@open-mercato/core 0.6.8-develop.7079.1.dbf29dd6a1 → 0.6.8-develop.7082.1.f2a845b020

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4342 entry points
+[build:core] found 4345 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/reset/validate.js

@@ -0,0 +1,55 @@
+import { validatePasswordResetTokenSchema } from "@open-mercato/core/modules/auth/data/validators";
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { z } from "zod";
+import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
+import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
+import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
+const resetValidateRateLimitConfig = readEndpointRateLimitConfig("RESET_VALIDATE", {
+  points: 10,
+  duration: 300,
+  keyPrefix: "reset-validate"
+});
+async function POST(req) {
+  const form = await req.formData();
+  const token = String(form.get("token") ?? "");
+  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetValidateRateLimitConfig });
+  if (rateLimitError) return rateLimitError;
+  const parsed = validatePasswordResetTokenSchema.safeParse({ token });
+  if (!parsed.success) return NextResponse.json({ ok: true, valid: false });
+  const container = await createRequestContainer();
+  const auth = container.resolve("authService");
+  const valid = await auth.isPasswordResetTokenValid(parsed.data.token);
+  return NextResponse.json({ ok: true, valid });
+}
+const metadata = { requireAuth: false };
+const passwordResetValidateResponseSchema = z.object({
+  ok: z.literal(true),
+  valid: z.boolean()
+});
+const openApi = {
+  tag: "Authentication & Accounts",
+  summary: "Check a password reset token",
+  methods: {
+    POST: {
+      summary: "Check whether a password reset token is still usable",
+      description: "Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.",
+      requestBody: {
+        contentType: "application/x-www-form-urlencoded",
+        schema: validatePasswordResetTokenSchema
+      },
+      responses: [
+        { status: 200, description: "Token state resolved", schema: passwordResetValidateResponseSchema }
+      ],
+      errors: [
+        { status: 429, description: "Too many token validation attempts", schema: rateLimitErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=validate.js.map

package/dist/modules/auth/api/reset/validate.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/auth/api/reset/validate.ts"],
+  "sourcesContent": ["import { validatePasswordResetTokenSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { z } from 'zod'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\n\nconst resetValidateRateLimitConfig = readEndpointRateLimitConfig('RESET_VALIDATE', {\n  points: 10, duration: 300, keyPrefix: 'reset-validate',\n})\n\nexport async function POST(req: Request) {\n  const form = await req.formData()\n  const token = String(form.get('token') ?? '')\n  // Rate limit by IP \u2014 checked before validation and DB work\n  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetValidateRateLimitConfig })\n  if (rateLimitError) return rateLimitError\n  const parsed = validatePasswordResetTokenSchema.safeParse({ token })\n  // A malformed token is reported as simply not valid: the caller learns nothing\n  // it could not learn by posting the same token to /api/auth/reset/confirm.\n  if (!parsed.success) return NextResponse.json({ ok: true, valid: false })\n  const container = await createRequestContainer()\n  const auth = container.resolve<AuthService>('authService')\n  const valid = await auth.isPasswordResetTokenValid(parsed.data.token)\n  return NextResponse.json({ ok: true, valid })\n}\n\nexport const metadata = { requireAuth: false }\n\nconst passwordResetValidateResponseSchema = z.object({\n  ok: z.literal(true),\n  valid: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Check a password reset token',\n  methods: {\n    POST: {\n      summary: 'Check whether a password reset token is still usable',\n      description: 'Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.',\n      requestBody: {\n        contentType: 'application/x-www-form-urlencoded',\n        schema: validatePasswordResetTokenSchema,\n      },\n      responses: [\n        { status: 200, description: 'Token state resolved', schema: passwordResetValidateResponseSchema },\n      ],\n      errors: [\n        { status: 429, description: 'Too many token validation attempts', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AAEnC,MAAM,+BAA+B,4BAA4B,kBAAkB;AAAA,EACjF,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAK,WAAW;AACxC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAE5C,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB,EAAE,KAAK,UAAU,6BAA6B,CAAC;AAC1G,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,iCAAiC,UAAU,EAAE,MAAM,CAAC;AAGnE,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,MAAM,CAAC;AACxE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AACzD,QAAM,QAAQ,MAAM,KAAK,0BAA0B,OAAO,KAAK,KAAK;AACpE,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,CAAC;AAC9C;AAEO,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,sCAAsC,EAAE,OAAO;AAAA,EACnD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,QAAQ;AACnB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oCAAoC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,qBAAqB;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/auth/data/validators.js

@@ -14,6 +14,9 @@ const confirmPasswordResetSchema = z.object({
