@open-mercato/core 0.6.8-develop.7066.1.6bfa9ff69f → 0.6.8-develop.7068.1.c55b52e1a1

package/dist/modules/audit_logs/services/actionLogService.js

@@ -2,7 +2,8 @@ import { sql } from "kysely";
 import { ActionLog } from "@open-mercato/core/modules/audit_logs/data/entities";
 import {
   actionLogCreateSchema,
-  actionLogListSchema
+  actionLogListSchema,
+  uuid
 } from "@open-mercato/core/modules/audit_logs/data/validators";
 import { isRecord } from "@open-mercato/core/modules/audit_logs/lib/changeRows";
 import {
@@ -24,6 +25,39 @@ const SORT_FIELDS = {
   createdAt: "action_logs.created_at"
 };
 const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/;
+const SCHEMA_UUID_REGEX = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
+const API_KEY_ACTOR_PREFIX = "api_key:";
+const SYSTEM_ACTOR_PREFIX = "system:";
+const SYSTEM_ACTOR_CONTEXT_KEY = "systemActor";
+const SYSTEM_ACTOR_REFERENCE_MAX_LENGTH = 255;
+function toNullableUuid(value) {
+  return typeof value === "string" && UUID_REGEX.test(value) ? value : null;
+}
+function isSchemaUuid(value) {
+  if (runtimeValidationAvailable === false) return SCHEMA_UUID_REGEX.test(value);
+  try {
+    return uuid.safeParse(value).success;
+  } catch (err) {
+    if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false;
+    return SCHEMA_UUID_REGEX.test(value);
+  }
+}
+function readActorCandidate(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function normalizeActorUserId(value) {
+  const candidate = readActorCandidate(value);
+  if (!candidate) return null;
+  const unwrapped = candidate.startsWith(API_KEY_ACTOR_PREFIX) ? candidate.slice(API_KEY_ACTOR_PREFIX.length) : candidate;
+  return isSchemaUuid(unwrapped) ? unwrapped : null;
+}
+function toSystemActorReference(candidate) {
+  if (!candidate.startsWith(SYSTEM_ACTOR_PREFIX)) return null;
+  if (candidate.length === SYSTEM_ACTOR_PREFIX.length) return null;
+  return candidate.slice(0, SYSTEM_ACTOR_REFERENCE_MAX_LENGTH);
+}
 function readString(record, ...keys) {
   for (const key of keys) {
     const value = record[key];
@@ -132,13 +166,14 @@ class ActionLogService {
     return log;
   }
   parseCreateInput(input) {
+    const sanitized = this.sanitizeActor(input);
     let data;
     const schema = actionLogCreateSchema;
     const canValidate = Boolean(schema && typeof schema.parse === "function");
     const shouldValidate = canValidate && runtimeValidationAvailable !== false;
     if (shouldValidate) {
       try {
-        data = schema.parse(input);
+        data = schema.parse(sanitized);
         runtimeValidationAvailable = true;
       } catch (err) {
         if (!isZodRuntimeMissing(err) && !validationWarningLogged) {
@@ -146,13 +181,28 @@ class ActionLogService {
           logger.warn("Falling back to permissive action log payload parser", { err });
         }
         if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false;
-        data = this.normalizeInput(input);
+        data = this.normalizeInput(sanitized);
       }
     } else {
-      data = this.normalizeInput(input);
+      data = this.normalizeInput(sanitized);
     }
     return data;
   }
+  sanitizeActor(input) {
+    if (!input) return input;
+    const candidate = readActorCandidate(input.actorUserId);
+    const actorUserId = normalizeActorUserId(candidate);
+    const systemActorReference = candidate && !actorUserId ? toSystemActorReference(candidate) : null;
+    if (!systemActorReference) {
+      if (actorUserId === (input.actorUserId ?? null)) return input;
+      return { ...input, actorUserId };
+    }
+    const context = isRecord(input.context) ? { ...input.context } : {};
+    if (context[SYSTEM_ACTOR_CONTEXT_KEY] === void 0) {
+      context[SYSTEM_ACTOR_CONTEXT_KEY] = systemActorReference;
+    }
+    return { ...input, actorUserId, context };
+  }
   createLogEntity(fork, data) {
     const projection = deriveActionLogProjection({
       actorUserId: data.actorUserId ?? null,
@@ -210,12 +260,6 @@ class ActionLogService {
         context: void 0
       };
     }
-    const UUID_REGEX2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/;
-    const toNullableUuid = (value) => {
-      if (typeof value !== "string" || value.length === 0) return null;
-      const candidate = value.startsWith("api_key:") ? value.slice("api_key:".length) : value;
-      return UUID_REGEX2.test(candidate) ? candidate : null;
-    };
     const normalizeRecordLike = (value) => {
       if (value === null) return null;
       if (Array.isArray(value)) return value;
@@ -226,7 +270,7 @@ class ActionLogService {
     return {
       tenantId: toNullableUuid(input.tenantId),
       organizationId: toNullableUuid(input.organizationId),
-      actorUserId: toNullableUuid(input.actorUserId),
+      actorUserId: normalizeActorUserId(input.actorUserId),
       commandId: typeof input.commandId === "string" && input.commandId.length > 0 ? input.commandId : "unknown",
       actionLabel: toOptionalString(input.actionLabel) ?? void 0,
       resourceKind: toOptionalString(input.resourceKind) ?? void 0,
@@ -551,6 +595,7 @@ class ActionLogService {
   }
 }
 export {
-  ActionLogService
+  ActionLogService,
+  SCHEMA_UUID_REGEX
 };
 //# sourceMappingURL=actionLogService.js.map

