@open-mercato/core 0.6.8-develop.6915.1.ac6031c503 → 0.6.8-develop.6917.1.af45bc96e2

package/dist/modules/auth/api/admin/nav.js

@@ -22,6 +22,7 @@ const sidebarNavItemSchema = z.lazy(
     pageContext: z.enum(["main", "admin", "settings", "profile"]).optional(),
     iconName: z.string().optional(),
     iconMarkup: z.string().optional(),
+    order: z.number().optional(),
     children: z.array(sidebarNavItemSchema).optional()
   })
 );
@@ -116,7 +117,7 @@ async function GET(req) {
     selectedOrganizationId = auth.orgId ?? null;
     selectedTenantId = auth.tenantId ?? null;
   }
-  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`;
+  const cacheVersion = `v7:${getModuleSurfaceFingerprint()}`;
   const cacheSelection = cacheScopeSelectedOrganizationId ?? "__all__";
   const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || "null"}:${cacheScopeOrganizationId || "null"}:${cacheSelection}`;
   try {

package/dist/modules/auth/api/admin/nav.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/admin/nav.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { z } from 'zod'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getBackendRouteManifests } from '@open-mercato/shared/modules/registry'\nimport { getModuleSurfaceFingerprint } from '@open-mercato/shared/lib/modules/surfaceFingerprint'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { groupBackendRoutesByModule, resolveBackendChromePayload } from '../../lib/backendChrome'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\n// The fingerprint covers the module set, each module's declared features and\n// the serializable route manifest, so the TTL only has to bound what it cannot\n// see \u2014 chiefly a route `icon` swap, which serializes identically. Rebuilding\n// this payload is expensive (a `renderToStaticMarkup` per nav icon plus several\n// scoped queries), so the bound is generous rather than aggressive.\nconst NAV_CACHE_TTL_MS = 30 * 60 * 1000\n\nconst sidebarNavItemSchema: z.ZodType<{\n  id?: string\n  href: string\n  title: string\n  defaultTitle?: string\n  enabled?: boolean\n  hidden?: boolean\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string().optional(),\n    href: z.string(),\n    title: z.string(),\n    defaultTitle: z.string().optional(),\n    enabled: z.boolean().optional(),\n    hidden: z.boolean().optional(),\n    pageContext: z.enum(['main', 'admin', 'settings', 'profile']).optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sidebarNavItemSchema).optional(),\n  }),\n)\n\nconst sectionItemSchema: z.ZodType<{\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  order?: number\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string(),\n    label: z.string(),\n    labelKey: z.string().optional(),\n    href: z.string(),\n    order: z.number().optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sectionItemSchema).optional(),\n  }),\n)\n\nconst sectionGroupSchema = z.object({\n  id: z.string(),\n  label: z.string(),\n  labelKey: z.string().optional(),\n  order: z.number().optional(),\n  items: z.array(sectionItemSchema),\n})\n\nconst adminNavResponseSchema = z.object({\n  brand: z.object({\n    name: z.string().optional(),\n    logo: z.object({\n      src: z.string(),\n      alt: z.string().optional(),\n    }).nullable().optional(),\n  }).nullable().optional(),\n  groups: z.array(\n    z.object({\n      id: z.string().optional(),\n      name: z.string(),\n      defaultName: z.string().optional(),\n      items: z.array(sidebarNavItemSchema),\n    }),\n  ),\n  settingsSections: z.array(sectionGroupSchema),\n  settingsPathPrefixes: z.array(z.string()),\n  profileSections: z.array(sectionGroupSchema),\n  profilePathPrefixes: z.array(z.string()),\n  grantedFeatures: z.array(z.string()),\n  roles: z.array(z.string()),\n  // Present when a single organization is in scope; `null` under an all-organizations selection or\n  // when the lookup fails. Declared optional so the response contract stays additive for clients\n  // generated against an older schema.\n  currentOrganization: z.object({\n    id: z.string(),\n    name: z.string(),\n  }).nullable().optional(),\n})\n\nconst adminNavErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { translate, locale } = await resolveTranslations()\n  const container = await createRequestContainer()\n  const cache = container.resolve('cache') as {\n    get?: (key: string) => Promise<unknown>\n    set?: (key: string, value: unknown, options?: { tags?: string[]; ttl?: number }) => Promise<void>\n  } | null\n  let selectedOrganizationId: string | null | undefined\n  let selectedTenantId: string | null | undefined\n  try {\n    const url = new URL(req.url)\n    const orgParam = url.searchParams.get('orgId')\n    const tenantParam = url.searchParams.get('tenantId')\n    selectedOrganizationId = orgParam === null ? undefined : orgParam || null\n    selectedTenantId = tenantParam === null ? undefined : tenantParam || null\n  } catch {\n    selectedOrganizationId = undefined\n    selectedTenantId = undefined\n  }\n\n  let cacheScopeTenantId = auth.tenantId ?? null\n  let cacheScopeOrganizationId = auth.orgId ?? null\n  let cacheScopeSelectedOrganizationId = auth.orgId ?? null\n  try {\n    const { organizationId, scope } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n      request: req,\n    })\n    cacheScopeOrganizationId = organizationId\n    cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null\n    cacheScopeSelectedOrganizationId = scope.selectedId ?? null\n  } catch {\n    cacheScopeOrganizationId = auth.orgId ?? null\n    cacheScopeTenantId = auth.tenantId ?? null\n    cacheScopeSelectedOrganizationId = auth.orgId ?? null\n    selectedOrganizationId = auth.orgId ?? null\n    selectedTenantId = auth.tenantId ?? null\n  }\n\n  // v6: the payload gained `currentOrganization`, and the payload also embeds the enabled-module set,\n  // its declared features, and the backend route manifest. The selection is part of the key because\n  // the resolved organization cannot distinguish \"all organizations\" from \"my own organization\";\n  // use the resolved selection so cookie-driven requests without an `orgId` query remain distinct.\n  // The fingerprint invalidates module-surface changes; the TTL bounds anything it cannot observe.\n  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`\n  const cacheSelection = cacheScopeSelectedOrganizationId ?? '__all__'\n  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${cacheSelection}`\n  try {\n    if (cache?.get) {\n      const cached = await cache.get(cacheKey)\n      if (cached) return NextResponse.json(cached)\n    }\n  } catch {\n    // ignore cache read failures\n  }\n\n  const payload = await resolveBackendChromePayload({\n    auth,\n    locale,\n    modules: groupBackendRoutesByModule(getBackendRouteManifests()),\n    translate: (key, fallback) => (key ? translate(key, fallback) : fallback),\n    request: req,\n    selectedOrganizationId,\n    selectedTenantId,\n  })\n\n  try {\n    if (cache?.set) {\n      const tags = [\n        `rbac:user:${auth.sub}`,\n        cacheScopeTenantId ? `rbac:tenant:${cacheScopeTenantId}` : undefined,\n        `nav:entities:${cacheScopeTenantId || 'null'}`,\n        `nav:locale:${locale}`,\n        `nav:sidebar:user:${auth.sub}`,\n        cacheScopeTenantId ? `nav:sidebar:tenant:${cacheScopeTenantId}` : undefined,\n        cacheScopeOrganizationId ? `nav:sidebar:organization:${cacheScopeOrganizationId}` : undefined,\n        `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${locale}`,\n        ...((Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)),\n      ].filter(Boolean) as string[]\n      await cache.set(cacheKey, payload, { tags, ttl: NAV_CACHE_TTL_MS })\n    }\n  } catch {\n    // ignore cache write failures\n  }\n\n  return NextResponse.json(payload)\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Admin sidebar navigation',\n  methods: {\n    GET: {\n      summary: 'Resolve backend chrome bootstrap payload',\n      description:\n        'Returns the backend chrome payload available to the authenticated administrator after applying scope, RBAC, role defaults, and personal sidebar preferences.',\n      responses: [\n        { status: 200, description: 'Backend chrome payload', schema: adminNavResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: adminNavErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,kCAAkC;AAC3C,SAAS,4BAA4B,mCAAmC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAOA,MAAM,mBAAmB,KAAK,KAAK;AAEnC,MAAM,uBAWD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,IACxB,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,IAChB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,SAAS,YAAY,SAAS,CAAC,EAAE,SAAS;AAAA,IACvE,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,oBAAoB,EAAE,SAAS;AAAA,EACnD,CAAC;AACH;AAEA,MAAM,oBASD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO;AAAA,IACb,OAAO,EAAE,OAAO;AAAA,IAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,EAChD,CAAC;AACH;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,MAAM,iBAAiB;AAClC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,MAAM,EAAE,OAAO;AAAA,MACb,KAAK,EAAE,OAAO;AAAA,MACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzB,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvB,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,MACxB,MAAM,EAAE,OAAO;AAAA,MACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,OAAO,EAAE,MAAM,oBAAoB;AAAA,IACrC,CAAC;AAAA,EACH;AAAA,EACA,kBAAkB,EAAE,MAAM,kBAAkB;AAAA,EAC5C,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxC,iBAAiB,EAAE,MAAM,kBAAkB;AAAA,EAC3C,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACvC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzB,qBAAqB,EAAE,OAAO;AAAA,IAC5B,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EAAE,SAAS,EAAE,SAAS;AACzB,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,EAAE,WAAW,OAAO,IAAI,MAAM,oBAAoB;AACxD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,UAAU,QAAQ,OAAO;AAIvC,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,WAAW,IAAI,aAAa,IAAI,OAAO;AAC7C,UAAM,cAAc,IAAI,aAAa,IAAI,UAAU;AACnD,6BAAyB,aAAa,OAAO,SAAY,YAAY;AACrE,uBAAmB,gBAAgB,OAAO,SAAY,eAAe;AAAA,EACvE,QAAQ;AACN,6BAAyB;AACzB,uBAAmB;AAAA,EACrB;AAEA,MAAI,qBAAqB,KAAK,YAAY;AAC1C,MAAI,2BAA2B,KAAK,SAAS;AAC7C,MAAI,mCAAmC,KAAK,SAAS;AACrD,MAAI;AACF,UAAM,EAAE,gBAAgB,MAAM,IAAI,MAAM,2BAA2B;AAAA,MACjE;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,+BAA2B;AAC3B,yBAAqB,MAAM,YAAY,KAAK,YAAY;AACxD,uCAAmC,MAAM,cAAc;AAAA,EACzD,QAAQ;AACN,+BAA2B,KAAK,SAAS;AACzC,yBAAqB,KAAK,YAAY;AACtC,uCAAmC,KAAK,SAAS;AACjD,6BAAyB,KAAK,SAAS;AACvC,uBAAmB,KAAK,YAAY;AAAA,EACtC;AAOA,QAAM,eAAe,MAAM,4BAA4B,CAAC;AACxD,QAAM,iBAAiB,oCAAoC;AAC3D,QAAM,WAAW,eAAe,YAAY,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,cAAc;AAC1J,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,OAAQ,QAAO,aAAa,KAAK,MAAM;AAAA,IAC7C;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,UAAU,MAAM,4BAA4B;AAAA,IAChD;AAAA,IACA;AAAA,IACA,SAAS,2BAA2B,yBAAyB,CAAC;AAAA,IAC9D,WAAW,CAAC,KAAK,aAAc,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,IAChE,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,OAAO;AAAA,QACX,aAAa,KAAK,GAAG;AAAA,QACrB,qBAAqB,eAAe,kBAAkB,KAAK;AAAA,QAC3D,gBAAgB,sBAAsB,MAAM;AAAA,QAC5C,cAAc,MAAM;AAAA,QACpB,oBAAoB,KAAK,GAAG;AAAA,QAC5B,qBAAqB,sBAAsB,kBAAkB,KAAK;AAAA,QAClE,2BAA2B,4BAA4B,wBAAwB,KAAK;AAAA,QACpF,qBAAqB,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,MAAM;AAAA,QAC7G,IAAK,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,oBAAoB,IAAI,EAAE;AAAA,MAC5F,EAAE,OAAO,OAAO;AAChB,YAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,KAAK,iBAAiB,CAAC;AAAA,IACpE;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,aAAa,KAAK,OAAO;AAClC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,uBAAuB;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { z } from 'zod'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getBackendRouteManifests } from '@open-mercato/shared/modules/registry'\nimport { getModuleSurfaceFingerprint } from '@open-mercato/shared/lib/modules/surfaceFingerprint'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { groupBackendRoutesByModule, resolveBackendChromePayload } from '../../lib/backendChrome'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\n// The fingerprint covers the module set, each module's declared features and\n// the serializable route manifest, so the TTL only has to bound what it cannot\n// see \u2014 chiefly a route `icon` swap, which serializes identically. Rebuilding\n// this payload is expensive (a `renderToStaticMarkup` per nav icon plus several\n// scoped queries), so the bound is generous rather than aggressive.\nconst NAV_CACHE_TTL_MS = 30 * 60 * 1000\n\nconst sidebarNavItemSchema: z.ZodType<{\n  id?: string\n  href: string\n  title: string\n  defaultTitle?: string\n  enabled?: boolean\n  hidden?: boolean\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  iconName?: string\n  iconMarkup?: string\n  order?: number\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string().optional(),\n    href: z.string(),\n    title: z.string(),\n    defaultTitle: z.string().optional(),\n    enabled: z.boolean().optional(),\n    hidden: z.boolean().optional(),\n    pageContext: z.enum(['main', 'admin', 'settings', 'profile']).optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    order: z.number().optional(),\n    children: z.array(sidebarNavItemSchema).optional(),\n  }),\n)\n\nconst sectionItemSchema: z.ZodType<{\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  order?: number\n  iconName?: string\n  iconMarkup?: string\n  children?: any[]\n}> = z.lazy(() =>\n  z.object({\n    id: z.string(),\n    label: z.string(),\n    labelKey: z.string().optional(),\n    href: z.string(),\n    order: z.number().optional(),\n    iconName: z.string().optional(),\n    iconMarkup: z.string().optional(),\n    children: z.array(sectionItemSchema).optional(),\n  }),\n)\n\nconst sectionGroupSchema = z.object({\n  id: z.string(),\n  label: z.string(),\n  labelKey: z.string().optional(),\n  order: z.number().optional(),\n  items: z.array(sectionItemSchema),\n})\n\nconst adminNavResponseSchema = z.object({\n  brand: z.object({\n    name: z.string().optional(),\n    logo: z.object({\n      src: z.string(),\n      alt: z.string().optional(),\n    }).nullable().optional(),\n  }).nullable().optional(),\n  groups: z.array(\n    z.object({\n      id: z.string().optional(),\n      name: z.string(),\n      defaultName: z.string().optional(),\n      items: z.array(sidebarNavItemSchema),\n    }),\n  ),\n  settingsSections: z.array(sectionGroupSchema),\n  settingsPathPrefixes: z.array(z.string()),\n  profileSections: z.array(sectionGroupSchema),\n  profilePathPrefixes: z.array(z.string()),\n  grantedFeatures: z.array(z.string()),\n  roles: z.array(z.string()),\n  // Present when a single organization is in scope; `null` under an all-organizations selection or\n  // when the lookup fails. Declared optional so the response contract stays additive for clients\n  // generated against an older schema.\n  currentOrganization: z.object({\n    id: z.string(),\n    name: z.string(),\n  }).nullable().optional(),\n})\n\nconst adminNavErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { translate, locale } = await resolveTranslations()\n  const container = await createRequestContainer()\n  const cache = container.resolve('cache') as {\n    get?: (key: string) => Promise<unknown>\n    set?: (key: string, value: unknown, options?: { tags?: string[]; ttl?: number }) => Promise<void>\n  } | null\n  let selectedOrganizationId: string | null | undefined\n  let selectedTenantId: string | null | undefined\n  try {\n    const url = new URL(req.url)\n    const orgParam = url.searchParams.get('orgId')\n    const tenantParam = url.searchParams.get('tenantId')\n    selectedOrganizationId = orgParam === null ? undefined : orgParam || null\n    selectedTenantId = tenantParam === null ? undefined : tenantParam || null\n  } catch {\n    selectedOrganizationId = undefined\n    selectedTenantId = undefined\n  }\n\n  let cacheScopeTenantId = auth.tenantId ?? null\n  let cacheScopeOrganizationId = auth.orgId ?? null\n  let cacheScopeSelectedOrganizationId = auth.orgId ?? null\n  try {\n    const { organizationId, scope } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n      request: req,\n    })\n    cacheScopeOrganizationId = organizationId\n    cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null\n    cacheScopeSelectedOrganizationId = scope.selectedId ?? null\n  } catch {\n    cacheScopeOrganizationId = auth.orgId ?? null\n    cacheScopeTenantId = auth.tenantId ?? null\n    cacheScopeSelectedOrganizationId = auth.orgId ?? null\n    selectedOrganizationId = auth.orgId ?? null\n    selectedTenantId = auth.tenantId ?? null\n  }\n\n  // v6: the payload gained `currentOrganization`, and the payload also embeds the enabled-module set,\n  // its declared features, and the backend route manifest. The selection is part of the key because\n  // the resolved organization cannot distinguish \"all organizations\" from \"my own organization\";\n  // use the resolved selection so cookie-driven requests without an `orgId` query remain distinct.\n  // The fingerprint invalidates module-surface changes; the TTL bounds anything it cannot observe.\n  const cacheVersion = `v7:${getModuleSurfaceFingerprint()}`\n  const cacheSelection = cacheScopeSelectedOrganizationId ?? '__all__'\n  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${cacheSelection}`\n  try {\n    if (cache?.get) {\n      const cached = await cache.get(cacheKey)\n      if (cached) return NextResponse.json(cached)\n    }\n  } catch {\n    // ignore cache read failures\n  }\n\n  const payload = await resolveBackendChromePayload({\n    auth,\n    locale,\n    modules: groupBackendRoutesByModule(getBackendRouteManifests()),\n    translate: (key, fallback) => (key ? translate(key, fallback) : fallback),\n    request: req,\n    selectedOrganizationId,\n    selectedTenantId,\n  })\n\n  try {\n    if (cache?.set) {\n      const tags = [\n        `rbac:user:${auth.sub}`,\n        cacheScopeTenantId ? `rbac:tenant:${cacheScopeTenantId}` : undefined,\n        `nav:entities:${cacheScopeTenantId || 'null'}`,\n        `nav:locale:${locale}`,\n        `nav:sidebar:user:${auth.sub}`,\n        cacheScopeTenantId ? `nav:sidebar:tenant:${cacheScopeTenantId}` : undefined,\n        cacheScopeOrganizationId ? `nav:sidebar:organization:${cacheScopeOrganizationId}` : undefined,\n        `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${locale}`,\n        ...((Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)),\n      ].filter(Boolean) as string[]\n      await cache.set(cacheKey, payload, { tags, ttl: NAV_CACHE_TTL_MS })\n    }\n  } catch {\n    // ignore cache write failures\n  }\n\n  return NextResponse.json(payload)\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Admin sidebar navigation',\n  methods: {\n    GET: {\n      summary: 'Resolve backend chrome bootstrap payload',\n      description:\n        'Returns the backend chrome payload available to the authenticated administrator after applying scope, RBAC, role defaults, and personal sidebar preferences.',\n      responses: [\n        { status: 200, description: 'Backend chrome payload', schema: adminNavResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: adminNavErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,kCAAkC;AAC3C,SAAS,4BAA4B,mCAAmC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAOA,MAAM,mBAAmB,KAAK,KAAK;AAEnC,MAAM,uBAYD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,IACxB,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,IAChB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC9B,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,SAAS,YAAY,SAAS,CAAC,EAAE,SAAS;AAAA,IACvE,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,EAAE,MAAM,oBAAoB,EAAE,SAAS;AAAA,EACnD,CAAC;AACH;AAEA,MAAM,oBASD,EAAE;AAAA,EAAK,MACV,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO;AAAA,IACb,OAAO,EAAE,OAAO;AAAA,IAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,EAChD,CAAC;AACH;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,MAAM,iBAAiB;AAClC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,MAAM,EAAE,OAAO;AAAA,MACb,KAAK,EAAE,OAAO;AAAA,MACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzB,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvB,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,MACxB,MAAM,EAAE,OAAO;AAAA,MACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,OAAO,EAAE,MAAM,oBAAoB;AAAA,IACrC,CAAC;AAAA,EACH;AAAA,EACA,kBAAkB,EAAE,MAAM,kBAAkB;AAAA,EAC5C,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxC,iBAAiB,EAAE,MAAM,kBAAkB;AAAA,EAC3C,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACvC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzB,qBAAqB,EAAE,OAAO;AAAA,IAC5B,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EAAE,SAAS,EAAE,SAAS;AACzB,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,EAAE,WAAW,OAAO,IAAI,MAAM,oBAAoB;AACxD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,UAAU,QAAQ,OAAO;AAIvC,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,WAAW,IAAI,aAAa,IAAI,OAAO;AAC7C,UAAM,cAAc,IAAI,aAAa,IAAI,UAAU;AACnD,6BAAyB,aAAa,OAAO,SAAY,YAAY;AACrE,uBAAmB,gBAAgB,OAAO,SAAY,eAAe;AAAA,EACvE,QAAQ;AACN,6BAAyB;AACzB,uBAAmB;AAAA,EACrB;AAEA,MAAI,qBAAqB,KAAK,YAAY;AAC1C,MAAI,2BAA2B,KAAK,SAAS;AAC7C,MAAI,mCAAmC,KAAK,SAAS;AACrD,MAAI;AACF,UAAM,EAAE,gBAAgB,MAAM,IAAI,MAAM,2BAA2B;AAAA,MACjE;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,+BAA2B;AAC3B,yBAAqB,MAAM,YAAY,KAAK,YAAY;AACxD,uCAAmC,MAAM,cAAc;AAAA,EACzD,QAAQ;AACN,+BAA2B,KAAK,SAAS;AACzC,yBAAqB,KAAK,YAAY;AACtC,uCAAmC,KAAK,SAAS;AACjD,6BAAyB,KAAK,SAAS;AACvC,uBAAmB,KAAK,YAAY;AAAA,EACtC;AAOA,QAAM,eAAe,MAAM,4BAA4B,CAAC;AACxD,QAAM,iBAAiB,oCAAoC;AAC3D,QAAM,WAAW,eAAe,YAAY,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,cAAc;AAC1J,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,OAAQ,QAAO,aAAa,KAAK,MAAM;AAAA,IAC7C;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,UAAU,MAAM,4BAA4B;AAAA,IAChD;AAAA,IACA;AAAA,IACA,SAAS,2BAA2B,yBAAyB,CAAC;AAAA,IAC9D,WAAW,CAAC,KAAK,aAAc,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,IAChE,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI;AACF,QAAI,OAAO,KAAK;AACd,YAAM,OAAO;AAAA,QACX,aAAa,KAAK,GAAG;AAAA,QACrB,qBAAqB,eAAe,kBAAkB,KAAK;AAAA,QAC3D,gBAAgB,sBAAsB,MAAM;AAAA,QAC5C,cAAc,MAAM;AAAA,QACpB,oBAAoB,KAAK,GAAG;AAAA,QAC5B,qBAAqB,sBAAsB,kBAAkB,KAAK;AAAA,QAClE,2BAA2B,4BAA4B,wBAAwB,KAAK;AAAA,QACpF,qBAAqB,KAAK,GAAG,IAAI,sBAAsB,MAAM,IAAI,4BAA4B,MAAM,IAAI,MAAM;AAAA,QAC7G,IAAK,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,oBAAoB,IAAI,EAAE;AAAA,MAC5F,EAAE,OAAO,OAAO;AAChB,YAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,KAAK,iBAAiB,CAAC;AAAA,IACpE;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,aAAa,KAAK,OAAO;AAClC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,uBAAuB;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/lib/backendChrome.js

@@ -59,6 +59,17 @@ async function serializeIconMarkup(icon) {
     return void 0;
   }
 }
+const NAV_ITEM_FALLBACK_WEIGHT = 1e4;
+function resolveNavItemWeight(item) {
+  return item.priority ?? item.order ?? NAV_ITEM_FALLBACK_WEIGHT;
+}
+function sortNavItemsByWeight(items) {
+  return [...items].sort((a, b) => {
+    const weightDifference = resolveNavItemWeight(a) - resolveNavItemWeight(b);
+    if (weightDifference !== 0) return weightDifference;
+    return a.title.localeCompare(b.title);
+  });
+}
 async function serializeNavItem(item) {
   return {
     id: item.href,
@@ -70,7 +81,8 @@ async function serializeNavItem(item) {
     pageContext: item.pageContext,
     iconName: typeof item.icon === "string" ? item.icon : void 0,
     iconMarkup: await serializeIconMarkup(item.icon),
-    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : void 0
+    order: resolveNavItemWeight(item),
+    children: item.children ? await Promise.all(sortNavItemsByWeight(item.children).map((child) => serializeNavItem(child))) : void 0
   };
 }
 const defaultGroupOrder = [
@@ -107,7 +119,7 @@ function normalizeGroupWeights(groups) {
   const defaultGroupCount = groupOrder.length;
   groups.forEach((group, index) => {
     const rank = groupOrderIndex.get(group.id);
-    const fallbackWeight = typeof group.weight === "number" ? group.weight : 1e4;
+    const fallbackWeight = typeof group.weight === "number" ? group.weight : NAV_ITEM_FALLBACK_WEIGHT;
     group.weight = (rank !== void 0 ? rank : defaultGroupCount + index) * 1e6 + Math.min(Math.max(fallbackWeight, 0), 999999);
   });
   return groups;
@@ -115,11 +127,10 @@ function normalizeGroupWeights(groups) {
 async function groupEntries(entries) {
   const groupMap = /* @__PURE__ */ new Map();
   for (const entry of entries) {
-    const weight = entry.priority ?? entry.order ?? 1e4;
-    const serializedItem = await serializeNavItem(entry);
+    const weight = resolveNavItemWeight(entry);
     const existing = groupMap.get(entry.groupId);
     if (existing) {
-      existing.items.push(serializedItem);
+      existing.entries.push(entry);
       if (weight < existing.weight) existing.weight = weight;
       continue;
     }
@@ -127,11 +138,18 @@ async function groupEntries(entries) {
       id: entry.groupId,
       name: entry.group,
       defaultName: entry.groupDefaultName,
-      items: [serializedItem],
+      entries: [entry],
       weight
     });
   }
-  return normalizeGroupWeights(Array.from(groupMap.values()));
+  const groups = [];
+  for (const { entries: groupItems, ...group } of groupMap.values()) {
+    groups.push({
+      ...group,
+      items: await Promise.all(sortNavItemsByWeight(groupItems).map((entry) => serializeNavItem(entry)))
+    });
+  }
+  return normalizeGroupWeights(groups);
 }
 function adoptSidebarDefaults(groups) {
   const adoptItems = (items) => items.map((item) => ({

package/dist/modules/auth/lib/backendChrome.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/backendChrome.tsx"],
-  "sourcesContent": ["import * as React from 'react'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { BackendRouteManifestEntry } from '@open-mercato/shared/modules/registry'\nimport type {\n  BackendChromePayload,\n  BackendChromeNavGroup,\n  BackendChromeNavItem,\n  BackendChromeSectionGroup,\n  BackendChromeSectionItem,\n} from '@open-mercato/shared/modules/navigation/backendChrome'\nimport {\n  buildAdminNav,\n  buildSettingsSections,\n  computeSettingsPathPrefixes,\n  convertToSectionNavGroups,\n  type AdminNavItem,\n} from '@open-mercato/ui/backend/utils/nav'\nimport { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'\nimport { profilePathPrefixes, profileSections } from './profile-sections'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getNavGroupOrderOverride } from '@open-mercato/shared/modules/overrides'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveFeatureCheckContext,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  applySidebarPreference,\n  loadFirstRoleSidebarPreference,\n  loadSidebarPreference,\n} from '@open-mercato/core/modules/auth/services/sidebarPreferencesService'\nimport type { SidebarPreferencesSettings } from '@open-mercato/shared/modules/navigation/sidebarPreferences'\n\ntype TranslationFn = (key: string | undefined, fallback: string) => string\n\ntype RouteModule = {\n  id: string\n  backendRoutes?: BackendRouteManifestEntry[]\n}\n\nexport function groupBackendRoutesByModule(routes: BackendRouteManifestEntry[]): RouteModule[] {\n  return Array.from(\n    routes.reduce((grouped, route) => {\n      const list = grouped.get(route.moduleId) ?? []\n      list.push(route)\n      grouped.set(route.moduleId, list)\n      return grouped\n    }, new Map<string, BackendRouteManifestEntry[]>()),\n  ).map(([id, backendRoutes]) => ({ id, backendRoutes }))\n}\n\ntype SerializableSectionItem = {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}\n\ntype SerializableSectionGroup = {\n  id: string\n  label: string\n  labelKey?: string\n  order?: number\n  items: SerializableSectionItem[]\n}\n\ntype ResolvedNavItem = Omit<BackendChromeNavItem, 'defaultTitle' | 'children'> & {\n  defaultTitle: string\n  children?: ResolvedNavItem[]\n}\n\ntype ResolveBackendChromePayloadArgs = {\n  auth: Exclude<AuthContext, null>\n  locale: string\n  modules: RouteModule[]\n  translate: TranslationFn\n  request?: Request\n  selectedOrganizationId?: string | null\n  selectedTenantId?: string | null\n}\n\n/**\n * Settings section weights, keyed by the untranslated group id each page declares as `pageGroupKey`.\n *\n * Mirrors `defaultGroupOrder` above: an id, never a rendered label, so the panel keeps its intended\n * order in every locale and an app-side module can place its own section deterministically (#4843).\n */\nexport const settingsSectionOrder: Record<string, number> = {\n  'settings.sections.system': 1,\n  'settings.sections.auth': 2,\n  'customer_accounts.settings.section': 3,\n  'settings.sections.dataDesigner': 4,\n  'settings.sections.moduleConfigs': 5,\n  'currencies.nav.group': 6,\n  'settings.sections.directory': 7,\n  'settings.sections.featureToggles': 8,\n}\n\ntype NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {\n  id: string\n  defaultName: string\n  items: ResolvedNavItem[]\n  weight: number\n}\n\nlet renderToStaticMarkupPromise: Promise<typeof import('react-dom/server')> | null = null\n\nasync function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<string | undefined> {\n  if (!icon) return undefined\n  if (!renderToStaticMarkupPromise) {\n    renderToStaticMarkupPromise = import('react-dom/server')\n  }\n  const { renderToStaticMarkup } = await renderToStaticMarkupPromise\n\n  const normalizedIcon = typeof icon === 'string'\n    ? resolveRegisteredLucideIconNode(icon, 'size-4')\n    : icon\n\n  if (!normalizedIcon) return undefined\n\n  try {\n    const markup = renderToStaticMarkup(<>{normalizedIcon}</>)\n    return markup.trim().length > 0 ? markup : undefined\n  } catch {\n    // Some icon values may be client-only component references after dependency upgrades.\n    // Avoid taking down the entire nav payload because one icon cannot be rendered server-side.