   token: z.string().min(10),
   password: passwordSchema
 });
+const validatePasswordResetTokenSchema = z.object({
+  token: z.string().min(10)
+});
 const refreshSessionRequestSchema = z.object({
   refreshToken: z.string().min(1)
 });
@@ -117,6 +120,7 @@ export {
   sidebarVariantSettingsSchema,
   updateSidebarVariantInputSchema,
   userCreateSchema,
-  userLoginSchema
+  userLoginSchema,
+  validatePasswordResetTokenSchema
 };
 //# sourceMappingURL=validators.js.map

package/dist/modules/auth/data/validators.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/data/validators.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nconst passwordSchema = buildPasswordSchema()\n\n// Core auth validators\nexport const userLoginSchema = z.object({\n  email: z.string().email(),\n  password: z.string().min(6),\n  requireRole: z.string().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const requestPasswordResetSchema = z.object({\n  email: z.string().email(),\n})\n\nexport const confirmPasswordResetSchema = z.object({\n  token: z.string().min(10),\n  password: passwordSchema,\n})\n\nexport const refreshSessionRequestSchema = z.object({\n  refreshToken: z.string().min(1),\n})\n\nexport const sidebarPreferencesScopeSchema = z.union([\n  z.object({ type: z.literal('user') }),\n  z.object({ type: z.literal('role'), roleId: z.string().uuid() }),\n])\n\n// Sidebar settings shape shared by both `sidebarPreferencesInputSchema` (which\n// adds role-targeting fields) and the variants API (which uses just the\n// settings + name + isActive). Keeping the field constraints in one place\n// prevents drift between the preferences and variants surfaces.\nexport const sidebarVariantSettingsSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n})\n\nexport const createSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const updateSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const sidebarVariantRecordSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  isActive: z.boolean(),\n  settings: z.object({\n    version: z.number().int().positive(),\n    groupOrder: z.array(z.string()),\n    groupLabels: z.record(z.string(), z.string()),\n    itemLabels: z.record(z.string(), z.string()),\n    hiddenItems: z.array(z.string()),\n    itemOrder: z.record(z.string(), z.array(z.string())),\n  }),\n  createdAt: z.string(),\n  updatedAt: z.string().nullable(),\n})\n\nexport const sidebarPreferencesInputSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n  applyToRoles: z.array(z.string().uuid()).optional(),\n  clearRoleIds: z.array(z.string().uuid()).optional(),\n  scope: sidebarPreferencesScopeSchema.optional(),\n}).superRefine((value, ctx) => {\n  const scopeType = value.scope?.type ?? 'user'\n  if (scopeType === 'role') {\n    if ((value.applyToRoles?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['applyToRoles'],\n        message: 'applyToRoles is only valid when scope.type === \"user\"',\n      })\n    }\n    if ((value.clearRoleIds?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['clearRoleIds'],\n        message: 'clearRoleIds is only valid when scope.type === \"user\"',\n      })\n    }\n  }\n})\n\n// Optional helpers for CLI or admin forms\nexport const userCreateSchema = z.object({\n  email: z.string().email(),\n  name: z.preprocess(\n    (value) => {\n      if (typeof value !== 'string') return value\n      const trimmed = value.trim()\n      return trimmed.length ? trimmed : undefined\n    },\n    z.string().trim().min(1).max(120).optional(),\n  ),\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid(),\n  rolesCsv: z.string().optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nexport const featureCheckRequestSchema = z.object({\n  features: z.array(z.string().max(128)).max(50).describe('Feature identifiers to check'),\n}).describe('Batch feature check payload')\n\nexport type UserLoginInput = z.infer<typeof userLoginSchema>\nexport type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>\nexport type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>\nexport type RefreshSessionRequestInput = z.infer<typeof refreshSessionRequestSchema>\nexport type SidebarPreferencesInput = z.infer<typeof sidebarPreferencesInputSchema>\nexport type SidebarVariantSettingsInput = z.infer<typeof sidebarVariantSettingsSchema>\nexport type CreateSidebarVariantInput = z.infer<typeof createSidebarVariantInputSchema>\nexport type UpdateSidebarVariantInput = z.infer<typeof updateSidebarVariantInputSchema>\nexport type SidebarVariantRecordResponse = z.infer<typeof sidebarVariantRecordSchema>\nexport type UserCreateInput = z.infer<typeof userCreateSchema>\nexport type FeatureCheckRequestInput = z.infer<typeof featureCheckRequestSchema>\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,2BAA2B;AAEpC,MAAM,iBAAiB,oBAAoB;AAGpC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,UAAU;AACZ,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AAEM,MAAM,gCAAgC,EAAE,MAAM;AAAA,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,EACpC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAMM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AACvF,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,IACjB,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACnC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC9B,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC5C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC3C,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,EACrD,CAAC;AAAA,EACD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EACrF,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,OAAO,8BAA8B,SAAS;AAChD,CAAC,EAAE,YAAY,CAAC,OAAO,QAAQ;AAC7B,QAAM,YAAY,MAAM,OAAO,QAAQ;AACvC,MAAI,cAAc,QAAQ;AACxB,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE;AAAA,IACN,CAAC,UAAU;AACT,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,SAAS,UAAU;AAAA,IACpC;AAAA,IACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C;AAAA,EACA,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEO,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,8BAA8B;AACxF,CAAC,EAAE,SAAS,6BAA6B;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nconst