idx' })\nexport class CustomerUserEmailVerification {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ type: 'text' })\n  token!: string\n\n  @Property({ type: 'text', default: 'email_verification' })\n  purpose: string = 'email_verification'\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'customer_user_password_resets' })\n@Index({ properties: ['token'], name: 'customer_user_password_resets_token_idx' })\nexport class CustomerUserPasswordReset {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ type: 'text' })\n  token!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'customer_user_invitations' })\n@Index({ properties: ['token'], name: 'customer_user_invitations_token_idx' })\n@Index({ properties: ['tenantId', 'emailHash'], name: 'customer_user_invitations_tenant_email_hash_idx' })\nexport class CustomerUserInvitation {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ type: 'text' })\n  email!: string\n\n  @Property({ name: 'email_hash', type: 'text' })\n  emailHash!: string\n\n  @Property({ type: 'text' })\n  token!: string\n\n  @Property({ name: 'customer_entity_id', type: 'uuid', nullable: true })\n  customerEntityId?: string | null\n\n  @Property({ name: 'role_ids_json', type: 'json', nullable: true })\n  roleIdsJson?: string[] | null\n\n  @Property({ name: 'invited_by_user_id', type: 'uuid', nullable: true })\n  invitedByUserId?: string | null\n\n  @Property({ name: 'invited_by_customer_user_id', type: 'uuid', nullable: true })\n  invitedByCustomerUserId?: string | null\n\n  @Property({ name: 'display_name', type: 'text', nullable: true })\n  displayName?: string | null\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'accepted_at', type: Date, nullable: true })\n  acceptedAt?: Date | null\n\n  @Property({ name: 'cancelled_at', type: Date, nullable: true })\n  cancelledAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'domain_mappings' })\n@Unique({ properties: ['hostname'], name: 'domain_mappings_hostname_unique' })\n@Index({ properties: ['organizationId'], name: 'domain_mappings_organization_id_idx' })\n@Index({ properties: ['tenantId'], name: 'domain_mappings_tenant_id_idx' })\n@Unique({\n  name: 'domain_mappings_replaces_domain_id_unique',\n  expression:\n    `create unique index \"domain_mappings_replaces_domain_id_unique\" on \"domain_mappings\" (\"replaces_domain_id\") where \"replaces_domain_id\" is not null`,\n})\n@Index({\n  name: 'domain_mappings_pending_verification_idx',\n  expression:\n    `create index \"domain_mappings_pending_verification_idx\" on \"domain_mappings\" (\"status\", \"last_dns_check_at\") where \"status\" in ('pending', 'dns_failed')`,\n})\n@Index({\n  name: 'domain_mappings_pending_tls_idx',\n  expression:\n    `create index \"domain_mappings_pending_tls_idx\" on \"domain_mappings\" (\"status\", \"updated_at\") where \"status\" in ('verified', 'tls_failed')`,\n})\n@Check({\n  name: 'domain_mappings_hostname_normalized_chk',\n  expression: `\"hostname\" = lower(\"hostname\") and \"hostname\" not like '%.'`,\n})\nexport class DomainMapping {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  hostname!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @ManyToOne(() => DomainMapping, { fieldName: 'replaces_domain_id', nullable: true })\n  replacesDomain?: DomainMapping | null\n\n  @Enum({ items: () => DOMAIN_PROVIDERS as unknown as string[], type: 'text', name: 'provider' })\n  provider: DomainProvider = 'traefik'\n\n  @Enum({ items: () => DOMAIN_STATUSES as unknown as string[], type: 'text', name: 'status' })\n  status: DomainStatus = 'pending'\n\n  @Property({ name: 'verified_at', type: Date, nullable: true })\n  verifiedAt?: Date | null\n\n  @Property({ name: 'last_dns_check_at', type: Date, nullable: true })\n  lastDnsCheckAt?: Date | null\n\n  @Property({ name: 'dns_failure_reason', type: 'text', nullable: true, length: 500 })\n  dnsFailureReason?: string | null\n\n  @Property({ name: 'tls_failure_reason', type: 'text', nullable: true, length: 500 })\n  tlsFailureReason?: string | null\n\n  @Property({ name: 'tls_retry_count', type: 'int', default: 0 })\n  tlsRetryCount: number = 0\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date | null\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW,YAAY,UAAU,cAAc;AAK7E,MAAM,mBAA8C,CAAC,SAAS;AAC9D,MAAM,kBAA2C;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,eAAN,MAAmB;AAAA,EAAnB;AA2BL,+BAA8B;AAoB9B,oBAAoB;AAGpB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAvDE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,aAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAJlC,aAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,aAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,aAWX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,EAC7C,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAAA,GAdrC,aAeX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjBtD,aAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GApBrC,aAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAvBxD,aAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,OAAO,SAAS,EAAE,CAAC;AAAA,GA1BzD,aA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7BnD,aA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhCpD,aAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnC1D,aAoCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,oBAAoB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EACnE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAAA,GAvCxC,aAwCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EACrE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAAA,GA3C1C,aA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GA9CpD,aA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAjD7D,aAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GApD7E,aAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAvDjD,aAwDX;AAxDW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,OAAO,EAAE,YAAY,CAAC,YAAY,WAAW,GAAG,MAAM,wCAAwC,CAAC;AAAA,GACnF;AA6DN,IAAM,eAAN,MAAmB;AAAA,EAAnB;AAoBL,qBAAqB;AAGrB,oBAAoB;AAGpB,8BAA8B;AAG9B,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAlCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,aAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAJlC,aAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,aAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,aAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,aAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhB/B,aAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAnBtD,aAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAtBrD,aAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAzB/D,aA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA5B7D,aA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA/B7E,aAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAlCjD,aAmCX;AAnCW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,OAAO,EAAE,YAAY,CAAC,YAAY,MAAM,GAAG,MAAM,kCAAkC,CAAC;AAAA,GACxE;AAwCN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,yBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAb3D,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAnB7E,gBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBjD,gBAuBX;AAvBW,kBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,OAAO,EAAE,YAAY,CAAC,QAAQ,UAAU,GAAG,MAAM,sCAAsC,CAAC;AAAA,GAC5E;AA4BN,IAAM,mBAAN,MAAuB;AAAA,EAAvB;AAWL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAbE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,iBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,iBAKX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAPlB,iBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAV7D,iBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAbjD,iBAcX;AAdW,mBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,sBAAsB,CAAC;AAAA,EAC3C,OAAO,EAAE,YAAY,CAAC,QAAQ,MAAM,GAAG,MAAM,qCAAqC,CAAC;AAAA,GACvE;AAmBN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,yBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAb3D,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAnB7E,gBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBjD,gBAuBX;AAvBW,kBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,OAAO,EAAE,YAAY,CAAC,QAAQ,UAAU,GAAG,MAAM,sCAAsC,CAAC;AAAA,GAC5E;AA4BN,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAuBL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAzBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,oBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,oBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAPnC,oBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVnD,oBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbnD,oBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAhBjC,oBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBnD,oBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAtB7D,oBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAzBjD,oBA0BX;AA1BW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,yBAAyB,CAAC;AAAA,EAC9C,MAAM,EAAE,YAAY,CAAC,WAAW,GAAG,MAAM,wCAAwC,CAAC;AAAA,GACtE;AA+BN,IAAM,gCAAN,MAAoC;AAAA,EAApC;AAWL,mBAAkB;AASlB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,8BAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,8BAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAPf,8BAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,SAAS,qBAAqB,CAAC;AAAA,GAV9C,8BAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAbjC,8BAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhB9C,8BAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,8BAoBX;AApBW,gCAAN;AAAA,EAFN,OAAO,EAAE,WAAW,oCAAoC,CAAC;AAAA,EACzD,MAAM,EAAE,YAAY,CAAC,OAAO,GAAG,MAAM,8CAA8C,CAAC;AAAA,GACxE;AAyBN,IAAM,4BAAN,MAAgC;AAAA,EAAhC;AAiBL,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAhBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,0BAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,0BAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAPf,0BAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAVjC,0BAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAb9C,0BAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,0BAiBX;AAjBW,4BAAN;AAAA,EAFN,OAAO,EAAE,WAAW,gCAAgC,CAAC;AAAA,EACrD,MAAM,EAAE,YAAY,CAAC,OAAO,GAAG,MAAM,0CAA0C,CAAC;AAAA,GACpE;AAuBN,IAAM,yBAAN,MAA6B;AAAA,EAA7B;AA4CL,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA3CE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,uBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAJlC,uBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,uBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,uBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAbnC,uBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAhBf,uBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnB3D,uBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBtD,uBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzB3D,uBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,+BAA+B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BpE,uBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/BrD,uBAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAlCjC,uBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GArClD,uBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAxCnD,uBAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA3C7D,uBA4CX;AA5CW,yBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,4BAA4B,CAAC;AAAA,EACjD,MAAM,EAAE,YAAY,CAAC,OAAO,GAAG,MAAM,sCAAsC,CAAC;AAAA,EAC5E,MAAM,EAAE,YAAY,CAAC,YAAY,WAAW,GAAG,MAAM,kDAAkD,CAAC;AAAA,GAC5F;AAsEN,IAAM,gBAAN,MAAoB;AAAA,EAApB;AAiBL,oBAA2B;AAG3B,kBAAuB;AAevB,yBAAwB;AAGxB,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAxCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,cAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,cAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,cAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAVxC,cAWX;AAGA;AAAA,EADC,UAAU,MAAM,eAAe,EAAE,WAAW,sBAAsB,UAAU,KAAK,CAAC;AAAA,GAbxE,cAcX;AAGA;AAAA,EADC,KAAK,EAAE,OAAO,MAAM,kBAAyC,MAAM,QAAQ,MAAM,WAAW,CAAC;AAAA,GAhBnF,cAiBX;AAGA;AAAA,EADC,KAAK,EAAE,OAAO,MAAM,iBAAwC,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAnBhF,cAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBlD,cAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAzBxD,cA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,MAAM,QAAQ,IAAI,CAAC;AAAA,GA5BxE,cA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,MAAM,QAAQ,IAAI,CAAC;AAAA,GA/BxE,cAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,SAAS,EAAE,CAAC;AAAA,GAlCnD,cAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArC7D,cAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAxC7E,cAyCX;AAzCW,gBAAN;AAAA,EAvBN,OAAO,EAAE,WAAW,kBAAkB,CAAC;AAAA,EACvC,OAAO,EAAE,YAAY,CAAC,UAAU,GAAG,MAAM,kCAAkC,CAAC;AAAA,EAC5E,MAAM,EAAE,YAAY,CAAC,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;AAAA,EACrF,MAAM,EAAE,YAAY,CAAC,UAAU,GAAG,MAAM,gCAAgC,CAAC;AAAA,EACzE,OAAO;AAAA,IACN,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,EACd,CAAC;AAAA,GACY;",
