@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/modules/entities/backend/entities/user/create/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/entities/backend/entities/user/create/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { z } from 'zod'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { CrudForm, type CrudField } from '@open-mercato/ui/backend/CrudForm'\nimport { createCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { upsertCustomEntitySchema } from '@open-mercato/core/modules/entities/data/validators'\nimport { useRouter } from 'next/navigation'\nimport { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { LoadingMessage } from '@open-mercato/ui/backend/detail'\n\nconst schema = upsertCustomEntitySchema\n\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\n\nexport default function CreateEntityPage() {\n  const t = useT()\n  const router = useRouter()\n  // Pre-fill the restriction toggle from the tenant default-restricted policy so\n  // the form reflects the workspace posture; null while loading.\n  const [defaultRestricted, setDefaultRestricted] = React.useState<boolean | null>(null)\n  React.useEffect(() => {\n    let active = true\n    ;(async () => {\n      const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(\n        '/api/entities/entity-settings',\n        undefined,\n        { errorMessage: '[internal] Failed to load entity settings', fallback: { newEntitiesRestrictedByDefault: false } },\n      ).catch(() => ({ newEntitiesRestrictedByDefault: false }))\n      if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)\n    })()\n    return () => { active = false }\n  }, [])\n  const fields = React.useMemo<CrudField[]>(() => ([\n    {\n      id: 'entityId',\n      label: t('entities.userEntities.form.entityId.label', 'Entity ID'),\n      type: 'text',\n      required: true,\n      placeholder: t('entities.userEntities.form.entityId.placeholder', 'module_name:entity_id'),\n    },\n    { id: 'label', label: t('entities.userEntities.form.label.label', 'Label'), type: 'text', required: true },\n    { id: 'description', label: t('entities.userEntities.form.description.label', 'Description'), type: 'textarea' },\n    {\n      id: 'defaultEditor',\n      label: t('entities.userEntities.form.defaultEditor.label', 'Default Editor (multiline)'),\n      type: 'select',\n      options: [\n        { value: '', label: t('entities.userEntities.form.defaultEditor.options.default', 'Default (Markdown)') },\n        { value: 'markdown', label: t('entities.userEntities.form.defaultEditor.options.markdown', 'Markdown (UIW)') },\n        { value: 'simpleMarkdown', label: t('entities.userEntities.form.defaultEditor.options.simpleMarkdown', 'Simple Markdown') },\n        { value: 'htmlRichText', label: t('entities.userEntities.form.defaultEditor.options.htmlRichText', 'HTML Rich Text') },\n        { value: 'plain', label: t('entities.userEntities.form.defaultEditor.options.plain', 'Plain textarea') },\n      ],\n    } as unknown as CrudField,\n    { id: 'showInSidebar', label: t('entities.userEntities.form.showInSidebar.label', 'Show in sidebar'), type: 'checkbox' } as CrudField,\n    {\n      id: 'accessRestricted',\n      label: t('entities.userEntities.form.accessRestricted.label', 'Restrict record access'),\n      type: 'checkbox',\n      description: t('entities.userEntities.form.accessRestricted.help', 'Require an explicit per-entity permission to view or manage this entity\u2019s records. Leave off to allow anyone with the general records permission.'),\n    } as CrudField,\n  ]), [t])\n\n  if (defaultRestricted === null) {\n    return (\n      <Page>\n        <PageBody>\n          <LoadingMessage label={t('entities.userEntities.form.loading', 'Loading\u2026')} />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={t('entities.userEntities.form.title', 'Create Entity')}\n          backHref=\"/backend/entities/user\"\n          schema={schema}\n          fields={fields}\n          initialValues={{ entityId: 'user:your_entity', label: '', showInSidebar: false, accessRestricted: defaultRestricted }}\n          submitLabel={t('entities.userEntities.form.submit', 'Create')}\n          cancelHref=\"/backend/entities/user\"\n          onSubmit={async (vals) => {\n            