package/dist/modules/audit_logs/services/actionLogService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/services/actionLogService.ts"],
-  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  TenantDataEncryptionService,\n  parseDecryptedFieldValue,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'action-log-service' })\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\nconst UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          return parseDecryptedFieldValue(decrypted)\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      // Audit log jsonb columns are encrypted as JSON-stringified payloads. After the\n      // service-level `decryptEntityPayload` call (which now returns raw strings \u2014\n      // see issue #1810 follow-up), reattach the structured shape via\n      // `parseDecryptedFieldValue` before running the recursive `deepDecrypt` walk\n      // so nested encrypted strings inside payload objects/arrays are handled.\n      const restoreJson = (value: unknown): unknown =>\n        typeof value === 'string' ? parseDecryptedFieldValue(value) : value\n\n      merged.changesJson = deepDecrypt(restoreJson(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json))\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(restoreJson(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before))\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(restoreJson(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after))\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(restoreJson(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload))\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(restoreJson(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json))\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        logger.warn('Failed to decrypt action log entry', { err })\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persist(log).flush()\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          logger.warn('Falling back to permissive action log payload parser', { err })\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      relatedResourceKind: toOptionalString(data.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(data.relatedResourceId) ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        relatedResourceKind: null,\n        relatedResourceId: null,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value\n      return UUID_REGEX.test(candidate) ? candidate : null\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      relatedResourceKind: toOptionalString(input.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(input.relatedResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    let query = (this.buildListQuery(parsed) as any).select('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query = query.limit(limit).offset(offset)\n    }\n\n    const rows = await query.execute()\n    const ids = rows.map((row: any) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry: any) => [entry.id, entry]))\n    return ids\n      .map((id: any) => byId.get(id))\n      .filter((entry: any): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery): any {\n    let query = (this.em.getKysely<any>() as any)\n      .selectFrom('action_logs')\n      .selectAll()\n      .where('action_logs.deleted_at', 'is', null) as any\n\n    if (parsed.tenantId) query = query.where('action_logs.tenant_id', '=', parsed.tenantId)\n    if (parsed.organizationId) query = query.where('action_logs.organization_id', '=', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query = query.where('action_logs.actor_user_id', '=', actorUserIds[0])\n    if (actorUserIds.length > 1) query = query.where('action_logs.actor_user_id', 'in', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query = query.where((eb: any) =>\n        eb.or([\n          eb.and([\n            eb('action_logs.resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.parent_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.parent_resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.related_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.related_resource_id', '=', parsed.resourceId),\n          ]),\n        ])\n      )\n    } else {\n      if (parsed.resourceKind) query = query.where('action_logs.resource_kind', '=', parsed.resourceKind)\n      if (parsed.resourceId) query = query.where('action_logs.resource_id', '=', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query = query.where('action_logs.undo_token', 'is not', null)\n    if (parsed.before) query = query.where('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query = query.where('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length === 1) query = query.where('action_logs.primary_changed_field', '=', fieldNames[0])\n    if (fieldNames.length > 1) query = query.where('action_logs.primary_changed_field', 'in', fieldNames)\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query = query.where('action_logs.action_type', '=', actionTypes[0])\n    if (actionTypes.length > 1) query = query.where('action_logs.action_type', 'in', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query = query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query = query.orderBy(sql`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '')`, sortDir)\n        break\n      case 'action':\n        query = query.orderBy(sql`coalesce(action_logs.action_type, '')`, sortDir)\n        break\n      case 'field':\n        query = query.orderBy(sql`coalesce(action_logs.primary_changed_field, '')`, sortDir)\n        break\n      case 'source':\n        query = query.orderBy(sql`coalesce(action_logs.source_key, '')`, sortDir)\n        break\n      case 'createdAt':\n      default:\n        query = query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query = query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query = query.orderBy('action_logs.created_at', 'desc')\n    query = query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await (this.buildListQuery(parsed) as any)\n      .clearSelect()\n      .clearOrderBy()\n      .select(sql<string>`count(*)`.as('count'))\n      .executeTakeFirst()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async claimForUndo(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'done', deletedAt: null },\n      { executionState: 'undoing' },\n    )\n    return affected === 1\n  }\n\n  async releaseUndoClaim(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'undoing', deletedAt: null },\n      { executionState: 'done' },\n    )\n    return affected === 1\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = (this.em.getKysely<any>() as any)\n        .selectFrom('action_logs')\n        .select([\n          'action_logs.id',\n          'action_logs.tenant_id',\n          'action_logs.organization_id',\n          'action_logs.actor_user_id',\n          'action_logs.command_id',\n          'action_logs.action_label',\n          'action_logs.snapshot_before',\n          'action_logs.changes_json',\n          'action_logs.context_json',\n          'action_logs.action_type',\n          'action_logs.source_key',\n          'action_logs.changed_fields',\n          'action_logs.primary_changed_field',\n          'action_logs.created_at',\n        ])\n        .where('action_logs.deleted_at', 'is', null) as any\n\n      if (options.tenantId) rowsQuery.where('action_logs.tenant_id', '=', options.tenantId)\n      if (options.organizationId) rowsQuery.where('action_logs.organization_id', '=', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.action_type', 'is', null),\n            eb('action_logs.source_key', 'is', null),\n            eb('action_logs.changed_fields', 'is', null),\n          ])\n        )\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.created_at', '>', cursorCreatedAt),\n            eb.and([\n              eb('action_logs.created_at', '=', cursorCreatedAt),\n              eb('action_logs.id', '>', cursorId),\n            ]),\n          ])\n        )\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await (this.em.getKysely<any>() as any)\n            .updateTable('action_logs')\n            .set({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n            .where('id', '=', row.id)\n            .execute()\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,WAAW;AACpB,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC;AAAA,EAEE;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAEnF,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AACA,MAAM,aAAa;AAkCnB,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,iBAAO,yBAAyBA,UAAS;AAAA,QAC3C;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAOA,YAAM,cAAc,CAAC,UACnB,OAAO,UAAU,WAAW,yBAAyB,KAAK,IAAI;AAEhE,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc,CAAC;AAC5I,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,eAAO,KAAK,sCAAsC,EAAE,IAAI,CAAC;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,QAAQ,GAAG,EAAE,MAAM;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,iBAAO,KAAK,wDAAwD,EAAE,IAAI,CAAC;AAAA,QAC7E;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,qBAAqB,iBAAiB,KAAK,mBAAmB,KAAK;AAAA,MACnE,mBAAmB,iBAAiB,KAAK,iBAAiB,KAAK;AAAA,MAC/D,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAMC,cAAa;AACnB,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,YAAM,YAAY,MAAM,WAAW,UAAU,IAAI,MAAM,MAAM,WAAW,MAAM,IAAI;AAClF,aAAOA,YAAW,KAAK,SAAS,IAAI,YAAY;AAAA,IAClD;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,qBAAqB,iBAAiB,MAAM,mBAAmB,KAAK;AAAA,MACpE,mBAAmB,iBAAiB,MAAM,iBAAiB,KAAK;AAAA,MAChE,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,QAAI,QAAS,KAAK,eAAe,MAAM,EAAU,OAAO,sBAAsB;AAE9E,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,cAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAC1C;AAEA,UAAM,OAAO,MAAM,MAAM,QAAQ;AACjC,UAAM,MAAM,KAAK,IAAI,CAAC,QAAa,IAAI,EAAE,EAAE,OAAO,OAAO;AACzD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAe,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AACnE,WAAO,IACJ,IAAI,CAAC,OAAY,KAAK,IAAI,EAAE,CAAC,EAC7B,OAAO,CAAC,UAAmC,QAAQ,KAAK,CAAC;AAAA,EAC9D;AAAA,EAEQ,eAAe,QAAiC;AACtD,QAAI,QAAS,KAAK,GAAG,UAAe,EACjC,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,0BAA0B,MAAM,IAAI;AAE7C,QAAI,OAAO,SAAU,SAAQ,MAAM,MAAM,yBAAyB,KAAK,OAAO,QAAQ;AACtF,QAAI,OAAO,eAAgB,SAAQ,MAAM,MAAM,+BAA+B,KAAK,OAAO,cAAc;AAExG,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,SAAQ,MAAM,MAAM,6BAA6B,KAAK,aAAa,CAAC,CAAC;AACpG,QAAI,aAAa,SAAS,EAAG,SAAQ,MAAM,MAAM,6BAA6B,MAAM,YAAY;AAEhG,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,cAAQ,MAAM;AAAA,QAAM,CAAC,OACnB,GAAG,GAAG;AAAA,UACJ,GAAG,IAAI;AAAA,YACL,GAAG,6BAA6B,KAAK,OAAO,YAAY;AAAA,YACxD,GAAG,2BAA2B,KAAK,OAAO,UAAU;AAAA,UACtD,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,oCAAoC,KAAK,OAAO,YAAY;AAAA,YAC/D,GAAG,kCAAkC,KAAK,OAAO,UAAU;AAAA,UAC7D,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,qCAAqC,KAAK,OAAO,YAAY;AAAA,YAChE,GAAG,mCAAmC,KAAK,OAAO,UAAU;AAAA,UAC9D,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,UAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,6BAA6B,KAAK,OAAO,YAAY;AAClG,UAAI,OAAO,WAAY,SAAQ,MAAM,MAAM,2BAA2B,KAAK,OAAO,UAAU;AAAA,IAC9F;AAEA,QAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,0BAA0B,UAAU,IAAI;AACrF,QAAI,OAAO,OAAQ,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,MAAM;AACnF,QAAI,OAAO,MAAO,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,KAAK;AAEjF,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,WAAW,EAAG,SAAQ,MAAM,MAAM,qCAAqC,KAAK,WAAW,CAAC,CAAC;AACxG,QAAI,WAAW,SAAS,EAAG,SAAQ,MAAM,MAAM,qCAAqC,MAAM,UAAU;AAEpG,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,SAAQ,MAAM,MAAM,2BAA2B,KAAK,YAAY,CAAC,CAAC;AAChG,QAAI,YAAY,SAAS,EAAG,SAAQ,MAAM,MAAM,2BAA2B,MAAM,WAAW;AAE5F,QAAI,OAAO,cAAc,QAAQ;AAC/B,cAAQ,MAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IAC9F;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,gBAAQ,MAAM,QAAQ,oEAAoE,OAAO;AACjG;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,4CAA4C,OAAO;AACzE;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,sDAAsD,OAAO;AACnF;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,2CAA2C,OAAO;AACxE;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,MAAM,QAAQ,YAAY,WAAW,OAAO;AACpD,gBAAQ,MAAM,QAAQ,kBAAkB,OAAO;AAC/C,eAAO;AAAA,IACX;AAEA,YAAQ,MAAM,QAAQ,0BAA0B,MAAM;AACtD,YAAQ,MAAM,QAAQ,kBAAkB,MAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAO,KAAK,eAAe,MAAM,EAC1C,YAAY,EACZ,aAAa,EACb,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AAEpB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAA8B;AAC/C,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,QAAQ,WAAW,KAAK;AAAA,MAC9C,EAAE,gBAAgB,UAAU;AAAA,IAC9B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAiB,IAA8B;AACnD,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,WAAW,WAAW,KAAK;AAAA,MACjD,EAAE,gBAAgB,OAAO;AAAA,IAC3B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAMC,UAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAa,KAAK,GAAG,UAAe,EACvC,WAAW,aAAa,EACxB,OAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EACA,MAAM,0BAA0B,MAAM,IAAI;AAE7C,UAAI,QAAQ,SAAU,WAAU,MAAM,yBAAyB,KAAK,QAAQ,QAAQ;AACpF,UAAI,QAAQ,eAAgB,WAAU,MAAM,+BAA+B,KAAK,QAAQ,cAAc;AAEtG,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,2BAA2B,MAAM,IAAI;AAAA,YACxC,GAAG,0BAA0B,MAAM,IAAI;AAAA,YACvC,GAAG,8BAA8B,MAAM,IAAI;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,0BAA0B,KAAK,eAAe;AAAA,YACjD,GAAG,IAAI;AAAA,cACL,GAAG,0BAA0B,KAAK,eAAe;AAAA,cACjD,GAAG,kBAAkB,KAAK,QAAQ;AAAA,YACpC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAO,KAAK,GAAG,UAAe,EAC3B,YAAY,aAAa,EACzB,IAAI;AAAA,YACH,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC,EACA,MAAM,MAAM,KAAK,IAAI,EAAE,EACvB,QAAQ;AAEX,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,UAAAA,QAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB,MAAAA;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
-  "names": ["decrypted", "UUID_REGEX", "logger"]