+  "sourcesContent": ["import { Check, Entity, Enum, Index, ManyToOne, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\nexport type DomainProvider = 'traefik'\nexport type DomainStatus = 'pending' | 'verified' | 'active' | 'dns_failed' | 'tls_failed'\n\nexport const DOMAIN_PROVIDERS: readonly DomainProvider[] = ['traefik'] as const\nexport const DOMAIN_STATUSES: readonly DomainStatus[] = [\n  'pending',\n  'verified',\n  'active',\n  'dns_failed',\n  'tls_failed',\n] as const\n\n@Entity({ tableName: 'customer_users' })\n@Unique({ properties: ['tenantId', 'emailHash'], name: 'customer_users_tenant_email_hash_uniq' })\nexport class CustomerUser {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ type: 'text' })\n  email!: string\n\n  @Property({ name: 'email_hash', type: 'text' })\n  @Index({ name: 'customer_users_email_hash_idx' })\n  emailHash!: string\n\n  @Property({ name: 'password_hash', type: 'text', nullable: true })\n  passwordHash?: string | null\n\n  @Property({ name: 'display_name', type: 'text' })\n  displayName!: string\n\n  @Property({ name: 'email_verified_at', type: Date, nullable: true })\n  emailVerifiedAt?: Date | null\n\n  @Property({ name: 'failed_login_attempts', type: 'int', default: 0 })\n  failedLoginAttempts: number = 0\n\n  @Property({ name: 'locked_until', type: Date, nullable: true })\n  lockedUntil?: Date | null\n\n  @Property({ name: 'last_login_at', type: Date, nullable: true })\n  lastLoginAt?: Date | null\n\n  @Property({ name: 'sessions_revoked_at', type: Date, nullable: true })\n  sessionsRevokedAt?: Date | null\n\n  @Property({ name: 'person_entity_id', type: 'uuid', nullable: true })\n  @Index({ name: 'customer_users_person_entity_idx' })\n  personEntityId?: string | null\n\n  @Property({ name: 'customer_entity_id', type: 'uuid', nullable: true })\n  @Index({ name: 'customer_users_customer_entity_idx' })\n  customerEntityId?: string | null\n\n  @Property({ name: 'is_active', type: 'boolean', default: true })\n  isActive: boolean = true\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_roles' })\n@Unique({ properties: ['tenantId', 'slug'], name: 'customer_roles_tenant_slug_uniq' })\nexport class CustomerRole {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ type: 'text' })\n  slug!: string\n\n  @Property({ type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'is_default', type: 'boolean', default: false })\n  isDefault: boolean = false\n\n  @Property({ name: 'is_system', type: 'boolean', default: false })\n  isSystem: boolean = false\n\n  @Property({ name: 'customer_assignable', type: 'boolean', default: false })\n  customerAssignable: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_role_acls' })\n@Unique({ properties: ['role', 'tenantId'], name: 'customer_role_acls_role_tenant_uniq' })\nexport class CustomerRoleAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerRole)\n  role!: CustomerRole\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  @Property({ name: 'is_portal_admin', type: 'boolean', default: false })\n  isPortalAdmin: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_roles' })\n@Unique({ properties: ['user', 'role'], name: 'customer_user_roles_user_role_uniq' })\nexport class CustomerUserRole {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @ManyToOne(() => CustomerRole)\n  role!: CustomerRole\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_acls' })\n@Unique({ properties: ['user', 'tenantId'], name: 'customer_user_acls_user_tenant_uniq' })\nexport class CustomerUserAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  @Property({ name: 'is_portal_admin', type: 'boolean', default: false })\n  isPortalAdmin: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_sessions' })\n@Index({ properties: ['tokenHash'], name: 'customer_user_sessions_token_hash_idx' })\nexport class CustomerUserSession {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ name: 'token_hash', type: 'text' })\n  tokenHash!: string\n\n  @Property({ name: 'ip_address', type: 'text', nullable: true })\n  ipAddress?: string | null\n\n  @Property({ name: 'user_agent', type: 'text', nullable: true })\n  userAgent?: string | null\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'customer_user_email_verifications' })\n@Index({ properties: ['token'], name: 'customer_user_email_verifications_token_idx' })\nexport class CustomerUserEmailVerification {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ type: 'text' })\n  token!: string\n\n  @Property({ type: 'text', default: 'email_verification' })\n  purpose: string = 'email_verification'\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'customer_user_password_resets' })\n@Index({ properties: ['token'], name: 'customer_user_password_resets_token_idx' })\nexport class CustomerUserPasswordReset {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => CustomerUser)\n  user!: CustomerUser\n\n  @Property({ type: 'text' })\n  token!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'customer_user_invitations' })\n@Index({ properties: ['token'], name: 'customer_user_invitations_token_idx' })\n@Index({ properties: ['tenantId', 'emailHash'], name: 'customer_user_invitations_tenant_email_hash_idx' })\nexport class CustomerUserInvitation {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ type: 'text' })\n  email!: string\n\n  @Property({ name: 'email_hash', type: 'text' })\n  emailHash!: string\n\n  @Property({ type: 'text' })\n  token!: string\n\n  @Property({ name: 'customer_entity_id', type: 'uuid', nullable: true })\n  customerEntityId?: string | null\n\n  @Property({ name: 'person_entity_id', type: 'uuid', nullable: true })\n  personEntityId?: string | null\n\n  @Property({ name: 'role_ids_json', type: 'json', nullable: true })\n  roleIdsJson?: string[] | null\n\n  @Property({ name: 'invited_by_user_id', type: 'uuid', nullable: true })\n  invitedByUserId?: string | null\n\n  @Property({ name: 'invited_by_customer_user_id', type: 'uuid', nullable: true })\n  invitedByCustomerUserId?: string | null\n\n  @Property({ name: 'display_name', type: 'text', nullable: true })\n  displayName?: string | null\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'accepted_at', type: Date, nullable: true })\n  acceptedAt?: Date | null\n\n  @Property({ name: 'cancelled_at', type: Date, nullable: true })\n  cancelledAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'domain_mappings' })\n@Unique({ properties: ['hostname'], name: 'domain_mappings_hostname_unique' })\n@Index({ properties: ['organizationId'], name: 'domain_mappings_organization_id_idx' })\n@Index({ properties: ['tenantId'], name: 'domain_mappings_tenant_id_idx' })\n@Unique({\n  name: 'domain_mappings_replaces_domain_id_unique',\n  expression:\n    `create unique index \"domain_mappings_replaces_domain_id_unique\" on \"domain_mappings\" (\"replaces_domain_id\") where \"replaces_domain_id\" is not null`,\n})\n@Index({\n  name: 'domain_mappings_pending_verification_idx',\n  expression:\n    `create index \"domain_mappings_pending_verification_idx\" on \"domain_mappings\" (\"status\", \"last_dns_check_at\") where \"status\" in ('pending', 'dns_failed')`,\n})\n@Index({\n  name: 'domain_mappings_pending_tls_idx',\n  expression:\n    `create index \"domain_mappings_pending_tls_idx\" on \"domain_mappings\" (\"status\", \"updated_at\") where \"status\" in ('verified', 'tls_failed')`,\n})\n@Check({\n  name: 'domain_mappings_hostname_normalized_chk',\n  expression: `\"hostname\" = lower(\"hostname\") and \"hostname\" not like '%.'`,\n})\nexport class DomainMapping {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  hostname!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @ManyToOne(() => DomainMapping, { fieldName: 'replaces_domain_id', nullable: true })\n  replacesDomain?: DomainMapping | null\n\n  @Enum({ items: () => DOMAIN_PROVIDERS as unknown as string[], type: 'text', name: 'provider' })\n  provider: DomainProvider = 'traefik'\n\n  @Enum({ items: () => DOMAIN_STATUSES as unknown as string[], type: 'text', name: 'status' })\n  status: DomainStatus = 'pending'\n\n  @Property({ name: 'verified_at', type: Date, nullable: true })\n  verifiedAt?: Date | null\n\n  @Property({ name: 'last_dns_check_at', type: Date, nullable: true })\n  lastDnsCheckAt?: Date | null\n\n  @Property({ name: 'dns_failure_reason', type: 'text', nullable: true, length: 500 })\n  dnsFailureReason?: string | null\n\n  @Property({ name: 'tls_failure_reason', type: 'text', nullable: true, length: 500 })\n  tlsFailureReason?: string | null\n\n  @Property({ name: 'tls_retry_count', type: 'int', default: 0 })\n  tlsRetryCount: number = 0\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date | null\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW,YAAY,UAAU,cAAc;AAK7E,MAAM,mBAA8C,CAAC,SAAS;AAC9D,MAAM,kBAA2C;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,eAAN,MAAmB;AAAA,EAAnB;AA2BL,+BAA8B;AAoB9B,oBAAoB;AAGpB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAvDE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,aAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAJlC,aAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,aAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,aAWX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,EAC7C,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAAA,GAdrC,aAeX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjBtD,aAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GApBrC,aAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAvBxD,aAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,OAAO,SAAS,EAAE,CAAC;AAAA,GA1BzD,aA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7BnD,aA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhCpD,aAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnC1D,aAoCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,oBAAoB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EACnE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAAA,GAvCxC,aAwCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EACrE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAAA,GA3C1C,aA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GA9CpD,aA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAjD7D,aAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GApD7E,aAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAvDjD,aAwDX;AAxDW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,OAAO,EAAE,YAAY,CAAC,YAAY,WAAW,GAAG,MAAM,wCAAwC,CAAC;AAAA,GACnF;AA6DN,IAAM,eAAN,MAAmB;AAAA,EAAnB;AAoBL,qBAAqB;AAGrB,oBAAoB;AAGpB,8BAA8B;AAG9B,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAlCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,aAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAJlC,aAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,aAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,aAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,aAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhB/B,aAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAnBtD,aAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAtBrD,aAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAzB/D,aA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA5B7D,aA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA/B7E,aAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAlCjD,aAmCX;AAnCW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,OAAO,EAAE,YAAY,CAAC,YAAY,MAAM,GAAG,MAAM,kCAAkC,CAAC;AAAA,GACxE;AAwCN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,yBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAb3D,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAnB7E,gBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBjD,gBAuBX;AAvBW,kBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,OAAO,EAAE,YAAY,CAAC,QAAQ,UAAU,GAAG,MAAM,sCAAsC,CAAC;AAAA,GAC5E;AA4BN,IAAM,mBAAN,MAAuB;AAAA,EAAvB;AAWL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAbE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,iBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,iBAKX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAPlB,iBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAV7D,iBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAbjD,iBAcX;AAdW,mBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,sBAAsB,CAAC;AAAA,EAC3C,OAAO,EAAE,YAAY,CAAC,QAAQ,MAAM,GAAG,MAAM,qCAAqC,CAAC;AAAA,GACvE;AAmBN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,yBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAb3D,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAnB7E,gBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBjD,gBAuBX;AAvBW,kBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,OAAO,EAAE,YAAY,CAAC,QAAQ,UAAU,GAAG,MAAM,sCAAsC,CAAC;AAAA,GAC5E;AA4BN,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAuBL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAzBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,oBAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,oBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAPnC,oBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVnD,oBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbnD,oBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAhBjC,oBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBnD,oBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAtB7D,oBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAzBjD,oBA0BX;AA1BW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,yBAAyB,CAAC;AAAA,EAC9C,MAAM,EAAE,YAAY,CAAC,WAAW,GAAG,MAAM,wCAAwC,CAAC;AAAA,GACtE;AA+BN,IAAM,gCAAN,MAAoC;AAAA,EAApC;AAWL,mBAAkB;AASlB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,8BAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,8BAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAPf,8BAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,SAAS,qBAAqB,CAAC;AAAA,GAV9C,8BAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAbjC,8BAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhB9C,8BAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,8BAoBX;AApBW,gCAAN;AAAA,EAFN,OAAO,EAAE,WAAW,oCAAoC,CAAC;AAAA,EACzD,MAAM,EAAE,YAAY,CAAC,OAAO,GAAG,MAAM,8CAA8C,CAAC;AAAA,GACxE;AAyBN,IAAM,4BAAN,MAAgC;AAAA,EAAhC;AAiBL,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAhBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,0BAEX;AAGA;AAAA,EADC,UAAU,MAAM,YAAY;AAAA,GAJlB,0BAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAPf,0BAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAVjC,0BAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAb9C,0BAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,0BAiBX;AAjBW,4BAAN;AAAA,EAFN,OAAO,EAAE,WAAW,gCAAgC,CAAC;AAAA,EACrD,MAAM,EAAE,YAAY,CAAC,OAAO,GAAG,MAAM,0CAA0C,CAAC;AAAA,GACpE;AAuBN,IAAM,yBAAN,MAA6B;AAAA,EAA7B;AA+CL,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA9CE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,uBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAJlC,uBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,uBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,uBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAbnC,uBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAhBf,uBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnB3D,uBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBzD,uBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBtD,uBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5B3D,uBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,+BAA+B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/BpE,uBAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlCrD,uBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GArCjC,uBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAxClD,uBAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA3CnD,uBA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA9C7D,uBA+CX;AA/CW,yBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,4BAA4B,CAAC;AAAA,EACjD,MAAM,EAAE,YAAY,CAAC,OAAO,GAAG,MAAM,sCAAsC,CAAC;AAAA,EAC5E,MAAM,EAAE,YAAY,CAAC,YAAY,WAAW,GAAG,MAAM,kDAAkD,CAAC;AAAA,GAC5F;AAyEN,IAAM,gBAAN,MAAoB;AAAA,EAApB;AAiBL,oBAA2B;AAG3B,kBAAuB;AAevB,yBAAwB;AAGxB,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAxCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,cAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,cAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,cAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAVxC,cAWX;AAGA;AAAA,EADC,UAAU,MAAM,eAAe,EAAE,WAAW,sBAAsB,UAAU,KAAK,CAAC;AAAA,GAbxE,cAcX;AAGA;AAAA,EADC,KAAK,EAAE,OAAO,MAAM,kBAAyC,MAAM,QAAQ,MAAM,WAAW,CAAC;AAAA,GAhBnF,cAiBX;AAGA;AAAA,EADC,KAAK,EAAE,OAAO,MAAM,iBAAwC,MAAM,QAAQ,MAAM,SAAS,CAAC;AAAA,GAnBhF,cAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBlD,cAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAzBxD,cA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,MAAM,QAAQ,IAAI,CAAC;AAAA,GA5BxE,cA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,MAAM,QAAQ,IAAI,CAAC;AAAA,GA/BxE,cAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,SAAS,EAAE,CAAC;AAAA,GAlCnD,cAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArC7D,cAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAxC7E,cAyCX;AAzCW,gBAAN;AAAA,EAvBN,OAAO,EAAE,WAAW,kBAAkB,CAAC;AAAA,EACvC,OAAO,EAAE,YAAY,CAAC,UAAU,GAAG,MAAM,kCAAkC,CAAC;AAAA,EAC5E,MAAM,EAAE,YAAY,CAAC,gBAAgB,GAAG,MAAM,sCAAsC,CAAC;AAAA,EACrF,MAAM,EAAE,YAAY,CAAC,UAAU,GAAG,MAAM,gCAAgC,CAAC;AAAA,EACzE,OAAO;AAAA,IACN,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,EACd,CAAC;AAAA,GACY;",
   "names": []
 }

