@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/audit_logs/components/AuditLogsActions.js

@@ -1,6 +1,7 @@
 "use client";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
+import { extensionPoints } from "@open-mercato/core/modules/audit_logs/extension-points";
 import { DataTable } from "@open-mercato/ui/backend/DataTable";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { apiCallOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
@@ -195,7 +196,7 @@ function AuditLogsActions({
   ] }) : void 0;
   const showSelfOnlyHint = !permissions.isLoading && !permissions.canViewTenant && !!permissions.currentUserId;
   return /* @__PURE__ */ jsxs(Fragment, { children: [
-    showSelfOnlyHint ? /* @__PURE__ */ jsx(Alert, { variant: "info", className: "mb-4", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("audit_logs.hint.view_self_only", "Showing only your own changes. Contact an administrator for broader access.") }) }) : null,
+    showSelfOnlyHint ? /* @__PURE__ */ jsx(Alert, { status: "information", className: "mb-4", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("audit_logs.hint.view_self_only", "Showing only your own changes. Contact an administrator for broader access.") }) }) : null,
     /* @__PURE__ */ jsx(
       DataTable,
       {
@@ -203,7 +204,7 @@ function AuditLogsActions({
         data: actionItems,
         columns,
         actions: combinedActions,
-        perspective: { tableId: "audit_logs.actions.list" },
+        perspective: { tableId: extensionPoints.hosts.actionsTable.tableId },
         isLoading: Boolean(isLoading) || Boolean(undoingToken) || Boolean(redoingId),
         onRowClick: (item) => setSelected(item),
         pagination

package/dist/modules/audit_logs/components/AuditLogsActions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/components/AuditLogsActions.tsx"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { DataTable, type PaginationProps } from '@open-mercato/ui/backend/DataTable'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { ActionLogDetailsDialog } from './ActionLogDetailsDialog'\nimport { Undo2, RotateCcw } from 'lucide-react'\nimport { markRedoConsumed, markUndoSuccess } from '@open-mercato/ui/backend/operations/store'\nimport { useAuditPermissions, canUndoEntry, canRedoEntry } from '@open-mercato/ui/backend/version-history'\nimport { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'AuditLogsActions' })\n\nexport type ActionLogItem = {\n  id: string\n  commandId: string\n  actionLabel: string | null\n  executionState: string\n  actorUserId: string | null\n  actorUserName: string | null\n  tenantId: string | null\n  tenantName: string | null\n  organizationId: string | null\n  organizationName: string | null\n  resourceKind: string | null\n  resourceId: string | null\n  undoToken: string | null\n  createdAt: string\n  updatedAt: string\n  snapshotBefore?: unknown | null\n  snapshotAfter?: unknown | null\n  changes?: Record<string, unknown> | null\n  context?: Record<string, unknown> | null\n}\n\nexport function AuditLogsActions({\n  items,\n  onRefresh,\n  isLoading,\n  headerExtras,\n  onUndoError,\n  onRedoError,\n  pagination,\n}: {\n  items: ActionLogItem[] | undefined\n  onRefresh: () => Promise<void>\n  isLoading?: boolean\n  headerExtras?: React.ReactNode\n  onUndoError?: () => void\n  onRedoError?: () => void\n  pagination?: PaginationProps\n}) {\n  const t = useT()\n  const permissions = useAuditPermissions(true)\n  const [undoingToken, setUndoingToken] = React.useState<string | null>(null)\n  const [redoingId, setRedoingId] = React.useState<string | null>(null)\n  const [selected, setSelected] = React.useState<ActionLogItem | null>(null)\n  const actionItems = Array.isArray(items) ? items : []\n  const latestUndoable = React.useMemo(() => actionItems.find((item) => !!item.undoToken && item.executionState === 'done'), [actionItems])\n  const noneLabel = t('audit_logs.common.none')\n  const latestPerResource = React.useMemo(() => {\n    const map = new Map<string, string>()\n    let fallback: string | null = null\n    for (const item of actionItems) {\n      if (!item.undoToken || item.executionState !== 'done') continue\n      const key = buildResourceKey(item)\n      if (key) {\n        if (!map.has(key)) map.set(key, item.id)\n      } else if (!fallback) {\n        fallback = item.id\n      }\n    }\n    return { map, fallback }\n  }, [actionItems])\n  const latestUndoneId = React.useMemo(() => {\n    const undone = actionItems.filter((item) => item.executionState === 'undone')\n    if (!undone.length) return null\n    const sorted = [...undone].sort((a, b) => {\n      const aTs = Date.parse(a.updatedAt)\n      const bTs = Date.parse(b.updatedAt)\n      return (Number.isFinite(bTs) ? bTs : 0) - (Number.isFinite(aTs) ? aTs : 0)\n    })\n    return sorted[0]?.id ?? null\n  }, [actionItems])\n\n  const isLatestUndoableForItem = React.useCallback((item: ActionLogItem) => {\n    const key = buildResourceKey(item)\n    if (key) return latestPerResource.map.get(key) === item.id\n    return latestPerResource.fallback === item.id\n  }, [latestPerResource])\n\n  const isRedoCandidate = React.useCallback((item: ActionLogItem) => item.executionState === 'undone' && latestUndoneId === item.id, [latestUndoneId])\n\n  const handleUndo = React.useCallback(async (token: string | null) => {\n    if (!token) return\n    setUndoingToken(token)\n    try {\n      await apiCallOrThrow('/api/audit_logs/audit-logs/actions/undo', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ undoToken: token }),\n      }, { errorMessage: t('audit_logs.error.undo') })\n      markUndoSuccess(token)\n      await onRefresh()\n    } catch (err) {\n      logger.error('Undo action failed', { err })\n      onUndoError?.()\n    } finally {\n      setUndoingToken(null)\n    }\n  }, [onRefresh, onUndoError, t])\n\n  const handleRedo = React.useCallback(async (logId: string | null) => {\n    if (!logId) return\n    setRedoingId(logId)\n    try {\n      await apiCallOrThrow('/api/audit_logs/audit-logs/actions/redo', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ logId }),\n      }, { errorMessage: t('audit_logs.error.redo') })\n      markRedoConsumed(logId)\n      await onRefresh()\n    } catch (err) {\n      logger.error('Redo action failed', { err })\n      onRedoError?.()\n    } finally {\n      setRedoingId(null)\n    }\n  }, [onRefresh, onRedoError, t])\n\n  const columns = React.useMemo<ColumnDef<ActionLogItem, any>[]>(() => [\n    {\n      accessorKey: 'actionLabel',\n      header: t('audit_logs.actions.columns.action'),\n      cell: (info) => info.row.original.actionLabel || info.row.original.commandId,\n    },\n    {\n      accessorKey: 'resourceKind',\n      header: t('audit_logs.actions.columns.resource'),\n      cell: (info) => formatResource(info.row.original, noneLabel),\n    },\n    {\n      accessorKey: 'actorUserId',\n      header: t('audit_logs.actions.columns.user'),\n      cell: (info) => info.row.original.actorUserName || info.getValue() || noneLabel,\n      meta: { priority: 3 },\n    },\n    {\n      accessorKey: 'tenantId',\n      header: t('audit_logs.actions.columns.tenant'),\n      cell: (info) => info.row.original.tenantName || info.getValue() || noneLabel,\n      meta: { priority: 4 },\n    },\n    {\n      accessorKey: 'organizationId',\n      header: t('audit_logs.actions.columns.organization'),\n      cell: (info) => info.row.original.organizationName || info.getValue() || noneLabel,\n      meta: { priority: 4 },\n    },\n    {\n      accessorKey: 