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  uuid,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  TenantDataEncryptionService,\n  parseDecryptedFieldValue,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'action-log-service' })\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\nconst UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n// Mirrors what `uuid` (`data/validators.ts`) accepts \u2014 versions 1-8 plus the nil and\n// max UUIDs \u2014 and is used only when the zod runtime is unavailable, so the actor\n// sanitizer can never reject a value `actionLogCreateSchema` would have accepted.\nexport const SCHEMA_UUID_REGEX = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/\nconst API_KEY_ACTOR_PREFIX = 'api_key:'\nconst SYSTEM_ACTOR_PREFIX = 'system:'\n// `context.systemActor` names the automated principal behind an entry; `context.source`\n// (read by `deriveActionLogSource`) names the channel it arrived through. They are\n// siblings on purpose and never contradict each other: an entry carrying `systemActor`\n// has a null actor column, which already derives the `system` source.\nconst SYSTEM_ACTOR_CONTEXT_KEY = 'systemActor'\nconst SYSTEM_ACTOR_REFERENCE_MAX_LENGTH = 255\n\nfunction toNullableUuid(value: unknown): string | null {\n  return typeof value === 'string' && UUID_REGEX.test(value) ? value : null\n}\n\nfunction isSchemaUuid(value: string): boolean {\n  if (runtimeValidationAvailable === false) return SCHEMA_UUID_REGEX.test(value)\n\n  try {\n    return uuid.safeParse(value).success\n  } catch (err) {\n    if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n    return SCHEMA_UUID_REGEX.test(value)\n  }\n}\n\nfunction readActorCandidate(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\nfunction normalizeActorUserId(value: unknown): string | null {\n  const candidate = readActorCandidate(value)\n  if (!candidate) return null\n  const unwrapped = candidate.startsWith(API_KEY_ACTOR_PREFIX)\n    ? candidate.slice(API_KEY_ACTOR_PREFIX.length)\n    : candidate\n\n  return isSchemaUuid(unwrapped) ? unwrapped : null\n}\n\nfunction toSystemActorReference(candidate: string): string | null {\n  if (!candidate.startsWith(SYSTEM_ACTOR_PREFIX)) return null\n  if (candidate.length === SYSTEM_ACTOR_PREFIX.length) return null\n  return candidate.slice(0, SYSTEM_ACTOR_REFERENCE_MAX_LENGTH)\n}\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          return parseDecryptedFieldValue(decrypted)\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      // Audit log jsonb columns are encrypted as JSON-stringified payloads. After the\n      // service-level `decryptEntityPayload` call (which now returns raw strings \u2014\n      // see issue #1810 follow-up), reattach the structured shape via\n      // `parseDecryptedFieldValue` before running the recursive `deepDecrypt` walk\n      // so nested encrypted strings inside payload objects/arrays are handled.\n      const restoreJson = (value: unknown): unknown =>\n        typeof value === 'string' ? parseDecryptedFieldValue(value) : value\n\n      merged.changesJson = deepDecrypt(restoreJson(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json))\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(restoreJson(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before))\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(restoreJson(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after))\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(restoreJson(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload))\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(restoreJson(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json))\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        logger.warn('Failed to decrypt action log entry', { err })\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persist(log).flush()\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    const sanitized = this.sanitizeActor(input)\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(sanitized)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          logger.warn('Falling back to permissive action log payload parser', { err })\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(sanitized)\n      }\n    } else {\n      data = this.normalizeInput(sanitized)\n    }\n\n    return data\n  }\n\n  private sanitizeActor(input: ActionLogCreateInput): ActionLogCreateInput {\n    if (!input) return input\n    const candidate = readActorCandidate(input.actorUserId)\n    const actorUserId = normalizeActorUserId(candidate)\n    const systemActorReference = candidate && !actorUserId ? toSystemActorReference(candidate) : null\n\n    if (!systemActorReference) {\n      if (actorUserId === (input.actorUserId ?? null)) return input\n      return { ...input, actorUserId }\n    }\n\n    const context = isRecord(input.context) ? { ...input.context } : {}\n    if (context[SYSTEM_ACTOR_CONTEXT_KEY] === undefined) {\n      context[SYSTEM_ACTOR_CONTEXT_KEY] = systemActorReference\n    }\n\n    return { ...input, actorUserId, context }\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      relatedResourceKind: toOptionalString(data.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(data.relatedResourceId) ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        relatedResourceKind: null,\n        relatedResourceId: null,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: normalizeActorUserId(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      relatedResourceKind: toOptionalString(input.relatedResourceKind) ?? null,\n      relatedResourceId: toOptionalString(input.relatedResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    let query = (this.buildListQuery(parsed) as any).select('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query = query.limit(limit).offset(offset)\n    }\n\n    const rows = await query.execute()\n    const ids = rows.map((row: any) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry: any) => [entry.id, entry]))\n    return ids\n      .map((id: any) => byId.get(id))\n      .filter((entry: any): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery): any {\n    let query = (this.em.getKysely<any>() as any)\n      .selectFrom('action_logs')\n      .selectAll()\n      .where('action_logs.deleted_at', 'is', null) as any\n\n    if (parsed.tenantId) query = query.where('action_logs.tenant_id', '=', parsed.tenantId)\n    if (parsed.organizationId) query = query.where('action_logs.organization_id', '=', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query = query.where('action_logs.actor_user_id', '=', actorUserIds[0])\n    if (actorUserIds.length > 1) query = query.where('action_logs.actor_user_id', 'in', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query = query.where((eb: any) =>\n        eb.or([\n          eb.and([\n            eb('action_logs.resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.parent_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.parent_resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.related_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.related_resource_id', '=', parsed.resourceId),\n          ]),\n        ])\n      )\n    } else {\n      if (parsed.resourceKind) query = query.where('action_logs.resource_kind', '=', parsed.resourceKind)\n      if (parsed.resourceId) query = query.where('action_logs.resource_id', '=', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query = query.where('action_logs.undo_token', 'is not', null)\n    if (parsed.before) query = query.where('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query = query.where('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length === 1) query = query.where('action_logs.primary_changed_field', '=', fieldNames[0])\n    if (fieldNames.length > 1) query = query.where('action_logs.primary_changed_field', 'in', fieldNames)\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query = query.where('action_logs.action_type', '=', actionTypes[0])\n    if (actionTypes.length > 1) query = query.where('action_logs.action_type', 'in', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query = query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query = query.orderBy(sql`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '')`, sortDir)\n        break\n      case 'action':\n        query = query.orderBy(sql`coalesce(action_logs.action_type, '')`, sortDir)\n        break\n      case 'field':\n        query = query.orderBy(sql`coalesce(action_logs.primary_changed_field, '')`, sortDir)\n        break\n      case 'source':\n        query = query.orderBy(sql`coalesce(action_logs.source_key, '')`, sortDir)\n        break\n      case 'createdAt':\n      default:\n        query = query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query = query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query = query.orderBy('action_logs.created_at', 'desc')\n    query = query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await (this.buildListQuery(parsed) as any)\n      .clearSelect()\n      .clearOrderBy()\n      .select(sql<string>`count(*)`.as('count'))\n      .executeTakeFirst()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async claimForUndo(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'done', deletedAt: null },\n      { executionState: 'undoing' },\n    )\n    return affected === 1\n  }\n\n  async releaseUndoClaim(id: string): Promise<boolean> {\n    const affected = await this.em.nativeUpdate(\n      ActionLog,\n      { id, executionState: 'undoing', deletedAt: null },\n      { executionState: 'done' },\n    )\n    return affected === 1\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = (this.em.getKysely<any>() as any)\n        .selectFrom('action_logs')\n        .select([\n          'action_logs.id',\n          'action_logs.tenant_id',\n          'action_logs.organization_id',\n          'action_logs.actor_user_id',\n          'action_logs.command_id',\n          'action_logs.action_label',\n          'action_logs.snapshot_before',\n          'action_logs.changes_json',\n          'action_logs.context_json',\n          'action_logs.action_type',\n          'action_logs.source_key',\n          'action_logs.changed_fields',\n          'action_logs.primary_changed_field',\n          'action_logs.created_at',\n        ])\n        .where('action_logs.deleted_at', 'is', null) as any\n\n      if (options.tenantId) rowsQuery.where('action_logs.tenant_id', '=', options.tenantId)\n      if (options.organizationId) rowsQuery.where('action_logs.organization_id', '=', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.action_type', 'is', null),\n            eb('action_logs.source_key', 'is', null),\n            eb('action_logs.changed_fields', 'is', null),\n          ])\n        )\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.created_at', '>', cursorCreatedAt),\n            eb.and([\n              eb('action_logs.created_at', '=', cursorCreatedAt),\n              eb('action_logs.id', '>', cursorId),\n            ]),\n          ])\n        )\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await (this.em.getKysely<any>() as any)\n            .updateTable('action_logs')\n            .set({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n            .where('id', '=', row.id)\n            .execute()\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,WAAW;AACpB,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC;AAAA,EAEE;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAEnF,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AACA,MAAM,aAAa;AAIZ,MAAM,oBAAoB;AACjC,MAAM,uBAAuB;AAC7B,MAAM,sBAAsB;AAK5B,MAAM,2BAA2B;AACjC,MAAM,oCAAoC;AAE1C,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,+BAA+B,MAAO,QAAO,kBAAkB,KAAK,KAAK;AAE7E,MAAI;AACF,WAAO,KAAK,UAAU,KAAK,EAAE;AAAA,EAC/B,SAAS,KAAK;AACZ,QAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,WAAO,kBAAkB,KAAK,KAAK;AAAA,EACrC;AACF;AAEA,SAAS,mBAAmB,OAA+B;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,QAAM,YAAY,mBAAmB,KAAK;AAC1C,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,UAAU,WAAW,oBAAoB,IACvD,UAAU,MAAM,qBAAqB,MAAM,IAC3C;AAEJ,SAAO,aAAa,SAAS,IAAI,YAAY;AAC/C;AAEA,SAAS,uBAAuB,WAAkC;AAChE,MAAI,CAAC,UAAU,WAAW,mBAAmB,EAAG,QAAO;AACvD,MAAI,UAAU,WAAW,oBAAoB,OAAQ,QAAO;AAC5D,SAAO,UAAU,MAAM,GAAG,iCAAiC;AAC7D;AAkCA,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,iBAAO,yBAAyBA,UAAS;AAAA,QAC3C;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAOA,YAAM,cAAc,CAAC,UACnB,OAAO,UAAU,WAAW,yBAAyB,KAAK,IAAI;AAEhE,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc,CAAC;AAC5I,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe,CAAC;AACjJ,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY,CAAC;AAClI,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,eAAO,KAAK,sCAAsC,EAAE,IAAI,CAAC;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,QAAQ,GAAG,EAAE,MAAM;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,UAAM,YAAY,KAAK,cAAc,KAAK;AAC1C,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,SAAS;AAC7B,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,iBAAO,KAAK,wDAAwD,EAAE,IAAI,CAAC;AAAA,QAC7E;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,SAAS;AAAA,MACtC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,SAAS;AAAA,IACtC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,OAAmD;AACvE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,YAAY,mBAAmB,MAAM,WAAW;AACtD,UAAM,cAAc,qBAAqB,SAAS;AAClD,UAAM,uBAAuB,aAAa,CAAC,cAAc,uBAAuB,SAAS,IAAI;AAE7F,QAAI,CAAC,sBAAsB;AACzB,UAAI,iBAAiB,MAAM,eAAe,MAAO,QAAO;AACxD,aAAO,EAAE,GAAG,OAAO,YAAY;AAAA,IACjC;AAEA,UAAM,UAAU,SAAS,MAAM,OAAO,IAAI,EAAE,GAAG,MAAM,QAAQ,IAAI,CAAC;AAClE,QAAI,QAAQ,wBAAwB,MAAM,QAAW;AACnD,cAAQ,wBAAwB,IAAI;AAAA,IACtC;AAEA,WAAO,EAAE,GAAG,OAAO,aAAa,QAAQ;AAAA,EAC1C;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,qBAAqB,iBAAiB,KAAK,mBAAmB,KAAK;AAAA,MACnE,mBAAmB,iBAAiB,KAAK,iBAAiB,KAAK;AAAA,MAC/D,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,qBAAqB,MAAM,WAAW;AAAA,MACnD,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,qBAAqB,iBAAiB,MAAM,mBAAmB,KAAK;AAAA,MACpE,mBAAmB,iBAAiB,MAAM,iBAAiB,KAAK;AAAA,MAChE,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,QAAI,QAAS,KAAK,eAAe,MAAM,EAAU,OAAO,sBAAsB;AAE9E,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,cAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAC1C;AAEA,UAAM,OAAO,MAAM,MAAM,QAAQ;AACjC,UAAM,MAAM,KAAK,IAAI,CAAC,QAAa,IAAI,EAAE,EAAE,OAAO,OAAO;AACzD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAe,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AACnE,WAAO,IACJ,IAAI,CAAC,OAAY,KAAK,IAAI,EAAE,CAAC,EAC7B,OAAO,CAAC,UAAmC,QAAQ,KAAK,CAAC;AAAA,EAC9D;AAAA,EAEQ,eAAe,QAAiC;AACtD,QAAI,QAAS,KAAK,GAAG,UAAe,EACjC,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,0BAA0B,MAAM,IAAI;AAE7C,QAAI,OAAO,SAAU,SAAQ,MAAM,MAAM,yBAAyB,KAAK,OAAO,QAAQ;AACtF,QAAI,OAAO,eAAgB,SAAQ,MAAM,MAAM,+BAA+B,KAAK,OAAO,cAAc;AAExG,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,SAAQ,MAAM,MAAM,6BAA6B,KAAK,aAAa,CAAC,CAAC;AACpG,QAAI,aAAa,SAAS,EAAG,SAAQ,MAAM,MAAM,6BAA6B,MAAM,YAAY;AAEhG,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,cAAQ,MAAM;AAAA,QAAM,CAAC,OACnB,GAAG,GAAG;AAAA,UACJ,GAAG,IAAI;AAAA,YACL,GAAG,6BAA6B,KAAK,OAAO,YAAY;AAAA,YACxD,GAAG,2BAA2B,KAAK,OAAO,UAAU;AAAA,UACtD,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,oCAAoC,KAAK,OAAO,YAAY;AAAA,YAC/D,GAAG,kCAAkC,KAAK,OAAO,UAAU;AAAA,UAC7D,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,qCAAqC,KAAK,OAAO,YAAY;AAAA,YAChE,GAAG,mCAAmC,KAAK,OAAO,UAAU;AAAA,UAC9D,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,UAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,6BAA6B,KAAK,OAAO,YAAY;AAClG,UAAI,OAAO,WAAY,SAAQ,MAAM,MAAM,2BAA2B,KAAK,OAAO,UAAU;AAAA,IAC9F;AAEA,QAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,0BAA0B,UAAU,IAAI;AACrF,QAAI,OAAO,OAAQ,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,MAAM;AACnF,QAAI,OAAO,MAAO,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,KAAK;AAEjF,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,WAAW,EAAG,SAAQ,MAAM,MAAM,qCAAqC,KAAK,WAAW,CAAC,CAAC;AACxG,QAAI,WAAW,SAAS,EAAG,SAAQ,MAAM,MAAM,qCAAqC,MAAM,UAAU;AAEpG,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,SAAQ,MAAM,MAAM,2BAA2B,KAAK,YAAY,CAAC,CAAC;AAChG,QAAI,YAAY,SAAS,EAAG,SAAQ,MAAM,MAAM,2BAA2B,MAAM,WAAW;AAE5F,QAAI,OAAO,cAAc,QAAQ;AAC/B,cAAQ,MAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IAC9F;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,gBAAQ,MAAM,QAAQ,oEAAoE,OAAO;AACjG;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,4CAA4C,OAAO;AACzE;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,sDAAsD,OAAO;AACnF;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,2CAA2C,OAAO;AACxE;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,MAAM,QAAQ,YAAY,WAAW,OAAO;AACpD,gBAAQ,MAAM,QAAQ,kBAAkB,OAAO;AAC/C,eAAO;AAAA,IACX;AAEA,YAAQ,MAAM,QAAQ,0BAA0B,MAAM;AACtD,YAAQ,MAAM,QAAQ,kBAAkB,MAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAO,KAAK,eAAe,MAAM,EAC1C,YAAY,EACZ,aAAa,EACb,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AAEpB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAA8B;AAC/C,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,QAAQ,WAAW,KAAK;AAAA,MAC9C,EAAE,gBAAgB,UAAU;AAAA,IAC9B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAiB,IAA8B;AACnD,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,gBAAgB,WAAW,WAAW,KAAK;AAAA,MACjD,EAAE,gBAAgB,OAAO;AAAA,IAC3B;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAMC,UAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAa,KAAK,GAAG,UAAe,EACvC,WAAW,aAAa,EACxB,OAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EACA,MAAM,0BAA0B,MAAM,IAAI;AAE7C,UAAI,QAAQ,SAAU,WAAU,MAAM,yBAAyB,KAAK,QAAQ,QAAQ;AACpF,UAAI,QAAQ,eAAgB,WAAU,MAAM,+BAA+B,KAAK,QAAQ,cAAc;AAEtG,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,2BAA2B,MAAM,IAAI;AAAA,YACxC,GAAG,0BAA0B,MAAM,IAAI;AAAA,YACvC,GAAG,8BAA8B,MAAM,IAAI;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,0BAA0B,KAAK,eAAe;AAAA,YACjD,GAAG,IAAI;AAAA,cACL,GAAG,0BAA0B,KAAK,eAAe;AAAA,cACjD,GAAG,kBAAkB,KAAK,QAAQ;AAAA,YACpC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAO,KAAK,GAAG,UAAe,EAC3B,YAAY,aAAa,EACzB,IAAI;AAAA,YACH,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC,EACA,MAAM,MAAM,KAAK,IAAI,EAAE,EACvB,QAAQ;AAEX,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,UAAAA,QAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB,MAAAA;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": ["decrypted", "logger"]
 }