passwordSchema = buildPasswordSchema()\n\n// Core auth validators\nexport const userLoginSchema = z.object({\n  email: z.string().email(),\n  password: z.string().min(6),\n  requireRole: z.string().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const requestPasswordResetSchema = z.object({\n  email: z.string().email(),\n})\n\nexport const confirmPasswordResetSchema = z.object({\n  token: z.string().min(10),\n  password: passwordSchema,\n})\n\nexport const validatePasswordResetTokenSchema = z.object({\n  token: z.string().min(10),\n})\n\nexport const refreshSessionRequestSchema = z.object({\n  refreshToken: z.string().min(1),\n})\n\nexport const sidebarPreferencesScopeSchema = z.union([\n  z.object({ type: z.literal('user') }),\n  z.object({ type: z.literal('role'), roleId: z.string().uuid() }),\n])\n\n// Sidebar settings shape shared by both `sidebarPreferencesInputSchema` (which\n// adds role-targeting fields) and the variants API (which uses just the\n// settings + name + isActive). Keeping the field constraints in one place\n// prevents drift between the preferences and variants surfaces.\nexport const sidebarVariantSettingsSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n})\n\nexport const createSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const updateSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const sidebarVariantRecordSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  isActive: z.boolean(),\n  settings: z.object({\n    version: z.number().int().positive(),\n    groupOrder: z.array(z.string()),\n    groupLabels: z.record(z.string(), z.string()),\n    itemLabels: z.record(z.string(), z.string()),\n    hiddenItems: z.array(z.string()),\n    itemOrder: z.record(z.string(), z.array(z.string())),\n  }),\n  createdAt: z.string(),\n  updatedAt: z.string().nullable(),\n})\n\nexport const sidebarPreferencesInputSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n  applyToRoles: z.array(z.string().uuid()).optional(),\n  clearRoleIds: z.array(z.string().uuid()).optional(),\n  scope: sidebarPreferencesScopeSchema.optional(),\n}).superRefine((value, ctx) => {\n  const scopeType = value.scope?.type ?? 'user'\n  if (scopeType === 'role') {\n    if ((value.applyToRoles?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['applyToRoles'],\n        message: 'applyToRoles is only valid when scope.type === \"user\"',\n      })\n    }\n    if ((value.clearRoleIds?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['clearRoleIds'],\n        message: 'clearRoleIds is only valid when scope.type === \"user\"',\n      })\n    }\n  }\n})\n\n// Optional helpers for CLI or admin forms\nexport const userCreateSchema = z.object({\n  email: z.string().email(),\n  name: z.preprocess(\n    (value) => {\n      if (typeof value !== 'string') return value\n      const trimmed = value.trim()\n      return trimmed.length ? trimmed : undefined\n    },\n    z.string().trim().min(1).max(120).optional(),\n  ),\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid(),\n  rolesCsv: z.string().optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nexport const featureCheckRequestSchema = z.object({\n  features: z.array(z.string().max(128)).max(50).describe('Feature identifiers to check'),\n}).describe('Batch feature check payload')\n\nexport type UserLoginInput = z.infer<typeof userLoginSchema>\nexport type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>\nexport type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>\nexport type ValidatePasswordResetTokenInput = z.infer<typeof validatePasswordResetTokenSchema>\nexport type RefreshSessionRequestInput = z.infer<typeof refreshSessionRequestSchema>\nexport type SidebarPreferencesInput = z.infer<typeof sidebarPreferencesInputSchema>\nexport type SidebarVariantSettingsInput = z.infer<typeof sidebarVariantSettingsSchema>\nexport type CreateSidebarVariantInput = z.infer<typeof createSidebarVariantInputSchema>\nexport type UpdateSidebarVariantInput = z.infer<typeof updateSidebarVariantInputSchema>\nexport type SidebarVariantRecordResponse = z.infer<typeof sidebarVariantRecordSchema>\nexport type UserCreateInput = z.infer<typeof userCreateSchema>\nexport type FeatureCheckRequestInput = z.infer<typeof