\n    return undefined\n  }\n}\n\nasync function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {\n  return {\n    id: item.href,\n    href: item.href,\n    title: item.title,\n    defaultTitle: item.defaultTitle,\n    enabled: item.enabled,\n    hidden: item.hidden,\n    pageContext: item.pageContext,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : undefined,\n  }\n}\n\nconst defaultGroupOrder = [\n  'customers.nav.group',\n  'catalog.nav.group',\n  'customers~sales.nav.group',\n  'wms.nav.group',\n  'resources.nav.group',\n  'staff.nav.group',\n  'entities.nav.group',\n  'directory.nav.group',\n  'attachments.nav.group',\n]\n\n/**\n * Group ids ranked ahead of everything else, most significant first.\n *\n * An app may prepend its own ids via `overrides.nav.groupOrder` in `modules.ts`; ids it does not name\n * keep the ordering they have today. With no override configured this returns `defaultGroupOrder`\n * itself, so ordering is unchanged for every existing install.\n */\nfunction resolveGroupOrder(): string[] {\n  const override = getNavGroupOrderOverride()\n  if (!override || override.length === 0) return defaultGroupOrder\n  const overridden = new Set(override)\n  return [...override, ...defaultGroupOrder.filter((id) => !overridden.has(id))]\n}\n\nfunction normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const groupOrder = resolveGroupOrder()\n  const groupOrderIndex = new Map(groupOrder.map((id, index) => [id, index]))\n  groups.sort((a, b) => {\n    const aIndex = groupOrderIndex.get(a.id)\n    const bIndex = groupOrderIndex.get(b.id)\n    if (aIndex !== undefined || bIndex !== undefined) {\n      if (aIndex === undefined) return 1\n      if (bIndex === undefined) return -1\n      if (aIndex !== bIndex) return aIndex - bIndex\n    }\n    if (a.weight !== b.weight) return a.weight - b.weight\n    return a.name.localeCompare(b.name)\n  })\n  const defaultGroupCount = groupOrder.length\n  groups.forEach((group, index) => {\n    const rank = groupOrderIndex.get(group.id)\n    const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000\n    group.weight =\n      (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +\n      Math.min(Math.max(fallbackWeight, 0), 999_999)\n  })\n  return groups\n}\n\nasync function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {\n  const groupMap = new Map<string, NavGroupWithWeight>()\n  for (const entry of entries) {\n    const weight = entry.priority ?? entry.order ?? 10_000\n    const serializedItem = await serializeNavItem(entry)\n    const existing = groupMap.get(entry.groupId)\n    if (existing) {\n      existing.items.push(serializedItem)\n      if (weight < existing.weight) existing.weight = weight\n      continue\n    }\n    groupMap.set(entry.groupId, {\n      id: entry.groupId,\n      name: entry.group,\n      defaultName: entry.groupDefaultName,\n      items: [serializedItem],\n      weight,\n    })\n  }\n  return normalizeGroupWeights(Array.from(groupMap.values()))\n}\n\nfunction adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const adoptItems = (items: ResolvedNavItem[]): ResolvedNavItem[] =>\n    items.map((item) => ({\n      ...item,\n      defaultTitle: item.title,\n      children: item.children ? adoptItems(item.children) : undefined,\n    }))\n\n  return groups.map((group) => ({\n    ...group,\n    defaultName: group.name,\n    items: adoptItems(group.items),\n  }))\n}\n\nasync function serializeSectionItem(item: {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}): Promise<BackendChromeSectionItem> {\n  return {\n    id: item.id,\n    label: item.label,\n    labelKey: item.labelKey,\n    href: item.href,\n    order: item.order,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeSectionItem(child))) : undefined,\n  }\n}\n\nasync function serializeSectionGroups(groups: SerializableSectionGroup[]): Promise<BackendChromeSectionGroup[]> {\n  return Promise.all(groups.map(async (group) => ({\n    id: group.id,\n    label: group.label,\n    labelKey: group.labelKey,\n    order: group.order,\n    items: await Promise.all(group.items.map((item) => serializeSectionItem(item))),\n  })))\n}\n\nasync function loadScopedContainer(): Promise<AwilixContainer> {\n  return createRequestContainer()\n}\n\nexport async function resolveBackendChromePayload({\n  auth,\n  locale,\n  modules,\n  translate,\n  request,\n  selectedOrganizationId,\n  selectedTenantId,\n}: ResolveBackendChromePayloadArgs): Promise<BackendChromePayload> {\n  const container = await loadScopedContainer()\n  const em = container.resolve('em') as EntityManager\n  const rbac = container.resolve('rbacService') as {\n    getEffectiveFeatures: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>\n    userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>\n  }\n\n  let scopedOrganizationId: string | null = auth.orgId ?? null\n  let scopedTenantId: string | null = auth.tenantId ?? null\n  // The organization the caller actually *selected*, as distinct from the one the scope resolver fell\n  // back to. `resolveFeatureCheckContext` resolves `organizationId` to `auth.orgId` when no concrete\n  // organization is selected \u2014 which is precisely what an all-organizations view produces \u2014 so the\n  // resolved id cannot answer \"which organization am I viewing\".\n  let concretelySelectedOrganizationId: string | null = null\n  let allowNavigation = true\n\n  try {\n    const { organizationId, scope, allowedOrganizationIds } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      request,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n    })\n    scopedOrganizationId = organizationId\n    scopedTenantId = scope.tenantId ?? auth.tenantId ?? null\n    concretelySelectedOrganizationId = scope.selectedId ?? null\n    if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {\n      allowNavigation = false\n    }\n  } catch {\n    scopedOrganizationId = auth.orgId ?? null\n    scopedTenantId = auth.tenantId ?? null\n    concretelySelectedOrganizationId = null\n  }\n\n  const grantedFeatures = allowNavigation\n    ? await rbac.getEffectiveFeatures(auth.sub, {\n        tenantId: scopedTenantId,\n        organizationId: scopedOrganizationId,\n      })\n    : []\n  const featureChecker = async (features: string[]): Promise<string[]> => {\n    if (!allowNavigation || !features.length) return []\n    const context = {\n      tenantId: scopedTenantId ?? auth.tenantId ?? null,\n      organizationId: scopedOrganizationId ?? null,\n    }\n    const hasAll = await rbac.userHasAllFeatures(auth.sub, features, context)\n    if (hasAll) return features\n\n    const granted: string[] = []\n    for (const feature of features) {\n      const hasFeature = await rbac.userHasAllFeatures(auth.sub, [feature], context)\n      if (hasFeature) granted.push(feature)\n    }\n    return granted\n  }\n\n  let userEntities: Array<{ entityId: string; label: string; href: string }> = []\n  if (allowNavigation) {\n    try {\n      const where: FilterQuery<CustomEntity> = {\n        isActive: true,\n        showInSidebar: true,\n      }\n      where.$and = [\n        { $or: [{ organizationId: scopedOrganizationId ?? undefined }, { organizationId: null }] },\n        { $or: [{ tenantId: scopedTenantId ?? undefined }, { tenantId: null }] },\n      ]\n      const entities = await em.find(CustomEntity, where, { orderBy: { label: 'asc' } })\n      userEntities = entities.map((entity) => ({\n        entityId: entity.entityId,\n        label: entity.label,\n        href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      }))\n    } catch {\n      userEntities = []\n    }\n  }\n\n  const ctxAuth = {\n    roles: auth.roles || [],\n    sub: auth.sub,\n    tenantId: scopedTenantId,\n    orgId: scopedOrganizationId,\n  }\n  const entries = allowNavigation\n    ? await buildAdminNav(\n        modules,\n        { auth: ctxAuth },\n        userEntities,\n        translate,\n        { checkFeatures: featureChecker },\n      )\n    : []\n\n  let rolePreference: SidebarPreferencesSettings | null = null\n  let userPreference: SidebarPreferencesSettings | null = null\n\n  if (Array.isArray(auth.roles) && auth.roles.length > 0) {\n    const roleRecords = scopedTenantId\n      ? await em.find(Role, {\n          name: { $in: auth.roles },\n          tenantId: scopedTenantId,\n        })\n      : []\n    const roleIds = Array.isArray(roleRecords) ? roleRecords.map((role) => role.id) : []\n    if (roleIds.length > 0) {\n      rolePreference = await loadFirstRoleSidebarPreference(em, {\n        roleIds,\n        tenantId: scopedTenantId,\n        locale,\n      })\n    }\n  }\n\n  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub\n  if (effectiveUserId) {\n    userPreference = await loadSidebarPreference(em, {\n      userId: effectiveUserId,\n      tenantId: scopedTenantId,\n      organizationId: scopedOrganizationId,\n      locale,\n    })\n  }\n\n  const baseGroups = await groupEntries(entries)\n  const groupsWithRole = rolePreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseGroups, rolePreference)\n    : baseGroups\n  const baseForUser = adoptSidebarDefaults(groupsWithRole)\n  const appliedGroups = userPreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseForUser, userPreference)\n    : baseForUser\n\n  const settingsSections = await serializeSectionGroups(\n    convertToSectionNavGroups(\n      buildSettingsSections(entries, settingsSectionOrder),\n      translate,\n    ),\n  )\n\n  const requestOrganizationId = request ? getSelectedOrganizationFromRequest(request) : null\n  const fallbackOrganizationId = selectedOrganizationId ?? requestOrganizationId ?? auth.orgId ?? null\n  const brandOrganizationId = scopedOrganizationId\n    ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)\n\n  let brand: BackendChromePayload['brand'] = null\n  // Resolved here rather than left to callers. `brand` only populates when the organization has a\n  // logo, so it is a branding channel, not a dependable \"which organization am I viewing\" source.\n  // Without this field every downstream app has to fetch `/api/directory/organization-switcher` and\n  // walk its tree for the selected id. The row is already loaded below, so the name costs nothing.