const entityId = await submitCreateEntity({\n              values: vals as Record<string, unknown>,\n              messages: {\n                entityIdRequired: t('entities.userEntities.errors.entityIdRequired', 'Entity ID is required'),\n                entityIdExists: t('entities.userEntities.errors.entityIdExists', 'Entity ID already exists'),\n                loadFailed: t('entities.userEntities.errors.loadFailed', 'Failed to load entities'),\n              },\n            })\n            try {\n              window.dispatchEvent(new Event('om:refresh-sidebar'))\n            } catch {}\n            const successMessage = t('entities.userEntities.flash.created', 'Entity created')\n            pushWithFlash(router, `/backend/entities/user/${encodeURIComponent(entityId)}`, successMessage, 'success')\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\ntype EntityListEntry = {\n  entityId?: string\n  source?: string\n}\n\ntype FetchCustomEntities = (errorMessage?: string) => Promise<EntityListEntry[]>\n\nasync function defaultFetchCustomEntities(errorMessage?: string): Promise<EntityListEntry[]> {\n  const data = await readApiResultOrThrow<{ items?: EntityListEntry[] }>(\n    '/api/entities/entities',\n    undefined,\n    { errorMessage: errorMessage ?? 'Failed to load entities', fallback: { items: [] } },\n  )\n  return Array.isArray(data?.items) ? data.items! : []\n}\n\ntype CreateEntityRequest = (payload: Record<string, unknown>) => Promise<void>\n\nasync function defaultCreateEntityRequest(payload: Record<string, unknown>) {\n  await createCrud('entities/entities', payload)\n}\n\nexport async function submitCreateEntity(options: {\n  values: Record<string, unknown>\n  fetchEntities?: FetchCustomEntities\n  createEntity?: CreateEntityRequest\n  messages?: {\n    entityIdRequired?: string\n    entityIdExists?: string\n    loadFailed?: string\n  }\n}): Promise<string> {\n  const {\n    values,\n    fetchEntities = defaultFetchCustomEntities,\n    createEntity = defaultCreateEntityRequest,\n    messages,\n  } = options\n  const rawEntityId = typeof values.entityId === 'string' ? values.entityId.trim() : ''\n  if (!rawEntityId) {\n    const message = messages?.entityIdRequired ?? 'Entity ID is required'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const existing = await fetchEntities(messages?.loadFailed)\n  const exists = existing.some(\n    (entry) => entry?.entityId === rawEntityId && (entry?.source === 'custom' || entry?.source === undefined),\n  )\n  if (exists) {\n    const message = messages?.entityIdExists ?? 'Entity ID already exists'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const payload: Record<string, unknown> = {\n    ...values,\n    entityId: rawEntityId,\n    labelField: 'name',\n    defaultEditor:\n      typeof (values as Record<string, unknown>).defaultEditor === 'string' &&\n      (values as Record<string, unknown>).defaultEditor\n        ? (values as Record<string, unknown>).defaultEditor\n        : undefined,\n  }\n\n  await createEntity(payload)\n  return rawEntityId\n}\n"],
-  "mappings": ";AAsEU;AArEV,YAAY,WAAW;AAEvB,SAAS,YAAY;AACrB,SAAS,gBAAgC;AACzC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAE/B,MAAM,SAAS;AAEf,SAAS,MAAM,gBAAgB;AAEhB,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AAGzB,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAyB,IAAI;AACrF,QAAM,UAAU,MAAM;AACpB,QAAI,SAAS;AACZ,KAAC,YAAY;AACZ,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,cAAc,6CAA6C,UAAU,EAAE,gCAAgC,MAAM,EAAE;AAAA,MACnH,EAAE,MAAM,OAAO,EAAE,gCAAgC,MAAM,EAAE;AACzD,UAAI,OAAQ,sBAAqB,MAAM,mCAAmC,IAAI;AAAA,IAChF,GAAG;AACH,WAAO,MAAM;AAAE,eAAS;AAAA,IAAM;AAAA,EAChC,GAAG,CAAC,CAAC;AACL,QAAM,SAAS,MAAM,QAAqB,MAAO;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,6CAA6C,WAAW;AAAA,MACjE,MAAM;AAAA,MACN,UAAU;AAAA,MACV,aAAa,EAAE,mDAAmD,uBAAuB;AAAA,IAC3F;AAAA,IACA,EAAE,IAAI,SAAS,OAAO,EAAE,0CAA0C,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,IACzG,EAAE,IAAI,eAAe,OAAO,EAAE,gDAAgD,aAAa,GAAG,MAAM,WAAW;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,kDAAkD,4BAA4B;AAAA,MACvF,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,4DAA4D,oBAAoB,EAAE;AAAA,QACxG,EAAE,OAAO,YAAY,OAAO,EAAE,6DAA6D,gBAAgB,EAAE;AAAA,QAC7G,EAAE,OAAO,kBAAkB,OAAO,EAAE,mEAAmE,iBAAiB,EAAE;AAAA,QAC1H,EAAE,OAAO,gBAAgB,OAAO,EAAE,iEAAiE,gBAAgB,EAAE;AAAA,QACrH,EAAE,OAAO,SAAS,OAAO,EAAE,0DAA0D,gBAAgB,EAAE;AAAA,MACzG;AAAA,IACF;AAAA,IACA,EAAE,IAAI,iBAAiB,OAAO,EAAE,kDAAkD,iBAAiB,GAAG,MAAM,WAAW;AAAA,IACvH;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qDAAqD,wBAAwB;AAAA,MACtF,MAAM;AAAA,MACN,aAAa,EAAE,oDAAoD,wJAAmJ;AAAA,IACxN;AAAA,EACF,GAAI,CAAC,CAAC,CAAC;AAEP,MAAI,sBAAsB,MAAM;AAC9B,WACE,oBAAC,QACC,8BAAC,YACC,8BAAC,kBAAe,OAAO,EAAE,sCAAsC,eAAU,GAAG,GAC9E,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,eAAe;AAAA,MAC5D,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,eAAe,EAAE,UAAU,oBAAoB,OAAO,IAAI,eAAe,OAAO,kBAAkB,kBAAkB;AAAA,MACpH,aAAa,EAAE,qCAAqC,QAAQ;AAAA,MAC5D,YAAW;AAAA,MACX,UAAU,OAAO,SAAS;AACxB,cAAM,WAAW,MAAM,mBAAmB;AAAA,UACxC,QAAQ;AAAA,UACR,UAAU;AAAA,YACR,kBAAkB,EAAE,iDAAiD,uBAAuB;AAAA,YAC5F,gBAAgB,EAAE,+CAA+C,0BAA0B;AAAA,YAC3F,YAAY,EAAE,2CAA2C,yBAAyB;AAAA,UACpF;AAAA,QACF,CAAC;AACD,YAAI;AACF,iBAAO,cAAc,IAAI,MAAM,oBAAoB,CAAC;AAAA,QACtD,QAAQ;AAAA,QAAC;AACT,cAAM,iBAAiB,EAAE,uCAAuC,gBAAgB;AAChF,sBAAc,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,IAAI,gBAAgB,SAAS;AAAA,MAC3G;AAAA;AAAA,EACF,GACF,GACF;AAEJ;AASA,eAAe,2BAA2B,cAAmD;AAC3F,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,cAAc,gBAAgB,2BAA2B,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EACrF;AACA,SAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAS,CAAC;AACrD;AAIA,eAAe,2BAA2B,SAAkC;AAC1E,QAAM,WAAW,qBAAqB,OAAO;AAC/C;AAEA,eAAsB,mBAAmB,SASrB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AACJ,QAAM,cAAc,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,KAAK,IAAI;AACnF,MAAI,CAAC,aAAa;AAChB,UAAM,UAAU,UAAU,oBAAoB;AAC9C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,WAAW,MAAM,cAAc,UAAU,UAAU;AACzD,QAAM,SAAS,SAAS;AAAA,IACtB,CAAC,UAAU,OAAO,aAAa,gBAAgB,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EACjG;AACA,MAAI,QAAQ;AACV,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,UAAmC;AAAA,IACvC,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,eACE,OAAQ,OAAmC,kBAAkB,YAC5D,OAAmC,gBAC/B,OAAmC,gBACpC;AAAA,EACR;AAEA,QAAM,aAAa,OAAO;AAC1B,SAAO;AACT;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { z } from 'zod'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { CrudForm, type CrudField } from '@open-mercato/ui/backend/CrudForm'\nimport { createCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { upsertCustomEntitySchema } from '@open-mercato/core/modules/entities/data/validators'\nimport { useRouter } from 'next/navigation'\nimport { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { LoadingMessage } from '@open-mercato/ui/backend/detail'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\n\nconst schema = upsertCustomEntitySchema\n\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\n\nexport default function CreateEntityPage() {\n  const t = useT()\n  const router = useRouter()\n  // Pre-fill the restriction toggle from the tenant default-restricted policy so\n  // the form reflects the workspace posture; null while loading.\n  const [defaultRestricted, setDefaultRestricted] = React.useState<boolean | null>(null)\n  React.useEffect(() => {\n    let active = true\n    ;(async () => {\n      try {\n        const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(\n          '/api/entities/entity-settings',\n          undefined,\n          {\n            errorMessage: t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'),\n            fallback: { newEntitiesRestrictedByDefault: false },\n          },\n        )\n        if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)\n      } catch {\n        flash(t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'), 'warning')\n        if (active) setDefaultRestricted(false)\n      }\n    })()\n    return () => { active = false }\n  }, [t])\n  const fields = React.useMemo<CrudField[]>(() => ([\n    {\n      id: 'entityId',\n      label: t('entities.userEntities.form.entityId.label', 'Entity ID'),\n      type: 'text',\n      required: true,\n      placeholder: t('entities.userEntities.form.entityId.placeholder', 'module_name:entity_id'),\n    },\n    { id: 'label', label: t('entities.userEntities.form.label.label', 'Label'), type: 'text', required: true },\n    { id: 'description', label: t('entities.userEntities.form.description.label', 