'createdAt',\n      header: t('audit_logs.actions.columns.when'),\n      cell: (info) => formatDate(info.getValue() as string),\n    },\n    {\n      accessorKey: 'executionState',\n      header: t('audit_logs.actions.columns.status'),\n    },\n    {\n      id: 'controls',\n      header: t('audit_logs.actions.columns.controls'),\n      enableSorting: false,\n      cell: (info) => {\n        const item = info.row.original\n        const itemCanUndo = canUndoEntry(permissions, item.actorUserId)\n        const itemCanRedo = canRedoEntry(permissions, item.actorUserId)\n        const canUndo = itemCanUndo && Boolean(item.undoToken) && item.executionState === 'done' && isLatestUndoableForItem(item)\n        const showRedo = itemCanRedo && item.executionState === 'undone'\n        const canRedo = showRedo && isRedoCandidate(item)\n        if (!canUndo && !showRedo) return null\n        return (\n          <div className=\"flex justify-end gap-1\">\n            {canUndo ? (\n              <Button\n                variant=\"ghost\"\n                size=\"icon\"\n                aria-label={t('audit_logs.actions.undo')}\n                onClick={() => { void handleUndo(item.undoToken) }}\n                disabled={undoingToken === item.undoToken || Boolean(redoingId)}\n              >\n                <Undo2 className=\"size-4\" aria-hidden=\"true\" />\n              </Button>\n            ) : null}\n            {showRedo ? (\n              <Button\n                variant=\"ghost\"\n                size=\"icon\"\n                aria-label={t('audit_logs.actions.redo')}\n                onClick={() => { void handleRedo(item.id) }}\n                disabled={!canRedo || redoingId === item.id || Boolean(undoingToken)}\n              >\n                <RotateCcw className=\"size-4\" aria-hidden=\"true\" />\n              </Button>\n            ) : null}\n          </div>\n        )\n      },\n      meta: { align: 'right' },\n    },\n  ], [t, noneLabel, handleUndo, handleRedo, isLatestUndoableForItem, isRedoCandidate, undoingToken, redoingId, permissions])\n\n  const undoButton = latestUndoable?.undoToken && canUndoEntry(permissions, latestUndoable.actorUserId) ? (\n    <Button\n      variant=\"secondary\"\n      size=\"sm\"\n      onClick={() => { void handleUndo(latestUndoable.undoToken) }}\n      disabled={Boolean(undoingToken) || Boolean(redoingId)}\n    >\n      {undoingToken ? t('audit_logs.actions.undoing') : t('audit_logs.actions.undo')}\n    </Button>\n  ) : null\n\n  const combinedActions = undoButton || headerExtras\n    ? <div className=\"flex items-center gap-2\">{headerExtras}{undoButton}</div>\n    : undefined\n\n  const showSelfOnlyHint = !permissions.isLoading && !permissions.canViewTenant && !!permissions.currentUserId\n\n  return (\n    <>\n      {showSelfOnlyHint ? (\n        <Alert variant=\"info\" className=\"mb-4\">\n          <AlertDescription>\n            {t('audit_logs.hint.view_self_only', 'Showing only your own changes. Contact an administrator for broader access.')}\n          </AlertDescription>\n        </Alert>\n      ) : null}\n      <DataTable<ActionLogItem>\n        title={t('audit_logs.actions.title')}\n        data={actionItems}\n        columns={columns}\n        actions={combinedActions}\n        perspective={{ tableId: 'audit_logs.actions.list' }}\n        isLoading={Boolean(isLoading) || Boolean(undoingToken) || Boolean(redoingId)}\n        onRowClick={(item) => setSelected(item)}\n        pagination={pagination}\n      />\n      {selected ? (\n        <ActionLogDetailsDialog\n          item={selected}\n          onClose={() => setSelected(null)}\n        />\n      ) : null}\n    </>\n  )\n}\n\nfunction formatResource(item: { resourceKind?: string | null; resourceId?: string | null }, fallback: string) {\n  if (!item.resourceKind && !item.resourceId) return fallback\n  return [item.resourceKind, item.resourceId].filter(Boolean).join(' \u00B7 ')\n}\n\nfunction buildResourceKey(item: { resourceKind?: string | null; resourceId?: string | null }) {\n  const kind = typeof item.resourceKind === 'string' ? item.resourceKind.trim() : ''\n  const id = typeof item.resourceId === 'string' ? item.resourceId.trim() : ''\n  if (!kind && !id) return null\n  return `${kind}::${id}`\n}\n\nfunction formatDate(value: string) {\n  const date = new Date(value)\n  if (Number.isNaN(date.getTime())) return value\n  return new Intl.DateTimeFormat(undefined, {\n    dateStyle: 'medium',\n    timeStyle: 'short',\n  }).format(date)\n}\n"],
-  "mappings": ";AA0LU,SAgDN,UAvCY,KATN;AAxLV,YAAY,WAAW;AAEvB,SAAS,iBAAuC;AAChD,SAAS,cAAc;AACvB,SAAS,sBAAsB;AAC/B,SAAS,YAAY;AACrB,SAAS,8BAA8B;AACvC,SAAS,OAAO,iBAAiB;AACjC,SAAS,kBAAkB,uBAAuB;AAClD,SAAS,qBAAqB,cAAc,oBAAoB;AAChE,SAAS,OAAO,wBAAwB;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,mBAAmB,CAAC;AAwB1E,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAQG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,oBAAoB,IAAI;AAC5C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAwB,IAAI;AAC1E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwB,IAAI;AACpE,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAA+B,IAAI;AACzE,QAAM,cAAc,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACpD,QAAM,iBAAiB,MAAM,QAAQ,MAAM,YAAY,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,aAAa,KAAK,mBAAmB,MAAM,GAAG,CAAC,WAAW,CAAC;AACxI,QAAM,YAAY,EAAE,wBAAwB;AAC5C,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,UAAM,MAAM,oBAAI,IAAoB;AACpC,QAAI,WAA0B;AAC9B,eAAW,QAAQ,aAAa;AAC9B,UAAI,CAAC,KAAK,aAAa,KAAK,mBAAmB,OAAQ;AACvD,YAAM,MAAM,iBAAiB,IAAI;AACjC,UAAI,KAAK;AACP,YAAI,CAAC,IAAI,IAAI,GAAG,EAAG,KAAI,IAAI,KAAK,KAAK,EAAE;AAAA,MACzC,WAAW,CAAC,UAAU;AACpB,mBAAW,KAAK;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,KAAK,SAAS;AAAA,EACzB,GAAG,CAAC,WAAW,CAAC;AAChB,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,UAAM,SAAS,YAAY,OAAO,CAAC,SAAS,KAAK,mBAAmB,QAAQ;AAC5E,QAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,UAAM,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AACxC,YAAM,MAAM,KAAK,MAAM,EAAE,SAAS;AAClC,YAAM,MAAM,KAAK,MAAM,EAAE,SAAS;AAClC,cAAQ,OAAO,SAAS,GAAG,IAAI,MAAM,MAAM,OAAO,SAAS,GAAG,IAAI,MAAM;AAAA,IAC1E,CAAC;AACD,WAAO,OAAO,CAAC,GAAG,MAAM;AAAA,EAC1B,GAAG,CAAC,WAAW,CAAC;AAEhB,QAAM,0BAA0B,MAAM,YAAY,CAAC,SAAwB;AACzE,UAAM,MAAM,iBAAiB,IAAI;AACjC,QAAI,IAAK,QAAO,kBAAkB,IAAI,IAAI,GAAG,MAAM,KAAK;AACxD,WAAO,kBAAkB,aAAa,KAAK;AAAA,EAC7C,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,kBAAkB,MAAM,YAAY,CAAC,SAAwB,KAAK,mBAAmB,YAAY,mBAAmB,KAAK,IAAI,CAAC,cAAc,CAAC;AAEnJ,QAAM,aAAa,MAAM,YAAY,OAAO,UAAyB;AACnE,QAAI,CAAC,MAAO;AACZ,oBAAgB,KAAK;AACrB,QAAI;AACF,YAAM,eAAe,2CAA2C;AAAA,QAC9D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,WAAW,MAAM,CAAC;AAAA,MAC3C,GAAG,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC;AAC/C,sBAAgB,KAAK;AACrB,YAAM,UAAU;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,oBAAc;AAAA,IAChB,UAAE;AACA,sBAAgB,IAAI;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,WAAW,aAAa,CAAC,CAAC;AAE9B,QAAM,aAAa,MAAM,YAAY,OAAO,UAAyB;AACnE,QAAI,CAAC,MAAO;AACZ,iBAAa,KAAK;AAClB,QAAI;AACF,YAAM,eAAe,2CAA2C;AAAA,QAC9D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,MAChC,GAAG,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC;AAC/C,uBAAiB,KAAK;AACtB,YAAM,UAAU;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,oBAAc;AAAA,IAChB,UAAE;AACA,mBAAa,IAAI;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,WAAW,aAAa,CAAC,CAAC;AAE9B,QAAM,UAAU,MAAM,QAAyC,MAAM;AAAA,IACnE;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,eAAe,KAAK,IAAI,SAAS;AAAA,IACrE