package/dist/modules/payment_gateways/api/webhook/[provider]/route.js

@@ -4,6 +4,7 @@ import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from "@open-mercato/shared/lib/ratelimit/helpers";
 import { getWebhookHandler } from "@open-mercato/shared/modules/payment_gateways/types";
+import { markQueueJobOrigin } from "@open-mercato/shared/lib/queue/dispatchOrigin";
 import { GatewayTransaction } from "../../../data/entities.js";
 import { getPaymentGatewayQueue } from "../../../lib/queue.js";
 import { processPaymentGatewayWebhookJob } from "../../../lib/webhook-processor.js";
@@ -81,17 +82,14 @@ async function POST(req, { params }) {
       throw lastVerificationError ?? new Error("Webhook verification failed: no matching transaction");
     }
     const scope = matchedScope;
-    const jobPayload = {
+    const jobPayload = markQueueJobOrigin({
       providerKey,
       event,
       transactionId: transaction.id,
       scope
-    };
+    }, "inbound-webhook");
     if (process.env.QUEUE_STRATEGY === "async") {
-      await queue.enqueue({
-        name: "payment-gateway-webhook",
-        payload: jobPayload
-      });
+      await queue.enqueue(jobPayload);
     } else {
       await processPaymentGatewayWebhookJob(
         {