'Description'), type: 'textarea' },\n    {\n      id: 'defaultEditor',\n      label: t('entities.userEntities.form.defaultEditor.label', 'Default Editor (multiline)'),\n      type: 'select',\n      options: [\n        { value: '', label: t('entities.userEntities.form.defaultEditor.options.default', 'Default (Markdown)') },\n        { value: 'markdown', label: t('entities.userEntities.form.defaultEditor.options.markdown', 'Markdown (UIW)') },\n        { value: 'simpleMarkdown', label: t('entities.userEntities.form.defaultEditor.options.simpleMarkdown', 'Simple Markdown') },\n        { value: 'htmlRichText', label: t('entities.userEntities.form.defaultEditor.options.htmlRichText', 'HTML Rich Text') },\n        { value: 'plain', label: t('entities.userEntities.form.defaultEditor.options.plain', 'Plain textarea') },\n      ],\n    } as unknown as CrudField,\n    { id: 'showInSidebar', label: t('entities.userEntities.form.showInSidebar.label', 'Show in sidebar'), type: 'checkbox' } as CrudField,\n    {\n      id: 'accessRestricted',\n      label: t('entities.userEntities.form.accessRestricted.label', 'Restrict record access'),\n      type: 'checkbox',\n      description: t('entities.userEntities.form.accessRestricted.help', 'Require an explicit per-entity permission to view or manage this entity\u2019s records. Leave off to allow anyone with the general records permission.'),\n    } as CrudField,\n  ]), [t])\n\n  if (defaultRestricted === null) {\n    return (\n      <Page>\n        <PageBody>\n          <LoadingMessage label={t('entities.userEntities.form.loading', 'Loading\u2026')} />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={t('entities.userEntities.form.title', 'Create Entity')}\n          backHref=\"/backend/entities/user\"\n          schema={schema}\n          fields={fields}\n          initialValues={{ entityId: 'user:your_entity', label: '', showInSidebar: false, accessRestricted: defaultRestricted }}\n          submitLabel={t('entities.userEntities.form.submit', 'Create')}\n          cancelHref=\"/backend/entities/user\"\n          onSubmit={async (vals) => {\n            const entityId = await submitCreateEntity({\n              values: vals as Record<string, unknown>,\n              messages: {\n                entityIdRequired: t('entities.userEntities.errors.entityIdRequired', 'Entity ID is required'),\n                entityIdExists: t('entities.userEntities.errors.entityIdExists', 'Entity ID already exists'),\n                loadFailed: t('entities.userEntities.errors.loadFailed', 'Failed to load entities'),\n              },\n            })\n            try {\n              window.dispatchEvent(new Event('om:refresh-sidebar'))\n            } catch {}\n            const successMessage = t('entities.userEntities.flash.created', 'Entity created')\n            pushWithFlash(router, `/backend/entities/user/${encodeURIComponent(entityId)}`, successMessage, 'success')\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\ntype EntityListEntry = {\n  entityId?: string\n  source?: string\n}\n\ntype FetchCustomEntities = (errorMessage?: string) => Promise<EntityListEntry[]>\n\nasync function defaultFetchCustomEntities(errorMessage?: string): Promise<EntityListEntry[]> {\n  const data = await readApiResultOrThrow<{ items?: EntityListEntry[] }>(\n    '/api/entities/entities',\n    undefined,\n    { errorMessage: errorMessage ?? 'Failed to load entities', fallback: { items: [] } },\n  )\n  return Array.isArray(data?.items) ? data.items! : []\n}\n\ntype CreateEntityRequest = (payload: Record<string, unknown>) => Promise<void>\n\nasync function defaultCreateEntityRequest(payload: Record<string, unknown>) {\n  await createCrud('entities/entities', payload)\n}\n\nexport async function submitCreateEntity(options: {\n  values: Record<string, unknown>\n  fetchEntities?: FetchCustomEntities\n  createEntity?: CreateEntityRequest\n  messages?: {\n    entityIdRequired?: string\n    entityIdExists?: string\n    loadFailed?: string\n  }\n}): Promise<string> {\n  const {\n    values,\n    fetchEntities = defaultFetchCustomEntities,\n    createEntity = defaultCreateEntityRequest,\n    messages,\n  } = options\n  const rawEntityId = typeof values.entityId === 'string' ? values.entityId.trim() : ''\n  if (!rawEntityId) {\n    const message = messages?.entityIdRequired ?? 