\n  let currentOrganization: BackendChromePayload['currentOrganization'] = null\n  if (brandOrganizationId && scopedTenantId) {\n    try {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: brandOrganizationId, tenant: scopedTenantId, deletedAt: null },\n        undefined,\n        { tenantId: scopedTenantId, organizationId: brandOrganizationId },\n      )\n      // Only when a concrete organization was selected. Under an all-organizations view\n      // `brandOrganizationId` still resolves (to the caller's own organization, which is what keeps\n      // branding working), so gating on the loaded row alone would misreport the scope.\n      if (organization && concretelySelectedOrganizationId === brandOrganizationId) {\n        currentOrganization = { id: String(organization.id), name: organization.name }\n      }\n      if (organization?.logoUrl) {\n        brand = {\n          name: organization.name,\n          logo: {\n            src: organization.logoUrl,\n            alt: `${organization.name} logo`,\n            preserveAspectRatio: !!organization.logoPreserveAspectRatio,\n          },\n        }\n      }\n    } catch {\n      // Fail soft, as before: a failed organization lookup must not take down the nav payload.\n      brand = null\n      currentOrganization = null\n    }\n  }\n\n  return {\n    groups: appliedGroups.map(({ weight: _weight, ...group }) => group),\n    settingsSections,\n    settingsPathPrefixes: computeSettingsPathPrefixes(buildSettingsSections(entries, settingsSectionOrder)),\n    profileSections: await serializeSectionGroups(profileSections),\n    profilePathPrefixes,\n    grantedFeatures,\n    roles: Array.isArray(auth.roles) ? auth.roles : [],\n    brand,\n    currentOrganization,\n  }\n}\n"],
-  "mappings": "AAmIwC;AAtHxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uCAAuC;AAChD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUA,SAAS,2BAA2B,QAAoD;AAC7F,SAAO,MAAM;AAAA,IACX,OAAO,OAAO,CAAC,SAAS,UAAU;AAChC,YAAM,OAAO,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC;AAC7C,WAAK,KAAK,KAAK;AACf,cAAQ,IAAI,MAAM,UAAU,IAAI;AAChC,aAAO;AAAA,IACT,GAAG,oBAAI,IAAyC,CAAC;AAAA,EACnD,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,OAAO,EAAE,IAAI,cAAc,EAAE;AACxD;AAyCO,MAAM,uBAA+C;AAAA,EAC1D,4BAA4B;AAAA,EAC5B,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,kCAAkC;AAAA,EAClC,mCAAmC;AAAA,EACnC,wBAAwB;AAAA,EACxB,+BAA+B;AAAA,EAC/B,oCAAoC;AACtC;AASA,IAAI,8BAAiF;AAErF,eAAe,oBAAoB,MAAgE;AACjG,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,6BAA6B;AAChC,kCAA8B,OAAO,kBAAkB;AAAA,EACzD;AACA,QAAM,EAAE,qBAAqB,IAAI,MAAM;AAEvC,QAAM,iBAAiB,OAAO,SAAS,WACnC,gCAAgC,MAAM,QAAQ,IAC9C;AAEJ,MAAI,CAAC,eAAgB,QAAO;AAE5B,MAAI;AACF,UAAM,SAAS,qBAAqB,gCAAG,0BAAe,CAAG;AACzD,WAAO,OAAO,KAAK,EAAE,SAAS,IAAI,SAAS;AAAA,EAC7C,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,MAA8C;AAC5E,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,cAAc,KAAK;AAAA,IACnB,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,IAAI;AAAA,EACvG;AACF;AAEA,MAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASA,SAAS,oBAA8B;AACrC,QAAM,WAAW,yBAAyB;AAC1C,MAAI,CAAC,YAAY,SAAS,WAAW,EAAG,QAAO;AAC/C,QAAM,aAAa,IAAI,IAAI,QAAQ;AACnC,SAAO,CAAC,GAAG,UAAU,GAAG,kBAAkB,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AAC/E;AAEA,SAAS,sBAAsB,QAAoD;AACjF,QAAM,aAAa,kBAAkB;AACrC,QAAM,kBAAkB,IAAI,IAAI,WAAW,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;AAC1E,SAAO,KAAK,CAAC,GAAG,MAAM;AACpB,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,QAAI,WAAW,UAAa,WAAW,QAAW;AAChD,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAQ,QAAO,SAAS;AAAA,IACzC;AACA,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,SAAS,EAAE;AAC/C,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACD,QAAM,oBAAoB,WAAW;AACrC,SAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,UAAM,OAAO,gBAAgB,IAAI,MAAM,EAAE;AACzC,UAAM,iBAAiB,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AACzE,UAAM,UACH,SAAS,SAAY,OAAO,oBAAoB,SAAS,MAC1D,KAAK,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,MAAO;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,aAAa,SAAwD;AAClF,QAAM,WAAW,oBAAI,IAAgC;AACrD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,MAAM,YAAY,MAAM,SAAS;AAChD,UAAM,iBAAiB,MAAM,iBAAiB,KAAK;AACnD,UAAM,WAAW,SAAS,IAAI,MAAM,OAAO;AAC3C,QAAI,UAAU;AACZ,eAAS,MAAM,KAAK,cAAc;AAClC,UAAI,SAAS,SAAS,OAAQ,UAAS,SAAS;AAChD;AAAA,IACF;AACA,aAAS,IAAI,MAAM,SAAS;AAAA,MAC1B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,OAAO,CAAC,cAAc;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,sBAAsB,MAAM,KAAK,SAAS,OAAO,CAAC,CAAC;AAC5D;AAEA,SAAS,qBAAqB,QAAoD;AAChF,QAAM,aAAa,CAAC,UAClB,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,UAAU,KAAK,WAAW,WAAW,KAAK,QAAQ,IAAI;AAAA,EACxD,EAAE;AAEJ,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,OAAO,WAAW,MAAM,KAAK;AAAA,EAC/B,EAAE;AACJ;AAEA,eAAe,qBAAqB,MAQE;AACpC,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,qBAAqB,KAAK,CAAC,CAAC,IAAI;AAAA,EAC3G;AACF;AAEA,eAAe,uBAAuB,QAA0E;AAC9G,SAAO,QAAQ,IAAI,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9C,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,CAAC;AAAA,EAChF,EAAE,CAAC;AACL;AAEA,eAAe,sBAAgD;AAC7D,SAAO,uBAAuB;AAChC;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAmE;AACjE,QAAM,YAAY,MAAM,oBAAoB;AAC5C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAK5C,MAAI,uBAAsC,KAAK,SAAS;AACxD,MAAI,iBAAgC,KAAK,YAAY;AAKrD,MAAI,mCAAkD;AACtD,MAAI,kBAAkB;AAEtB,MAAI;AACF,UAAM,EAAE,gBAAgB,OAAO,uBAAuB,IAAI,MAAM,2BAA2B;AAAA,MACzF;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AACD,2BAAuB;AACvB,qBAAiB,MAAM,YAAY,KAAK,YAAY;AACpD,uCAAmC,MAAM,cAAc;AACvD,QAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,WAAW,GAAG;AAChF,wBAAkB;AAAA,IACpB;AAAA,EACF,QAAQ;AACN,2BAAuB,KAAK,SAAS;AACrC,qBAAiB,KAAK,YAAY;AAClC,uCAAmC;AAAA,EACrC;AAEA,QAAM,kBAAkB,kBACpB,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACxC,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC,IACD,CAAC;AACL,QAAM,iBAAiB,OAAO,aAA0C;AACtE,QAAI,CAAC,mBAAmB,CAAC,SAAS,OAAQ,QAAO,CAAC;AAClD,UAAM,UAAU;AAAA,MACd,UAAU,kBAAkB,KAAK,YAAY;AAAA,MAC7C,gBAAgB,wBAAwB;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,OAAO;AACxE,QAAI,OAAQ,QAAO;AAEnB,UAAM,UAAoB,CAAC;AAC3B,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO;AAC7E,UAAI,WAAY,SAAQ,KAAK,OAAO;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAyE,CAAC;AAC9E,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AACA,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,CAAC,EAAE,gBAAgB,wBAAwB,OAAU,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AAAA,QACzF,EAAE,KAAK,CAAC,EAAE,UAAU,kBAAkB,OAAU,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,MACzE;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AACjF,qBAAe,SAAS,IAAI,CAAC,YAAY;AAAA,QACvC,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,MAAM,0BAA0B,mBAAmB,OAAO,QAAQ,CAAC;AAAA,MACrE,EAAE;AAAA,IACJ,QAAQ;AACN,qBAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACA,QAAM,UAAU,kBACZ,MAAM;AAAA,IACJ;AAAA,IACA,EAAE,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,EAAE,eAAe,eAAe;AAAA,EAClC,IACA,CAAC;AAEL,MAAI,iBAAoD;AACxD,MAAI,iBAAoD;AAExD,MAAI,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG;AACtD,UAAM,cAAc,iBAChB,MAAM,GAAG,KAAK,MAAM;AAAA,MAClB,MAAM,EAAE,KAAK,KAAK,MAAM;AAAA,MACxB,UAAU;AAAA,IACZ,CAAC,IACD,CAAC;AACL,UAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,uBAAiB,MAAM,+BAA+B,IAAI;AAAA,QACxD;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,WAAW,KAAK,SAAS,KAAK;AAC3D,MAAI,iBAAiB;AACnB,qBAAiB,MAAM,sBAAsB,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,QAAM,iBAAiB,iBACnB,uBAA2C,YAAY,cAAc,IACrE;AACJ,QAAM,cAAc,qBAAqB,cAAc;AACvD,QAAM,gBAAgB,iBAClB,uBAA2C,aAAa,cAAc,IACtE;AAEJ,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,MACE,sBAAsB,SAAS,oBAAoB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,wBAAwB,UAAU,mCAAmC,OAAO,IAAI;AACtF,QAAM,yBAAyB,0BAA0B,yBAAyB,KAAK,SAAS;AAChG,QAAM,sBAAsB,yBACtB,0BAA0B,CAAC,4BAA4B,sBAAsB,IAAI,yBAAyB;AAEhH,MAAI,QAAuC;AAK3C,MAAI,sBAAmE;AACvE,MAAI,uBAAuB,gBAAgB;AACzC,QAAI;AACF,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,QACnE;AAAA,QACA,EAAE,UAAU,gBAAgB,gBAAgB,oBAAoB;AAAA,MAClE;AAIA,UAAI,gBAAgB,qCAAqC,qBAAqB;AAC5E,8BAAsB,EAAE,IAAI,OAAO,aAAa,EAAE,GAAG,MAAM,aAAa,KAAK;AAAA,MAC/E;AACA,UAAI,cAAc,SAAS;AACzB,gBAAQ;AAAA,UACN,MAAM,aAAa;AAAA,UACnB,MAAM;AAAA,YACJ,KAAK,aAAa;AAAA,YAClB,KAAK,GAAG,aAAa,IAAI;AAAA,YACzB,qBAAqB,CAAC,CAAC,aAAa;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAEN,cAAQ;AACR,4BAAsB;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,cAAc,IAAI,CAAC,EAAE,QAAQ,SAAS,GAAG,MAAM,MAAM,KAAK;AAAA,IAClE;AAAA,IACA,sBAAsB,4BAA4B,sBAAsB,SAAS,oBAAoB,CAAC;AAAA,IACtG,iBAAiB,MAAM,uBAAuB,eAAe;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["import * as React from 'react'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { BackendRouteManifestEntry } from '@open-mercato/shared/modules/registry'\nimport type {\n  BackendChromePayload,\n  BackendChromeNavGroup,\n  BackendChromeNavItem,\n  BackendChromeSectionGroup,\n  BackendChromeSectionItem,\n} from '@open-mercato/shared/modules/navigation/backendChrome'\nimport {\n  buildAdminNav,\n  buildSettingsSections,\n  computeSettingsPathPrefixes,\n  convertToSectionNavGroups,\n  type AdminNavItem,\n} from '@open-mercato/ui/backend/utils/nav'\nimport { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'\nimport { profilePathPrefixes, profileSections } from './profile-sections'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getNavGroupOrderOverride } from '@open-mercato/shared/modules/overrides'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveFeatureCheckContext,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  applySidebarPreference,\n  loadFirstRoleSidebarPreference,\n  loadSidebarPreference,\n} from '@open-mercato/core/modules/auth/services/sidebarPreferencesService'\nimport type { SidebarPreferencesSettings } from '@open-mercato/shared/modules/navigation/sidebarPreferences'\n\ntype TranslationFn = (key: string | undefined, fallback: string) => string\n\ntype RouteModule = {\n  id: string\n  backendRoutes?: BackendRouteManifestEntry[]\n}\n\nexport function groupBackendRoutesByModule(routes: BackendRouteManifestEntry[]): RouteModule[] {\n  return Array.from(\n    routes.reduce((grouped, route) => {\n      const list = grouped.get(route.moduleId) ?? []\n      list.push(route)\n      grouped.set(route.moduleId, list)\n      return grouped\n    }, new Map<string, BackendRouteManifestEntry[]>()),\n  ).map(([id, backendRoutes]) => ({ id, backendRoutes }))\n}\n\ntype SerializableSectionItem = {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}\n\ntype SerializableSectionGroup = {\n  id: string\n  label: string\n  labelKey?: string\n  order?: number\n  items: SerializableSectionItem[]\n}\n\ntype ResolvedNavItem = Omit<BackendChromeNavItem, 'defaultTitle' | 'children'> & {\n  defaultTitle: string\n  children?: ResolvedNavItem[]\n}\n\ntype ResolveBackendChromePayloadArgs = {\n  auth: Exclude<AuthContext, null>\n  locale: string\n  modules: RouteModule[]\n  translate: TranslationFn\n  request?: Request\n  selectedOrganizationId?: string | null\n  selectedTenantId?: string | null\n}\n\n/**\n * Settings section weights, keyed by the untranslated group id each page declares as `pageGroupKey`.