featureCheckRequestSchema>\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,2BAA2B;AAEpC,MAAM,iBAAiB,oBAAoB;AAGpC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,UAAU;AACZ,CAAC;AAEM,MAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC1B,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AAEM,MAAM,gCAAgC,EAAE,MAAM;AAAA,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,EACpC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAMM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AACvF,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,IACjB,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACnC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC9B,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC5C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC3C,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,EACrD,CAAC;AAAA,EACD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EACrF,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,OAAO,8BAA8B,SAAS;AAChD,CAAC,EAAE,YAAY,CAAC,OAAO,QAAQ;AAC7B,QAAM,YAAY,MAAM,OAAO,QAAQ;AACvC,MAAI,cAAc,QAAQ;AACxB,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE;AAAA,IACN,CAAC,UAAU;AACT,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,SAAS,UAAU;AAAA,IACpC;AAAA,IACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C;AAAA,EACA,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEO,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,8BAA8B;AACxF,CAAC,EAAE,SAAS,6BAA6B;",
   "names": []
 }

package/dist/modules/auth/frontend/reset/[token]/page.js

@@ -5,8 +5,10 @@ import { Button } from "@open-mercato/ui/primitives/button";
 import { PasswordInput } from "@open-mercato/ui/primitives/password-input";
 import { Label } from "@open-mercato/ui/primitives/label";
 import { useEffect, useState } from "react";
+import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { Spinner } from "@open-mercato/ui/primitives/spinner";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from "@open-mercato/shared/lib/auth/passwordPolicy";
 function ResetWithTokenPage({ params }) {
@@ -15,12 +17,35 @@ function ResetWithTokenPage({ params }) {
   const [error, setError] = useState(null);
   const [submitting, setSubmitting] = useState(false);
   const [clientReady, setClientReady] = useState(false);
+  const [tokenState, setTokenState] = useState("checking");
   const passwordPolicy = getPasswordPolicy();
   const passwordRequirements = formatPasswordRequirements(passwordPolicy, t);
   const passwordDescription = passwordRequirements ? t("auth.password.requirements.help", "Password requirements: {requirements}", { requirements: passwordRequirements }) : "";
   useEffect(() => {
     setClientReady(true);
   }, []);
+  useEffect(() => {
+    let cancelled = false;
+    async function checkToken() {
+      const body = new FormData();
+      body.set("token", params.token);
+      try {
+        const { ok, result } = await apiCall(
+          "/api/auth/reset/validate",
+          { method: "POST", body }
+        );
+        if (cancelled) return;
+        setTokenState(ok && result?.valid === false ? "expired" : "usable");
+      } catch {
+        if (cancelled) return;
+        setTokenState("usable");
+      }
+    }
+    void checkToken();
+    return () => {
+      cancelled = true;
+    };
+  }, [params.token]);
   async function onSubmit(e) {
     e.preventDefault();
     setError(null);
@@ -59,6 +84,27 @@ function ResetWithTokenPage({ params }) {
       setSubmitting(false);
     }
   }
+  if (tokenState === "checking") {
+    return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
+      /* @__PURE__ */ jsx(CardHeader, { children: /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }) }),
+      /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", "data-auth-token-state": "checking", children: [
+        /* @__PURE__ */ jsx(Spinner, { size: "sm" }),
+        /* @__PURE__ */ jsx("span", { children: t("auth.reset.token.checking", "Checking your reset link...") })
+      ] }) })
+    ] }) });
+  }
+  if (tokenState === "expired") {
+    return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
+      /* @__PURE__ */ jsxs(CardHeader, { children: [
+        /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.token.expiredTitle", "This reset link is no longer valid") }),
+        /* @__PURE__ */ jsx(CardDescription, { children: t("auth.reset.token.expiredSubtitle", "It has already been used or has expired. Request a new link to set your password.") })
+      ] }),
+      /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("div", { className: "grid gap-3", "data-auth-token-state": "expired", children: [
+        /* @__PURE__ */ jsx(Button, { asChild: true, className: "w-full", children: /* @__PURE__ */ jsx(Link, { href: "/reset", children: t("auth.reset.token.requestNew", "Request a new link") }) }),
+        /* @__PURE__ */ jsx("div", { className: "text-center", children: /* @__PURE__ */ jsx(Link, { href: "/login", className: "text-xs text-muted-foreground underline", children: t("auth.reset.backToLogin", "Back to login") }) })
+      ] }) })
+    ] }) });
+  }
   return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
     /* @__PURE__ */ jsxs(CardHeader, { children: [
       /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }),