'Entity ID is required'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const existing = await fetchEntities(messages?.loadFailed)\n  const exists = existing.some(\n    (entry) => entry?.entityId === rawEntityId && (entry?.source === 'custom' || entry?.source === undefined),\n  )\n  if (exists) {\n    const message = messages?.entityIdExists ?? 'Entity ID already exists'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const payload: Record<string, unknown> = {\n    ...values,\n    entityId: rawEntityId,\n    labelField: 'name',\n    defaultEditor:\n      typeof (values as Record<string, unknown>).defaultEditor === 'string' &&\n      (values as Record<string, unknown>).defaultEditor\n        ? (values as Record<string, unknown>).defaultEditor\n        : undefined,\n  }\n\n  await createEntity(payload)\n  return rawEntityId\n}\n"],
+  "mappings": ";AA+EU;AA9EV,YAAY,WAAW;AAEvB,SAAS,YAAY;AACrB,SAAS,gBAAgC;AACzC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,aAAa;AAEtB,MAAM,SAAS;AAEf,SAAS,MAAM,gBAAgB;AAEhB,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AAGzB,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAyB,IAAI;AACrF,QAAM,UAAU,MAAM;AACpB,QAAI,SAAS;AACZ,KAAC,YAAY;AACZ,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA,UACA;AAAA,YACE,cAAc,EAAE,mDAAmD,0DAA0D;AAAA,YAC7H,UAAU,EAAE,gCAAgC,MAAM;AAAA,UACpD;AAAA,QACF;AACA,YAAI,OAAQ,sBAAqB,MAAM,mCAAmC,IAAI;AAAA,MAChF,QAAQ;AACN,cAAM,EAAE,mDAAmD,0DAA0D,GAAG,SAAS;AACjI,YAAI,OAAQ,sBAAqB,KAAK;AAAA,MACxC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AAAE,eAAS;AAAA,IAAM;AAAA,EAChC,GAAG,CAAC,CAAC,CAAC;AACN,QAAM,SAAS,MAAM,QAAqB,MAAO;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,6CAA6C,WAAW;AAAA,MACjE,MAAM;AAAA,MACN,UAAU;AAAA,MACV,aAAa,EAAE,mDAAmD,uBAAuB;AAAA,IAC3F;AAAA,IACA,EAAE,IAAI,SAAS,OAAO,EAAE,0CAA0C,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,IACzG,EAAE,IAAI,eAAe,OAAO,EAAE,gDAAgD,aAAa,GAAG,MAAM,WAAW;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,kDAAkD,4BAA4B;AAAA,MACvF,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,4DAA4D,oBAAoB,EAAE;AAAA,QACxG,EAAE,OAAO,YAAY,OAAO,EAAE,6DAA6D,gBAAgB,EAAE;AAAA,QAC7G,EAAE,OAAO,kBAAkB,OAAO,EAAE,mEAAmE,iBAAiB,EAAE;AAAA,QAC1H,EAAE,OAAO,gBAAgB,OAAO,EAAE,iEAAiE,gBAAgB,EAAE;AAAA,QACrH,EAAE,OAAO,SAAS,OAAO,EAAE,0DAA0D,gBAAgB,EAAE;AAAA,MACzG;AAAA,IACF;AAAA,IACA,EAAE,IAAI,iBAAiB,OAAO,EAAE,kDAAkD,iBAAiB,GAAG,MAAM,WAAW;AAAA,IACvH;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qDAAqD,wBAAwB;AAAA,MACtF,MAAM;AAAA,MACN,aAAa,EAAE,oDAAoD,wJAAmJ;AAAA,IACxN;AAAA,EACF,GAAI,CAAC,CAAC,CAAC;AAEP,MAAI,sBAAsB,MAAM;AAC9B,WACE,oBAAC,QACC,8BAAC,YACC,8BAAC,kBAAe,OAAO,EAAE,sCAAsC,eAAU,GAAG,GAC9E,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,eAAe;AAAA,MAC5D,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,eAAe,EAAE,UAAU,oBAAoB,OAAO,IAAI,eAAe,OAAO,kBAAkB,kBAAkB;AAAA,MACpH,aAAa,EAAE,qCAAqC,QAAQ;AAAA,MAC5D,YAAW;AAAA,MACX,UAAU,OAAO,SAAS;AACxB,cAAM,WAAW,MAAM,mBAAmB;AAAA,UACxC,QAAQ;AAAA,UACR,UAAU;AAAA,YACR,kBAAkB,EAAE,iDAAiD,uBAAuB;AAAA,YAC5F,gBAAgB,EAAE,+CAA+C,0BAA0B;AAAA,YAC3F,YAAY,EAAE,2CAA2C,yBAAyB;AAAA,UACpF;AAAA,QACF,CAAC;AACD,YAAI;AACF,iBAAO,cAAc,IAAI,MAAM,oBAAoB,CAAC;AAAA,QACtD,QAAQ;AAAA,QAAC;AACT,cAAM,iBAAiB,EAAE,uCAAuC,gBAAgB;AAChF,sBAAc,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,IAAI,gBAAgB,SAAS;AAAA,MAC3G;AAAA;AAAA,EACF,GACF,GACF;AAEJ;AASA,eAAe,2BAA2B,cAAmD;AAC3F,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,cAAc,gBAAgB,2BAA2B,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EACrF;AACA,SAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAS,CAAC;AACrD;AAIA,eAAe,2BAA2B,SAAkC;AAC1E,QAAM,WAAW,qBAAqB,OAAO;AAC/C;AAEA,eAAsB,mBAAmB,SASrB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AACJ,QAAM,cAAc,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,KAAK,IAAI;AACnF,MAAI,CAAC,aAAa;AAChB,UAAM,UAAU,UAAU,oBAAoB;AAC9C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,WAAW,MAAM,cAAc,UAAU,UAAU;AACzD,QAAM,SAAS,SAAS;AAAA,IACtB,CAAC,UAAU,OAAO,aAAa,gBAAgB,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EACjG;AACA,MAAI,QAAQ;AACV,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,UAAmC;AAAA,IACvC,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,eACE,OAAQ,OAAmC,kBAAkB,YAC5D,OAAmC,gBAC/B,OAAmC,gBACpC;AAAA,EACR;AAEA,QAAM,aAAa,OAAO;AAC1B,SAAO;AACT;",