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,qCAAqC;AAAA,MAC/C,MAAM,CAAC,SAAS,eAAe,KAAK,IAAI,UAAU,SAAS;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,iBAAiB,KAAK,SAAS,KAAK;AAAA,MACtE,MAAM,EAAE,UAAU,EAAE;AAAA,IACtB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,cAAc,KAAK,SAAS,KAAK;AAAA,MACnE,MAAM,EAAE,UAAU,EAAE;AAAA,IACtB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,yCAAyC;AAAA,MACnD,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,oBAAoB,KAAK,SAAS,KAAK;AAAA,MACzE,MAAM,EAAE,UAAU,EAAE;AAAA,IACtB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,SAAS,WAAW,KAAK,SAAS,CAAW;AAAA,IACtD;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC;AAAA,IAC/C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,qCAAqC;AAAA,MAC/C,eAAe;AAAA,MACf,MAAM,CAAC,SAAS;AACd,cAAM,OAAO,KAAK,IAAI;AACtB,cAAM,cAAc,aAAa,aAAa,KAAK,WAAW;AAC9D,cAAM,cAAc,aAAa,aAAa,KAAK,WAAW;AAC9D,cAAM,UAAU,eAAe,QAAQ,KAAK,SAAS,KAAK,KAAK,mBAAmB,UAAU,wBAAwB,IAAI;AACxH,cAAM,WAAW,eAAe,KAAK,mBAAmB;AACxD,cAAM,UAAU,YAAY,gBAAgB,IAAI;AAChD,YAAI,CAAC,WAAW,CAAC,SAAU,QAAO;AAClC,eACE,qBAAC,SAAI,WAAU,0BACZ;AAAA,oBACC;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,cAAY,EAAE,yBAAyB;AAAA,cACvC,SAAS,MAAM;AAAE,qBAAK,WAAW,KAAK,SAAS;AAAA,cAAE;AAAA,cACjD,UAAU,iBAAiB,KAAK,aAAa,QAAQ,SAAS;AAAA,cAE9D,8BAAC,SAAM,WAAU,UAAS,eAAY,QAAO;AAAA;AAAA,UAC/C,IACE;AAAA,UACH,WACC;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,cAAY,EAAE,yBAAyB;AAAA,cACvC,SAAS,MAAM;AAAE,qBAAK,WAAW,KAAK,EAAE;AAAA,cAAE;AAAA,cAC1C,UAAU,CAAC,WAAW,cAAc,KAAK,MAAM,QAAQ,YAAY;AAAA,cAEnE,8BAAC,aAAU,WAAU,UAAS,eAAY,QAAO;AAAA;AAAA,UACnD,IACE;AAAA,WACN;AAAA,MAEJ;AAAA,MACA,MAAM,EAAE,OAAO,QAAQ;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,GAAG,WAAW,YAAY,YAAY,yBAAyB,iBAAiB,cAAc,WAAW,WAAW,CAAC;AAEzH,QAAM,aAAa,gBAAgB,aAAa,aAAa,aAAa,eAAe,WAAW,IAClG;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,SAAS,MAAM;AAAE,aAAK,WAAW,eAAe,SAAS;AAAA,MAAE;AAAA,MAC3D,UAAU,QAAQ,YAAY,KAAK,QAAQ,SAAS;AAAA,MAEnD,yBAAe,EAAE,4BAA4B,IAAI,EAAE,yBAAyB;AAAA;AAAA,EAC/E,IACE;AAEJ,QAAM,kBAAkB,cAAc,eAClC,qBAAC,SAAI,WAAU,2BAA2B;AAAA;AAAA,IAAc;AAAA,KAAW,IACnE;AAEJ,QAAM,mBAAmB,CAAC,YAAY,aAAa,CAAC,YAAY,iBAAiB,CAAC,CAAC,YAAY;AAE/F,SACE,iCACG;AAAA,uBACC,oBAAC,SAAM,SAAQ,QAAO,WAAU,QAC9B,8BAAC,oBACE,YAAE,kCAAkC,6EAA6E,GACpH,GACF,IACE;AAAA,IACJ;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,0BAA0B;AAAA,QACnC,MAAM;AAAA,QACN;AAAA,QACA,SAAS;AAAA,QACT,aAAa,EAAE,SAAS,0BAA0B;AAAA,QAClD,WAAW,QAAQ,SAAS,KAAK,QAAQ,YAAY,KAAK,QAAQ,SAAS;AAAA,QAC3E,YAAY,CAAC,SAAS,YAAY,IAAI;AAAA,QACtC;AAAA;AAAA,IACF;AAAA,IACC,WACC;AAAA,MAAC;AAAA;AAAA,QACC,MAAM;AAAA,QACN,SAAS,MAAM,YAAY,IAAI;AAAA;AAAA,IACjC,IACE;AAAA,KACN;AAEJ;AAEA,SAAS,eAAe,MAAoE,UAAkB;AAC5G,MAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,WAAY,QAAO;AACnD,SAAO,CAAC,KAAK,cAAc,KAAK,UAAU,EAAE,OAAO,OAAO,EAAE,KAAK,QAAK;AACxE;AAEA,SAAS,iBAAiB,MAAoE;AAC5F,QAAM,OAAO,OAAO,KAAK,iBAAiB,WAAW,KAAK,aAAa,KAAK,IAAI;AAChF,QAAM,KAAK,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,KAAK,IAAI;AAC1E,MAAI,CAAC,QAAQ,CAAC,GAAI,QAAO;AACzB,SAAO,GAAG,IAAI,KAAK,EAAE;AACvB;AAEA,SAAS,WAAW,OAAe;AACjC,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO;AACzC,SAAO,IAAI,KAAK,eAAe,QAAW;AAAA,IACxC,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC,EAAE,OAAO,IAAI;AAChB;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/audit_logs/extension-points'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { DataTable, type PaginationProps } from '@open-mercato/ui/backend/DataTable'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { ActionLogDetailsDialog } from './ActionLogDetailsDialog'\nimport { Undo2, RotateCcw } from 'lucide-react'\nimport { markRedoConsumed, markUndoSuccess } from '@open-mercato/ui/backend/operations/store'\nimport { useAuditPermissions, canUndoEntry, canRedoEntry } from '@open-mercato/ui/backend/version-history'\nimport { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'AuditLogsActions' })\n\nexport type ActionLogItem = {\n  id: string\n  commandId: string\n  actionLabel: string | null\n  executionState: string\n  actorUserId: string | null\n  actorUserName: string | null\n  tenantId: string | null\n  tenantName: string | null\n  organizationId: string | null\n  organizationName: string | null\n  resourceKind: string | null\n  resourceId: string | null\n  undoToken: string | null\n  createdAt: string\n  updatedAt: string\n  snapshotBefore?: unknown | null\n  snapshotAfter?: unknown | null\n  changes?: Record<string, unknown> | null\n  context?: Record<string, unknown> | null\n}\n\nexport function AuditLogsActions({\n  items,\n  onRefresh,\n  isLoading,\n  headerExtras,\n  onUndoError,\n  onRedoError,\n  pagination,\n}: {\n  items: ActionLogItem[] | undefined\n  onRefresh: () => Promise<void>\n  isLoading?: boolean\n  headerExtras?: React.ReactNode\n  onUndoError?: () => void\n  onRedoError?: () => void\n  pagination?: PaginationProps\n}) {\n  const t = useT()\n  const permissions = useAuditPermissions(true)\n  const [undoingToken, setUndoingToken] = React.useState<string | null>(null)\n  const [redoingId, setRedoingId] = React.useState<string | null>(null)\n  const [selected, setSelected] = React.useState<ActionLogItem | null>(null)\n  const actionItems = Array.isArray(items) ? items : []\n  const latestUndoable = React.useMemo(() => actionItems.find((item) => !!item.undoToken && item.executionState === 'done'), [actionItems])\n  const noneLabel = t('audit_logs.common.none')\n  const latestPerResource = React.useMemo(() => {\n    const map = new Map<string, string>()\n    let fallback: string | null = null\n    for (const item of actionItems) {\n      if (!item.undoToken || item.executionState !== 'done') continue\n      const key = buildResourceKey(item)\n      if (key) {\n        if (!map.has(key)) map.set(key, item.id)\n      } else if (!fallback) {\n        fallback = item.id\n      }\n    }\n    return { map, fallback }\n  }, [actionItems])\n  const latestUndoneId = React.useMemo(() => {\n    const undone = actionItems.filter((item) => item.executionState === 'undone')\n    if (!undone.length) return null\n    const sorted = [...undone].sort((a, b) => {\n      const aTs = Date.parse(a.updatedAt)\n      const bTs = Date.parse(b.updatedAt)\n      return (Number.isFinite(bTs) ? bTs : 0) - (Number.isFinite(aTs) ? aTs : 0)\n    })\n    return sorted[0]?.id ?? null\n  }, [actionItems])\n\n  const isLatestUndoableForItem = React.useCallback((item: ActionLogItem) => {\n    const key = buildResourceKey(item)\n    if (key) return latestPerResource.map.get(key) === item.id\n    return latestPerResource.fallback === item.id\n  }, [latestPerResource])\n\n  const isRedoCandidate = React.useCallback((item: ActionLogItem) => item.executionState === 'undone' && latestUndoneId === item.id, [latestUndoneId])\n\n  const handleUndo = React.useCallback(async (token: string | null) => {\n    if (!token) return\n    setUndoingToken(token)\n    try {\n      await apiCallOrThrow('/api/audit_logs/audit-logs/actions/undo', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ undoToken: token }),\n      }, { errorMessage: t('audit_logs.error.undo') })\n      markUndoSuccess(token)\n      await onRefresh()\n    } catch (err) {\n      logger.error('Undo action failed', { err })\n      onUndoError?.()\n    } finally {\n      setUndoingToken(null)\n    }\n  }, [onRefresh, onUndoError, t])\n\n  const handleRedo = React.useCallback(async (logId: string | null) => {\n    if (!logId) return\n    setRedoingId(logId)\n    try {\n      await apiCallOrThrow('/api/audit_logs/audit-logs/actions/redo', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ logId }),\n      }, { errorMessage: t('audit_logs.error.redo') })\n      markRedoConsumed(logId)\n      await onRefresh()\n    } catch (err) {\n      logger.error('Redo action failed', { err })\n      onRedoError?.