\n *\n * Mirrors `defaultGroupOrder` above: an id, never a rendered label, so the panel keeps its intended\n * order in every locale and an app-side module can place its own section deterministically (#4843).\n */\nexport const settingsSectionOrder: Record<string, number> = {\n  'settings.sections.system': 1,\n  'settings.sections.auth': 2,\n  'customer_accounts.settings.section': 3,\n  'settings.sections.dataDesigner': 4,\n  'settings.sections.moduleConfigs': 5,\n  'currencies.nav.group': 6,\n  'settings.sections.directory': 7,\n  'settings.sections.featureToggles': 8,\n}\n\ntype NavGroupWithWeight = Omit<BackendChromeNavGroup, 'id' | 'defaultName' | 'items'> & {\n  id: string\n  defaultName: string\n  items: ResolvedNavItem[]\n  weight: number\n}\n\nlet renderToStaticMarkupPromise: Promise<typeof import('react-dom/server')> | null = null\n\nasync function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<string | undefined> {\n  if (!icon) return undefined\n  if (!renderToStaticMarkupPromise) {\n    renderToStaticMarkupPromise = import('react-dom/server')\n  }\n  const { renderToStaticMarkup } = await renderToStaticMarkupPromise\n\n  const normalizedIcon = typeof icon === 'string'\n    ? resolveRegisteredLucideIconNode(icon, 'size-4')\n    : icon\n\n  if (!normalizedIcon) return undefined\n\n  try {\n    const markup = renderToStaticMarkup(<>{normalizedIcon}</>)\n    return markup.trim().length > 0 ? markup : undefined\n  } catch {\n    // Some icon values may be client-only component references after dependency upgrades.\n    // Avoid taking down the entire nav payload because one icon cannot be rendered server-side.\n    return undefined\n  }\n}\n\nconst NAV_ITEM_FALLBACK_WEIGHT = 10_000\n\n/**\n * The weight a nav entry sorts by, using the same `priority ?? order` precedence as `buildAdminNav`.\n *\n * `serializeNavItem` emits this resolved number rather than the raw declaration, including the\n * fallback, so a consumer that re-sorts by the field it receives lands on the order it was served in.\n * Emitting the raw `priority ?? order` would leave `order` undefined on any page declaring neither \u2014\n * and the `(a.order ?? 0) - (b.order ?? 0)` idiom this codebase uses elsewhere would then hoist those\n * pages to the top instead of leaving them last (#4845).\n */\nfunction resolveNavItemWeight(item: AdminNavItem): number {\n  return item.priority ?? item.order ?? NAV_ITEM_FALLBACK_WEIGHT\n}\n\nfunction sortNavItemsByWeight(items: AdminNavItem[]): AdminNavItem[] {\n  return [...items].sort((a, b) => {\n    const weightDifference = resolveNavItemWeight(a) - resolveNavItemWeight(b)\n    if (weightDifference !== 0) return weightDifference\n    return a.title.localeCompare(b.title)\n  })\n}\n\nasync function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {\n  return {\n    id: item.href,\n    href: item.href,\n    title: item.title,\n    defaultTitle: item.defaultTitle,\n    enabled: item.enabled,\n    hidden: item.hidden,\n    pageContext: item.pageContext,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    order: resolveNavItemWeight(item),\n    children: item.children\n      ? await Promise.all(sortNavItemsByWeight(item.children).map((child) => serializeNavItem(child)))\n      : undefined,\n  }\n}\n\nconst defaultGroupOrder = [\n  'customers.nav.group',\n  'catalog.nav.group',\n  'customers~sales.nav.group',\n  'wms.nav.group',\n  'resources.nav.group',\n  'staff.nav.group',\n  'entities.nav.group',\n  'directory.nav.group',\n  'attachments.nav.group',\n]\n\n/**\n * Group ids ranked ahead of everything else, most significant first.\n *\n * An app may prepend its own ids via `overrides.nav.groupOrder` in `modules.ts`; ids it does not name\n * keep the ordering they have today. With no override configured this returns `defaultGroupOrder`\n * itself, so ordering is unchanged for every existing install.\n */\nfunction resolveGroupOrder(): string[] {\n  const override = getNavGroupOrderOverride()\n  if (!override || override.length === 0) return defaultGroupOrder\n  const overridden = new Set(override)\n  return [...override, ...defaultGroupOrder.filter((id) => !overridden.has(id))]\n}\n\nfunction normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const groupOrder = resolveGroupOrder()\n  const groupOrderIndex = new Map(groupOrder.map((id, index) => [id, index]))\n  groups.sort((a, b) => {\n    const aIndex = groupOrderIndex.get(a.id)\n    const bIndex = groupOrderIndex.get(b.id)\n    if (aIndex !== undefined || bIndex !== undefined) {\n      if (aIndex === undefined) return 1\n      if (bIndex === undefined) return -1\n      if (aIndex !== bIndex) return aIndex - bIndex\n    }\n    if (a.weight !== b.weight) return a.weight - b.weight\n    return a.name.localeCompare(b.name)\n  })\n  const defaultGroupCount = groupOrder.length\n  groups.forEach((group, index) => {\n    const rank = groupOrderIndex.get(group.id)\n    const fallbackWeight = typeof group.weight === 'number' ? group.weight : NAV_ITEM_FALLBACK_WEIGHT\n    group.weight =\n      (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +\n      Math.min(Math.max(fallbackWeight, 0), 999_999)\n  })\n  return groups\n}\n\nasync function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {\n  const groupMap = new Map<string, Omit<NavGroupWithWeight, 'items'> & { entries: AdminNavItem[] }>()\n  for (const entry of entries) {\n    const weight = resolveNavItemWeight(entry)\n    const existing = groupMap.get(entry.groupId)\n    if (existing) {\n      existing.entries.push(entry)\n      if (weight < existing.weight) existing.weight = weight\n      continue\n    }\n    groupMap.set(entry.groupId, {\n      id: entry.groupId,\n      name: entry.group,\n      defaultName: entry.groupDefaultName,\n      entries: [entry],\n      weight,\n    })\n  }\n  const groups: NavGroupWithWeight[] = []\n  for (const { entries: groupItems, ...group } of groupMap.values()) {\n    groups.push({\n      ...group,\n      items: await Promise.all(sortNavItemsByWeight(groupItems).map((entry) => serializeNavItem(entry))),\n    })\n  }\n  return normalizeGroupWeights(groups)\n}\n\nfunction adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {\n  const adoptItems = (items: ResolvedNavItem[]): ResolvedNavItem[] =>\n    items.map((item) => ({\n      ...item,\n      defaultTitle: item.title,\n      children: item.children ? adoptItems(item.children) : undefined,\n    }))\n\n  return groups.map((group) => ({\n    ...group,\n    defaultName: group.name,\n    items: adoptItems(group.items),\n  }))\n}\n\nasync function serializeSectionItem(item: {\n  id: string\n  label: string\n  labelKey?: string\n  href: string\n  icon?: React.ReactNode\n  order?: number\n  children?: SerializableSectionItem[]\n}): Promise<BackendChromeSectionItem> {\n  return {\n    id: item.id,\n    label: item.label,\n    labelKey: item.labelKey,\n    href: item.href,\n    order: item.order,\n    iconName: typeof item.icon === 'string' ? item.icon : undefined,\n    iconMarkup: await serializeIconMarkup(item.icon),\n    children: item.children ? await Promise.all(item.children.map((child) => serializeSectionItem(child))) : undefined,\n  }\n}\n\nasync function serializeSectionGroups(groups: SerializableSectionGroup[]): Promise<BackendChromeSectionGroup[]> {\n  return Promise.all(groups.map(async (group) => ({\n    id: group.id,\n    label: group.label,\n    labelKey: group.labelKey,\n    order: group.order,\n    items: await Promise.all(group.items.map((item) => serializeSectionItem(item))),\n  })))\n}\n\nasync function loadScopedContainer(): Promise<AwilixContainer> {\n  return createRequestContainer()\n}\n\nexport async function resolveBackendChromePayload({\n  auth,\n  locale,\n  modules,\n  translate,\n  request,\n  selectedOrganizationId,\n  selectedTenantId,\n}: ResolveBackendChromePayloadArgs): Promise<BackendChromePayload> {\n  const container = await loadScopedContainer()\n  const em = container.resolve('em') as EntityManager\n  const rbac = container.resolve('rbacService') as {\n    getEffectiveFeatures: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>\n    userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>\n  }\n\n  let scopedOrganizationId: string | null = auth.orgId ?? null\n  let scopedTenantId: string | null = auth.tenantId ?? null\n  // The organization the caller actually *selected*, as distinct from the one the scope resolver fell\n  // back to. `resolveFeatureCheckContext` resolves `organizationId` to `auth.orgId` when no concrete\n  // organization is selected \u2014 which is precisely what an all-organizations view produces \u2014 so the\n  // resolved id cannot answer \"which organization am I viewing\".