   "names": []
 }

package/dist/modules/entities/cli.js

@@ -22,6 +22,7 @@ import {
   parseDecryptedFieldValue
 } from "@open-mercato/shared/lib/encryption/tenantDataEncryptionService";
 import { resolveEntityIdFromMetadata } from "@open-mercato/shared/lib/encryption/entityIds";
+import { listEntityMetadata } from "@open-mercato/shared/lib/db/entityMetadata";
 import { Organization } from "../directory/data/entities.js";
 import crypto from "node:crypto";
 function parseArgs(rest) {
@@ -248,8 +249,17 @@ function resolveEncryptionMapModules() {
     return [];
   }
 }
+function getSystemScopedEntityIds() {
+  return new Set(
+    getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === "system").map((map) => map.entityId)
+  );
+}
 async function upsertEncryptionMaps(em, tenantId, organizationId, logger) {
   for (const spec of getDefaultEncryptionMaps(resolveEncryptionMapModules())) {
+    if (spec.keyScope === "system") {
+      logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`);
+      continue;
+    }
     const existing = await em.findOne(EncryptionMap, {
       entityId: spec.entityId,
       tenantId,
@@ -344,9 +354,7 @@ function resolveProperty(meta, field) {
   return { columnName: null, prop: null };
 }
 function buildEntityMetaRegistry(em) {
-  const registry = em?.getMetadata?.();
-  const allMetaRaw = typeof registry?.getAll === "function" ? registry.getAll() : [];
-  const allMeta = Array.isArray(allMetaRaw) ? allMetaRaw : Object.values(allMetaRaw ?? {});
+  const allMeta = listEntityMetadata(em);
   const metaByEntityId = /* @__PURE__ */ new Map();
   for (const meta of allMeta) {
     const resolved = resolveEntityIdFromMetadata(meta);
@@ -368,6 +376,19 @@ function resolveMapMeta(map, metaByEntityId, warn = () => {
   if (!tenantId) return null;
   return { entityId, meta, fields, tenantId };
 }
+function isEncryptedPayload(value) {
+  if (typeof value !== "string") return false;
+  const parts = value.split(":");
+  return parts.length === 4 && parts[3] === "v1";
+}
+function formatValueForColumn(prop, value) {
+  if (value === null || value === void 0) return value;
+  const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : [];
+  const type = String(prop?.type ?? "").toLowerCase();
+  const isJson = types.some((entry) => entry.toLowerCase().includes("json")) || type === "json" || type === "jsonb";
+  if (!isJson) return value;
+  return JSON.stringify(value);
+}
 const rotateEncryptionKey = {
   command: "rotate-encryption-key",
   async run(rest) {
@@ -420,28 +441,23 @@ const rotateEncryptionKey = {
         console.log("[rotate-encryption-key] dek fingerprints skipped (no tenantId)");
       }
     }
-    const isEncryptedPayload = (value) => {
-      if (typeof value !== "string") return false;
-      const parts = value.split(":");
-      return parts.length === 4 && parts[3] === "v1";
-    };
     const metaByEntityId = buildEntityMetaRegistry(em);
     const where = { deletedAt: null };
     if (tenantIdArg) where.tenantId = tenantIdArg;
     if (organizationIdArg) where.organizationId = organizationIdArg;
-    const maps = await em.find(EncryptionMap, where);
+    const allMaps = await em.find(EncryptionMap, where);
+    const systemScopedEntityIds = getSystemScopedEntityIds();
+    const maps = allMaps.filter((map) => {
+      if (!systemScopedEntityIds.has(String(map.entityId))) return true;
+      console.warn(
+        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key and cannot be rotated with a tenant key \u2014 use "mercato entities backfill-system-encryption" instead.`
+      );
+      return false;
+    });
     if (!maps.length) {
       console.log("No encryption maps found for the selected scope.");
       return;
     }
-    const formatValueForColumn = (prop, value) => {
-      if (value === null || value === void 0) return value;
-      const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : [];
-      const type = String(prop?.type ?? "").toLowerCase();
-      const isJson = types.some((entry) => entry.toLowerCase().includes("json")) || type === "json" || type === "jsonb";
-      if (!isJson) return value;
-      return JSON.stringify(value);
-    };
     const resolveScopes = async (tenantId, organizationId) => {