package/dist/modules/customer_accounts/data/validators.js

@@ -66,6 +66,7 @@ const updateRoleAclSchema = z.object({
 const inviteUserSchema = z.object({
   email: emailField,
   customerEntityId: z.string().uuid().optional(),
+  personEntityId: z.string().uuid().optional(),
   roleIds: z.array(z.string().uuid()).min(1),
   displayName: displayNameField.optional()
 });

package/dist/modules/customer_accounts/data/validators.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/data/validators.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { normalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\n\nconst emailField = z.string().email().max(255)\nconst passwordField = z.string().min(8).max(128)\nconst displayNameField = z.string().min(1).max(255)\n\nexport const signupSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const loginSchema = z.object({\n  email: emailField,\n  password: z.string().min(1).max(128),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const emailVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const passwordResetRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const passwordResetConfirmSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n})\n\nexport const magicLinkRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const magicLinkVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const invitationAcceptSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n  displayName: displayNameField,\n})\n\nexport const profileUpdateSchema = z.object({\n  displayName: displayNameField.optional(),\n})\n\nexport const passwordChangeSchema = z.object({\n  currentPassword: z.string().min(1).max(128),\n  newPassword: passwordField,\n})\n\nexport const createRoleSchema = z.object({\n  name: z.string().min(1).max(255),\n  slug: z.string().min(1).max(255).regex(/^[a-z0-9_-]+$/),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleSchema = z.object({\n  name: z.string().min(1).max(255).optional(),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleAclSchema = z.object({\n  features: z.array(z.string().min(1).max(255)),\n  isPortalAdmin: z.boolean().optional(),\n})\n\nexport const inviteUserSchema = z.object({\n  email: emailField,\n  customerEntityId: z.string().uuid().optional(),\n  roleIds: z.array(z.string().uuid()).min(1),\n  displayName: displayNameField.optional(),\n})\n\nexport const assignRolesSchema = z.object({\n  roleIds: z.array(z.string().uuid()).min(1),\n})\n\nexport const adminCreateUserSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  roleIds: z.array(z.string().uuid()).optional(),\n  customerEntityId: z.string().uuid().optional(),\n})\n\nexport const adminUpdateUserSchema = z.object({\n  displayName: displayNameField.optional(),\n  isActive: z.boolean().optional(),\n  lockedUntil: z.string().datetime().nullable().optional(),\n  personEntityId: z.string().uuid().nullable().optional(),\n  customerEntityId: z.string().uuid().nullable().optional(),\n  roleIds: z.array(z.string().uuid()).optional(),\n})\n\nexport const adminResetPasswordSchema = z.object({\n  newPassword: passwordField,\n})\n\nexport type AdminCreateUserInput = z.infer<typeof adminCreateUserSchema>\nexport type AdminResetPasswordInput = z.infer<typeof adminResetPasswordSchema>\nexport type SignupInput = z.infer<typeof signupSchema>\nexport type LoginInput = z.infer<typeof loginSchema>\nexport type EmailVerifyInput = z.infer<typeof emailVerifySchema>\nexport type PasswordResetRequestInput = z.infer<typeof passwordResetRequestSchema>\nexport type PasswordResetConfirmInput = z.infer<typeof passwordResetConfirmSchema>\nexport type MagicLinkRequestInput = z.infer<typeof magicLinkRequestSchema>\nexport type MagicLinkVerifyInput = z.infer<typeof magicLinkVerifySchema>\nexport type InvitationAcceptInput = z.infer<typeof invitationAcceptSchema>\nexport type ProfileUpdateInput = z.infer<typeof profileUpdateSchema>\nexport type PasswordChangeInput = z.infer<typeof passwordChangeSchema>\nexport type CreateRoleInput = z.infer<typeof createRoleSchema>\nexport type UpdateRoleInput = z.infer<typeof updateRoleSchema>\nexport type UpdateRoleAclInput = z.infer<typeof updateRoleAclSchema>\nexport type InviteUserInput = z.infer<typeof inviteUserSchema>\nexport type AssignRolesInput = z.infer<typeof assignRolesSchema>\nexport type AdminUpdateUserInput = z.infer<typeof adminUpdateUserSchema>\n\n// Custom domain mapping\nexport const hostnameSchema = z\n  .string()\n  .min(1, 'Hostname is required')\n  .max(512, 'Hostname is too long')\n  .transform((value, ctx) => {\n    try {\n      return normalizeHostname(value)\n    } catch (err) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: err instanceof Error ? err.message : 'Invalid hostname',\n      })\n      return z.NEVER\n    }\n  })\n\nexport const registerDomainSchema = z.object({\n  hostname: hostnameSchema,\n  organizationId: z.string().uuid(),\n  replacesDomainId: z.string().uuid().optional(),\n})\n\nexport type RegisterDomainInput = z.infer<typeof registerDomainSchema>\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,yBAAyB;AAElC,MAAM,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAC7C,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC/C,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE3C,MAAM,eAAe,EAAE,OAAO;AAAA,EACnC,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,cAAc,EAAE,OAAO;AAAA,EAClC,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AACZ,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AAAA,EACV,aAAa;AACf,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa;AACf,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,eAAe;AAAA,EACtD,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC5C,eAAe,EAAE,QAAQ,EAAE,SAAS;AACtC,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO;AAAA,EACP,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAC3C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,aAAa,iBAAiB,SAAS;AAAA,EACvC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,aAAa;AACf,CAAC;AAsBM,MAAM,iBAAiB,EAC3B,OAAO,EACP,IAAI,GAAG,sBAAsB,EAC7B,IAAI,KAAK,sBAAsB,EAC/B,UAAU,CAAC,OAAO,QAAQ;AACzB,MAAI;AACF,WAAO,kBAAkB,KAAK;AAAA,EAChC,SAAS,KAAK;AACZ,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,IAChD,CAAC;AACD,WAAO,EAAE;AAAA,EACX;AACF,CAAC;AAEI,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { normalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\n\nconst emailField = z.string().email().max(255)\nconst passwordField = z.string().min(8).max(128)\nconst displayNameField = z.string().min(1).max(255)\n\nexport const signupSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const loginSchema = z.object({\n  email: emailField,\n  password: z.string().min(1).max(128),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const emailVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const passwordResetRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const passwordResetConfirmSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n})\n\nexport const magicLinkRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const magicLinkVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const invitationAcceptSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n  displayName: displayNameField,\n})\n\nexport const profileUpdateSchema = z.object({\n  displayName: displayNameField.optional(),\n})\n\nexport const passwordChangeSchema = z.object({\n  currentPassword: z.string().min(1).max(128),\n  newPassword: passwordField,\n})\n\nexport const createRoleSchema = z.object({\n  name: z.string().min(1).max(255),\n  slug: z.string().min(1).max(255).regex(/^[a-z0-9_-]+$/),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleSchema = z.object({\n  name: z.string().min(1).max(255).optional(),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleAclSchema = z.object({\n  features: z.array(z.string().min(1).max(255)),\n  isPortalAdmin: z.boolean().optional(),\n})\n\nexport const inviteUserSchema = z.object({\n  email: emailField,\n  customerEntityId: z.string().uuid().optional(),\n  personEntityId: z.string().uuid().optional(),\n  roleIds: z.array(z.string().uuid()).min(1),\n  displayName: displayNameField.optional(),\n})\n\nexport const assignRolesSchema = z.object({\n  roleIds: z.array(z.string().uuid()).min(1),\n})\n\nexport const adminCreateUserSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  roleIds: z.array(z.string().uuid()).optional(),\n  customerEntityId: z.string().uuid().optional(),\n})\n\nexport const adminUpdateUserSchema = z.object({\n  displayName: displayNameField.optional(),\n  isActive: z.boolean().optional(),\n  lockedUntil: z.string().datetime().nullable().optional(),\n  personEntityId: z.string().uuid().nullable().optional(),\n  customerEntityId: z.string().uuid().nullable().optional(),\n  roleIds: z.array(z.string().uuid()).optional(),\n})\n\nexport const adminResetPasswordSchema = z.object({\n  newPassword: passwordField,\n})\n\nexport type AdminCreateUserInput = z.infer<typeof adminCreateUserSchema>\nexport type AdminResetPasswordInput = z.infer<typeof adminResetPasswordSchema>\nexport type SignupInput = z.infer<typeof signupSchema>\nexport type LoginInput = z.infer<typeof loginSchema>\nexport type EmailVerifyInput = z.infer<typeof emailVerifySchema>\nexport type PasswordResetRequestInput = z.infer<typeof passwordResetRequestSchema>\nexport type PasswordResetConfirmInput = z.infer<typeof passwordResetConfirmSchema>\nexport type MagicLinkRequestInput = z.infer<typeof magicLinkRequestSchema>\nexport type MagicLinkVerifyInput = z.infer<typeof magicLinkVerifySchema>\nexport type InvitationAcceptInput = z.infer<typeof invitationAcceptSchema>\nexport type ProfileUpdateInput = z.infer<typeof profileUpdateSchema>\nexport type PasswordChangeInput = z.infer<typeof passwordChangeSchema>\nexport type CreateRoleInput = z.infer<typeof createRoleSchema>\nexport type UpdateRoleInput = z.infer<typeof updateRoleSchema>\nexport type UpdateRoleAclInput = z.infer<typeof updateRoleAclSchema>\nexport type InviteUserInput = z.infer<typeof inviteUserSchema>\nexport type AssignRolesInput = z.infer<typeof assignRolesSchema>\nexport type AdminUpdateUserInput = z.infer<typeof adminUpdateUserSchema>\n\n// Custom domain mapping\nexport const hostnameSchema = z\n  .string()\n  .min(1, 'Hostname is required')\n  .max(512, 'Hostname is too long')\n  .transform((value, ctx) => {\n    try {\n      return normalizeHostname(value)\n    } catch (err) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: err instanceof Error ? err.message : 'Invalid hostname',\n      })\n      return z.NEVER\n    }\n  })\n\nexport const registerDomainSchema = z.object({\n  hostname: hostnameSchema,\n  organizationId: z.string().uuid(),\n  replacesDomainId: z.string().uuid().optional(),\n})\n\nexport type RegisterDomainInput = z.infer<typeof registerDomainSchema>\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,yBAAyB;AAElC,MAAM,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAC7C,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC/C,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE3C,MAAM,eAAe,EAAE,OAAO;AAAA,EACnC,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,cAAc,EAAE,OAAO;AAAA,EAClC,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AACZ,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AAAA,EACV,aAAa;AACf,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa;AACf,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,eAAe;AAAA,EACtD,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC5C,eAAe,EAAE,QAAQ,EAAE,SAAS;AACtC,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO;AAAA,EACP,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAC3C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,aAAa,iBAAiB,SAAS;AAAA,EACvC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,aAAa;AACf,CAAC;AAsBM,MAAM,iBAAiB,EAC3B,OAAO,EACP,IAAI,GAAG,sBAAsB,EAC7B,IAAI,KAAK,sBAAsB,EAC/B,UAAU,CAAC,OAAO,QAAQ;AACzB,MAAI;AACF,WAAO,kBAAkB,KAAK;AAAA,EAChC,SAAS,KAAK;AACZ,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,IAChD,CAAC;AACD,WAAO,EAAE;AAAA,EACX;AACF,CAAC;AAEI,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;",
   "names": []
 }