package/dist/modules/payment_gateways/api/webhook/[provider]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/payment_gateways/api/webhook/%5Bprovider%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getWebhookHandler } from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { PaymentGatewayService } from '../../../lib/gateway-service'\nimport type { CredentialsService } from '../../../../integrations/lib/credentials-service'\nimport { GatewayTransaction } from '../../../data/entities'\nimport { getPaymentGatewayQueue } from '../../../lib/queue'\nimport { processPaymentGatewayWebhookJob } from '../../../lib/webhook-processor'\nimport { paymentGatewaysTag } from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('payment_gateways').child({ component: 'webhook' })\n\nexport const metadata = {\n  path: '/payment_gateways/webhook/[provider]',\n  POST: { requireAuth: false },\n}\n\nconst WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'\n\nconst paymentGatewayWebhookRateLimitConfig = {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'payment_gateways:webhook',\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n  const container = await createRequestContainer()\n  const registration = getWebhookHandler(providerKey)\n  if (!registration) {\n    return NextResponse.json({ error: `No webhook handler for provider: ${providerKey}` }, { status: 404 })\n  }\n\n  const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)\n  if (rateLimitResponse) return rateLimitResponse\n\n  let rawBody: string\n  try {\n    rawBody = registration.maxBodyBytes === undefined\n      ? await req.text()\n      : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })\n    }\n    throw error\n  }\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n  const em = container.resolve('em') as EntityManager\n  const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const queue = getPaymentGatewayQueue(registration.queue ?? 'payment-gateways-webhook')\n  const payload = await readJsonSafe<Record<string, unknown>>(rawBody)\n  const sessionIdHint = registration.readSessionIdHint?.(payload) ?? null\n\n  try {\n    // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a\n    // GatewayTransaction whose per-tenant credentials successfully verify the inbound\n    // signature \u2014 NEVER from attacker-controlled payload metadata. If no candidate\n    // transaction can be located by the provider-reported session id, or no candidate's\n    // credentials can verify the signature, we fail closed with 401. This prevents\n    // forged webhooks (e.g. mock gateway PoC) from mutating another tenant's payment\n    // state via `event.data.metadata.{organizationId,tenantId}`.\n    const candidates = sessionIdHint\n      ? await findWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerKey,\n          providerSessionId: sessionIdHint,\n          deletedAt: null,\n        },\n        { limit: 10, orderBy: { createdAt: 'desc' } },\n      )\n      : []\n\n    let transaction: GatewayTransaction | null = null\n    let matchedScope: { organizationId: string; tenantId: string } | null = null\n    let event: Awaited<ReturnType<typeof registration.handler>> | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates) {\n      const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }\n      const credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {}\n      try {\n        event = await registration.handler({ rawBody, headers, credentials })\n        transaction = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !transaction || !matchedScope) {\n      throw lastVerificationError ?? new Error('Webhook verification failed: no matching transaction')\n    }\n\n    const scope = matchedScope\n\n    const jobPayload = {\n      providerKey,\n      event,\n      transactionId: transaction.id,\n      scope,\n    }\n\n    if (process.env.QUEUE_STRATEGY === 'async') {\n      await queue.enqueue({\n        name: 'payment-gateway-webhook',\n        payload: jobPayload,\n      })\n    } else {\n      await processPaymentGatewayWebhookJob(\n        {\n          em: container.resolve('em') as EntityManager,\n          paymentGatewayService: service,\n          integrationLogService: container.resolve('integrationLogService') as IntegrationLogService,\n        },\n        jobPayload,\n      )\n    }\n\n    return NextResponse.json({ received: true, queued: true }, { status: 202 })\n  } catch (err: unknown) {\n    logger.warn('Webhook verification failed', { providerKey, err })\n    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })\n  }\n}\n\nasync function checkProviderWebhookRateLimit(\n  container: { resolve: (name: string) => unknown },\n  req: Request,\n  providerKey: string,\n): Promise<NextResponse | null> {\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n  if (!rateLimiterService) return null\n\n  return checkRateLimit(\n    rateLimiterService,\n    paymentGatewayWebhookRateLimitConfig,\n    `${providerKey}:${getClientIp(req, rateLimiterService.trustProxyDepth) ?? 'unknown'}`,\n    RATE_LIMIT_ERROR_FALLBACK,\n  )\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Receive payment gateway webhook',\n  methods: {\n    POST: {\n      summary: 'Process inbound webhook from payment provider',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB,aAAa,iCAAiC;AAGvE,SAAS,yBAAyB;AAIlC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,gCAAgC;AAEjE,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,8BAA8B;AAEpC,MAAM,uCAAuC;AAAA,EAC3C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAqE;AACrH,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,kBAAkB,WAAW;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,WAAW,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,QAAM,oBAAoB,MAAM,8BAA8B,WAAW,KAAK,WAAW;AACzF,MAAI,kBAAmB,QAAO;AAE9B,MAAI;AACJ,MAAI;AACF,cAAU,aAAa,iBAAiB,SACpC,MAAM,IAAI,KAAK,IACf,MAAM,uBAAuB,KAAK,EAAE,UAAU,aAAa,aAAa,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AACzD,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,gCAAgC,UAAU,QAAQ,+BAA+B;AACvF,QAAM,QAAQ,uBAAuB,aAAa,SAAS,0BAA0B;AACrF,QAAM,UAAU,MAAM,aAAsC,OAAO;AACnE,QAAM,gBAAgB,aAAa,oBAAoB,OAAO,KAAK;AAEnE,MAAI;AAQF,UAAM,aAAa,gBACf,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,mBAAmB;AAAA,QACnB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,OAAO,IAAI,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC9C,IACE,CAAC;AAEL,QAAI,cAAyC;AAC7C,QAAI,eAAoE;AACxE,QAAI,QAAiE;AACrE,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAY;AAClC,YAAM,iBAAiB,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AAChG,YAAM,cAAc,MAAM,8BAA8B,QAAQ,WAAW,WAAW,IAAI,cAAc,KAAK,CAAC;AAC9G,UAAI;AACF,gBAAQ,MAAM,aAAa,QAAQ,EAAE,SAAS,SAAS,YAAY,CAAC;AACpE,sBAAc;AACd,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc;AAC3C,YAAM,yBAAyB,IAAI,MAAM,sDAAsD;AAAA,IACjG;AAEA,UAAM,QAAQ;AAEd,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,QAAQ,IAAI,mBAAmB,SAAS;AAC1C,YAAM,MAAM,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH,OAAO;AACL,YAAM;AAAA,QACJ;AAAA,UACE,IAAI,UAAU,QAAQ,IAAI;AAAA,UAC1B,uBAAuB;AAAA,UACvB,uBAAuB,UAAU,QAAQ,uBAAuB;AAAA,QAClE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E,SAAS,KAAc;AACrB,WAAO,KAAK,+BAA+B,EAAE,aAAa,IAAI,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,8BACb,WACA,KACA,aAC8B;AAC9B,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AACzF,MAAI,CAAC,mBAAoB,QAAO;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,WAAW,IAAI,YAAY,KAAK,mBAAmB,eAAe,KAAK,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getWebhookHandler } from '@open-mercato/shared/modules/payment_gateways/types'\nimport { markQueueJobOrigin } from '@open-mercato/shared/lib/queue/dispatchOrigin'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { PaymentGatewayService } from '../../../lib/gateway-service'\nimport type { CredentialsService } from '../../../../integrations/lib/credentials-service'\nimport { GatewayTransaction } from '../../../data/entities'\nimport { getPaymentGatewayQueue } from '../../../lib/queue'\nimport { processPaymentGatewayWebhookJob } from '../../../lib/webhook-processor'\nimport { paymentGatewaysTag } from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('payment_gateways').child({ component: 'webhook' })\n\nexport const metadata = {\n  path: '/payment_gateways/webhook/[provider]',\n  POST: { requireAuth: false },\n}\n\nconst WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'\n\nconst paymentGatewayWebhookRateLimitConfig = {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'payment_gateways:webhook',\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n  const container = await createRequestContainer()\n  const registration = getWebhookHandler(providerKey)\n  if (!registration) {\n    return NextResponse.json({ error: `No webhook handler for provider: ${providerKey}` }, { status: 404 })\n  }\n\n  const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)\n  if (rateLimitResponse) return rateLimitResponse\n\n  let rawBody: string\n  try {\n    rawBody = registration.maxBodyBytes === undefined\n      ? await req.text()\n      : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })\n    }\n    throw error\n  }\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n  const em = container.resolve('em') as EntityManager\n  const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const queue = getPaymentGatewayQueue(registration.queue ?? 'payment-gateways-webhook')\n  const payload = await readJsonSafe<Record<string, unknown>>(rawBody)\n  const sessionIdHint = registration.readSessionIdHint?.(payload) ?? null\n\n  try {\n    // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a\n    // GatewayTransaction whose per-tenant credentials successfully verify the inbound\n    // signature \u2014 NEVER from attacker-controlled payload metadata. If no candidate\n    // transaction can be located by the provider-reported session id, or no candidate's\n    // credentials can verify the signature, we fail closed with 401. This prevents\n    // forged webhooks (e.g. mock gateway PoC) from mutating another tenant's payment\n    // state via `event.data.metadata.{organizationId,tenantId}`.\n    const candidates = sessionIdHint\n      ? await findWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerKey,\n          providerSessionId: sessionIdHint,\n          deletedAt: null,\n        },\n        { limit: 10, orderBy: { createdAt: 'desc' } },\n      )\n      : []\n\n    let transaction: GatewayTransaction | null = null\n    let matchedScope: { organizationId: string; tenantId: string } | null = null\n    let event: Awaited<ReturnType<typeof registration.handler>> | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates) {\n      const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }\n      const credentials = await integrationCredentialsService.resolve(`gateway_${providerKey}`, candidateScope) ?? {}\n      try {\n        event = await registration.handler({ rawBody, headers, credentials })\n        transaction = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !transaction || !matchedScope) {\n      throw lastVerificationError ?? new Error('Webhook verification failed: no matching transaction')\n    }\n\n    const scope = matchedScope\n\n    const jobPayload = markQueueJobOrigin({\n      providerKey,\n      event,\n      transactionId: transaction.id,\n      scope,\n    }, 'inbound-webhook')\n\n    if (process.env.QUEUE_STRATEGY === 'async') {\n      await queue.enqueue(jobPayload)\n    } else {\n      await processPaymentGatewayWebhookJob(\n        {\n          em: container.resolve('em') as EntityManager,\n          paymentGatewayService: service,\n          integrationLogService: container.resolve('integrationLogService') as IntegrationLogService,\n        },\n        jobPayload,\n      )\n    }\n\n    return NextResponse.json({ received: true, queued: true }, { status: 202 })\n  } catch (err: unknown) {\n    logger.warn('Webhook verification failed', { providerKey, err })\n    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })\n  }\n}\n\nasync function checkProviderWebhookRateLimit(\n  container: { resolve: (name: string) => unknown },\n  req: Request,\n  providerKey: string,\n): Promise<NextResponse | null> {\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n  if (!rateLimiterService) return null\n\n  return checkRateLimit(\n    rateLimiterService,\n    paymentGatewayWebhookRateLimitConfig,\n    `${providerKey}:${getClientIp(req, rateLimiterService.trustProxyDepth) ?? 'unknown'}`,\n    RATE_LIMIT_ERROR_FALLBACK,\n  )\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Receive payment gateway webhook',\n  methods: {\n    POST: {\n      summary: 'Process inbound webhook from payment provider',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB,aAAa,iCAAiC;AAGvE,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AAInC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,gCAAgC;AAEjE,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEvE,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,8BAA8B;AAEpC,MAAM,uCAAuC;AAAA,EAC3C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAqE;AACrH,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,kBAAkB,WAAW;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,WAAW,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,QAAM,oBAAoB,MAAM,8BAA8B,WAAW,KAAK,WAAW;AACzF,MAAI,kBAAmB,QAAO;AAE9B,MAAI;AACJ,MAAI;AACF,cAAU,aAAa,iBAAiB,SACpC,MAAM,IAAI,KAAK,IACf,MAAM,uBAAuB,KAAK,EAAE,UAAU,aAAa,aAAa,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AACzD,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,gCAAgC,UAAU,QAAQ,+BAA+B;AACvF,QAAM,QAAQ,uBAAuB,aAAa,SAAS,0BAA0B;AACrF,QAAM,UAAU,MAAM,aAAsC,OAAO;AACnE,QAAM,gBAAgB,aAAa,oBAAoB,OAAO,KAAK;AAEnE,MAAI;AAQF,UAAM,aAAa,gBACf,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,mBAAmB;AAAA,QACnB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,OAAO,IAAI,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC9C,IACE,CAAC;AAEL,QAAI,cAAyC;AAC7C,QAAI,eAAoE;AACxE,QAAI,QAAiE;AACrE,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAY;AAClC,YAAM,iBAAiB,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AAChG,YAAM,cAAc,MAAM,8BAA8B,QAAQ,WAAW,WAAW,IAAI,cAAc,KAAK,CAAC;AAC9G,UAAI;AACF,gBAAQ,MAAM,aAAa,QAAQ,EAAE,SAAS,SAAS,YAAY,CAAC;AACpE,sBAAc;AACd,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc;AAC3C,YAAM,yBAAyB,IAAI,MAAM,sDAAsD;AAAA,IACjG;AAEA,UAAM,QAAQ;AAEd,UAAM,aAAa,mBAAmB;AAAA,MACpC;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,iBAAiB;AAEpB,QAAI,QAAQ,IAAI,mBAAmB,SAAS;AAC1C,YAAM,MAAM,QAAQ,UAAU;AAAA,IAChC,OAAO;AACL,YAAM;AAAA,QACJ;AAAA,UACE,IAAI,UAAU,QAAQ,IAAI;AAAA,UAC1B,uBAAuB;AAAA,UACvB,uBAAuB,UAAU,QAAQ,uBAAuB;AAAA,QAClE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E,SAAS,KAAc;AACrB,WAAO,KAAK,+BAA+B,EAAE,aAAa,IAAI,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,8BACb,WACA,KACA,aAC8B;AAC9B,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AACzF,MAAI,CAAC,mBAAoB,QAAO;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,WAAW,IAAI,YAAY,KAAK,mBAAmB,eAAe,KAAK,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/payment_gateways/lib/webhook-processor.js