()\n    } finally {\n      setRedoingId(null)\n    }\n  }, [onRefresh, onRedoError, t])\n\n  const columns = React.useMemo<ColumnDef<ActionLogItem, any>[]>(() => [\n    {\n      accessorKey: 'actionLabel',\n      header: t('audit_logs.actions.columns.action'),\n      cell: (info) => info.row.original.actionLabel || info.row.original.commandId,\n    },\n    {\n      accessorKey: 'resourceKind',\n      header: t('audit_logs.actions.columns.resource'),\n      cell: (info) => formatResource(info.row.original, noneLabel),\n    },\n    {\n      accessorKey: 'actorUserId',\n      header: t('audit_logs.actions.columns.user'),\n      cell: (info) => info.row.original.actorUserName || info.getValue() || noneLabel,\n      meta: { priority: 3 },\n    },\n    {\n      accessorKey: 'tenantId',\n      header: t('audit_logs.actions.columns.tenant'),\n      cell: (info) => info.row.original.tenantName || info.getValue() || noneLabel,\n      meta: { priority: 4 },\n    },\n    {\n      accessorKey: 'organizationId',\n      header: t('audit_logs.actions.columns.organization'),\n      cell: (info) => info.row.original.organizationName || info.getValue() || noneLabel,\n      meta: { priority: 4 },\n    },\n    {\n      accessorKey: 'createdAt',\n      header: t('audit_logs.actions.columns.when'),\n      cell: (info) => formatDate(info.getValue() as string),\n    },\n    {\n      accessorKey: 'executionState',\n      header: t('audit_logs.actions.columns.status'),\n    },\n    {\n      id: 'controls',\n      header: t('audit_logs.actions.columns.controls'),\n      enableSorting: false,\n      cell: (info) => {\n        const item = info.row.original\n        const itemCanUndo = canUndoEntry(permissions, item.actorUserId)\n        const itemCanRedo = canRedoEntry(permissions, item.actorUserId)\n        const canUndo = itemCanUndo && Boolean(item.undoToken) && item.executionState === 'done' && isLatestUndoableForItem(item)\n        const showRedo = itemCanRedo && item.executionState === 'undone'\n        const canRedo = showRedo && isRedoCandidate(item)\n        if (!canUndo && !showRedo) return null\n        return (\n          <div className=\"flex justify-end gap-1\">\n            {canUndo ? (\n              <Button\n                variant=\"ghost\"\n                size=\"icon\"\n                aria-label={t('audit_logs.actions.undo')}\n                onClick={() => { void handleUndo(item.undoToken) }}\n                disabled={undoingToken === item.undoToken || Boolean(redoingId)}\n              >\n                <Undo2 className=\"size-4\" aria-hidden=\"true\" />\n              </Button>\n            ) : null}\n            {showRedo ? (\n              <Button\n                variant=\"ghost\"\n                size=\"icon\"\n                aria-label={t('audit_logs.actions.redo')}\n                onClick={() => { void handleRedo(item.id) }}\n                disabled={!canRedo || redoingId === item.id || Boolean(undoingToken)}\n              >\n                <RotateCcw className=\"size-4\" aria-hidden=\"true\" />\n              </Button>\n            ) : null}\n          </div>\n        )\n      },\n      meta: { align: 'right' },\n    },\n  ], [t, noneLabel, handleUndo, handleRedo, isLatestUndoableForItem, isRedoCandidate, undoingToken, redoingId, permissions])\n\n  const undoButton = latestUndoable?.undoToken && canUndoEntry(permissions, latestUndoable.actorUserId) ? (\n    <Button\n      variant=\"secondary\"\n      size=\"sm\"\n      onClick={() => { void handleUndo(latestUndoable.undoToken) }}\n      disabled={Boolean(undoingToken) || Boolean(redoingId)}\n    >\n      {undoingToken ? t('audit_logs.actions.undoing') : t('audit_logs.actions.undo')}\n    </Button>\n  ) : null\n\n  const combinedActions = undoButton || headerExtras\n    ? <div className=\"flex items-center gap-2\">{headerExtras}{undoButton}</div>\n    : undefined\n\n  const showSelfOnlyHint = !permissions.isLoading && !permissions.canViewTenant && !!permissions.currentUserId\n\n  return (\n    <>\n      {showSelfOnlyHint ? (\n        <Alert status=\"information\" className=\"mb-4\">\n          <AlertDescription>\n            {t('audit_logs.hint.view_self_only', 'Showing only your own changes. Contact an administrator for broader access.')}\n          </AlertDescription>\n        </Alert>\n      ) : null}\n      <DataTable<ActionLogItem>\n        title={t('audit_logs.actions.title')}\n        data={actionItems}\n        columns={columns}\n        actions={combinedActions}\n        perspective={{ tableId: extensionPoints.hosts.actionsTable.tableId }}\n        isLoading={Boolean(isLoading) || Boolean(undoingToken) || Boolean(redoingId)}\n        onRowClick={(item) => setSelected(item)}\n        pagination={pagination}\n      />\n      {selected ? (\n        <ActionLogDetailsDialog\n          item={selected}\n          onClose={() => setSelected(null)}\n        />\n      ) : null}\n    </>\n  )\n}\n\nfunction formatResource(item: { resourceKind?: string | null; resourceId?: string | null }, fallback: string) {\n  if (!item.resourceKind && !item.resourceId) return fallback\n  return [item.resourceKind, item.resourceId].filter(Boolean).join(' \u00B7 ')\n}\n\nfunction buildResourceKey(item: { resourceKind?: string | null; resourceId?: string | null }) {\n  const kind = typeof item.resourceKind === 'string' ? item.resourceKind.trim() : ''\n  const id = typeof item.resourceId === 'string' ? item.resourceId.trim() : ''\n  if (!kind && !id) return null\n  return `${kind}::${id}`\n}\n\nfunction formatDate(value: string) {\n  const date = new Date(value)\n  if (Number.isNaN(date.getTime())) return value\n  return new Intl.DateTimeFormat(undefined, {\n    dateStyle: 'medium',\n    timeStyle: 'short',\n  }).format(date)\n}\n"],
+  "mappings": ";AA2LU,SAgDN,UAvCY,KATN;AAzLV,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAEhC,SAAS,iBAAuC;AAChD,SAAS,cAAc;AACvB,SAAS,sBAAsB;AAC/B,SAAS,YAAY;AACrB,SAAS,8BAA8B;AACvC,SAAS,OAAO,iBAAiB;AACjC,SAAS,kBAAkB,uBAAuB;AAClD,SAAS,qBAAqB,cAAc,oBAAoB;AAChE,SAAS,OAAO,wBAAwB;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,mBAAmB,CAAC;AAwB1E,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAQG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,oBAAoB,IAAI;AAC5C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAwB,IAAI;AAC1E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwB,IAAI;AACpE,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAA+B,IAAI;AACzE,QAAM,cAAc,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACpD,QAAM,iBAAiB,MAAM,QAAQ,MAAM,YAAY,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,aAAa,KAAK,mBAAmB,MAAM,GAAG,CAAC,WAAW,CAAC;AACxI,QAAM,YAAY,EAAE,wBAAwB;AAC5C,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,UAAM,MAAM,oBAAI,IAAoB;AACpC,QAAI,WAA0B;AAC9B,eAAW,QAAQ,aAAa;AAC9B,UAAI,CAAC,KAAK,aAAa,KAAK,mBAAmB,OAAQ;AACvD,YAAM,MAAM,iBAAiB,IAAI;AACjC,UAAI,KAAK;AACP,YAAI,CAAC,IAAI,IAAI,GAAG,EAAG,KAAI,IAAI,KAAK,KAAK,EAAE;AAAA,MACzC,WAAW,CAAC,UAAU;AACpB,mBAAW,KAAK;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,KAAK,SAAS;AAAA,EACzB,GAAG,CAAC,WAAW,CAAC;AAChB,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,UAAM,SAAS,YAAY,OAAO,CAAC,SAAS,KAAK,mBAAmB,QAAQ;AAC5E,QAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,UAAM,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AACxC,YAAM,MAAM,KAAK,MAAM,EAAE,SAAS;AAClC,YAAM,MAAM,KAAK,MAAM,EAAE,SAAS;AAClC,cAAQ,OAAO,SAAS,GAAG,IAAI,MAAM,MAAM,OAAO,SAAS,GAAG,IAAI,MAAM;AAAA,IAC1E,CAAC;AACD,WAAO,OAAO,CAAC,GAAG,MAAM;AAAA,EAC1B,GAAG,CAAC,WAAW,CAAC;AAEhB,QAAM,0BAA0B,MAAM,YAAY,CAAC,SAAwB;AACzE,UAAM,MAAM,iBAAiB,IAAI;AACjC,QAAI,IAAK,QAAO,kBAAkB,IAAI,IAAI,GAAG,MAAM,KAAK;AACxD,WAAO,kBAAkB,aAAa,KAAK;AAAA,EAC7C,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,kBAAkB,MAAM,YAAY,CAAC,SAAwB,KAAK,mBAAmB,YAAY,mBAAmB,KAAK,IAAI,CAAC,cAAc,CAAC;AAEnJ,QAAM,aAAa,MAAM,YAAY,OAAO,UAAyB;AACnE,QAAI,CAAC,MAAO;AACZ,oBAAgB,KAAK;AACrB,QAAI;AACF,YAAM,eAAe,2CAA2C;AAAA,QAC9D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,WAAW,MAAM,CAAC;AAAA,MAC3C,GAAG,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC;AAC/C,sBAAgB,KAAK;AACrB,YAAM,UAAU;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,oBAAc;AAAA,IAChB,UAAE;AACA,sBAAgB,IAAI;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,WAAW,aAAa,CAAC,CAAC;AAE9B,QAAM,aAAa,MAAM,YAAY,OAAO,UAAyB;AACnE,QAAI,CAAC,MAAO;AACZ,iBAAa,KAAK;AAClB,QAAI;AACF,YAAM,eAAe,2CAA2C;AAAA,QAC9D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,MAChC,GAAG,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC;AAC/C,uBAAiB,KAAK;AACtB,YAAM,UAAU;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,oBAAc;AAAA,IAChB,UAAE;AACA,mBAAa,IAAI;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,WAAW,aAAa,CAAC,CAAC;AAE9B,QAAM,UAAU,MAAM,QAAyC,MAAM;AAAA,IACnE;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,eAAe,KAAK,IAAI,SAAS;AAAA,IACrE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,qCAAqC;AAAA,MAC/C,MAAM,CAAC,SAAS,eAAe,KAAK,IAAI,UAAU,SAAS;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,iBAAiB,KAAK,SAAS,KAAK;AAAA,MACtE,MAAM,EAAE,UAAU,EAAE;AAAA,IACtB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,cAAc,KAAK,SAAS,KAAK;AAAA,MACnE,MAAM,EAAE,UAAU,EAAE;AAAA,IACtB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,yCAAyC;AAAA,MACnD,MAAM,CAAC,SAAS,KAAK,IAAI,SAAS,oBAAoB,KAAK,SAAS,KAAK;AAAA,MACzE,MAAM,EAAE,UAAU,EAAE;AAAA,IACtB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,SAAS,WAAW,KAAK,SAAS,CAAW;AAAA,IACtD;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC;AAAA,IAC/C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,qCAAqC;AAAA,MAC/C,eAAe;AAAA,MACf,MAAM,CAAC,SAAS;AACd,cAAM,OAAO,KAAK,IAAI;AACtB,cAAM,cAAc,aAAa,aAAa,KAAK,WAAW;AAC9D,cAAM,cAAc,aAAa,aAAa,KAAK,WAAW;AAC9D,cAAM,UAAU,eAAe,QAAQ,KAAK,SAAS,KAAK,KAAK,mBAAmB,UAAU,wBAAwB,IAAI;AACxH,cAAM,WAAW,eAAe,KAAK,mBAAmB;AACxD,cAAM,UAAU,YAAY,gBAAgB,IAAI;AAChD,YAAI,CAAC,WAAW,CAAC,SAAU,QAAO;AAClC,eACE,qBAAC,SAAI,WAAU,0BACZ;AAAA,oBACC;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,cAAY,EAAE,yBAAyB;AAAA,cACvC,SAAS,MAAM;AAAE,qBAAK,WAAW,KAAK,SAAS;AAAA,cAAE;AAAA,cACjD,UAAU,iBAAiB,KAAK,aAAa,QAAQ,SAAS;AAAA,cAE9D,8BAAC,SAAM,WAAU,UAAS,eAAY,QAAO;AAAA;AAAA,UAC/C,IACE;AAAA,UACH,WACC;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,cAAY,EAAE,yBAAyB;AAAA,cACvC,SAAS,MAAM;AAAE,qBAAK,WAAW,KAAK,EAAE;AAAA,cAAE;AAAA,cAC1C,UAAU,CAAC,WAAW,cAAc,KAAK,MAAM,QAAQ,YAAY;AAAA,cAEnE,8BAAC,aAAU,WAAU,UAAS,eAAY,QAAO;AAAA;AAAA,UACnD,IACE;AAAA,WACN;AAAA,MAEJ;AAAA,MACA,MAAM,EAAE,OAAO,QAAQ;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,GAAG,WAAW,YAAY,YAAY,yBAAyB,iBAAiB,cAAc,WAAW,WAAW,CAAC;AAEzH,QAAM,aAAa,gBAAgB,aAAa,aAAa,aAAa,eAAe,WAAW,IAClG;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,SAAS,MAAM;AAAE,aAAK,WAAW,eAAe,SAAS;AAAA,MAAE;AAAA,MAC3D,UAAU,QAAQ,YAAY,KAAK,QAAQ,SAAS;AAAA,MAEnD,yBAAe,EAAE,4BAA4B,IAAI,EAAE,yBAAyB;AAAA;AAAA,EAC/E,IACE;AAEJ,QAAM,kBAAkB,cAAc,eAClC,qBAAC,SAAI,WAAU,2BAA2B;AAAA;AAAA,IAAc;AAAA,KAAW,IACnE;AAEJ,QAAM,mBAAmB,CAAC,YAAY,aAAa,CAAC,YAAY,iBAAiB,CAAC,CAAC,YAAY;AAE/F,SACE,iCACG;AAAA,uBACC,oBAAC,SAAM,QAAO,eAAc,WAAU,QACpC,8BAAC,oBACE,YAAE,kCAAkC,6EAA6E,GACpH,GACF,IACE;AAAA,IACJ;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,0BAA0B;AAAA,QACnC,MAAM;AAAA,QACN;AAAA,QACA,SAAS;AAAA,QACT,aAAa,EAAE,SAAS,gBAAgB,MAAM,aAAa,QAAQ;AAAA,QACnE,WAAW,QAAQ,SAAS,KAAK,QAAQ,YAAY,KAAK,QAAQ,SAAS;AAAA,QAC3E,YAAY,CAAC,SAAS,YAAY,IAAI;AAAA,QACtC;AAAA;AAAA,IACF;AAAA,IACC,WACC;AAAA,MAAC;AAAA;AAAA,QACC,MAAM;AAAA,QACN,SAAS,MAAM,YAAY,IAAI;AAAA;AAAA,IACjC,IACE;AAAA,KACN;AAEJ;AAEA,SAAS,eAAe,MAAoE,UAAkB;AAC5G,MAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,WAAY,QAAO;AACnD,SAAO,CAAC,KAAK,cAAc,KAAK,UAAU,EAAE,OAAO,OAAO,EAAE,KAAK,QAAK;AACxE;AAEA,SAAS,iBAAiB,MAAoE;AAC5F,QAAM,OAAO,OAAO,KAAK,iBAAiB,WAAW,KAAK,aAAa,KAAK,IAAI;AAChF,QAAM,KAAK,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,KAAK,IAAI;AAC1E,MAAI,CAAC,QAAQ,CAAC,GAAI,QAAO;AACzB,SAAO,GAAG,IAAI,KAAK,EAAE;AACvB;AAEA,SAAS,WAAW,OAAe;AACjC,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO;AACzC,SAAO,IAAI,KAAK,eAAe,QAAW;AAAA,IACxC,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC,EAAE,OAAO,IAAI;AAChB;",
   "names": []
 }

package/dist/modules/audit_logs/extension-points.js

@@ -0,0 +1,14 @@
+import { dataTableExtensionHost, defineModuleExtensionPoints } from "@open-mercato/shared/modules/widgets/extension-points";
+const extensionPoints = defineModuleExtensionPoints({
+  moduleId: "audit_logs",
+  hosts: {
+    accessLogsTable: dataTableExtensionHost({ tableId: "audit_logs.access.list", source: "components/AccessLogsTable.tsx" }),
+    actionsTable: dataTableExtensionHost({ tableId: "audit_logs.actions.list", source: "components/AuditLogsActions.tsx" })
+  }
+});
+var extension_points_default = extensionPoints;
+export {
+  extension_points_default as default,
+  extensionPoints
+};
+//# sourceMappingURL=extension-points.js.map

package/dist/modules/audit_logs/extension-points.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/audit_logs/extension-points.ts"],
+  "sourcesContent": ["import { dataTableExtensionHost, defineModuleExtensionPoints } from '@open-mercato/shared/modules/widgets/extension-points'\n\nexport const extensionPoints = defineModuleExtensionPoints({\n  moduleId: 'audit_logs',\n  hosts: {\n    accessLogsTable: dataTableExtensionHost({ tableId: 'audit_logs.access.list', source: 'components/AccessLogsTable.tsx' }),\n    actionsTable: dataTableExtensionHost({ tableId: 'audit_logs.actions.list', source: 'components/AuditLogsActions.tsx' }),\n  },\n})\n\nexport default extensionPoints\n"],
+  "mappings": "AAAA,SAAS,wBAAwB,mCAAmC;AAE7D,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,OAAO;AAAA,IACL,iBAAiB,uBAAuB,EAAE,SAAS,0BAA0B,QAAQ,iCAAiC,CAAC;AAAA,IACvH,cAAc,uBAAuB,EAAE,SAAS,2BAA2B,QAAQ,kCAAkC,CAAC;AAAA,EACxH;AACF,CAAC;AAED,IAAO,2BAAQ;",
+  "names": []
+}

package/dist/modules/auth/api/admin/nav.js

@@ -4,11 +4,13 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getBackendRouteManifests } from "@open-mercato/shared/modules/registry";
+import { getModuleSurfaceFingerprint } from "@open-mercato/shared/lib/modules/surfaceFingerprint";
 import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { groupBackendRoutesByModule, resolveBackendChromePayload } from "../../lib/backendChrome.js";
 const metadata = {
   GET: { requireAuth: true }
 };
+const NAV_CACHE_TTL_MS = 30 * 60 * 1e3;
 const sidebarNavItemSchema = z.lazy(
   () => z.object({
     id: z.string().optional(),
@@ -63,7 +65,14 @@ const adminNavResponseSchema = z.object({
   profileSections: z.array(sectionGroupSchema),
   profilePathPrefixes: z.array(z.string()),
   grantedFeatures: z.array(z.string()),
-  roles: z.array(z.string())
+  roles: z.array(z.string()),
+  // Present when a single organization is in scope; `null` under an all-organizations selection or
+  // when the lookup fails. Declared optional so the response contract stays additive for clients
+  // generated against an older schema.