package/dist/modules/auth/frontend/reset/[token]/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/frontend/reset/%5Btoken%5D/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useEffect, useState } from 'react'\nimport { useRouter } from 'next/navigation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nexport default function ResetWithTokenPage({ params }: { params: { token: string } }) {\n  const router = useRouter()\n  const t = useT()\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [clientReady, setClientReady] = useState(false)\n  const passwordPolicy = getPasswordPolicy()\n  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)\n  const passwordDescription = passwordRequirements\n    ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n    : ''\n\n  useEffect(() => {\n    setClientReady(true)\n  }, [])\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    const form = new FormData(e.currentTarget)\n    const password = String(form.get('password') ?? '')\n    const confirmPassword = String(form.get('confirmPassword') ?? '')\n\n    if (!password) {\n      setError(t('auth.profile.form.errors.newPasswordRequired', 'New password is required.'))\n      return\n    }\n    if (!confirmPassword) {\n      setError(t('auth.profile.form.errors.confirmPasswordRequired', 'Please confirm the new password.'))\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(t('auth.profile.form.errors.passwordMismatch', 'Passwords do not match.'))\n      return\n    }\n    if (!validatePassword(password, passwordPolicy).ok) {\n      setError(t('auth.profile.form.errors.passwordRequirements', 'Password must meet the requirements.'))\n      return\n    }\n\n    setSubmitting(true)\n    try {\n      form.set('token', params.token)\n      const { ok, result } = await apiCall<{ ok?: boolean; error?: string; redirect?: string }>(\n        '/api/auth/reset/confirm',\n        { method: 'POST', body: form },\n      )\n      if (!ok || result?.ok === false) {\n        setError(result?.error || t('auth.reset.errors.failed', 'Unable to reset password'))\n        return\n      }\n      router.replace(result?.redirect || '/login')\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader>\n          <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit} data-auth-ready={clientReady ? '1' : '0'}>\n            {error && <div className=\"text-sm text-status-error-text\">{error}</div>}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.reset.form.password', 'New password')}</Label>\n              <PasswordInput id=\"password\" name=\"password\" required minLength={passwordPolicy.minLength} autoComplete=\"new-password\" />\n              {passwordDescription ? (\n                <p className=\"text-xs text-muted-foreground\">{passwordDescription}</p>\n              ) : null}\n            </div>\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"confirmPassword\">{t('auth.profile.form.confirmPassword', 'Confirm new password')}</Label>\n              <PasswordInput\n                id=\"confirmPassword\"\n                name=\"confirmPassword\"\n                required\n                minLength={passwordPolicy.minLength}\n                autoComplete=\"new-password\"\n              />\n            </div>\n            <Button type=\"submit\" className=\"mt-2 w-full\" disabled={submitting}>\n              {submitting ? t('auth.reset.form.loading', '...') : t('auth.reset.form.submit', 'Update password')}\n            </Button>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
-  "mappings": ";AAuEQ,SACE,KADF;AAtER,SAAS,MAAM,aAAa,YAAY,WAAW,uBAAuB;AAC1E,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAC9B,SAAS,aAAa;AACtB,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB;AAC1B,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,4BAA4B,mBAAmB,wBAAwB;AAEjE,SAAR,mBAAoC,EAAE,OAAO,GAAkC;AACpF,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,uBAAuB,2BAA2B,gBAAgB,CAAC;AACzE,QAAM,sBAAsB,uBACxB,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH;AAEJ,YAAU,MAAM;AACd,mBAAe,IAAI;AAAA,EACrB,GAAG,CAAC,CAAC;AAEL,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,UAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,UAAM,kBAAkB,OAAO,KAAK,IAAI,iBAAiB,KAAK,EAAE;AAEhE,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,gDAAgD,2BAA2B,CAAC;AACvF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,eAAS,EAAE,oDAAoD,kCAAkC,CAAC;AAClG;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,6CAA6C,yBAAyB,CAAC;AAClF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,UAAU,cAAc,EAAE,IAAI;AAClD,eAAS,EAAE,iDAAiD,sCAAsC,CAAC;AACnG;AAAA,IACF;AAEA,kBAAc,IAAI;AAClB,QAAI;AACF,WAAK,IAAI,SAAS,OAAO,KAAK;AAC9B,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA,EAAE,QAAQ,QAAQ,MAAM,KAAK;AAAA,MAC/B;AACA,UAAI,CAAC,MAAM,QAAQ,OAAO,OAAO;AAC/B,iBAAS,QAAQ,SAAS,EAAE,4BAA4B,0BAA0B,CAAC;AACnF;AAAA,MACF;AACA,aAAO,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC7C,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cACC;AAAA,0BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE;AAAA,MACxD,oBAAC,mBAAiB,YAAE,uBAAuB,4CAA4C,GAAE;AAAA,OAC3F;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,mBAAiB,cAAc,MAAM,KACnF;AAAA,eAAS,oBAAC,SAAI,WAAU,kCAAkC,iBAAM;AAAA,MACjE,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,4BAA4B,cAAc,GAAE;AAAA,QACzE,oBAAC,iBAAc,IAAG,YAAW,MAAK,YAAW,UAAQ,MAAC,WAAW,eAAe,WAAW,cAAa,gBAAe;AAAA,QACtH,sBACC,oBAAC,OAAE,WAAU,iCAAiC,+BAAoB,IAChE;AAAA,SACN;AAAA,MACA,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,qCAAqC,sBAAsB,GAAE;AAAA,QACjG;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,WAAW,eAAe;AAAA,YAC1B,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,eAAc,UAAU,YACrD,uBAAa,EAAE,2BAA2B,KAAK,IAAI,EAAE,0BAA0B,iBAAiB,GACnG;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useEffect, useState } from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\ntype TokenState = 'checking' | 'usable' | 'expired'\n\nexport default function ResetWithTokenPage({ params }: { params: { token: string } }) {\n  const router = useRouter()\n  const t = useT()\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [clientReady, setClientReady] = useState(false)\n  const [tokenState, setTokenState] = useState<TokenState>('checking')\n  const passwordPolicy = getPasswordPolicy()\n  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)\n  const passwordDescription = passwordRequirements\n    ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n    : ''\n\n  useEffect(() => {\n    setClientReady(true)\n  }, [])\n\n  useEffect(() => {\n    let cancelled = false\n    async function checkToken() {\n      const body = new FormData()\n      body.set('token', params.token)\n      // Fail open whenever the check cannot answer \u2014 an unreachable or failing\n      // endpoint must not strand a user holding a perfectly good link, and the\n      // confirm endpoint still rejects a dead token on submit.\n      try {\n        const { ok, result } = await apiCall<{ ok?: boolean; valid?: boolean }>(\n          '/api/auth/reset/validate',\n          { method: 'POST', body },\n        )\n        if (cancelled) return\n        setTokenState(ok && result?.valid === false ? 'expired' : 'usable')\n      } catch {\n        if (cancelled) return\n        setTokenState('usable')\n      }\n    }\n    void checkToken()\n    return () => { cancelled = true }\n  }, [params.token])\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    const form = new FormData(e.currentTarget)\n    const password = String(form.get('password') ?? '')\n    const confirmPassword = String(form.get('confirmPassword') ?? '')\n\n    if (!password) {\n      setError(t('auth.profile.form.errors.newPasswordRequired', 'New password is required.'))\n      return\n    }\n    if (!confirmPassword) {\n      setError(t('auth.profile.form.errors.confirmPasswordRequired', 'Please confirm the new password.'))\n      return\n    }\n    if (password !== confirmPassword) {\n      setError(t('auth.profile.form.errors.passwordMismatch', 'Passwords do not match.'))\n      return\n    }\n    if (!validatePassword(password, passwordPolicy).ok) {\n      setError(t('auth.profile.form.errors.passwordRequirements', 'Password must meet the requirements.'))\n      return\n    }\n\n    setSubmitting(true)\n    try {\n      form.set('token', params.token)\n      const { ok, result } = await apiCall<{ ok?: boolean; error?: string; redirect?: string }>(\n        '/api/auth/reset/confirm',\n        { method: 'POST', body: form },\n      )\n      if (!ok || result?.ok === false) {\n        setError(result?.error || t('auth.reset.errors.failed', 'Unable to reset password'))\n        return\n      }\n      router.replace(result?.redirect || '/login')\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  if (tokenState === 'checking') {\n    return (\n      <div className=\"min-h-svh flex items-center justify-center p-4\">\n        <Card className=\"w-full max-w-sm\">\n          <CardHeader>\n            <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          </CardHeader>\n          <CardContent>\n            <div className=\"flex items-center gap-2 text-sm text-muted-foreground\" data-auth-token-state=\"checking\">\n              <Spinner size=\"sm\" />\n              <span>{t('auth.reset.token.checking', 'Checking your reset link...')}</span>\n            </div>\n          </CardContent>\n        </Card>\n      </div>\n    )\n  }\n\n  if (tokenState === 'expired') {\n    return (\n      <div className=\"min-h-svh flex items-center justify-center p-4\">\n        <Card className=\"w-full max-w-sm\">\n          <CardHeader>\n            <CardTitle>{t('auth.reset.token.expiredTitle', 'This reset link is no longer valid')}</CardTitle>\n            <CardDescription>\n              {t('auth.reset.token.expiredSubtitle', 'It has already been used or has expired. Request a new link to set your password.')}\n            </CardDescription>\n          </CardHeader>\n          <CardContent>\n            <div className=\"grid gap-3\" data-auth-token-state=\"expired\">\n              <Button asChild className=\"w-full\">\n                <Link href=\"/reset\">{t('auth.reset.token.requestNew', 'Request a new link')}</Link>\n              </Button>\n              <div className=\"text-center\">\n                <Link href=\"/login\" className=\"text-xs text-muted-foreground underline\">\n                  {t('auth.reset.backToLogin', 'Back to login')}\n                </Link>\n              </div>\n            </div>\n          </CardContent>\n        </Card>\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader>\n          <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit} data-auth-ready={clientReady ? '1' : '0'}>\n            {error && <div className=\"text-sm text-status-error-text\">{error}</div>}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.reset.form.password', 'New password')}</Label>\n              <PasswordInput id=\"password\" name=\"password\" required minLength={passwordPolicy.minLength} autoComplete=\"new-password\" />\n              {passwordDescription ? (\n                <p className=\"text-xs text-muted-foreground\">{passwordDescription}</p>\n              ) : null}\n            </div>\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"confirmPassword\">{t('auth.profile.form.confirmPassword', 'Confirm new password')}</Label>\n              <PasswordInput\n                id=\"confirmPassword\"\n                name=\"confirmPassword\"\n                required\n                minLength={passwordPolicy.minLength}\n                autoComplete=\"new-password\"\n              />\n            </div>\n            <Button type=\"submit\" className=\"mt-2 w-full\" disabled={submitting}>\n              {submitting ? t('auth.reset.form.loading', '...') : t('auth.reset.form.submit', 'Update password')}\n            </Button>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