@@ -1,5 +1,8 @@
 import { getGatewayAdapter } from "@open-mercato/shared/modules/payment_gateways/types";
+import { isTrustedWebhookDispatch } from "@open-mercato/shared/lib/queue/dispatchOrigin";
+import { createLogger } from "@open-mercato/shared/lib/logger";
 import { claimWebhookProcessing, releaseWebhookClaim } from "./webhook-utils.js";
+const logger = createLogger("payment_gateways").child({ component: "webhook-processor" });
 function readSessionIdFromEvent(event) {
   const id = event.data.id;
   if (typeof id === "string" && id.trim().length > 0) return id.trim();
@@ -20,6 +23,10 @@ async function writeTransactionLog(integrationLogService, providerKey, scope, tr
 async function processPaymentGatewayWebhookJob(deps, payload) {
   const { em, paymentGatewayService, integrationLogService } = deps;
   const { providerKey, event } = payload;
+  if (!isTrustedWebhookDispatch(payload)) {
+    logger.error("Dropping webhook job with missing or untrusted dispatch origin", { providerKey, eventType: event?.eventType ?? null });
+    return;
+  }
   const scopedPayload = payload.scope ?? null;
   if (!scopedPayload) return;
   let transaction = payload.transactionId ? await paymentGatewayService.findTransaction(payload.transactionId, scopedPayload) : null;