package/dist/modules/customer_accounts/emails/CustomerInvitationEmail.js

@@ -0,0 +1,26 @@
+import { jsx, jsxs } from "react/jsx-runtime";
+import { Html, Head, Preview, Body, Container, Text, Section, Link } from "@react-email/components";
+function CustomerInvitationEmail({ inviteUrl, copy }) {
+  return /* @__PURE__ */ jsxs(Html, { children: [
+    /* @__PURE__ */ jsx(Head, {}),
+    /* @__PURE__ */ jsx(Preview, { children: copy.preview }),
+    /* @__PURE__ */ jsx(Body, { style: body, children: /* @__PURE__ */ jsx(Container, { style: container, children: /* @__PURE__ */ jsxs(Section, { children: [
+      /* @__PURE__ */ jsx(Text, { style: title, children: copy.title }),
+      /* @__PURE__ */ jsx(Text, { style: paragraph, children: copy.body }),
+      /* @__PURE__ */ jsx(Text, { children: /* @__PURE__ */ jsx(Link, { href: inviteUrl, style: button, children: copy.cta }) }),
+      /* @__PURE__ */ jsx(Text, { style: hint, children: copy.hint })
+    ] }) }) })
+  ] });
+}
+const body = { backgroundColor: "#f9fafb", margin: 0, padding: "24px 0" };
+const container = { backgroundColor: "#ffffff", borderRadius: 12, padding: 24, margin: "0 auto", maxWidth: 520, boxShadow: "0 1px 4px rgba(0,0,0,0.06)" };
+const title = { fontSize: 20, fontWeight: 600, color: "#111827", margin: "0 0 12px" };
+const paragraph = { fontSize: 14, color: "#4b5563", lineHeight: "20px", margin: "0 0 16px" };
+const button = { display: "inline-block", backgroundColor: "#111827", color: "#ffffff", padding: "10px 14px", borderRadius: 8, textDecoration: "none", fontSize: 14 };
+const hint = { fontSize: 12, color: "#6b7280", marginTop: 16 };
+var CustomerInvitationEmail_default = CustomerInvitationEmail;
+export {
+  CustomerInvitationEmail,
+  CustomerInvitationEmail_default as default
+};
+//# sourceMappingURL=CustomerInvitationEmail.js.map

package/dist/modules/customer_accounts/emails/CustomerInvitationEmail.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/emails/CustomerInvitationEmail.tsx"],
+  "sourcesContent": ["import * as React from 'react'\nimport { Html, Head, Preview, Body, Container, Text, Section, Link } from '@react-email/components'\n\nexport type CustomerInvitationEmailCopy = {\n  preview: string\n  title: string\n  body: string\n  cta: string\n  hint: string\n}\n\nexport type CustomerInvitationEmailProps = {\n  inviteUrl: string\n  copy: CustomerInvitationEmailCopy\n}\n\nexport function CustomerInvitationEmail({ inviteUrl, copy }: CustomerInvitationEmailProps) {\n  return (\n    <Html>\n      <Head />\n      <Preview>{copy.preview}</Preview>\n      <Body style={body}>\n        <Container style={container}>\n          <Section>\n            <Text style={title}>{copy.title}</Text>\n            <Text style={paragraph}>{copy.body}</Text>\n            <Text>\n              <Link href={inviteUrl} style={button}>{copy.cta}</Link>\n            </Text>\n            <Text style={hint}>{copy.hint}</Text>\n          </Section>\n        </Container>\n      </Body>\n    </Html>\n  )\n}\n\nconst body: React.CSSProperties = { backgroundColor: '#f9fafb', margin: 0, padding: '24px 0' }\nconst container: React.CSSProperties = { backgroundColor: '#ffffff', borderRadius: 12, padding: 24, margin: '0 auto', maxWidth: 520, boxShadow: '0 1px 4px rgba(0,0,0,0.06)' }\nconst title: React.CSSProperties = { fontSize: 20, fontWeight: 600, color: '#111827', margin: '0 0 12px' }\nconst paragraph: React.CSSProperties = { fontSize: 14, color: '#4b5563', lineHeight: '20px', margin: '0 0 16px' }\nconst button: React.CSSProperties = { display: 'inline-block', backgroundColor: '#111827', color: '#ffffff', padding: '10px 14px', borderRadius: 8, textDecoration: 'none', fontSize: 14 }\nconst hint: React.CSSProperties = { fontSize: 12, color: '#6b7280', marginTop: 16 }\n\nexport default CustomerInvitationEmail\n"],
+  "mappings": "AAmBM,cAII,YAJJ;AAlBN,SAAS,MAAM,MAAM,SAAS,MAAM,WAAW,MAAM,SAAS,YAAY;AAenE,SAAS,wBAAwB,EAAE,WAAW,KAAK,GAAiC;AACzF,SACE,qBAAC,QACC;AAAA,wBAAC,QAAK;AAAA,IACN,oBAAC,WAAS,eAAK,SAAQ;AAAA,IACvB,oBAAC,QAAK,OAAO,MACX,8BAAC,aAAU,OAAO,WAChB,+BAAC,WACC;AAAA,0BAAC,QAAK,OAAO,OAAQ,eAAK,OAAM;AAAA,MAChC,oBAAC,QAAK,OAAO,WAAY,eAAK,MAAK;AAAA,MACnC,oBAAC,QACC,8BAAC,QAAK,MAAM,WAAW,OAAO,QAAS,eAAK,KAAI,GAClD;AAAA,MACA,oBAAC,QAAK,OAAO,MAAO,eAAK,MAAK;AAAA,OAChC,GACF,GACF;AAAA,KACF;AAEJ;AAEA,MAAM,OAA4B,EAAE,iBAAiB,WAAW,QAAQ,GAAG,SAAS,SAAS;AAC7F,MAAM,YAAiC,EAAE,iBAAiB,WAAW,cAAc,IAAI,SAAS,IAAI,QAAQ,UAAU,UAAU,KAAK,WAAW,6BAA6B;AAC7K,MAAM,QAA6B,EAAE,UAAU,IAAI,YAAY,KAAK,OAAO,WAAW,QAAQ,WAAW;AACzG,MAAM,YAAiC,EAAE,UAAU,IAAI,OAAO,WAAW,YAAY,QAAQ,QAAQ,WAAW;AAChH,MAAM,SAA8B,EAAE,SAAS,gBAAgB,iBAAiB,WAAW,OAAO,WAAW,SAAS,aAAa,cAAc,GAAG,gBAAgB,QAAQ,UAAU,GAAG;AACzL,MAAM,OAA4B,EAAE,UAAU,IAAI,OAAO,WAAW,WAAW,GAAG;AAElF,IAAO,kCAAQ;",
+  "names": []
+}