       if (organizationId) return [{ tenantId, organizationId }];
       const orgs = await em.find(Organization, { tenant: tenantId });
@@ -626,7 +642,15 @@ const decryptDatabase = {
     const mapWhere = { tenantId: tenantIdArg, deletedAt: null, isActive: true };
     if (organizationIdArg) mapWhere.organizationId = organizationIdArg;
     if (entityIdArg) mapWhere.entityId = entityIdArg;
-    const maps = await em.find(EncryptionMap, mapWhere);
+    const allMaps = await em.find(EncryptionMap, mapWhere);
+    const systemScopedEntityIds = getSystemScopedEntityIds();
+    const maps = allMaps.filter((map) => {
+      if (!systemScopedEntityIds.has(String(map.entityId))) return true;
+      console.warn(
+        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key that the tenant DEK cannot open, so this command leaves it untouched.`
+      );
+      return false;
+    });
     if (!maps.length) {
       console.log("No active encryption maps found for the selected scope.");
       return;
@@ -894,7 +918,157 @@ ${prefix}Decryption summary:`);
     }
   }
 };
-var cli_default = [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase];
+const backfillSystemEncryption = {
+  command: "backfill-system-encryption",
+  async run(rest) {
+    const args = parseArgs(rest);
+    const entityIdArg = args.entity || null;
+    const dryRun = Boolean(args["dry-run"] || args.dry);
+    const batchSize = Math.max(1, parseInt(String(args["batch-size"] || args.batchSize || "500"), 10) || 500);
+    const debug = Boolean(args.debug);
+    if (!isTenantDataEncryptionEnabled()) {
+      console.error("TENANT_DATA_ENCRYPTION is disabled; aborting. Enable encryption before backfilling.");
+      return;
+    }
+    const systemMaps = getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === "system");
+    if (!systemMaps.length) {
+      console.log("No system-scoped encryption maps are declared by the installed modules. Nothing to backfill.");
+      return;
+    }
+    const selectedMaps = entityIdArg ? systemMaps.filter((map) => map.entityId === entityIdArg) : systemMaps;
+    if (!selectedMaps.length) {
+      console.error(`No system-scoped encryption map declared for entity "${entityIdArg}".`);
+      console.error(`Known system-scoped entities: ${systemMaps.map((map) => map.entityId).join(", ")}`);
+      return;
+    }
+    const { resolve } = await createRequestContainer();
+    const em = resolve("em");
+    const conn = em?.getConnection?.();
+    if (!conn || typeof conn.execute !== "function") {
+      console.error("Unable to access raw database connection; aborting.");
+      return;
+    }
+    const encryptionService = new TenantDataEncryptionService(em, {
+      kms: createKmsService(),
+      defaultEncryptionMaps: systemMaps
+    });
+    if (!encryptionService.isEnabled()) {
+      console.error("Encryption service is not enabled (KMS unhealthy). Aborting without touching any row.");
+      return;
+    }
+    const metaByEntityId = buildEntityMetaRegistry(em);
+    const prefix = dryRun ? "[dry-run] " : "";
+    let totalRowsScanned = 0;
+    let totalRowsUpdated = 0;
+    let totalRowsUnchanged = 0;
+    for (const map of selectedMaps) {
+      const entityId = map.entityId;
+      const meta = metaByEntityId.get(entityId);
+      if (!meta) {
+        console.warn(`Skipping ${entityId}: entity metadata not found (is the owning module enabled?).`);
+        continue;
+      }
+      const tableName = meta?.tableName;
+      if (!tableName) {
+        console.warn(`Skipping ${entityId}: entity has no table name.`);
+        continue;
+      }
+      const primaryKey = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : "id";
+      const { columnName: primaryKeyColumn } = resolveProperty(meta, primaryKey);
+      const pkColumn = primaryKeyColumn ?? primaryKey;
+      const qualifiedTable = meta?.schema ? `"${meta.schema}"."${tableName}"` : `"${tableName}"`;
+      const columns = /* @__PURE__ */ new Set([pkColumn]);
+      for (const rule of map.fields) {
+        const resolved = resolveProperty(meta, rule.field);
+        if (resolved.columnName) columns.add(resolved.columnName);
+        if (rule.hashField) {
+          const resolvedHash = resolveProperty(meta, rule.hashField);