\n  let concretelySelectedOrganizationId: string | null = null\n  let allowNavigation = true\n\n  try {\n    const { organizationId, scope, allowedOrganizationIds } = await resolveFeatureCheckContext({\n      container,\n      auth,\n      request,\n      selectedId: selectedOrganizationId,\n      tenantId: selectedTenantId,\n    })\n    scopedOrganizationId = organizationId\n    scopedTenantId = scope.tenantId ?? auth.tenantId ?? null\n    concretelySelectedOrganizationId = scope.selectedId ?? null\n    if (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length === 0) {\n      allowNavigation = false\n    }\n  } catch {\n    scopedOrganizationId = auth.orgId ?? null\n    scopedTenantId = auth.tenantId ?? null\n    concretelySelectedOrganizationId = null\n  }\n\n  const grantedFeatures = allowNavigation\n    ? await rbac.getEffectiveFeatures(auth.sub, {\n        tenantId: scopedTenantId,\n        organizationId: scopedOrganizationId,\n      })\n    : []\n  const featureChecker = async (features: string[]): Promise<string[]> => {\n    if (!allowNavigation || !features.length) return []\n    const context = {\n      tenantId: scopedTenantId ?? auth.tenantId ?? null,\n      organizationId: scopedOrganizationId ?? null,\n    }\n    const hasAll = await rbac.userHasAllFeatures(auth.sub, features, context)\n    if (hasAll) return features\n\n    const granted: string[] = []\n    for (const feature of features) {\n      const hasFeature = await rbac.userHasAllFeatures(auth.sub, [feature], context)\n      if (hasFeature) granted.push(feature)\n    }\n    return granted\n  }\n\n  let userEntities: Array<{ entityId: string; label: string; href: string }> = []\n  if (allowNavigation) {\n    try {\n      const where: FilterQuery<CustomEntity> = {\n        isActive: true,\n        showInSidebar: true,\n      }\n      where.$and = [\n        { $or: [{ organizationId: scopedOrganizationId ?? undefined }, { organizationId: null }] },\n        { $or: [{ tenantId: scopedTenantId ?? undefined }, { tenantId: null }] },\n      ]\n      const entities = await em.find(CustomEntity, where, { orderBy: { label: 'asc' } })\n      userEntities = entities.map((entity) => ({\n        entityId: entity.entityId,\n        label: entity.label,\n        href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      }))\n    } catch {\n      userEntities = []\n    }\n  }\n\n  const ctxAuth = {\n    roles: auth.roles || [],\n    sub: auth.sub,\n    tenantId: scopedTenantId,\n    orgId: scopedOrganizationId,\n  }\n  const entries = allowNavigation\n    ? await buildAdminNav(\n        modules,\n        { auth: ctxAuth },\n        userEntities,\n        translate,\n        { checkFeatures: featureChecker },\n      )\n    : []\n\n  let rolePreference: SidebarPreferencesSettings | null = null\n  let userPreference: SidebarPreferencesSettings | null = null\n\n  if (Array.isArray(auth.roles) && auth.roles.length > 0) {\n    const roleRecords = scopedTenantId\n      ? await em.find(Role, {\n          name: { $in: auth.roles },\n          tenantId: scopedTenantId,\n        })\n      : []\n    const roleIds = Array.isArray(roleRecords) ? roleRecords.map((role) => role.id) : []\n    if (roleIds.length > 0) {\n      rolePreference = await loadFirstRoleSidebarPreference(em, {\n        roleIds,\n        tenantId: scopedTenantId,\n        locale,\n      })\n    }\n  }\n\n  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub\n  if (effectiveUserId) {\n    userPreference = await loadSidebarPreference(em, {\n      userId: effectiveUserId,\n      tenantId: scopedTenantId,\n      organizationId: scopedOrganizationId,\n      locale,\n    })\n  }\n\n  const baseGroups = await groupEntries(entries)\n  const groupsWithRole = rolePreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseGroups, rolePreference)\n    : baseGroups\n  const baseForUser = adoptSidebarDefaults(groupsWithRole)\n  const appliedGroups = userPreference\n    ? applySidebarPreference<NavGroupWithWeight>(baseForUser, userPreference)\n    : baseForUser\n\n  const settingsSections = await serializeSectionGroups(\n    convertToSectionNavGroups(\n      buildSettingsSections(entries, settingsSectionOrder),\n      translate,\n    ),\n  )\n\n  const requestOrganizationId = request ? getSelectedOrganizationFromRequest(request) : null\n  const fallbackOrganizationId = selectedOrganizationId ?? requestOrganizationId ?? auth.orgId ?? null\n  const brandOrganizationId = scopedOrganizationId\n    ?? (fallbackOrganizationId && !isAllOrganizationsSelection(fallbackOrganizationId) ? fallbackOrganizationId : null)\n\n  let brand: BackendChromePayload['brand'] = null\n  // Resolved here rather than left to callers. `brand` only populates when the organization has a\n  // logo, so it is a branding channel, not a dependable \"which organization am I viewing\" source.\n  // Without this field every downstream app has to fetch `/api/directory/organization-switcher` and\n  // walk its tree for the selected id. The row is already loaded below, so the name costs nothing.\n  let currentOrganization: BackendChromePayload['currentOrganization'] = null\n  if (brandOrganizationId && scopedTenantId) {\n    try {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: brandOrganizationId, tenant: scopedTenantId, deletedAt: null },\n        undefined,\n        { tenantId: scopedTenantId, organizationId: brandOrganizationId },\n      )\n      // Only when a concrete organization was selected. Under an all-organizations view\n      // `brandOrganizationId` still resolves (to the caller's own organization, which is what keeps\n      // branding working), so gating on the loaded row alone would misreport the scope.\n      if (organization && concretelySelectedOrganizationId === brandOrganizationId) {\n        currentOrganization = { id: String(organization.id), name: organization.name }\n      }\n      if (organization?.logoUrl) {\n        brand = {\n          name: organization.name,\n          logo: {\n            src: organization.logoUrl,\n            alt: `${organization.name} logo`,\n            preserveAspectRatio: !!organization.logoPreserveAspectRatio,\n          },\n        }\n      }\n    } catch {\n      // Fail soft, as before: a failed organization lookup must not take down the nav payload.\n      brand = null\n      currentOrganization = null\n    }\n  }\n\n  return {\n    groups: appliedGroups.map(({ weight: _weight, ...group }) => group),\n    settingsSections,\n    settingsPathPrefixes: computeSettingsPathPrefixes(buildSettingsSections(entries, settingsSectionOrder)),\n    profileSections: await serializeSectionGroups(profileSections),\n    profilePathPrefixes,\n    grantedFeatures,\n    roles: Array.isArray(auth.roles) ? auth.roles : [],\n    brand,\n    currentOrganization,\n  }\n}\n"],
+  "mappings": "AAmIwC;AAtHxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uCAAuC;AAChD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUA,SAAS,2BAA2B,QAAoD;AAC7F,SAAO,MAAM;AAAA,IACX,OAAO,OAAO,CAAC,SAAS,UAAU;AAChC,YAAM,OAAO,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC;AAC7C,WAAK,KAAK,KAAK;AACf,cAAQ,IAAI,MAAM,UAAU,IAAI;AAChC,aAAO;AAAA,IACT,GAAG,oBAAI,IAAyC,CAAC;AAAA,EACnD,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,OAAO,EAAE,IAAI,cAAc,EAAE;AACxD;AAyCO,MAAM,uBAA+C;AAAA,EAC1D,4BAA4B;AAAA,EAC5B,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,kCAAkC;AAAA,EAClC,mCAAmC;AAAA,EACnC,wBAAwB;AAAA,EACxB,+BAA+B;AAAA,EAC/B,oCAAoC;AACtC;AASA,IAAI,8BAAiF;AAErF,eAAe,oBAAoB,MAAgE;AACjG,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,6BAA6B;AAChC,kCAA8B,OAAO,kBAAkB;AAAA,EACzD;AACA,QAAM,EAAE,qBAAqB,IAAI,MAAM;AAEvC,QAAM,iBAAiB,OAAO,SAAS,WACnC,gCAAgC,MAAM,QAAQ,IAC9C;AAEJ,MAAI,CAAC,eAAgB,QAAO;AAE5B,MAAI;AACF,UAAM,SAAS,qBAAqB,gCAAG,0BAAe,CAAG;AACzD,WAAO,OAAO,KAAK,EAAE,SAAS,IAAI,SAAS;AAAA,EAC7C,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,2BAA2B;AAWjC,SAAS,qBAAqB,MAA4B;AACxD,SAAO,KAAK,YAAY,KAAK,SAAS;AACxC;AAEA,SAAS,qBAAqB,OAAuC;AACnE,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM;AAC/B,UAAM,mBAAmB,qBAAqB,CAAC,IAAI,qBAAqB,CAAC;AACzE,QAAI,qBAAqB,EAAG,QAAO;AACnC,WAAO,EAAE,MAAM,cAAc,EAAE,KAAK;AAAA,EACtC,CAAC;AACH;AAEA,eAAe,iBAAiB,MAA8C;AAC5E,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,cAAc,KAAK;AAAA,IACnB,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,OAAO,qBAAqB,IAAI;AAAA,IAChC,UAAU,KAAK,WACX,MAAM,QAAQ,IAAI,qBAAqB,KAAK,QAAQ,EAAE,IAAI,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,IAC7F;AAAA,EACN;AACF;AAEA,MAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASA,SAAS,oBAA8B;AACrC,QAAM,WAAW,yBAAyB;AAC1C,MAAI,CAAC,YAAY,SAAS,WAAW,EAAG,QAAO;AAC/C,QAAM,aAAa,IAAI,IAAI,QAAQ;AACnC,SAAO,CAAC,GAAG,UAAU,GAAG,kBAAkB,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AAC/E;AAEA,SAAS,sBAAsB,QAAoD;AACjF,QAAM,aAAa,kBAAkB;AACrC,QAAM,kBAAkB,IAAI,IAAI,WAAW,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;AAC1E,SAAO,KAAK,CAAC,GAAG,MAAM;AACpB,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,UAAM,SAAS,gBAAgB,IAAI,EAAE,EAAE;AACvC,QAAI,WAAW,UAAa,WAAW,QAAW;AAChD,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAW,QAAO;AACjC,UAAI,WAAW,OAAQ,QAAO,SAAS;AAAA,IACzC;AACA,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,SAAS,EAAE;AAC/C,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AACD,QAAM,oBAAoB,WAAW;AACrC,SAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,UAAM,OAAO,gBAAgB,IAAI,MAAM,EAAE;AACzC,UAAM,iBAAiB,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AACzE,UAAM,UACH,SAAS,SAAY,OAAO,oBAAoB,SAAS,MAC1D,KAAK,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,MAAO;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,aAAa,SAAwD;AAClF,QAAM,WAAW,oBAAI,IAA6E;AAClG,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,qBAAqB,KAAK;AACzC,UAAM,WAAW,SAAS,IAAI,MAAM,OAAO;AAC3C,QAAI,UAAU;AACZ,eAAS,QAAQ,KAAK,KAAK;AAC3B,UAAI,SAAS,SAAS,OAAQ,UAAS,SAAS;AAChD;AAAA,IACF;AACA,aAAS,IAAI,MAAM,SAAS;AAAA,MAC1B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,SAAS,CAAC,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,SAA+B,CAAC;AACtC,aAAW,EAAE,SAAS,YAAY,GAAG,MAAM,KAAK,SAAS,OAAO,GAAG;AACjE,WAAO,KAAK;AAAA,MACV,GAAG;AAAA,MACH,OAAO,MAAM,QAAQ,IAAI,qBAAqB,UAAU,EAAE,IAAI,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC;AAAA,IACnG,CAAC;AAAA,EACH;AACA,SAAO,sBAAsB,MAAM;AACrC;AAEA,SAAS,qBAAqB,QAAoD;AAChF,QAAM,aAAa,CAAC,UAClB,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,cAAc,KAAK;AAAA,IACnB,UAAU,KAAK,WAAW,WAAW,KAAK,QAAQ,IAAI;AAAA,EACxD,EAAE;AAEJ,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,OAAO,WAAW,MAAM,KAAK;AAAA,EAC/B,EAAE;AACJ;AAEA,eAAe,qBAAqB,MAQE;AACpC