package/dist/modules/customer_accounts/extension-points.js

@@ -0,0 +1,14 @@
+import { dataTableExtensionHost, defineModuleExtensionPoints } from "@open-mercato/shared/modules/widgets/extension-points";
+const extensionPoints = defineModuleExtensionPoints({
+  moduleId: "customer_accounts",
+  hosts: {
+    usersTable: dataTableExtensionHost({ tableId: "customer_accounts.admin.users", source: "backend/customer_accounts/users/page.tsx" }),
+    rolesTable: dataTableExtensionHost({ tableId: "customer_accounts.admin.roles", source: "backend/customer_accounts/roles/page.tsx" })
+  }
+});
+var extension_points_default = extensionPoints;
+export {
+  extension_points_default as default,
+  extensionPoints
+};
+//# sourceMappingURL=extension-points.js.map

package/dist/modules/customer_accounts/extension-points.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/customer_accounts/extension-points.ts"],
+  "sourcesContent": ["import { dataTableExtensionHost, defineModuleExtensionPoints } from '@open-mercato/shared/modules/widgets/extension-points'\n\nexport const extensionPoints = defineModuleExtensionPoints({\n  moduleId: 'customer_accounts',\n  hosts: {\n    usersTable: dataTableExtensionHost({ tableId: 'customer_accounts.admin.users', source: 'backend/customer_accounts/users/page.tsx' }),\n    rolesTable: dataTableExtensionHost({ tableId: 'customer_accounts.admin.roles', source: 'backend/customer_accounts/roles/page.tsx' }),\n  },\n})\n\nexport default extensionPoints\n"],
+  "mappings": "AAAA,SAAS,wBAAwB,mCAAmC;AAE7D,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,OAAO;AAAA,IACL,YAAY,uBAAuB,EAAE,SAAS,iCAAiC,QAAQ,2CAA2C,CAAC;AAAA,IACnI,YAAY,uBAAuB,EAAE,SAAS,iCAAiC,QAAQ,2CAA2C,CAAC;AAAA,EACrI;AACF,CAAC;AAED,IAAO,2BAAQ;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/customerAuth.js

@@ -46,7 +46,11 @@ async function validateUserState(sub, tenantId, orgId, iat) {
   const { CustomerRbacService } = await import("@open-mercato/core/modules/customer_accounts/services/customerRbacService");
   const rbac = container.resolve("customerRbacService");
   const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId });
-  return { valid: true, resolvedFeatures: acl.isPortalAdmin ? ["*"] : acl.features };
+  const resolvedFeatures = await rbac.getEffectiveFeatures(sub, {
+    tenantId,
+    organizationId: orgId
+  });
+  return { valid: true, resolvedFeatures, isPortalAdmin: acl.isPortalAdmin };
 }
 async function getCustomerAuthFromRequest(req) {
   const cookieHeader = req.headers.get("cookie") || "";
@@ -95,7 +99,8 @@ async function getCustomerAuthFromRequest(req) {
       displayName: String(payload.displayName || ""),
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
       personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
-      resolvedFeatures: userState.resolvedFeatures
+      resolvedFeatures: userState.resolvedFeatures,
+      isPortalAdmin: userState.isPortalAdmin
     };
   } catch {
     return null;

package/dist/modules/customer_accounts/lib/customerAuth.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerAuth.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { verifyAudienceJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport type { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\n\nexport interface CustomerAuthContext {\n  sub: string\n  sid: string\n  type: 'customer'\n  tenantId: string\n  orgId: string\n  email: string\n  displayName: string\n  customerEntityId?: string | null\n  personEntityId?: string | null\n  resolvedFeatures: string[]\n}\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),\n    ])\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    // Fail closed: if we cannot verify the session, treat the token as revoked to prevent\n    // replay of leaked JWTs when the backend is partially degraded.\n    return false\n  }\n}\n\nexport function readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nexport type UserValidationResult =\n  | { valid: false }\n  | { valid: true; resolvedFeatures: string[] }\n\nexport async function validateUserState(\n  sub: string,\n  tenantId: string,\n  orgId: string,\n  iat: unknown,\n): Promise<UserValidationResult> {\n  const [{ createRequestContainer }, { CustomerUser }] = await Promise.all([\n    import('@open-mercato/shared/lib/di/container'),\n    import('@open-mercato/core/modules/customer_accounts/data/entities'),\n  ])\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const user = await findOneWithDecryption(em, CustomerUser, { id: sub }, {\n    fields: ['sessionsRevokedAt', 'deletedAt', 'isActive'],\n  })\n  if (!user) return { valid: false }\n  if (user.deletedAt) return { valid: false }\n  if (!user.isActive) return { valid: false }\n  if (user.sessionsRevokedAt && typeof iat === 'number' && iat * 1000 < user.sessionsRevokedAt.getTime()) {\n    return { valid: false }\n  }\n\n  const { CustomerRbacService } = await import(\n    '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\n  )\n  const rbac = container.resolve('customerRbacService') as InstanceType<typeof CustomerRbacService>\n  const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId })\n  return { valid: true, resolvedFeatures: acl.isPortalAdmin ? ['*'] : acl.features }\n}\n\nexport async function getCustomerAuthFromRequest(req: Request): Promise<CustomerAuthContext | null> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const authHeader = (req.headers.get('authorization') || '').trim()\n\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) {\n    token = authHeader.slice(7).trim()\n  }\n  if (!token) {\n    const cookieValue = readCookieFromHeader(cookieHeader, 'customer_auth_token')\n    if (cookieValue) {\n      try {\n        token = decodeURIComponent(cookieValue)\n      } catch {\n        // Malformed percent-encoding; use raw value\n        token = cookieValue\n      }\n    }\n  }\n  if (!token) return null\n\n  try {\n    let payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    // Legacy fallback: try raw JWT_SECRET for pre-migration customer tokens\n    if (!payload) {\n      payload = verifyJwt(token) as Record<string, unknown> | null\n      if (payload) payload._legacyToken = true\n    }\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid && payload._legacyToken !== true) return null\n    const stillActive = sid ? await assertSessionStillActive(sid) : true\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      String(payload.tenantId),\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId: String(payload.tenantId),\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\nexport async function requireCustomerAuth(req: Request): Promise<CustomerAuthContext> {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    throw NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  return auth\n}\n\nexport async function requireCustomerFeature(\n  auth: CustomerAuthContext,\n  features: string[],\n  rbac: CustomerRbacService,\n): Promise<void> {\n  if (!features.length) return\n  const ok = await rbac.userHasAllFeatures(\n    auth.sub,\n    features,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n  if (!ok) {\n    throw NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB,iBAAiB;AAE7C,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AAetC,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,uBAAuB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjF,OAAO,uCAAuC;AAAA,MAC9C,OAAO,8EAA8E;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAAqB,QAAmC,MAAkC;AACxG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,kBACpB,KACA,UACA,OACA,KAC+B;AAC/B,QAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACvE,OAAO,uCAAuC;AAAA,IAC9C,OAAO,4DAA4D;AAAA,EACrE,CAAC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,IAAI,GAAG;AAAA,IACtE,QAAQ,CAAC,qBAAqB,aAAa,UAAU;AAAA,EACvD,CAAC;AACD,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,MAAM;AACjC,MAAI,KAAK,UAAW,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,CAAC,KAAK,SAAU,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,KAAK,qBAAqB,OAAO,QAAQ,YAAY,MAAM,MAAO,KAAK,kBAAkB,QAAQ,GAAG;AACtG,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OACpC,2EACF;AACA,QAAM,OAAO,UAAU,QAAQ,qBAAqB;AACpD,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvE,SAAO,EAAE,OAAO,MAAM,kBAAkB,IAAI,gBAAgB,CAAC,GAAG,IAAI,IAAI,SAAS;AACnF;AAEA,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AAEjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,YAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EACnC;AACA,MAAI,CAAC,OAAO;AACV,UAAM,cAAc,qBAAqB,cAAc,qBAAqB;AAC5E,QAAI,aAAa;AACf,UAAI;AACF,gBAAQ,mBAAmB,WAAW;AAAA,MACxC,QAAQ;AAEN,gBAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,QAAI,UAAU,kBAAkB,uBAAuB,KAAK;AAE5D,QAAI,CAAC,SAAS;AACZ,gBAAU,UAAU,KAAK;AACzB,UAAI,QAAS,SAAQ,eAAe;AAAA,IACtC;AACA,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,OAAO,QAAQ,iBAAiB,KAAM,QAAO;AAClD,UAAM,cAAc,MAAM,MAAM,yBAAyB,GAAG,IAAI;AAChE,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,QAAQ,QAAQ;AAAA,MACvB,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,UAAU,OAAO,QAAQ,QAAQ;AAAA,MACjC,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,IAC9B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,KAA4C;AACpF,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,MACA,UACA,MACe;AACf,MAAI,CAAC,SAAS,OAAQ;AACtB,QAAM,KAAK,MAAM,KAAK;AAAA,IACpB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AACA,MAAI,CAAC,IAAI;AACP,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { verifyAudienceJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport type { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\n\nexport interface CustomerAuthContext {\n  sub: string\n  sid: string\n  type: 'customer'\n  tenantId: string\n  orgId: string\n  email: string\n  displayName: string\n  customerEntityId?: string | null\n  personEntityId?: string | null\n  resolvedFeatures: string[]\n  isPortalAdmin?: boolean\n}\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),\n    ])\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    // Fail closed: if we cannot verify the session, treat the token as revoked to prevent\n    // replay of leaked JWTs when the backend is partially degraded.\n    return false\n  }\n}\n\nexport function readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nexport type UserValidationResult =\n  | { valid: false }\n  | { valid: true; resolvedFeatures: string[]; isPortalAdmin: boolean }\n\nexport async function validateUserState(\n  sub: string,\n  tenantId: string,\n  orgId: string,\n  iat: unknown,\n): Promise<UserValidationResult> {\n  const [{ createRequestContainer }, { CustomerUser }] = await Promise.all([\n    import('@open-mercato/shared/lib/di/container'),\n    import('@open-mercato/core/modules/customer_accounts/data/entities'),\n  ])\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const user = await findOneWithDecryption(em, CustomerUser, { id: sub }, {\n    fields: ['sessionsRevokedAt', 'deletedAt', 'isActive'],\n  })\n  if (!user) return { valid: false }\n  if (user.deletedAt) return { valid: false }\n  if (!user.isActive) return { valid: false }\n  if (user.sessionsRevokedAt && typeof iat === 'number' && iat * 1000 < user.sessionsRevokedAt.getTime()) {\n    return { valid: false }\n  }\n\n  const { CustomerRbacService } = await import(\n    '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\n  )\n  const rbac = container.resolve('customerRbacService') as InstanceType<typeof CustomerRbacService>\n  const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId })\n  const resolvedFeatures = await rbac.getEffectiveFeatures(sub, {\n    tenantId,\n    organizationId: orgId,\n  })\n  return { valid: true, resolvedFeatures, isPortalAdmin: acl.isPortalAdmin }\n}\n\nexport async function getCustomerAuthFromRequest(req: Request): Promise<CustomerAuthContext | null> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const authHeader = (req.headers.get('authorization') || '').trim()\n\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) {\n    token = authHeader.slice(7).trim()\n  }\n  if (!token) {\n    const cookieValue = readCookieFromHeader(cookieHeader, 'customer_auth_token')\n    if (cookieValue) {\n      try {\n        token = decodeURIComponent(cookieValue)\n      } catch {\n        // Malformed percent-encoding; use raw value\n        token = cookieValue\n      }\n    }\n  }\n  if (!token) return null\n\n  try {\n    let payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    // Legacy fallback: try raw JWT_SECRET for pre-migration customer tokens\n    if (!payload) {\n      payload = verifyJwt(token) as Record<string, unknown> | null\n      if (payload) payload._legacyToken = true\n    }\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid && payload._legacyToken !== true) return null\n    const stillActive = sid ? await assertSessionStillActive(sid) : true\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      String(payload.tenantId),\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId: String(payload.tenantId),\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n      isPortalAdmin: userState.isPortalAdmin,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\nexport async function requireCustomerAuth(req: Request): Promise<CustomerAuthContext> {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    throw NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  return auth\n}\n\nexport async function requireCustomerFeature(\n  auth: CustomerAuthContext,\n  features: string[],\n  rbac: CustomerRbacService,\n): Promise<void> {\n  if (!features.length) return\n  const ok = await rbac.userHasAllFeatures(\n    auth.sub,\n    features,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n  if (!ok) {\n    throw NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB,iBAAiB;AAE7C,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AAgBtC,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,uBAAuB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjF,OAAO,uCAAuC;AAAA,MAC9C,OAAO,8EAA8E;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAAqB,QAAmC,MAAkC;AACxG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,kBACpB,KACA,UACA,OACA,KAC+B;AAC/B,QAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACvE,OAAO,uCAAuC;AAAA,IAC9C,OAAO,4DAA4D;AAAA,EACrE,CAAC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,IAAI,GAAG;AAAA,IACtE,QAAQ,CAAC,qBAAqB,aAAa,UAAU;AAAA,EACvD,CAAC;AACD,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,MAAM;AACjC,MAAI,KAAK,UAAW,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,CAAC,KAAK,SAAU,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,KAAK,qBAAqB,OAAO,QAAQ,YAAY,MAAM,MAAO,KAAK,kBAAkB,QAAQ,GAAG;AACtG,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OACpC,2EACF;AACA,QAAM,OAAO,UAAU,QAAQ,qBAAqB;AACpD,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvE,QAAM,mBAAmB,MAAM,KAAK,qBAAqB,KAAK;AAAA,IAC5D;AAAA,IACA,gBAAgB;AAAA,EAClB,CAAC;AACD,SAAO,EAAE,OAAO,MAAM,kBAAkB,eAAe,IAAI,cAAc;AAC3E;AAEA,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AAEjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,YAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EACnC;AACA,MAAI,CAAC,OAAO;AACV,UAAM,cAAc,qBAAqB,cAAc,qBAAqB;AAC5E,QAAI,aAAa;AACf,UAAI;AACF,gBAAQ,mBAAmB,WAAW;AAAA,MACxC,QAAQ;AAEN,gBAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,QAAI,UAAU,kBAAkB,uBAAuB,KAAK;AAE5D,QAAI,CAAC,SAAS;AACZ,gBAAU,UAAU,KAAK;AACzB,UAAI,QAAS,SAAQ,eAAe;AAAA,IACtC;AACA,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,OAAO,QAAQ,iBAAiB,KAAM,QAAO;AAClD,UAAM,cAAc,MAAM,MAAM,yBAAyB,GAAG,IAAI;AAChE,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,QAAQ,QAAQ;AAAA,MACvB,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,UAAU,OAAO,QAAQ,QAAQ;AAAA,MACjC,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,IAC3B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,KAA4C;AACpF,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,MACA,UACA,MACe;AACf,MAAI,CAAC,SAAS,OAAQ;AACtB,QAAM,KAAK,MAAM,KAAK;AAAA,IACpB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AACA,MAAI,CAAC,IAAI;AACP,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerAuthServer.js