+  currentOrganization: z.object({
+    id: z.string(),
+    name: z.string()
+  }).nullable().optional()
 });
 const adminNavErrorSchema = z.object({
   error: z.string()
@@ -88,6 +97,7 @@ async function GET(req) {
   }
   let cacheScopeTenantId = auth.tenantId ?? null;
   let cacheScopeOrganizationId = auth.orgId ?? null;
+  let cacheScopeSelectedOrganizationId = auth.orgId ?? null;
   try {
     const { organizationId, scope } = await resolveFeatureCheckContext({
       container,
@@ -98,14 +108,17 @@ async function GET(req) {
     });
     cacheScopeOrganizationId = organizationId;
     cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null;
+    cacheScopeSelectedOrganizationId = scope.selectedId ?? null;
   } catch {
     cacheScopeOrganizationId = auth.orgId ?? null;
     cacheScopeTenantId = auth.tenantId ?? null;
+    cacheScopeSelectedOrganizationId = auth.orgId ?? null;
     selectedOrganizationId = auth.orgId ?? null;
     selectedTenantId = auth.tenantId ?? null;
   }
-  const cacheVersion = "v4";
-  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || "null"}:${cacheScopeOrganizationId || "null"}`;
+  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`;
+  const cacheSelection = cacheScopeSelectedOrganizationId ?? "__all__";
+  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || "null"}:${cacheScopeOrganizationId || "null"}:${cacheSelection}`;
   try {
     if (cache?.get) {
       const cached = await cache.get(cacheKey);
@@ -135,7 +148,7 @@ async function GET(req) {
         `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || "null"}:${cacheScopeOrganizationId || "null"}:${locale}`,
         ...(Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)
       ].filter(Boolean);
-      await cache.set(cacheKey, payload, { tags });
+      await cache.set(cacheKey, payload, { tags, ttl: NAV_CACHE_TTL_MS });
     }
   } catch {
   }

package/dist/modules/auth/api/admin/nav.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/admin/nav.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { z } from 'zod'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getBackendRouteManifests } from '@open-mercato/shared/modules/registry'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { groupBackendRoutesByModule, resolveBackendChromePayload } from '../../lib/backendChrome'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst sidebarNavItemSchema: z.ZodType<{\n  id?: string\n  href: string\n  title: string\n  defaultTitle?: string\n  enabled?: boolean\n  hidden?: boolean\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string().optional(),\n    href: z.string(),\n    title: z.string(),\n    defaultTitle: z.string().optional(),\n    enabled: z.boolean().optional(),\n    hidden: z.boolean().optional(),\n    pageContext: z.enum(['main', 'admin', 'settings', 'profile']).optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sidebarNavItemSchema).optional(),\n  }),\n)\n\nconst sectionItemSchema: z.ZodType<{\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  order?: number\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string(),\n    label: z.string(),\n    labelKey: z.string().optional(),\n    href: z.string(),\n    order: z.number().optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sectionItemSchema).optional(),\n  }),\n)\n\nconst sectionGroupSchema = z.object({\n  id: z.string(),\n  label: z.string(),\n  labelKey: z.string().optional(),\n  order: z.number().optional(),\n  items: z.array(sectionItemSchema),\n})\n\nconst adminNavResponseSchema = z.object({\n  brand: z.object({\n    name: z.string().optional(),\n    logo: z.object({\n      src: z.string(),\n      alt: z.string().optional(),\n    }).nullable().optional(),\n  }).nullable().optional(),\n  groups: z.array(\n    z.object({\n      id: z.string().optional(),\n      name: z.string(),\n      defaultName: z.string().optional(),\n      items: z.array(sidebarNavItemSchema),\n    }),\n  ),\n  settingsSections: z.array(sectionGroupSchema),\n  settingsPathPrefixes: z.array(z.string()),\n  profileSections: z.array(sectionGroupSchema),\n  profilePathPrefixes: z.array(z.string()),\n  grantedFeatures: z.array(z.string()),\n  roles: z.array(z.string()),\n})\n\nconst adminNavErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { translate, locale } = await resolveTranslations()\n  const container = await createRequestContainer()\n  const cache = container.resolve('cache') as {\n    get?: (key: string) => Promise<unknown>\n    set?: (key: string, value: unknown, options?: { tags?: string[] }) => Promise<void>\n  } | null\n  let selectedOrganizationId: string | null | undefined\n  let selectedTenantId: string | null | undefined\n  try {\n    const url = new URL(req.url)\n    const orgParam = url.searchParams.get('orgId')\n    const tenantParam = url.searchParams.get('tenantId')\n    selectedOrganizationId = orgParam === null ? undefined : orgParam || null\n    selectedTenantId = tenantParam === null ? undefined : tenantParam || null\n  } catch {\n    selectedOrganizationId = undefined\n    selectedTenantId = undefined\n  }\n\n  let cacheScopeTenantId = auth.tenantId ?? null\n  let cacheScopeOrganizationId = auth.orgId ?? null\n  try {\n    const { organizationId, scope } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n      request: req,\n    })\n    cacheScopeOrganizationId = organizationId\n    cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null\n  } catch {\n    cacheScopeOrganizationId = auth.orgId ?? null\n    cacheScopeTenantId = auth.tenantId ?? null\n    selectedOrganizationId = auth.orgId ?? null\n    selectedTenantId = auth.tenantId ?? null\n  }\n\n  const cacheVersion = 'v4'\n  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}`\n  try {\n    if (cache?.get) {\n      const cached = await cache.get(cacheKey)\n      if (cached) return NextResponse.json(cached)\n    }\n  } catch {\n    // ignore cache read failures\n  }\n\n  const payload = await resolveBackendChromePayload({\n    auth,\n    locale,\n    modules: groupBackendRoutesByModule(getBackendRouteManifests()),\n    translate: (key, fallback) => (key ? translate(key, fallback) : fallback),\n    request: req,\n    selectedOrganizationId,\n    selectedTenantId,\n  })\n\n  try {\n    if (cache?.set) {\n      const tags = [\n        `rbac:user:${auth.sub}`,\n        cacheScopeTenantId ? `rbac:tenant:${cacheScopeTenantId}` : undefined,\n        `nav:entities:${cacheScopeTenantId || 'null'}`,\n        `nav:locale:${locale}`,\n        `nav:sidebar:user:${auth.sub}`,\n        cacheScopeTenantId ? `nav:sidebar:tenant:${cacheScopeTenantId}` : undefined,\n        cacheScopeOrganizationId ? `nav:sidebar:organization:${cacheScopeOrganizationId}` : undefined,\n        `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${locale}`,\n        ...((Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)),\n      ].filter(Boolean) as string[]\n      await cache.set(cacheKey, payload, { tags })\n    }\n  } catch {\n    // ignore cache write failures\n  }\n\n  return NextResponse.json(payload)\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Admin sidebar navigation',\n  methods: {\n    GET: {\n      summary: 'Resolve backend chrome bootstrap payload',\n      description:\n        'Returns the backend chrome payload available to the authenticated administrator after applying scope, RBAC, role defaults, and personal sidebar preferences.',\n      responses: [\n        { status: 200, description: 'Backend chrome payload', schema: adminNavResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: adminNavErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,kCAAkC;AAC3C,SAAS,4BAA4B,mCAAmC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,uBAWD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,IACxB,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,IAChB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,SAAS,YAAY,SAAS,CAAC,EAAE,SAAS;AAAA,IACvE,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,oBAAoB,EAAE,SAAS;AAAA,EACnD,CAAC;AACH;AAEA,MAAM,oBASD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO;AAAA,IACb,OAAO,EAAE,OAAO;AAAA,IAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,EAChD,CAAC;AACH;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,MAAM,iBAAiB;AAClC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,MAAM,EAAE,OAAO;AAAA,MACb,KAAK,EAAE,OAAO;AAAA,MACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzB,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvB,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,MACxB,MAAM,EAAE,OAAO;AAAA,MACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,OAAO,EAAE,MAAM,oBAAoB;AAAA,IACrC,CAAC;AAAA,EACH;AAAA,EACA,kBAAkB,EAAE,MAAM,kBAAkB;AAAA,EAC5C,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxC,iBAAiB,EAAE,MAAM,kBAAkB;AAAA,EAC3C,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACvC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,EAAE,WAAW,OAAO,IAAI,MAAM,oBAAoB;AACxD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,UAAU,QAAQ,OAAO;AAIvC,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,WAAW,IAAI,aAAa,IAAI,OAAO;AAC7C,UAAM,cAAc,IAAI,aAAa,IAAI,UAAU;AACnD,6BAAyB,aAAa,OAAO,SAAY,YAAY;AACrE,uBAAmB,gBAAgB,OAAO,SAAY,eAAe;AAAA,EACvE,QAAQ;AACN,6BAAyB;AACzB,uBAAmB;AAAA,EACrB;AAEA,MAAI,qBAAqB,KAAK,YAAY;AAC1C,MAAI,2BAA2B,KAAK,SAAS;AAC7C,MAAI;AACF,UAAM,EAAE,gBAAgB,MAAM,IAAI,MAAM,2BAA2B;AAAA,MACjE;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,+BAA2B;AAC3B,yBAAqB,MAAM,YAAY,KAAK,YAAY;AAAA,EAC1D,QAAQ;AACN,+BAA2B,KAAK,SAAS;AACzC,yBAAqB,KAAK,YAAY;AACtC,6BAAyB,KAAK,SAAS;AACvC,uBAAmB,KAAK,YAAY;AAAA,EACtC;AAEA,QAAM,eAAe;AACrB,QAAM,WAAW,eAAe,YAAY,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM;AACxI,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,OAAQ,QAAO,aAAa,KAAK,MAAM;AAAA,IAC7C;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,UAAU,MAAM,4BAA4B;AAAA,IAChD;AAAA,IACA;AAAA,IACA,SAAS,2BAA2B,yBAAyB,CAAC;AAAA,IAC9D,WAAW,CAAC,KAAK,aAAc,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,IAChE,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,OAAO;AAAA,QACX,aAAa,KAAK,GAAG;AAAA,QACrB,qBAAqB,eAAe,kBAAkB,KAAK;AAAA,QAC3D,gBAAgB,sBAAsB,MAAM;AAAA,QAC5C,cAAc,MAAM;AAAA,QACpB,oBAAoB,KAAK,GAAG;AAAA,QAC5B,qBAAqB,sBAAsB,kBAAkB,KAAK;AAAA,QAClE,2BAA2B,4BAA4B,wBAAwB,KAAK;AAAA,QACpF,qBAAqB,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,MAAM;AAAA,QAC7G,IAAK,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,oBAAoB,IAAI,EAAE;AAAA,MAC5F,EAAE,OAAO,OAAO;AAChB,YAAM,MAAM,IAAI,UAAU,SAAS,EAAE,KAAK,CAAC;AAAA,IAC7C;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,aAAa,KAAK,OAAO;AAClC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,uBAAuB;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { z } from 'zod'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getBackendRouteManifests } from '@open-mercato/shared/modules/registry'\nimport { getModuleSurfaceFingerprint } from '@open-mercato/shared/lib/modules/surfaceFingerprint'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { groupBackendRoutesByModule, resolveBackendChromePayload } from '../../lib/backendChrome'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\n// The fingerprint covers the module set, each module's declared features and\n// the serializable route manifest, so the TTL only has to bound what it cannot\n// see \u2014 chiefly a route `icon` swap, which serializes identically. Rebuilding\n// this payload is expensive (a `renderToStaticMarkup` per nav icon plus several\n// scoped queries), so the bound is generous rather than aggressive.\nconst NAV_CACHE_TTL_MS = 30 * 60 * 1000\n\nconst sidebarNavItemSchema: z.ZodType<{\n  id?: string\n  href: string\n  title: string\n  defaultTitle?: string\n  enabled?: boolean\n  hidden?: boolean\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string().optional(),\n    href: z.string(),\n    title: z.string(),\n    defaultTitle: z.string().optional(),\n    enabled: z.boolean().optional(),\n    hidden: z.boolean().optional(),\n    pageContext: z.enum(['main', 'admin', 'settings', 'profile']).optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sidebarNavItemSchema).optional(),\n  }),\n)\n\nconst sectionItemSchema: z.ZodType<{\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  order?: number\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string(),\n    label: z.string(),\n    labelKey: z.string().optional(),\n    href: z.string(),\n    order: z.number().optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sectionItemSchema).optional(),\n  }),\n)\n\nconst sectionGroupSchema = z.object({\n  id: z.string(),\n  label: z.string(),\n  labelKey: z.string().optional(),\n  order: z.number().optional(),\n  items: z.array(sectionItemSchema),\n})\n\nconst adminNavResponseSchema = z.object({\n  brand: z.object({\n    name: z.string().optional(),\n    logo: z.object({\n      src: z.string(),\n      alt: z.string().optional(),\n    }).nullable().optional(),\n  }).nullable().optional(),\n  groups: z.array(\n    z.object({\n      id: z.string().optional(),\n      name: z.string(),\n      defaultName: z.string().optional(),\n      items: z.array(sidebarNavItemSchema),\n    }),\n  ),\n  settingsSections: z.array(sectionGroupSchema),\n  settingsPathPrefixes: z.array(z.string()),\n  profileSections: z.array(sectionGroupSchema),\n  profilePathPrefixes: z.array(z.string()),\n  grantedFeatures: z.array(z.string()),\n  roles: z.array(z.string()),\n  // Present when a single organization is in scope; `null` under an all-organizations selection or\n  // when the lookup fails. Declared optional so the response contract stays additive for clients\n  // generated against an older schema.\n  currentOrganization: z.object({\n    id: z.string(),\n    name: z.string(),\n  }).nullable().optional(),\n})\n\nconst adminNavErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { translate, locale } = await resolveTranslations()\n  const container = await createRequestContainer()\n  const cache = container.resolve('cache') as {\n    get?: (key: string) => Promise<unknown>\n    set?: (key: string, value: unknown, options?: { tags?: string[]; ttl?: number }) => Promise<void>\n  } | null\n  let selectedOrganizationId: string | null | undefined\n  let selectedTenantId: string | null | undefined\n  try {\n    const url = new URL(req.url)\n    const orgParam = url.searchParams.get('orgId')\n    const tenantParam = url.searchParams.get('tenantId')\n    selectedOrganizationId = orgParam === null ? undefined : orgParam || null\n    selectedTenantId = tenantParam === null ? undefined : tenantParam || null\n  } catch {\n    selectedOrganizationId = undefined\n    selectedTenantId = undefined\n  }\n\n  let cacheScopeTenantId = auth.tenantId ?? null\n  let cacheScopeOrganizationId = auth.orgId ?? null\n  let cacheScopeSelectedOrganizationId = auth.orgId ?? null\n  try {\n    const { organizationId, scope } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n      request: req,\n    })\n    cacheScopeOrganizationId = organizationId\n    cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null\n    cacheScopeSelectedOrganizationId = scope.selectedId ?? null\n  } catch {\n    cacheScopeOrganizationId = auth.orgId ?? null\n    cacheScopeTenantId = auth.tenantId ?? null\n    cacheScopeSelectedOrganizationId = auth.orgId ?? null\n    selectedOrganizationId = auth.orgId ?? null\n    selectedTenantId = auth.tenantId ?? null\n  }\n\n  // v6: the payload gained `currentOrganization`, and the payload also embeds the enabled-module set,\n  // its declared features, and the backend route manifest. The selection is part of the key because\n  // the resolved organization cannot distinguish \"all organizations\" from \"my own organization\";\n  // use the resolved selection so cookie-driven requests without an `orgId` query remain distinct.\n  // The fingerprint invalidates module-surface changes; the TTL bounds anything it cannot observe.\n  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`\n  const cacheSelection = cacheScopeSelectedOrganizationId ?? '__all__'\n  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${cacheSelection}`\n  try {\n    if (cache?.get) {\n      const cached = await cache.get(cacheKey)\n      if (cached) return NextResponse.json(cached)\n    }\n  } catch {\n    // ignore cache read failures\n  }\n\n  const payload = await resolveBackendChromePayload({\n    auth,\n    locale,\n    modules: groupBackendRoutesByModule(getBackendRouteManifests()),\n    translate: (key, fallback) => (key ? translate(key, fallback) : fallback),\n    request: req,\n    selectedOrganizationId,\n    selectedTenantId,\n  })\n\n  try {\n    if (cache?.set) {\n      const tags = [\n        `rbac:user:${auth.sub}`,\n        cacheScopeTenantId ? `rbac:tenant:${cacheScopeTenantId}` : undefined,\n        `nav:entities:${cacheScopeTenantId || 'null'}`,\n        `nav:locale:${locale}`,\n        `nav:sidebar:user:${auth.sub}`,\n        cacheScopeTenantId ? `nav:sidebar:tenant:${cacheScopeTenantId}` : undefined,\n        cacheScopeOrganizationId ? `nav:sidebar:organization:${cacheScopeOrganizationId}` : undefined,\n        `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${locale}`,\n        ...((Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)),\n      ].filter(Boolean) as string[]\n      await cache.set(cacheKey, payload, { tags, ttl: NAV_CACHE_TTL_MS })\n    }\n  } catch {\n    // ignore cache write failures\n  }\n\n  return NextResponse.json(payload)\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Admin sidebar navigation',\n  methods: {\n    GET: {\n      summary: 'Resolve backend chrome bootstrap payload',\n      description:\n        'Returns the backend chrome payload available to the authenticated administrator after applying scope, RBAC, role defaults, and personal sidebar preferences.',\n      responses: [\n        { status: 200, description: 'Backend chrome payload', schema: adminNavResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: adminNavErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,kCAAkC;AAC3C,SAAS,4BAA4B,mCAAmC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAOA,MAAM,mBAAmB,KAAK,KAAK;AAEnC,MAAM,uBAWD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,IACxB,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,IAChB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,SAAS,YAAY,SAAS,CAAC,EAAE,SAAS;AAAA,IACvE,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,oBAAoB,EAAE,SAAS;AAAA,EACnD,CAAC;AACH;AAEA,MAAM,oBASD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO;AAAA,IACb,OAAO,EAAE,OAAO;AAAA,IAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,EAChD,CAAC;AACH;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,MAAM,iBAAiB;AAClC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,MAAM,EAAE,OAAO;AAAA,MACb,KAAK,EAAE,OAAO;AAAA,MACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzB,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvB,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,MACxB,MAAM,EAAE,OAAO;AAAA,MACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,OAAO,EAAE,MAAM,oBAAoB;AAAA,IACrC,CAAC;AAAA,EACH;AAAA,EACA,kBAAkB,EAAE,MAAM,kBAAkB;AAAA,EAC5C,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxC,iBAAiB,EAAE,MAAM,kBAAkB;AAAA,EAC3C,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACvC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzB,qBAAqB,EAAE,OAAO;AAAA,IAC5B,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EAAE,SAAS,EAAE,SAAS;AACzB,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,EAAE,WAAW,OAAO,IAAI,MAAM,oBAAoB;AACxD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,UAAU,QAAQ,OAAO;AAIvC,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,WAAW,IAAI,aAAa,IAAI,OAAO;AAC7C,UAAM,cAAc,IAAI,aAAa,IAAI,UAAU;AACnD,6BAAyB,aAAa,OAAO,SAAY,YAAY;AACrE,uBAAmB,gBAAgB,OAAO,SAAY,eAAe;AAAA,EACvE,QAAQ;AACN,6BAAyB;AACzB,uBAAmB;AAAA,EACrB;AAEA,MAAI,qBAAqB,KAAK,YAAY;AAC1C,MAAI,2BAA2B,KAAK,SAAS;AAC7C,MAAI,mCAAmC,KAAK,SAAS;AACrD,MAAI;AACF,UAAM,EAAE,gBAAgB,MAAM,IAAI,MAAM,2BAA2B;AAAA,MACjE;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,+BAA2B;AAC3B,yBAAqB,MAAM,YAAY,KAAK,YAAY;AACxD,uCAAmC,MAAM,cAAc;AAAA,EACzD,QAAQ;AACN,+BAA2B,KAAK,SAAS;AACzC,yBAAqB,KAAK,YAAY;AACtC,uCAAmC,KAAK,SAAS;AACjD,6BAAyB,KAAK,SAAS;AACvC,uBAAmB,KAAK,YAAY;AAAA,EACtC;AAOA,QAAM,eAAe,MAAM,4BAA4B,CAAC;AACxD,QAAM,iBAAiB,oCAAoC;AAC3D,QAAM,WAAW,eAAe,YAAY,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,cAAc;AAC1J,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,OAAQ,QAAO,aAAa,KAAK,MAAM;AAAA,IAC7C;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,UAAU,MAAM,4BAA4B;AAAA,IAChD;AAAA,IACA;AAAA,IACA,SAAS,2BAA2B,yBAAyB,CAAC;AAAA,IAC9D,WAAW,CAAC,KAAK,aAAc,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,IAChE,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,OAAO;AAAA,QACX,aAAa,KAAK,GAAG;AAAA,QACrB,qBAAqB,eAAe,kBAAkB,KAAK;AAAA,QAC3D,gBAAgB,sBAAsB,MAAM;AAAA,QAC5C,cAAc,MAAM;AAAA,QACpB,oBAAoB,KAAK,GAAG;AAAA,QAC5B,qBAAqB,sBAAsB,kBAAkB,KAAK;AAAA,QAClE,2BAA2B,4BAA4B,wBAAwB,KAAK;AAAA,QACpF,qBAAqB,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,MAAM;AAAA,QAC7G,IAAK,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,oBAAoB,IAAI,EAAE;AAAA,MAC5F,EAAE,OAAO,OAAO;AAChB,YAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,KAAK,iBAAiB,CAAC;AAAA,IACpE;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,aAAa,KAAK,OAAO;AAClC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,uBAAuB;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/profile/route.js

@@ -12,6 +12,7 @@ import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("auth").child({ component: "profile" });
 const profileResponseSchema = z.object({
   email: z.string().email(),
+  name: z.string().nullable().optional(),
   roles: z.array(z.string())
 });
 const passwordSchema = buildPasswordSchema();
@@ -92,7 +93,12 @@ async function GET(req) {
     if (!user) {
       return NextResponse.json({ error: translate("auth.users.form.errors.notFound", "User not found") }, { status: 404 });
     }
-    return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] });
+    const displayName = typeof user.name === "string" ? user.name.trim() : "";
+    return NextResponse.json({
+      email: String(user.email),
+      name: displayName.length > 0 ? displayName : null,
+      roles: auth.roles ?? []
+    });
   } catch (err) {
     logger.error("Profile load failed", { err });
     return NextResponse.json({ error: translate("auth.profile.form.errors.load", "Failed to load profile.") }, { status: 400 });
@@ -191,7 +197,7 @@ const openApi = {
   methods: {
     GET: {
       summary: "Get current profile",
-      description: "Returns the email address for the signed-in user.",
+      description: "Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.",
       responses: [
         { status: 200, description: "Profile payload", schema: profileResponseSchema },
         { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },

package/dist/modules/auth/api/profile/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/profile/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address for the signed-in user.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,KAAK,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;AAAA,EACjF,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/users/route.js

@@ -19,9 +19,7 @@ import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/
 import { buildPasswordSchema } from "@open-mercato/shared/lib/auth/passwordPolicy";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { parseBooleanFlag } from "@open-mercato/shared/lib/boolean";
-import { resolveSearchConfig } from "@open-mercato/shared/lib/search/config";
-import { tokenizeText } from "@open-mercato/shared/lib/search/tokenize";
-import { sql } from "kysely";
+import { findEntityIdsBySearchTokensCompat } from "@open-mercato/shared/lib/search/tokenLookup";
 import { normalizeDisplayNameInput } from "@open-mercato/core/modules/auth/lib/displayName";
 import {
   getSelectedTenantFromRequest,
@@ -444,22 +442,13 @@ const DELETE = async (req) => {
   return crud.DELETE(req);
 };
 async function findUserIdsBySearchTokens(em, entityType, search, tenantScope, field) {
-  const trimmed = search.trim();
-  if (!trimmed) return null;
-  const searchConfig = resolveSearchConfig();
-  if (!searchConfig.enabled) return [];
-  const { hashes } = tokenizeText(trimmed, searchConfig);
-  if (!hashes.length) return [];
-  const db = em.getKysely();
-  let query = db.selectFrom("search_tokens").select("entity_id").where("entity_type", "=", entityType).where("token_hash", "in", hashes).groupBy("entity_id").having(sql`count(distinct token_hash) >= ${hashes.length}`);
-  if (field) {
-    query = query.where("field", "=", field);
-  }
-  if (tenantScope !== void 0) {
-    query = query.where(sql`tenant_id is not distinct from ${tenantScope}`);
-  }
-  const rows = await query.execute();
-  return rows.map((row) => typeof row.entity_id === "string" ? row.entity_id : null).filter((id) => typeof id === "string" && id.length > 0);
+  return findEntityIdsBySearchTokensCompat({
+    db: em.getKysely(),
+    entityType,
+    query: search,
+    fields: field ? [field] : void 0,
+    scope: { tenantId: tenantScope }
+  });
 }
 async function assertCanModifySuperAdminTarget(req, targetUserId) {
   const auth = await getAuthFromRequest(req);