package/dist/modules/payment_gateways/lib/webhook-processor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/payment_gateways/lib/webhook-processor.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { getGatewayAdapter, type WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { IntegrationLogService } from '../../integrations/lib/log-service'\nimport type { PaymentGatewayService } from './gateway-service'\nimport { claimWebhookProcessing, releaseWebhookClaim } from './webhook-utils'\n\nexport type PaymentGatewayWebhookJobPayload = {\n  providerKey: string\n  event: WebhookEvent\n  transactionId?: string | null\n  scope?: {\n    organizationId: string\n    tenantId: string\n  } | null\n}\n\ntype PaymentGatewayWebhookProcessorDeps = {\n  em: EntityManager\n  paymentGatewayService: PaymentGatewayService\n  integrationLogService: IntegrationLogService\n}\n\nfunction readSessionIdFromEvent(event: WebhookEvent): string | null {\n  const id = event.data.id\n  if (typeof id === 'string' && id.trim().length > 0) return id.trim()\n  const paymentIntent = event.data.payment_intent\n  if (typeof paymentIntent === 'string' && paymentIntent.trim().length > 0) return paymentIntent.trim()\n  return null\n}\n\nasync function writeTransactionLog(\n  integrationLogService: IntegrationLogService,\n  providerKey: string,\n  scope: { organizationId: string; tenantId: string },\n  transactionId: string,\n  level: 'info' | 'warn' | 'error',\n  message: string,\n  payload?: Record<string, unknown>,\n) {\n  await integrationLogService.write({\n    integrationId: `gateway_${providerKey}`,\n    scopeEntityType: 'payment_transaction',\n    scopeEntityId: transactionId,\n    level,\n    message,\n    payload: payload ?? null,\n  }, scope)\n}\n\nexport async function processPaymentGatewayWebhookJob(\n  deps: PaymentGatewayWebhookProcessorDeps,\n  payload: PaymentGatewayWebhookJobPayload,\n): Promise<void> {\n  const { em, paymentGatewayService, integrationLogService } = deps\n  const { providerKey, event } = payload\n  // Scope MUST come from the trusted route layer (derived from a verified GatewayTransaction).\n  // Never fall back to attacker-controlled metadata on `event.data.metadata` \u2014 that was the\n  // vector that allowed forged mock webhooks to mutate another tenant's payment state.\n  const scopedPayload = payload.scope ?? null\n  if (!scopedPayload) return\n\n  let transaction = payload.transactionId\n    ? await paymentGatewayService.findTransaction(payload.transactionId, scopedPayload)\n    : null\n\n  if (!transaction) {\n    const sessionId = readSessionIdFromEvent(event)\n    if (sessionId) {\n      transaction = await paymentGatewayService.findTransactionBySessionId(sessionId, scopedPayload, providerKey)\n    }\n  }\n  if (!transaction) return\n\n  const scope = { organizationId: transaction.organizationId, tenantId: transaction.tenantId }\n  const claimed = await claimWebhookProcessing(em, event.idempotencyKey, providerKey, scope, event.eventType)\n  if (!claimed) {\n    await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Duplicate payment gateway webhook skipped', {\n      eventType: event.eventType,\n      idempotencyKey: event.idempotencyKey,\n    })\n    return\n  }\n\n  try {\n    const adapter = getGatewayAdapter(providerKey)\n    if (!adapter) {\n      await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'warn', 'Missing payment gateway adapter for webhook event', {\n        providerKey,\n        eventType: event.eventType,\n      })\n      return\n    }\n\n    const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''\n    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType)\n    await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook received', {\n      eventType: event.eventType,\n      providerStatus,\n      unifiedStatus,\n    })\n\n    await paymentGatewayService.syncTransactionStatus(transaction.id, {\n      unifiedStatus,\n      providerStatus: event.eventType,\n      providerData: event.data,\n      webhookEvent: {\n        eventType: event.eventType,\n        idempotencyKey: event.idempotencyKey,\n        processed: true,\n      },\n    }, scope)\n\n    await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook processed', {\n      eventType: event.eventType,\n      unifiedStatus,\n    })\n  } catch (error: unknown) {\n    await releaseWebhookClaim(em, event.idempotencyKey, providerKey, scope)\n    throw error\n  }\n}\n"],
-  "mappings": "AACA,SAAS,yBAA4C;AAGrD,SAAS,wBAAwB,2BAA2B;AAkB5D,SAAS,uBAAuB,OAAoC;AAClE,QAAM,KAAK,MAAM,KAAK;AACtB,MAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,EAAG,QAAO,GAAG,KAAK;AACnE,QAAM,gBAAgB,MAAM,KAAK;AACjC,MAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,SAAS,EAAG,QAAO,cAAc,KAAK;AACpG,SAAO;AACT;AAEA,eAAe,oBACb,uBACA,aACA,OACA,eACA,OACA,SACA,SACA;AACA,QAAM,sBAAsB,MAAM;AAAA,IAChC,eAAe,WAAW,WAAW;AAAA,IACrC,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,SAAS,WAAW;AAAA,EACtB,GAAG,KAAK;AACV;AAEA,eAAsB,gCACpB,MACA,SACe;AACf,QAAM,EAAE,IAAI,uBAAuB,sBAAsB,IAAI;AAC7D,QAAM,EAAE,aAAa,MAAM,IAAI;AAI/B,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,CAAC,cAAe;AAEpB,MAAI,cAAc,QAAQ,gBACtB,MAAM,sBAAsB,gBAAgB,QAAQ,eAAe,aAAa,IAChF;AAEJ,MAAI,CAAC,aAAa;AAChB,UAAM,YAAY,uBAAuB,KAAK;AAC9C,QAAI,WAAW;AACb,oBAAc,MAAM,sBAAsB,2BAA2B,WAAW,eAAe,WAAW;AAAA,IAC5G;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,QAAQ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAC3F,QAAM,UAAU,MAAM,uBAAuB,IAAI,MAAM,gBAAgB,aAAa,OAAO,MAAM,SAAS;AAC1G,MAAI,CAAC,SAAS;AACZ,UAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,6CAA6C;AAAA,MACxI,WAAW,MAAM;AAAA,MACjB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,kBAAkB,WAAW;AAC7C,QAAI,CAAC,SAAS;AACZ,YAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,qDAAqD;AAAA,QAChJ;AAAA,QACA,WAAW,MAAM;AAAA,MACnB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,iBAAiB,OAAO,MAAM,KAAK,WAAW,WAAW,MAAM,KAAK,SAAS;AACnF,UAAM,gBAAgB,QAAQ,UAAU,gBAAgB,MAAM,SAAS;AACvE,UAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,oCAAoC;AAAA,MAC/H,WAAW,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,sBAAsB,sBAAsB,YAAY,IAAI;AAAA,MAChE;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,cAAc,MAAM;AAAA,MACpB,cAAc;AAAA,QACZ,WAAW,MAAM;AAAA,QACjB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,IACF,GAAG,KAAK;AAER,UAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,qCAAqC;AAAA,MAChI,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAgB;AACvB,UAAM,oBAAoB,IAAI,MAAM,gBAAgB,aAAa,KAAK;AACtE,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { getGatewayAdapter, type WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'\nimport { isTrustedWebhookDispatch } from '@open-mercato/shared/lib/queue/dispatchOrigin'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { IntegrationLogService } from '../../integrations/lib/log-service'\nimport type { PaymentGatewayService } from './gateway-service'\nimport { claimWebhookProcessing, releaseWebhookClaim } from './webhook-utils'\n\nconst logger = createLogger('payment_gateways').child({ component: 'webhook-processor' })\n\nexport type PaymentGatewayWebhookJobPayload = {\n  providerKey: string\n  event: WebhookEvent\n  transactionId?: string | null\n  scope?: {\n    organizationId: string\n    tenantId: string\n  } | null\n}\n\ntype PaymentGatewayWebhookProcessorDeps = {\n  em: EntityManager\n  paymentGatewayService: PaymentGatewayService\n  integrationLogService: IntegrationLogService\n}\n\nfunction readSessionIdFromEvent(event: WebhookEvent): string | null {\n  const id = event.data.id\n  if (typeof id === 'string' && id.trim().length > 0) return id.trim()\n  const paymentIntent = event.data.payment_intent\n  if (typeof paymentIntent === 'string' && paymentIntent.trim().length > 0) return paymentIntent.trim()\n  return null\n}\n\nasync function writeTransactionLog(\n  integrationLogService: IntegrationLogService,\n  providerKey: string,\n  scope: { organizationId: string; tenantId: string },\n  transactionId: string,\n  level: 'info' | 'warn' | 'error',\n  message: string,\n  payload?: Record<string, unknown>,\n) {\n  await integrationLogService.write({\n    integrationId: `gateway_${providerKey}`,\n    scopeEntityType: 'payment_transaction',\n    scopeEntityId: transactionId,\n    level,\n    message,\n    payload: payload ?? null,\n  }, scope)\n}\n\nexport async function processPaymentGatewayWebhookJob(\n  deps: PaymentGatewayWebhookProcessorDeps,\n  payload: PaymentGatewayWebhookJobPayload,\n): Promise<void> {\n  const { em, paymentGatewayService, integrationLogService } = deps\n  const { providerKey, event } = payload\n  // Fail closed on untrusted dispatch origins (#5213): only jobs enqueued by the\n  // inbound webhook route (signature verified) may drive payment state. Jobs that\n  // arrive through any other path \u2014 e.g. a scheduled queue target \u2014 are dropped.\n  if (!isTrustedWebhookDispatch(payload)) {\n    logger.error('Dropping webhook job with missing or untrusted dispatch origin', { providerKey, eventType: event?.eventType ?? null })\n    return\n  }\n  // Scope MUST come from the trusted route layer (derived from a verified GatewayTransaction).\n  // Never fall back to attacker-controlled metadata on `event.data.metadata` \u2014 that was the\n  // vector that allowed forged mock webhooks to mutate another tenant's payment state.\n  const scopedPayload = payload.scope ?? null\n  if (!scopedPayload) return\n\n  let transaction = payload.transactionId\n    ? await paymentGatewayService.findTransaction(payload.transactionId, scopedPayload)\n    : null\n\n  if (!transaction) {\n    const sessionId = readSessionIdFromEvent(event)\n    if (sessionId) {\n      transaction = await paymentGatewayService.findTransactionBySessionId(sessionId, scopedPayload, providerKey)\n    }\n  }\n  if (!transaction) return\n\n  const scope = { organizationId: transaction.organizationId, tenantId: transaction.tenantId }\n  const claimed = await claimWebhookProcessing(em, event.idempotencyKey, providerKey, scope, event.eventType)\n  if (!claimed) {\n    await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Duplicate payment gateway webhook skipped', {\n      eventType: event.eventType,\n      idempotencyKey: event.idempotencyKey,\n    })\n    return\n  }\n\n  try {\n    const adapter = getGatewayAdapter(providerKey)\n    if (!adapter) {\n      await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'warn', 'Missing payment gateway adapter for webhook event', {\n        providerKey,\n        eventType: event.eventType,\n      })\n      return\n    }\n\n    const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''\n    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType)\n    await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook received', {\n      eventType: event.eventType,\n      providerStatus,\n      unifiedStatus,\n    })\n\n    await paymentGatewayService.syncTransactionStatus(transaction.id, {\n      unifiedStatus,\n      providerStatus: event.eventType,\n      providerData: event.data,\n      webhookEvent: {\n        eventType: event.eventType,\n        idempotencyKey: event.idempotencyKey,\n        processed: true,\n      },\n    }, scope)\n\n    await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook processed', {\n      eventType: event.eventType,\n      unifiedStatus,\n    })\n  } catch (error: unknown) {\n    await releaseWebhookClaim(em, event.idempotencyKey, providerKey, scope)\n    throw error\n  }\n}\n"],
+  "mappings": "AACA,SAAS,yBAA4C;AACrD,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAG7B,SAAS,wBAAwB,2BAA2B;AAE5D,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,oBAAoB,CAAC;AAkBxF,SAAS,uBAAuB,OAAoC;AAClE,QAAM,KAAK,MAAM,KAAK;AACtB,MAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,EAAG,QAAO,GAAG,KAAK;AACnE,QAAM,gBAAgB,MAAM,KAAK;AACjC,MAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,SAAS,EAAG,QAAO,cAAc,KAAK;AACpG,SAAO;AACT;AAEA,eAAe,oBACb,uBACA,aACA,OACA,eACA,OACA,SACA,SACA;AACA,QAAM,sBAAsB,MAAM;AAAA,IAChC,eAAe,WAAW,WAAW;AAAA,IACrC,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,SAAS,WAAW;AAAA,EACtB,GAAG,KAAK;AACV;AAEA,eAAsB,gCACpB,MACA,SACe;AACf,QAAM,EAAE,IAAI,uBAAuB,sBAAsB,IAAI;AAC7D,QAAM,EAAE,aAAa,MAAM,IAAI;AAI/B,MAAI,CAAC,yBAAyB,OAAO,GAAG;AACtC,WAAO,MAAM,kEAAkE,EAAE,aAAa,WAAW,OAAO,aAAa,KAAK,CAAC;AACnI;AAAA,EACF;AAIA,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,CAAC,cAAe;AAEpB,MAAI,cAAc,QAAQ,gBACtB,MAAM,sBAAsB,gBAAgB,QAAQ,eAAe,aAAa,IAChF;AAEJ,MAAI,CAAC,aAAa;AAChB,UAAM,YAAY,uBAAuB,KAAK;AAC9C,QAAI,WAAW;AACb,oBAAc,MAAM,sBAAsB,2BAA2B,WAAW,eAAe,WAAW;AAAA,IAC5G;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,QAAQ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAC3F,QAAM,UAAU,MAAM,uBAAuB,IAAI,MAAM,gBAAgB,aAAa,OAAO,MAAM,SAAS;AAC1G,MAAI,CAAC,SAAS;AACZ,UAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,6CAA6C;AAAA,MACxI,WAAW,MAAM;AAAA,MACjB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,kBAAkB,WAAW;AAC7C,QAAI,CAAC,SAAS;AACZ,YAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,qDAAqD;AAAA,QAChJ;AAAA,QACA,WAAW,MAAM;AAAA,MACnB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,iBAAiB,OAAO,MAAM,KAAK,WAAW,WAAW,MAAM,KAAK,SAAS;AACnF,UAAM,gBAAgB,QAAQ,UAAU,gBAAgB,MAAM,SAAS;AACvE,UAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,oCAAoC;AAAA,MAC/H,WAAW,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,sBAAsB,sBAAsB,YAAY,IAAI;AAAA,MAChE;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,cAAc,MAAM;AAAA,MACpB,cAAc;AAAA,QACZ,WAAW,MAAM;AAAA,QACjB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,IACF,GAAG,KAAK;AAER,UAAM,oBAAoB,uBAAuB,aAAa,OAAO,YAAY,IAAI,QAAQ,qCAAqC;AAAA,MAChI,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAgB;AACvB,UAAM,oBAAoB,IAAI,MAAM,gBAAgB,aAAa,KAAK;AACtE,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.7066.1.6bfa9ff69f",
+  "version": "0.6.8-develop.7068.1.c55b52e1a1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -252,16 +252,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/shared": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/ui": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7068.1.c55b52e1a1",
+    "@open-mercato/shared": "0.6.8-develop.7068.1.c55b52e1a1",
+    "@open-mercato/ui": "0.6.8-develop.7068.1.c55b52e1a1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/shared": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/ui": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7068.1.c55b52e1a1",
+    "@open-mercato/shared": "0.6.8-develop.7068.1.c55b52e1a1",
+    "@open-mercato/ui": "0.6.8-develop.7068.1.c55b52e1a1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/audit_logs/services/actionLogService.ts