@@ -50,7 +50,8 @@ async function getCustomerAuthFromCookies(options) {
       displayName: String(payload.displayName || ""),
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
       personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
-      resolvedFeatures: userState.resolvedFeatures
+      resolvedFeatures: userState.resolvedFeatures,
+      isPortalAdmin: userState.isPortalAdmin
     };
   } catch {
     return null;

package/dist/modules/customer_accounts/lib/customerAuthServer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerAuthServer.ts"],
-  "sourcesContent": ["/**\n * Server-side customer auth helpers for Next.js server components.\n *\n * Uses the `cookies()` API from `next/headers` to read the customer auth token\n * from cookies \u2014 analogous to `getAuthFromCookies()` for staff auth.\n */\n\nimport { cookies } from 'next/headers'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { CUSTOMER_JWT_AUDIENCE, CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { validateUserState } from './customerAuth'\nimport type { CustomerAuthContext } from './customerAuth'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'customer-auth-server' })\n\nexport type { CustomerAuthContext }\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    return false\n  }\n}\n\n/**\n * Read and verify customer auth from cookies in server components.\n *\n * Returns the customer auth context if a valid customer JWT is found,\n * or null if not authenticated.\n *\n * @example\n * ```tsx\n * // In a server component or catch-all route\n * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'\n *\n * const customerAuth = await getCustomerAuthFromCookies()\n * if (!customerAuth) redirect('/login')\n * ```\n */\nexport async function getCustomerAuthFromCookies(\n  options?: { expectedTenantId?: string },\n): Promise<CustomerAuthContext | null> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('customer_auth_token')?.value\n  if (!token) return null\n\n  try {\n    const payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid) return null\n    const tenantId = String(payload.tenantId)\n    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {\n      // Cross-host JWT replay defense. See spec rev 5 Customer Authentication\n      // section: the host-resolved tenant is the authoritative scope; mismatched\n      // JWTs are rejected as if unauthenticated.\n      return null\n    }\n    const stillActive = await assertSessionStillActive(sid)\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      tenantId,\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId,\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\n/**\n * Convenience wrapper for custom-domain pages: resolves the host, calls\n * getCustomerAuthFromCookies with the host-resolved tenant as expectedTenantId.\n *\n * Use from server components rendered under custom domains.\n */\nexport async function getCustomerAuthForHost(\n  host: string | null | undefined,\n): Promise<CustomerAuthContext | null> {\n  if (!host) return getCustomerAuthFromCookies()\n\n  try {\n    const hostname = tryNormalizeHostname(host)\n    if (!hostname) return getCustomerAuthFromCookies()\n    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies()\n\n    const container = await createRequestContainer()\n    const service = container.resolve('domainMappingService') as InstanceType<typeof DomainMappingService>\n    const resolved = await service.resolveByHostname(hostname)\n    if (!resolved || resolved.status !== 'active') return null\n    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId })\n  } catch (err) {\n    logger.warn('Domain resolve failed; falling back to platform cookie', { err })\n    return getCustomerAuthFromCookies()\n  }\n}\n"],
-  "mappings": "AAOA,SAAS,eAAe;AACxB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,6BAAqD;AAE9D,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAI5F,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,eAAsB,2BACpB,SACqC;AACrC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,qBAAqB,GAAG;AACtD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,UAAU,kBAAkB,uBAAuB,KAAK;AAC9D,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,OAAO,QAAQ,QAAQ;AACxC,QAAI,SAAS,oBAAoB,QAAQ,qBAAqB,UAAU;AAItE,aAAO;AAAA,IACT;AACA,UAAM,cAAc,MAAM,yBAAyB,GAAG;AACtD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB;AAAA,MACA,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,IAC9B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,uBACpB,MACqC;AACrC,MAAI,CAAC,KAAM,QAAO,2BAA2B;AAE7C,MAAI;AACF,UAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAI,CAAC,SAAU,QAAO,2BAA2B;AACjD,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO,2BAA2B;AAE5E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,UAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,QAAI,CAAC,YAAY,SAAS,WAAW,SAAU,QAAO;AACtD,WAAO,2BAA2B,EAAE,kBAAkB,SAAS,SAAS,CAAC;AAAA,EAC3E,SAAS,KAAK;AACZ,WAAO,KAAK,0DAA0D,EAAE,IAAI,CAAC;AAC7E,WAAO,2BAA2B;AAAA,EACpC;AACF;",
+  "sourcesContent": ["/**\n * Server-side customer auth helpers for Next.js server components.\n *\n * Uses the `cookies()` API from `next/headers` to read the customer auth token\n * from cookies \u2014 analogous to `getAuthFromCookies()` for staff auth.\n */\n\nimport { cookies } from 'next/headers'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { CUSTOMER_JWT_AUDIENCE, CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { validateUserState } from './customerAuth'\nimport type { CustomerAuthContext } from './customerAuth'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'customer-auth-server' })\n\nexport type { CustomerAuthContext }\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    return false\n  }\n}\n\n/**\n * Read and verify customer auth from cookies in server components.\n *\n * Returns the customer auth context if a valid customer JWT is found,\n * or null if not authenticated.\n *\n * @example\n * ```tsx\n * // In a server component or catch-all route\n * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'\n *\n * const customerAuth = await getCustomerAuthFromCookies()\n * if (!customerAuth) redirect('/login')\n * ```\n */\nexport async function getCustomerAuthFromCookies(\n  options?: { expectedTenantId?: string },\n): Promise<CustomerAuthContext | null> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('customer_auth_token')?.value\n  if (!token) return null\n\n  try {\n    const payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid) return null\n    const tenantId = String(payload.tenantId)\n    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {\n      // Cross-host JWT replay defense. See spec rev 5 Customer Authentication\n      // section: the host-resolved tenant is the authoritative scope; mismatched\n      // JWTs are rejected as if unauthenticated.\n      return null\n    }\n    const stillActive = await assertSessionStillActive(sid)\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      tenantId,\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId,\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n      isPortalAdmin: userState.isPortalAdmin,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\n/**\n * Convenience wrapper for custom-domain pages: resolves the host, calls\n * getCustomerAuthFromCookies with the host-resolved tenant as expectedTenantId.\n *\n * Use from server components rendered under custom domains.\n */\nexport async function getCustomerAuthForHost(\n  host: string | null | undefined,\n): Promise<CustomerAuthContext | null> {\n  if (!host) return getCustomerAuthFromCookies()\n\n  try {\n    const hostname = tryNormalizeHostname(host)\n    if (!hostname) return getCustomerAuthFromCookies()\n    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies()\n\n    const container = await createRequestContainer()\n    const service = container.resolve('domainMappingService') as InstanceType<typeof DomainMappingService>\n    const resolved = await service.resolveByHostname(hostname)\n    if (!resolved || resolved.status !== 'active') return null\n    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId })\n  } catch (err) {\n    logger.warn('Domain resolve failed; falling back to platform cookie', { err })\n    return getCustomerAuthFromCookies()\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,eAAe;AACxB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,6BAAqD;AAE9D,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAI5F,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,eAAsB,2BACpB,SACqC;AACrC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,qBAAqB,GAAG;AACtD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,UAAU,kBAAkB,uBAAuB,KAAK;AAC9D,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,OAAO,QAAQ,QAAQ;AACxC,QAAI,SAAS,oBAAoB,QAAQ,qBAAqB,UAAU;AAItE,aAAO;AAAA,IACT;AACA,UAAM,cAAc,MAAM,yBAAyB,GAAG;AACtD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB;AAAA,MACA,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,IAC3B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,uBACpB,MACqC;AACrC,MAAI,CAAC,KAAM,QAAO,2BAA2B;AAE7C,MAAI;AACF,UAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAI,CAAC,SAAU,QAAO,2BAA2B;AACjD,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO,2BAA2B;AAE5E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,UAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,QAAI,CAAC,YAAY,SAAS,WAAW,SAAU,QAAO;AACtD,WAAO,2BAA2B,EAAE,kBAAkB,SAAS,SAAS,CAAC;AAAA,EAC3E,SAAS,KAAK;AACZ,WAAO,KAAK,0DAA0D,EAAE,IAAI,CAAC;AAC7E,WAAO,2BAA2B;AAAA,EACpC;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerEntityOwnership.js