+  "mappings": ";AAsGY,cAGA,YAHA;AArGZ,SAAS,MAAM,aAAa,YAAY,WAAW,uBAAuB;AAC1E,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAC9B,SAAS,aAAa;AACtB,SAAS,WAAW,gBAAgB;AACpC,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,eAAe;AACxB,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,4BAA4B,mBAAmB,wBAAwB;AAIjE,SAAR,mBAAoC,EAAE,OAAO,GAAkC;AACpF,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAqB,UAAU;AACnE,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,uBAAuB,2BAA2B,gBAAgB,CAAC;AACzE,QAAM,sBAAsB,uBACxB,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH;AAEJ,YAAU,MAAM;AACd,mBAAe,IAAI;AAAA,EACrB,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,QAAI,YAAY;AAChB,mBAAe,aAAa;AAC1B,YAAM,OAAO,IAAI,SAAS;AAC1B,WAAK,IAAI,SAAS,OAAO,KAAK;AAI9B,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UAC3B;AAAA,UACA,EAAE,QAAQ,QAAQ,KAAK;AAAA,QACzB;AACA,YAAI,UAAW;AACf,sBAAc,MAAM,QAAQ,UAAU,QAAQ,YAAY,QAAQ;AAAA,MACpE,QAAQ;AACN,YAAI,UAAW;AACf,sBAAc,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,SAAK,WAAW;AAChB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,OAAO,KAAK,CAAC;AAEjB,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,UAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,UAAM,kBAAkB,OAAO,KAAK,IAAI,iBAAiB,KAAK,EAAE;AAEhE,QAAI,CAAC,UAAU;AACb,eAAS,EAAE,gDAAgD,2BAA2B,CAAC;AACvF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,eAAS,EAAE,oDAAoD,kCAAkC,CAAC;AAClG;AAAA,IACF;AACA,QAAI,aAAa,iBAAiB;AAChC,eAAS,EAAE,6CAA6C,yBAAyB,CAAC;AAClF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,UAAU,cAAc,EAAE,IAAI;AAClD,eAAS,EAAE,iDAAiD,sCAAsC,CAAC;AACnG;AAAA,IACF;AAEA,kBAAc,IAAI;AAClB,QAAI;AACF,WAAK,IAAI,SAAS,OAAO,KAAK;AAC9B,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA,EAAE,QAAQ,QAAQ,MAAM,KAAK;AAAA,MAC/B;AACA,UAAI,CAAC,MAAM,QAAQ,OAAO,OAAO;AAC/B,iBAAS,QAAQ,SAAS,EAAE,4BAA4B,0BAA0B,CAAC;AACnF;AAAA,MACF;AACA,aAAO,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC7C,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,eAAe,YAAY;AAC7B,WACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,0BAAC,cACC,8BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE,GAC1D;AAAA,MACA,oBAAC,eACC,+BAAC,SAAI,WAAU,yDAAwD,yBAAsB,YAC3F;AAAA,4BAAC,WAAQ,MAAK,MAAK;AAAA,QACnB,oBAAC,UAAM,YAAE,6BAA6B,6BAA6B,GAAE;AAAA,SACvE,GACF;AAAA,OACF,GACF;AAAA,EAEJ;AAEA,MAAI,eAAe,WAAW;AAC5B,WACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,2BAAC,cACC;AAAA,4BAAC,aAAW,YAAE,iCAAiC,oCAAoC,GAAE;AAAA,QACrF,oBAAC,mBACE,YAAE,oCAAoC,mFAAmF,GAC5H;AAAA,SACF;AAAA,MACA,oBAAC,eACC,+BAAC,SAAI,WAAU,cAAa,yBAAsB,WAChD;AAAA,4BAAC,UAAO,SAAO,MAAC,WAAU,UACxB,8BAAC,QAAK,MAAK,UAAU,YAAE,+BAA+B,oBAAoB,GAAE,GAC9E;AAAA,QACA,oBAAC,SAAI,WAAU,eACb,8BAAC,QAAK,MAAK,UAAS,WAAU,2CAC3B,YAAE,0BAA0B,eAAe,GAC9C,GACF;AAAA,SACF,GACF;AAAA,OACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cACC;AAAA,0BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE;AAAA,MACxD,oBAAC,mBAAiB,YAAE,uBAAuB,4CAA4C,GAAE;AAAA,OAC3F;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,mBAAiB,cAAc,MAAM,KACnF;AAAA,eAAS,oBAAC,SAAI,WAAU,kCAAkC,iBAAM;AAAA,MACjE,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,4BAA4B,cAAc,GAAE;AAAA,QACzE,oBAAC,iBAAc,IAAG,YAAW,MAAK,YAAW,UAAQ,MAAC,WAAW,eAAe,WAAW,cAAa,gBAAe;AAAA,QACtH,sBACC,oBAAC,OAAE,WAAU,iCAAiC,+BAAoB,IAChE;AAAA,SACN;AAAA,MACA,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,mBAAmB,YAAE,qCAAqC,sBAAsB,GAAE;AAAA,QACjG;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,WAAW,eAAe;AAAA,YAC1B,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACA,oBAAC,UAAO,MAAK,UAAS,WAAU,eAAc,UAAU,YACrD,uBAAa,EAAE,2BAA2B,KAAK,IAAI,EAAE,0BAA0B,iBAAiB,GACnG;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/auth/services/authService.js

@@ -110,11 +110,25 @@ class AuthService {
     await this.em.persist(row).flush();
     return { user, token: rawToken };
   }
-  async confirmPasswordReset(token, newPassword) {
+  async findUnconsumedPasswordReset(token) {
     const now = /* @__PURE__ */ new Date();
     const hashedToken = hashAuthToken(token);
     const row = await this.em.findOne(PasswordReset, { token: hashedToken });
-    if (!row || row.usedAt && row.usedAt <= now || row.expiresAt <= now) return null;
+    if (!row) return null;
+    if (row.usedAt && row.usedAt <= now) return null;
+    if (row.expiresAt <= now) return null;
+    return row;
+  }
+  async isPasswordResetTokenValid(token) {
+    const row = await this.findUnconsumedPasswordReset(token);
+    if (!row) return false;
+    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null });
+    return user != null;
+  }
+  async confirmPasswordReset(token, newPassword) {
+    const now = /* @__PURE__ */ new Date();
+    const row = await this.findUnconsumedPasswordReset(token);
+    if (!row) return null;
     const affected = await this.em.nativeUpdate(
       PasswordReset,
       { id: row.id, usedAt: null },

package/dist/modules/auth/services/authService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/authService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