@@ -5,6 +5,7 @@ import { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'
 import {
   actionLogCreateSchema,
   actionLogListSchema,
+  uuid,
   type ActionLogCreateInput,
   type ActionLogListQuery,
 } from '@open-mercato/core/modules/audit_logs/data/validators'
@@ -34,6 +35,55 @@ const SORT_FIELDS = {
   createdAt: 'action_logs.created_at',
 } as const
 const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
+// Mirrors what `uuid` (`data/validators.ts`) accepts — versions 1-8 plus the nil and
+// max UUIDs — and is used only when the zod runtime is unavailable, so the actor
+// sanitizer can never reject a value `actionLogCreateSchema` would have accepted.
+export const SCHEMA_UUID_REGEX = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/
+const API_KEY_ACTOR_PREFIX = 'api_key:'
+const SYSTEM_ACTOR_PREFIX = 'system:'
+// `context.systemActor` names the automated principal behind an entry; `context.source`
+// (read by `deriveActionLogSource`) names the channel it arrived through. They are
+// siblings on purpose and never contradict each other: an entry carrying `systemActor`
+// has a null actor column, which already derives the `system` source.
+const SYSTEM_ACTOR_CONTEXT_KEY = 'systemActor'
+const SYSTEM_ACTOR_REFERENCE_MAX_LENGTH = 255
+
+function toNullableUuid(value: unknown): string | null {
+  return typeof value === 'string' && UUID_REGEX.test(value) ? value : null
+}
+
+function isSchemaUuid(value: string): boolean {
+  if (runtimeValidationAvailable === false) return SCHEMA_UUID_REGEX.test(value)
+
+  try {
+    return uuid.safeParse(value).success
+  } catch (err) {
+    if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
+    return SCHEMA_UUID_REGEX.test(value)
+  }
+}
+
+function readActorCandidate(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  return trimmed.length > 0 ? trimmed : null
+}
+
+function normalizeActorUserId(value: unknown): string | null {
+  const candidate = readActorCandidate(value)
+  if (!candidate) return null
+  const unwrapped = candidate.startsWith(API_KEY_ACTOR_PREFIX)
+    ? candidate.slice(API_KEY_ACTOR_PREFIX.length)
+    : candidate
+
+  return isSchemaUuid(unwrapped) ? unwrapped : null
+}
+
+function toSystemActorReference(candidate: string): string | null {
+  if (!candidate.startsWith(SYSTEM_ACTOR_PREFIX)) return null
+  if (candidate.length === SYSTEM_ACTOR_PREFIX.length) return null
+  return candidate.slice(0, SYSTEM_ACTOR_REFERENCE_MAX_LENGTH)
+}
 
 type ActionLogProjectionBackfillOptions = {
   batchSize?: number
@@ -202,6 +252,7 @@ export class ActionLogService {
   }
 
   private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {
+    const sanitized = this.sanitizeActor(input)
     let data: ActionLogCreateInput
     const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }
     const canValidate = Boolean(schema && typeof schema.parse === 'function')
@@ -209,7 +260,7 @@ export class ActionLogService {
 
     if (shouldValidate) {
       try {
-        data = schema.parse(input)
+        data = schema.parse(sanitized)
         runtimeValidationAvailable = true
       } catch (err) {
         if (!isZodRuntimeMissing(err) && !validationWarningLogged) {
@@ -217,15 +268,34 @@ export class ActionLogService {
           logger.warn('Falling back to permissive action log payload parser', { err })
         }
         if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
-        data = this.normalizeInput(input)
+        data = this.normalizeInput(sanitized)
       }
     } else {
-      data = this.normalizeInput(input)
+      data = this.normalizeInput(sanitized)
     }
 
     return data
   }
 
+  private sanitizeActor(input: ActionLogCreateInput): ActionLogCreateInput {
+    if (!input) return input
+    const candidate = readActorCandidate(input.actorUserId)
+    const actorUserId = normalizeActorUserId(candidate)
+    const systemActorReference = candidate && !actorUserId ? toSystemActorReference(candidate) : null
+
+    if (!systemActorReference) {
+      if (actorUserId === (input.actorUserId ?? null)) return input
+      return { ...input, actorUserId }
+    }
+
+    const context = isRecord(input.context) ? { ...input.context } : {}
+    if (context[SYSTEM_ACTOR_CONTEXT_KEY] === undefined) {
+      context[SYSTEM_ACTOR_CONTEXT_KEY] = systemActorReference
+    }
+
+    return { ...input, actorUserId, context }
+  }
+
   private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {
     const projection = deriveActionLogProjection({
       actorUserId: data.actorUserId ?? null,
@@ -286,13 +356,6 @@ export class ActionLogService {
       }
     }
 
-    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
-    const toNullableUuid = (value: unknown) => {
-      if (typeof value !== 'string' || value.length === 0) return null
-      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value
-      return UUID_REGEX.test(candidate) ? candidate : null
-    }
-
     const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {
       if (value === null) return null
       if (Array.isArray(value)) return value
@@ -309,7 +372,7 @@ export class ActionLogService {
     return {
       tenantId: toNullableUuid(input.tenantId),
       organizationId: toNullableUuid(input.organizationId),
-      actorUserId: toNullableUuid(input.actorUserId),
+      actorUserId: normalizeActorUserId(input.actorUserId),
       commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',
       actionLabel: toOptionalString(input.actionLabel) ?? undefined,
       resourceKind: toOptionalString(input.resourceKind) ?? undefined,

package/src/modules/payment_gateways/api/webhook/[provider]/route.ts

@@ -6,6 +6,7 @@ import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-me
 import type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getWebhookHandler } from '@open-mercato/shared/modules/payment_gateways/types'
+import { markQueueJobOrigin } from '@open-mercato/shared/lib/queue/dispatchOrigin'
 import type { IntegrationLogService } from '../../../../integrations/lib/log-service'
 import type { PaymentGatewayService } from '../../../lib/gateway-service'
 import type { CredentialsService } from '../../../../integrations/lib/credentials-service'
@@ -111,18 +112,15 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
 
     const scope = matchedScope
 
-    const jobPayload = {
+    const jobPayload = markQueueJobOrigin({
       providerKey,
       event,
       transactionId: transaction.id,
       scope,
-    }
+    }, 'inbound-webhook')
 
     if (process.env.QUEUE_STRATEGY === 'async') {
-      await queue.enqueue({
-        name: 'payment-gateway-webhook',
-        payload: jobPayload,
-      })
+      await queue.enqueue(jobPayload)
     } else {
       await processPaymentGatewayWebhookJob(
         {

package/src/modules/payment_gateways/lib/webhook-processor.ts

@@ -1,9 +1,13 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getGatewayAdapter, type WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'
+import { isTrustedWebhookDispatch } from '@open-mercato/shared/lib/queue/dispatchOrigin'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import type { IntegrationLogService } from '../../integrations/lib/log-service'
 import type { PaymentGatewayService } from './gateway-service'
 import { claimWebhookProcessing, releaseWebhookClaim } from './webhook-utils'
 
+const logger = createLogger('payment_gateways').child({ component: 'webhook-processor' })
+
 export type PaymentGatewayWebhookJobPayload = {
   providerKey: string
   event: WebhookEvent
@@ -53,6 +57,13 @@ export async function processPaymentGatewayWebhookJob(
 ): Promise<void> {
   const { em, paymentGatewayService, integrationLogService } = deps
   const { providerKey, event } = payload
+  // Fail closed on untrusted dispatch origins (#5213): only jobs enqueued by the
+  // inbound webhook route (signature verified) may drive payment state. Jobs that
+  // arrive through any other path — e.g. a scheduled queue target — are dropped.
+  if (!isTrustedWebhookDispatch(payload)) {
+    logger.error('Dropping webhook job with missing or untrusted dispatch origin', { providerKey, eventType: event?.eventType ?? null })
+    return
+  }
   // Scope MUST come from the trusted route layer (derived from a verified GatewayTransaction).
   // Never fall back to attacker-controlled metadata on `event.data.metadata` — that was the
   // vector that allowed forged mock webhooks to mutate another tenant's payment state.