@@ -1,14 +1,38 @@
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 async function isOwnedCompanyEntity(em, customerEntityId, scope) {
+  return isOwnedEntityOfKind(em, customerEntityId, "company", scope);
+}
+async function isOwnedPersonEntity(em, personEntityId, scope) {
+  return isOwnedEntityOfKind(em, personEntityId, "person", scope);
+}
+async function resolveOwnedCompanyForPerson(em, personEntityId, scope) {
+  const { CustomerPersonProfile } = await import("@open-mercato/core/modules/customers/data/entities");
+  const profile = await em.findOne(CustomerPersonProfile, {
+    entity: personEntityId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId
+  });
+  const candidate = readCompanyEntityId(profile);
+  if (!candidate) return null;
+  return await isOwnedCompanyEntity(em, candidate, scope) ? candidate : null;
+}
+function readCompanyEntityId(profile) {
+  const company = profile?.company;
+  if (!company) return null;
+  if (typeof company === "string") return company;
+  const id = company.id;
+  return typeof id === "string" ? id : null;
+}
+async function isOwnedEntityOfKind(em, entityId, kind, scope) {
   const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
   const entity = await findOneWithDecryption(
     em,
     CustomerEntity,
     {
-      id: customerEntityId,
+      id: entityId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      kind: "company",
+      kind,
       deletedAt: null
     },
     void 0,
@@ -17,6 +41,8 @@ async function isOwnedCompanyEntity(em, customerEntityId, scope) {
   return !!entity;
 }
 export {
-  isOwnedCompanyEntity
+  isOwnedCompanyEntity,
+  isOwnedPersonEntity,
+  resolveOwnedCompanyForPerson
 };
 //# sourceMappingURL=customerEntityOwnership.js.map

package/dist/modules/customer_accounts/lib/customerEntityOwnership.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerEntityOwnership.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport type CustomerEntityScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\n/**\n * Confirms that a caller-supplied `customerEntityId` (the CRM company FK linked\n * onto a customer user) exists, is a company, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * Without this check an admin in org A could pass a company UUID from org B in\n * the same tenant and cross-link a customer user into another org's portal\n * context (#2693). The lookup is org-scoped to match how `CustomerEntity` rows\n * are created and listed.\n */\nexport async function isOwnedCompanyEntity(\n  em: EntityManager,\n  customerEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: customerEntityId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      kind: 'company',\n      deletedAt: null,\n    } as any,\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  return !!entity\n}\n"],
-  "mappings": "AACA,SAAS,6BAA6B;AAiBtC,eAAsB,qBACpB,IACA,kBACA,OACkB;AAClB,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAC5F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,SAAO,CAAC,CAAC;AACX;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport type CustomerEntityScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\n/**\n * Confirms that a caller-supplied `customerEntityId` (the CRM company FK linked\n * onto a customer user) exists, is a company, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * Without this check an admin in org A could pass a company UUID from org B in\n * the same tenant and cross-link a customer user into another org's portal\n * context (#2693). The lookup is org-scoped to match how `CustomerEntity` rows\n * are created and listed.\n */\nexport async function isOwnedCompanyEntity(\n  em: EntityManager,\n  customerEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  return isOwnedEntityOfKind(em, customerEntityId, 'company', scope)\n}\n\n/**\n * Confirms that a caller-supplied `personEntityId` (the CRM person FK linked\n * onto a customer user) exists, is a person, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * This is the symmetric guard to {@link isOwnedCompanyEntity}: the person FK is\n * copied onto the customer user on accept and short-circuits CRM auto-linking,\n * so an unvalidated id would permanently cross-link a portal user to another\n * org's person (the #4362/#2693 class of bug, on the person side).\n */\nexport async function isOwnedPersonEntity(\n  em: EntityManager,\n  personEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  return isOwnedEntityOfKind(em, personEntityId, 'person', scope)\n}\n\n/**\n * Resolves the CRM company a person belongs to, but only when both the profile\n * lookup and the company itself stay inside the given tenant/organization scope.\n * Returns null when the person has no company or that company is out of scope.\n *\n * Both the invite route and the CRM auto-link subscriber need this answer, and\n * both write the result into `customerEntityId` \u2014 the portal company scope key \u2014\n * so they must agree on what counts as an in-scope company.\n */\nexport async function resolveOwnedCompanyForPerson(\n  em: EntityManager,\n  personEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<string | null> {\n  const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')\n  const profile = await em.findOne(CustomerPersonProfile as any, {\n    entity: personEntityId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  } as any)\n  const candidate = readCompanyEntityId(profile)\n  if (!candidate) return null\n  return (await isOwnedCompanyEntity(em, candidate, scope)) ? candidate : null\n}\n\n/**\n * `CustomerPersonProfile.company` is a relation on `company_entity_id`, not a\n * scalar \u2014 MikroORM hands back either the raw id or an entity reference, never a\n * `companyEntityId` property. Reading the wrong one silently yields undefined and\n * turns every company recovery into a clear.\n */\nfunction readCompanyEntityId(profile: unknown): string | null {\n  const company = (profile as { company?: unknown } | null | undefined)?.company\n  if (!company) return null\n  if (typeof company === 'string') return company\n  const id = (company as { id?: unknown }).id\n  return typeof id === 'string' ? id : null\n}\n\nasync function isOwnedEntityOfKind(\n  em: EntityManager,\n  entityId: string,\n  kind: 'company' | 'person',\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: entityId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      kind,\n      deletedAt: null,\n    } as any,\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  return !!entity\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AAiBtC,eAAsB,qBACpB,IACA,kBACA,OACkB;AAClB,SAAO,oBAAoB,IAAI,kBAAkB,WAAW,KAAK;AACnE;AAYA,eAAsB,oBACpB,IACA,gBACA,OACkB;AAClB,SAAO,oBAAoB,IAAI,gBAAgB,UAAU,KAAK;AAChE;AAWA,eAAsB,6BACpB,IACA,gBACA,OACwB;AACxB,QAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,oDAAoD;AACnG,QAAM,UAAU,MAAM,GAAG,QAAQ,uBAA8B;AAAA,IAC7D,QAAQ;AAAA,IACR,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAQ;AACR,QAAM,YAAY,oBAAoB,OAAO;AAC7C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAQ,MAAM,qBAAqB,IAAI,WAAW,KAAK,IAAK,YAAY;AAC1E;AAQA,SAAS,oBAAoB,SAAiC;AAC5D,QAAM,UAAW,SAAsD;AACvE,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,QAAM,KAAM,QAA6B;AACzC,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAEA,eAAe,oBACb,IACA,UACA,MACA,OACkB;AAClB,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAC5F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,SAAO,CAAC,CAAC;AACX;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerUrl.js

@@ -1,4 +1,5 @@
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 function platformBaseUrl() {
   const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim();
   if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, "");
@@ -13,6 +14,23 @@ function resolveContainer(container) {
   if (container) return Promise.resolve(container);
   return createRequestContainer();
 }
+async function resolveOrgSlug(container, orgId) {
+  try {
+    const orgService = container.resolve("orgService");
+    if (orgService && typeof orgService.findById === "function") {
+      const org = await orgService.findById(orgId);
+      return org?.slug ?? null;
+    }
+  } catch {
+  }
+  try {
+    const em = container.resolve("em");
+    const org = await em.findOne(Organization, { id: orgId, deletedAt: null });
+    return org?.slug ?? null;
+  } catch {
+    return null;
+  }
+}
 async function urlForCustomerOrg(orgId, path, options) {
   const safePath = path.startsWith("/") ? path : `/${path}`;
   const container = await resolveContainer(options?.container);
@@ -28,16 +46,7 @@ async function urlForCustomerOrg(orgId, path, options) {
   if (active && active.hostname) {
     return `https://${active.hostname}${safePath}`;
   }
-  let orgSlug = null;
-  try {
-    const orgService = container.resolve("orgService");
-    if (orgService && typeof orgService.findById === "function") {
-      const org = await orgService.findById(orgId);
-      orgSlug = org?.slug ?? null;
-    }
-  } catch {
-    orgSlug = null;
-  }
+  const orgSlug = await resolveOrgSlug(container, orgId);
   const base = platformBaseUrl();
   if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`;
   return `${base}${safePath}`;