+          if (resolvedHash.columnName) columns.add(resolvedHash.columnName);
+        }
+      }
+      const columnList = Array.from(columns);
+      const selectList = columnList.map((column) => `"${column}"`).join(", ");
+      let cursor = null;
+      let entityRowsScanned = 0;
+      let entityRowsUpdated = 0;
+      let entityRowsUnchanged = 0;
+      for (; ; ) {
+        const selectSql = cursor === null ? `select ${selectList} from ${qualifiedTable} order by "${pkColumn}" asc limit ?` : `select ${selectList} from ${qualifiedTable} where "${pkColumn}" > ? order by "${pkColumn}" asc limit ?`;
+        const params = cursor === null ? [batchSize] : [cursor, batchSize];
+        const rows = await conn.execute(selectSql, params);
+        const list = Array.isArray(rows) ? rows : [];
+        if (!list.length) break;
+        for (const row of list) {
+          entityRowsScanned += 1;
+          cursor = row[pkColumn];
+          const payload = {};
+          let hasPlaintext = false;
+          for (const rule of map.fields) {
+            const resolved = resolveProperty(meta, rule.field);
+            if (!resolved.columnName) continue;
+            const rawValue = row[resolved.columnName];
+            payload[rule.field] = rawValue;
+            if (rawValue !== null && rawValue !== void 0 && !isEncryptedPayload(rawValue)) hasPlaintext = true;
+            if (rule.hashField) {
+              const resolvedHash = resolveProperty(meta, rule.hashField);
+              if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName];
+            }
+          }
+          if (!hasPlaintext) continue;
+          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null);
+          const updates = {};
+          for (const rule of map.fields) {
+            const resolved = resolveProperty(meta, rule.field);
+            if (resolved.columnName) {
+              const nextValue = encrypted[rule.field];
+              if (nextValue !== void 0 && nextValue !== row[resolved.columnName]) {
+                updates[resolved.columnName] = formatValueForColumn(resolved.prop, nextValue);
+              }
+            }
+            if (rule.hashField) {
+              const resolvedHash = resolveProperty(meta, rule.hashField);
+              const nextHash = encrypted[rule.hashField];
+              if (resolvedHash.columnName && nextHash !== void 0 && nextHash !== row[resolvedHash.columnName]) {
+                updates[resolvedHash.columnName] = formatValueForColumn(resolvedHash.prop, nextHash);
+              }
+            }
+          }
+          if (!Object.keys(updates).length) {
+            entityRowsUnchanged += 1;
+            if (debug) console.warn(`[backfill-system-encryption] ${entityId} ${String(row[pkColumn])}: plaintext left unchanged`);
+            continue;
+          }
+          if (!dryRun) {
+            const setSql = Object.keys(updates).map((column) => `"${column}" = ?`).join(", ");
+            await conn.execute(
+              `update ${qualifiedTable} set ${setSql} where "${pkColumn}" = ?`,
+              [...Object.values(updates), row[pkColumn]]
+            );
+          }
+          entityRowsUpdated += 1;
+        }
+        if (list.length < batchSize) break;
+      }
+      totalRowsScanned += entityRowsScanned;
+      totalRowsUpdated += entityRowsUpdated;
+      totalRowsUnchanged += entityRowsUnchanged;
+      console.log(`${prefix}${entityId}: scanned ${entityRowsScanned}, encrypted ${entityRowsUpdated}`);
+    }
+    console.log(`
+${prefix}Backfill summary:`);
+    console.log(`  Rows scanned:   ${totalRowsScanned}`);
+    console.log(`  Rows encrypted: ${totalRowsUpdated}`);
+    if (totalRowsUnchanged > 0) {
+      console.warn(
+        `  \u26A0 ${totalRowsUnchanged} row(s) held plaintext that could not be encrypted \u2014 the system DEK was unavailable. Verify the KMS/fallback key, then re-run (use --debug to list the rows).`
+      );
+    }
+    if (!dryRun && totalRowsUpdated > 0) {
+      console.log("\n\u2705 Backfill complete. Re-run with --dry-run to confirm no plaintext rows remain.");
+    }
+  }
+};
+var cli_default = [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase, backfillSystemEncryption];
 export {
   cli_default as default
 };