,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IACtD,YAAY,MAAM,oBAAoB,KAAK,IAAI;AAAA,IAC/C,UAAU,KAAK,WAAW,MAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,qBAAqB,KAAK,CAAC,CAAC,IAAI;AAAA,EAC3G;AACF;AAEA,eAAe,uBAAuB,QAA0E;AAC9G,SAAO,QAAQ,IAAI,OAAO,IAAI,OAAO,WAAW;AAAA,IAC9C,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,CAAC;AAAA,EAChF,EAAE,CAAC;AACL;AAEA,eAAe,sBAAgD;AAC7D,SAAO,uBAAuB;AAChC;AAEA,eAAsB,4BAA4B;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAmE;AACjE,QAAM,YAAY,MAAM,oBAAoB;AAC5C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAK5C,MAAI,uBAAsC,KAAK,SAAS;AACxD,MAAI,iBAAgC,KAAK,YAAY;AAKrD,MAAI,mCAAkD;AACtD,MAAI,kBAAkB;AAEtB,MAAI;AACF,UAAM,EAAE,gBAAgB,OAAO,uBAAuB,IAAI,MAAM,2BAA2B;AAAA,MACzF;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AACD,2BAAuB;AACvB,qBAAiB,MAAM,YAAY,KAAK,YAAY;AACpD,uCAAmC,MAAM,cAAc;AACvD,QAAI,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,WAAW,GAAG;AAChF,wBAAkB;AAAA,IACpB;AAAA,EACF,QAAQ;AACN,2BAAuB,KAAK,SAAS;AACrC,qBAAiB,KAAK,YAAY;AAClC,uCAAmC;AAAA,EACrC;AAEA,QAAM,kBAAkB,kBACpB,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACxC,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC,IACD,CAAC;AACL,QAAM,iBAAiB,OAAO,aAA0C;AACtE,QAAI,CAAC,mBAAmB,CAAC,SAAS,OAAQ,QAAO,CAAC;AAClD,UAAM,UAAU;AAAA,MACd,UAAU,kBAAkB,KAAK,YAAY;AAAA,MAC7C,gBAAgB,wBAAwB;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,OAAO;AACxE,QAAI,OAAQ,QAAO;AAEnB,UAAM,UAAoB,CAAC;AAC3B,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO;AAC7E,UAAI,WAAY,SAAQ,KAAK,OAAO;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,MAAI,eAAyE,CAAC;AAC9E,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AACA,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,CAAC,EAAE,gBAAgB,wBAAwB,OAAU,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AAAA,QACzF,EAAE,KAAK,CAAC,EAAE,UAAU,kBAAkB,OAAU,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,MACzE;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AACjF,qBAAe,SAAS,IAAI,CAAC,YAAY;AAAA,QACvC,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,MAAM,0BAA0B,mBAAmB,OAAO,QAAQ,CAAC;AAAA,MACrE,EAAE;AAAA,IACJ,QAAQ;AACN,qBAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACA,QAAM,UAAU,kBACZ,MAAM;AAAA,IACJ;AAAA,IACA,EAAE,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,EAAE,eAAe,eAAe;AAAA,EAClC,IACA,CAAC;AAEL,MAAI,iBAAoD;AACxD,MAAI,iBAAoD;AAExD,MAAI,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG;AACtD,UAAM,cAAc,iBAChB,MAAM,GAAG,KAAK,MAAM;AAAA,MAClB,MAAM,EAAE,KAAK,KAAK,MAAM;AAAA,MACxB,UAAU;AAAA,IACZ,CAAC,IACD,CAAC;AACL,UAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,uBAAiB,MAAM,+BAA+B,IAAI;AAAA,QACxD;AAAA,QACA,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,WAAW,KAAK,SAAS,KAAK;AAC3D,MAAI,iBAAiB;AACnB,qBAAiB,MAAM,sBAAsB,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,QAAM,iBAAiB,iBACnB,uBAA2C,YAAY,cAAc,IACrE;AACJ,QAAM,cAAc,qBAAqB,cAAc;AACvD,QAAM,gBAAgB,iBAClB,uBAA2C,aAAa,cAAc,IACtE;AAEJ,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,MACE,sBAAsB,SAAS,oBAAoB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,wBAAwB,UAAU,mCAAmC,OAAO,IAAI;AACtF,QAAM,yBAAyB,0BAA0B,yBAAyB,KAAK,SAAS;AAChG,QAAM,sBAAsB,yBACtB,0BAA0B,CAAC,4BAA4B,sBAAsB,IAAI,yBAAyB;AAEhH,MAAI,QAAuC;AAK3C,MAAI,sBAAmE;AACvE,MAAI,uBAAuB,gBAAgB;AACzC,QAAI;AACF,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,qBAAqB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,QACnE;AAAA,QACA,EAAE,UAAU,gBAAgB,gBAAgB,oBAAoB;AAAA,MAClE;AAIA,UAAI,gBAAgB,qCAAqC,qBAAqB;AAC5E,8BAAsB,EAAE,IAAI,OAAO,aAAa,EAAE,GAAG,MAAM,aAAa,KAAK;AAAA,MAC/E;AACA,UAAI,cAAc,SAAS;AACzB,gBAAQ;AAAA,UACN,MAAM,aAAa;AAAA,UACnB,MAAM;AAAA,YACJ,KAAK,aAAa;AAAA,YAClB,KAAK,GAAG,aAAa,IAAI;AAAA,YACzB,qBAAqB,CAAC,CAAC,aAAa;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAEN,cAAQ;AACR,4BAAsB;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,cAAc,IAAI,CAAC,EAAE,QAAQ,SAAS,GAAG,MAAM,MAAM,KAAK;AAAA,IAClE;AAAA,IACA,sBAAsB,4BAA4B,sBAAsB,SAAS,oBAAoB,CAAC;AAAA,IACtG,iBAAiB,MAAM,uBAAuB,eAAe;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6915.1.ac6031c503",
+  "version": "0.6.8-develop.6917.1.af45bc96e2",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6915.1.ac6031c503",
-    "@open-mercato/shared": "0.6.8-develop.6915.1.ac6031c503",
-    "@open-mercato/ui": "0.6.8-develop.6915.1.ac6031c503",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6917.1.af45bc96e2",
+    "@open-mercato/shared": "0.6.8-develop.6917.1.af45bc96e2",
+    "@open-mercato/ui": "0.6.8-develop.6917.1.af45bc96e2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6915.1.ac6031c503",
-    "@open-mercato/shared": "0.6.8-develop.6915.1.ac6031c503",
-    "@open-mercato/ui": "0.6.8-develop.6915.1.ac6031c503",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6917.1.af45bc96e2",
+    "@open-mercato/shared": "0.6.8-develop.6917.1.af45bc96e2",
+    "@open-mercato/ui": "0.6.8-develop.6917.1.af45bc96e2",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/auth/api/admin/nav.ts

@@ -30,6 +30,7 @@ const sidebarNavItemSchema: z.ZodType<{
   pageContext?: 'main' | 'admin' | 'settings' | 'profile'
   iconName?: string
   iconMarkup?: string
+  order?: number
   children?: any[]
 }> = z.lazy(() =>
   z.object({
@@ -42,6 +43,7 @@ const sidebarNavItemSchema: z.ZodType<{
     pageContext: z.enum(['main', 'admin', 'settings', 'profile']).optional(),
     iconName: z.string().optional(),
     iconMarkup: z.string().optional(),
+    order: z.number().optional(),
     children: z.array(sidebarNavItemSchema).optional(),
   }),
 )
@@ -161,7 +163,7 @@ export async function GET(req: Request) {
   // the resolved organization cannot distinguish "all organizations" from "my own organization";
   // use the resolved selection so cookie-driven requests without an `orgId` query remain distinct.
   // The fingerprint invalidates module-surface changes; the TTL bounds anything it cannot observe.
-  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`
+  const cacheVersion = `v7:${getModuleSurfaceFingerprint()}`
   const cacheSelection = cacheScopeSelectedOrganizationId ?? '__all__'
   const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${cacheSelection}`
   try {

package/src/modules/auth/lib/backendChrome.tsx

@@ -138,6 +138,29 @@ async function serializeIconMarkup(icon: React.ReactNode | undefined): Promise<s
   }
 }
 
+const NAV_ITEM_FALLBACK_WEIGHT = 10_000
+
+/**
+ * The weight a nav entry sorts by, using the same `priority ?? order` precedence as `buildAdminNav`.
+ *
+ * `serializeNavItem` emits this resolved number rather than the raw declaration, including the
+ * fallback, so a consumer that re-sorts by the field it receives lands on the order it was served in.
+ * Emitting the raw `priority ?? order` would leave `order` undefined on any page declaring neither —
+ * and the `(a.order ?? 0) - (b.order ?? 0)` idiom this codebase uses elsewhere would then hoist those
+ * pages to the top instead of leaving them last (#4845).
+ */
+function resolveNavItemWeight(item: AdminNavItem): number {
+  return item.priority ?? item.order ?? NAV_ITEM_FALLBACK_WEIGHT
+}
+
+function sortNavItemsByWeight(items: AdminNavItem[]): AdminNavItem[] {
+  return [...items].sort((a, b) => {
+    const weightDifference = resolveNavItemWeight(a) - resolveNavItemWeight(b)
+    if (weightDifference !== 0) return weightDifference
+    return a.title.localeCompare(b.title)
+  })
+}
+
 async function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {
   return {
     id: item.href,
@@ -149,7 +172,10 @@ async function serializeNavItem(item: AdminNavItem): Promise<ResolvedNavItem> {
     pageContext: item.pageContext,
     iconName: typeof item.icon === 'string' ? item.icon : undefined,
     iconMarkup: await serializeIconMarkup(item.icon),
-    children: item.children ? await Promise.all(item.children.map((child) => serializeNavItem(child))) : undefined,
+    order: resolveNavItemWeight(item),
+    children: item.children
+      ? await Promise.all(sortNavItemsByWeight(item.children).map((child) => serializeNavItem(child)))
+      : undefined,
   }
 }
 
@@ -196,7 +222,7 @@ function normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight
   const defaultGroupCount = groupOrder.length
   groups.forEach((group, index) => {
     const rank = groupOrderIndex.get(group.id)
-    const fallbackWeight = typeof group.weight === 'number' ? group.weight : 10_000
+    const fallbackWeight = typeof group.weight === 'number' ? group.weight : NAV_ITEM_FALLBACK_WEIGHT
     group.weight =
       (rank !== undefined ? rank : defaultGroupCount + index) * 1_000_000 +
       Math.min(Math.max(fallbackWeight, 0), 999_999)
@@ -205,13 +231,12 @@ function normalizeGroupWeights(groups: NavGroupWithWeight[]): NavGroupWithWeight
 }
 
 async function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight[]> {
-  const groupMap = new Map<string, NavGroupWithWeight>()
+  const groupMap = new Map<string, Omit<NavGroupWithWeight, 'items'> & { entries: AdminNavItem[] }>()
   for (const entry of entries) {
-    const weight = entry.priority ?? entry.order ?? 10_000
-    const serializedItem = await serializeNavItem(entry)
+    const weight = resolveNavItemWeight(entry)
     const existing = groupMap.get(entry.groupId)
     if (existing) {
-      existing.items.push(serializedItem)
+      existing.entries.push(entry)
       if (weight < existing.weight) existing.weight = weight
       continue
     }
@@ -219,11 +244,18 @@ async function groupEntries(entries: AdminNavItem[]): Promise<NavGroupWithWeight
       id: entry.groupId,
       name: entry.group,
       defaultName: entry.groupDefaultName,
-      items: [serializedItem],
+      entries: [entry],
       weight,
     })
   }
-  return normalizeGroupWeights(Array.from(groupMap.values()))
+  const groups: NavGroupWithWeight[] = []
+  for (const { entries: groupItems, ...group } of groupMap.values()) {
+    groups.push({
+      ...group,
+      items: await Promise.all(sortNavItemsByWeight(groupItems).map((entry) => serializeNavItem(entry))),
+    })
+  }
+  return normalizeGroupWeights(groups)
 }
 
 function adoptSidebarDefaults(groups: NavGroupWithWeight[]): NavGroupWithWeight[] {