package/dist/modules/customer_accounts/lib/customerUrl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerUrl.ts"],
-  "sourcesContent": ["// Build customer-portal URLs that honor the active custom domain when present.\n// All customer-facing email senders (signup welcome, magic link, password reset,\n// notification digests) MUST construct links via this helper instead of\n// hard-coding PLATFORM_PORTAL_BASE_URL \u2014 see customer_accounts/AGENTS.md.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\n\ntype DomainMappingService = {\n  resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>\n}\n\ntype OrgService = {\n  findById(orgId: string): Promise<{ id: string; slug: string | null } | null>\n}\n\nfunction platformBaseUrl(): string {\n  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()\n  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\\/+$/, '')\n  // Outbound emails (welcome, magic link, password reset) embed this URL \u2014\n  // localhost in production silently sends broken links to real customers.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      'PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails.',\n    )\n  }\n  return 'http://localhost:3000'\n}\n\nfunction resolveContainer(container?: AppContainer): Promise<AppContainer> {\n  if (container) return Promise.resolve(container)\n  return createRequestContainer()\n}\n\nexport async function urlForCustomerOrg(\n  orgId: string,\n  path: string,\n  options?: { container?: AppContainer },\n): Promise<string> {\n  const safePath = path.startsWith('/') ? path : `/${path}`\n  const container = await resolveContainer(options?.container)\n\n  let active: { hostname: string } | null = null\n  try {\n    const service = container.resolve('domainMappingService') as DomainMappingService\n    if (service && typeof service.resolveActiveByOrg === 'function') {\n      active = await service.resolveActiveByOrg(orgId)\n    }\n  } catch {\n    // domainMappingService not registered yet (fresh installs, tests) \u2014 fall through to platform URL.\n    active = null\n  }\n\n  if (active && active.hostname) {\n    return `https://${active.hostname}${safePath}`\n  }\n\n  let orgSlug: string | null = null\n  try {\n    const orgService = container.resolve('orgService') as OrgService | undefined\n    if (orgService && typeof orgService.findById === 'function') {\n      const org = await orgService.findById(orgId)\n      orgSlug = org?.slug ?? null\n    }\n  } catch {\n    orgSlug = null\n  }\n\n  const base = platformBaseUrl()\n  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`\n  return `${base}${safePath}`\n}\n"],
-  "mappings": "AAMA,SAAS,8BAA8B;AAUvC,SAAS,kBAA0B;AACjC,QAAM,UAAU,QAAQ,IAAI,0BAA0B,KAAK;AAC3D,MAAI,WAAW,QAAQ,SAAS,EAAG,QAAO,QAAQ,QAAQ,QAAQ,EAAE;AAGpE,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,UAAW,QAAO,QAAQ,QAAQ,SAAS;AAC/C,SAAO,uBAAuB;AAChC;AAEA,eAAsB,kBACpB,OACA,MACA,SACiB;AACjB,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACvD,QAAM,YAAY,MAAM,iBAAiB,SAAS,SAAS;AAE3D,MAAI,SAAsC;AAC1C,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAI,WAAW,OAAO,QAAQ,uBAAuB,YAAY;AAC/D,eAAS,MAAM,QAAQ,mBAAmB,KAAK;AAAA,IACjD;AAAA,EACF,QAAQ;AAEN,aAAS;AAAA,EACX;AAEA,MAAI,UAAU,OAAO,UAAU;AAC7B,WAAO,WAAW,OAAO,QAAQ,GAAG,QAAQ;AAAA,EAC9C;AAEA,MAAI,UAAyB;AAC7B,MAAI;AACF,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAI,cAAc,OAAO,WAAW,aAAa,YAAY;AAC3D,YAAM,MAAM,MAAM,WAAW,SAAS,KAAK;AAC3C,gBAAU,KAAK,QAAQ;AAAA,IACzB;AAAA,EACF,QAAQ;AACN,cAAU;AAAA,EACZ;AAEA,QAAM,OAAO,gBAAgB;AAC7B,MAAI,QAAS,QAAO,GAAG,IAAI,IAAI,OAAO,UAAU,QAAQ;AACxD,SAAO,GAAG,IAAI,GAAG,QAAQ;AAC3B;",
+  "sourcesContent": ["// Build customer-portal URLs that honor the active custom domain when present.\n// All customer-facing email senders (signup welcome, magic link, password reset,\n// notification digests) MUST construct links via this helper instead of\n// hard-coding PLATFORM_PORTAL_BASE_URL \u2014 see customer_accounts/AGENTS.md.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\n\ntype DomainMappingService = {\n  resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>\n}\n\ntype OrgService = {\n  findById(orgId: string): Promise<{ id: string; slug: string | null } | null>\n}\n\ntype EntityManagerResolver = {\n  resolve(name: 'em'): EntityManager\n}\n\nfunction platformBaseUrl(): string {\n  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()\n  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\\/+$/, '')\n  // Outbound emails (welcome, magic link, password reset) embed this URL \u2014\n  // localhost in production silently sends broken links to real customers.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      'PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails.',\n    )\n  }\n  return 'http://localhost:3000'\n}\n\nfunction resolveContainer(container?: AppContainer): Promise<AppContainer> {\n  if (container) return Promise.resolve(container)\n  return createRequestContainer()\n}\n\nasync function resolveOrgSlug(container: AppContainer, orgId: string): Promise<string | null> {\n  try {\n    const orgService = container.resolve('orgService') as OrgService | undefined\n    if (orgService && typeof orgService.findById === 'function') {\n      const org = await orgService.findById(orgId)\n      return org?.slug ?? null\n    }\n  } catch {\n    // orgService is optional in standalone/runtime contexts \u2014 fall through to EntityManager.\n  }\n\n  try {\n    const em = (container as AppContainer & EntityManagerResolver).resolve('em')\n    const org = await em.findOne(Organization, { id: orgId, deletedAt: null })\n    return org?.slug ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function urlForCustomerOrg(\n  orgId: string,\n  path: string,\n  options?: { container?: AppContainer },\n): Promise<string> {\n  const safePath = path.startsWith('/') ? path : `/${path}`\n  const container = await resolveContainer(options?.container)\n\n  let active: { hostname: string } | null = null\n  try {\n    const service = container.resolve('domainMappingService') as DomainMappingService\n    if (service && typeof service.resolveActiveByOrg === 'function') {\n      active = await service.resolveActiveByOrg(orgId)\n    }\n  } catch {\n    // domainMappingService not registered yet (fresh installs, tests) \u2014 fall through to platform URL.\n    active = null\n  }\n\n  if (active && active.hostname) {\n    return `https://${active.hostname}${safePath}`\n  }\n\n  const orgSlug = await resolveOrgSlug(container, orgId)\n  const base = platformBaseUrl()\n  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`\n  return `${base}${safePath}`\n}\n"],
+  "mappings": "AAMA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAe7B,SAAS,kBAA0B;AACjC,QAAM,UAAU,QAAQ,IAAI,0BAA0B,KAAK;AAC3D,MAAI,WAAW,QAAQ,SAAS,EAAG,QAAO,QAAQ,QAAQ,QAAQ,EAAE;AAGpE,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,UAAW,QAAO,QAAQ,QAAQ,SAAS;AAC/C,SAAO,uBAAuB;AAChC;AAEA,eAAe,eAAe,WAAyB,OAAuC;AAC5F,MAAI;AACF,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAI,cAAc,OAAO,WAAW,aAAa,YAAY;AAC3D,YAAM,MAAM,MAAM,WAAW,SAAS,KAAK;AAC3C,aAAO,KAAK,QAAQ;AAAA,IACtB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,KAAM,UAAmD,QAAQ,IAAI;AAC3E,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAc,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AACzE,WAAO,KAAK,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,OACA,MACA,SACiB;AACjB,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACvD,QAAM,YAAY,MAAM,iBAAiB,SAAS,SAAS;AAE3D,MAAI,SAAsC;AAC1C,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAI,WAAW,OAAO,QAAQ,uBAAuB,YAAY;AAC/D,eAAS,MAAM,QAAQ,mBAAmB,KAAK;AAAA,IACjD;AAAA,EACF,QAAQ;AAEN,aAAS;AAAA,EACX;AAEA,MAAI,UAAU,OAAO,UAAU;AAC7B,WAAO,WAAW,OAAO,QAAQ,GAAG,QAAQ;AAAA,EAC9C;AAEA,QAAM,UAAU,MAAM,eAAe,WAAW,KAAK;AACrD,QAAM,OAAO,gBAAgB;AAC7B,MAAI,QAAS,QAAO,GAAG,IAAI,IAAI,OAAO,UAAU,QAAQ;AACxD,SAAO,GAAG,IAAI,GAAG,QAAQ;AAC3B;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/invitationEmail.js

@@ -0,0 +1,35 @@
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { sendEmail } from "@open-mercato/shared/lib/email/send";
+import CustomerInvitationEmail from "@open-mercato/core/modules/customer_accounts/emails/CustomerInvitationEmail";
+import { urlForCustomerOrg } from "@open-mercato/core/modules/customer_accounts/lib/customerUrl";
+async function sendCustomerInvitationEmail(input) {
+  const { translate } = await resolveTranslations();
+  const inviteUrl = await urlForCustomerOrg(
+    input.organizationId,
+    `/invite?token=${encodeURIComponent(input.rawToken)}`,
+    { container: input.container }
+  );
+  const subject = translate("customer_accounts.invitation.email.subject", "You have been invited to the customer portal");
+  const copy = {
+    preview: translate("customer_accounts.invitation.email.preview", "Accept your invitation to finish setting up portal access."),
+    title: translate("customer_accounts.invitation.email.title", "You have been invited"),
+    body: translate(
+      "customer_accounts.invitation.email.body",
+      "Use this secure invitation link to create your password and access the customer portal."
+    ),
+    cta: translate("customer_accounts.invitation.email.cta", "Accept invitation"),
+    hint: translate(
+      "customer_accounts.invitation.email.hint",
+      "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email."
+    )
+  };
+  await sendEmail({
+    to: input.email,
+    subject,
+    react: CustomerInvitationEmail({ inviteUrl, copy })
+  });
+}
+export {
+  sendCustomerInvitationEmail
+};
+//# sourceMappingURL=invitationEmail.js.map

package/dist/modules/customer_accounts/lib/invitationEmail.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/invitationEmail.ts"],
+  "sourcesContent": ["import type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport CustomerInvitationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerInvitationEmail'\nimport { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'\n\nexport type CustomerInvitationEmailInput = {\n  container: AppContainer\n  organizationId: string\n  email: string\n  rawToken: string\n}\n\nexport async function sendCustomerInvitationEmail(input: CustomerInvitationEmailInput): Promise<void> {\n  const { translate } = await resolveTranslations()\n  const inviteUrl = await urlForCustomerOrg(\n    input.organizationId,\n    `/invite?token=${encodeURIComponent(input.rawToken)}`,\n    { container: input.container },\n  )\n\n  const subject = translate('customer_accounts.invitation.email.subject', 'You have been invited to the customer portal')\n  const copy = {\n    preview: translate('customer_accounts.invitation.email.preview', 'Accept your invitation to finish setting up portal access.'),\n    title: translate('customer_accounts.invitation.email.title', 'You have been invited'),\n    body: translate(\n      'customer_accounts.invitation.email.body',\n      'Use this secure invitation link to create your password and access the customer portal.',\n    ),\n    cta: translate('customer_accounts.invitation.email.cta', 'Accept invitation'),\n    hint: translate(\n      'customer_accounts.invitation.email.hint',\n      'This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.',\n    ),\n  }\n\n  await sendEmail({\n    to: input.email,\n    subject,\n    react: CustomerInvitationEmail({ inviteUrl, copy }),\n  })\n}\n"],
+  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,OAAO,6BAA6B;AACpC,SAAS,yBAAyB;AASlC,eAAsB,4BAA4B,OAAoD;AACpG,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,YAAY,MAAM;AAAA,IACtB,MAAM;AAAA,IACN,iBAAiB,mBAAmB,MAAM,QAAQ,CAAC;AAAA,IACnD,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AAEA,QAAM,UAAU,UAAU,8CAA8C,8CAA8C;AACtH,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,8CAA8C,4DAA4D;AAAA,IAC7H,OAAO,UAAU,4CAA4C,uBAAuB;AAAA,IACpF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU,0CAA0C,mBAAmB;AAAA,IAC5E,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,IAAI,MAAM;AAAA,IACV;AAAA,IACA,OAAO,wBAAwB,EAAE,WAAW,KAAK,CAAC;AAAA,EACpD,CAAC;AACH;",
+  "names": []
+}