-  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,OAAQ,IAAI,UAAU,IAAI,UAAU,OAAQ,IAAI,aAAa,IAAK,QAAO;AAG9E,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  private async findUnconsumedPasswordReset(token: string): Promise<PasswordReset | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row) return null\n    if (row.usedAt && row.usedAt <= now) return null\n    if (row.expiresAt <= now) return null\n    return row\n  }\n\n  async isPasswordResetTokenValid(token: string): Promise<boolean> {\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return false\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    return user != null\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
+  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAc,4BAA4B,OAA8C;AACtF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,UAAU,IAAI,UAAU,IAAK,QAAO;AAC5C,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,OAAiC;AAC/D,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AAGjB,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/modules/customers/backend/hooks/useEmailDuplicateCheck.js

@@ -18,13 +18,19 @@ function useEmailDuplicateCheck(email, { recordId, disabled, debounceMs = DEFAUL
       return;
     }
     const normalized = trimmed.toLowerCase();
+    const excludedId = typeof recordId === "string" && recordId.trim().length ? recordId.trim() : null;
     let cancelled = false;
     const controller = new AbortController();
     const timer = window.setTimeout(async () => {
       setChecking(true);
       try {
-        const queryParam = matchMode === "prefix" ? `emailStartsWith=${encodeURIComponent(normalized)}` : `email=${encodeURIComponent(normalized)}`;
-        const call = await apiCall(`/api/customers/people?${queryParam}&pageSize=5&page=1`, {
+        const params = [
+          matchMode === "prefix" ? `emailStartsWith=${encodeURIComponent(normalized)}` : `email=${encodeURIComponent(normalized)}`,
+          "pageSize=5",
+          "page=1"
+        ];
+        if (excludedId) params.push(`excludeIds=${encodeURIComponent(excludedId)}`);
+        const call = await apiCall(`/api/customers/people?${params.join("&")}`, {
           signal: controller.signal
         });
         if (!call.ok) {
@@ -41,7 +47,7 @@ function useEmailDuplicateCheck(email, { recordId, disabled, debounceMs = DEFAUL
           const emailValue = typeof item.primary_email === "string" ? item.primary_email.toLowerCase() : null;
           return id && displayName && emailValue ? { id, displayName, email: emailValue } : null;
         }).filter((entry) => !!entry).find((entry) => {
-          if (entry.id === recordId) return false;
+          if (excludedId && entry.id === excludedId) return false;
           return matchMode === "prefix" ? entry.email.startsWith(normalized) : entry.email === normalized;
         }) ?? null;
         if (!cancelled) {

package/dist/modules/customers/backend/hooks/useEmailDuplicateCheck.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customers/backend/hooks/useEmailDuplicateCheck.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport type EmailDuplicateMatch = {\n  id: string\n  displayName: string\n  email: string\n}\n\ntype UseEmailDuplicateCheckOptions = {\n  recordId?: string | null\n  disabled?: boolean\n  debounceMs?: number\n  matchMode?: 'exact' | 'prefix'\n}\n\nconst DEFAULT_DEBOUNCE_MS = 300\n\nexport function useEmailDuplicateCheck(\n  email: string | null | undefined,\n  { recordId, disabled, debounceMs = DEFAULT_DEBOUNCE_MS, matchMode = 'exact' }: UseEmailDuplicateCheckOptions = {}\n) {\n  const [duplicate, setDuplicate] = React.useState<EmailDuplicateMatch | null>(null)\n  const [checking, setChecking] = React.useState(false)\n\n  React.useEffect(() => {\n    if (disabled) {\n      setDuplicate(null)\n      setChecking(false)\n      return\n    }\n\n    const trimmed = typeof email === 'string' ? email.trim() : ''\n    if (!trimmed.length) {\n      setDuplicate(null)\n      setChecking(false)\n      return\n    }\n\n    const normalized = trimmed.toLowerCase()\n    let cancelled = false\n    const controller = new AbortController()\n    const timer = window.setTimeout(async () => {\n      setChecking(true)\n      try {\n        const queryParam =\n          matchMode === 'prefix'\n            ? `emailStartsWith=${encodeURIComponent(normalized)}`\n            : `email=${encodeURIComponent(normalized)}`\n        const call = await apiCall<{ items?: unknown[] }>(`/api/customers/people?${queryParam}&pageSize=5&page=1`, {\n          signal: controller.signal,\n        })\n        if (!call.ok) {\n          if (!cancelled) setDuplicate(null)\n          return\n        }\n        const payload = call.result ?? {}\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        const match =\n          items\n            .map((raw) => {\n              if (!raw || typeof raw !== 'object') return null\n              const item = raw as Record<string, unknown>\n              const id = typeof item.id === 'string' ? item.id : null\n              const displayName = typeof item.display_name === 'string' ? item.display_name : null\n              const emailValue = typeof item.primary_email === 'string' ? item.primary_email.toLowerCase() : null\n              return id && displayName && emailValue\n                ? { id, displayName, email: emailValue }\n                : null\n            })\n            .filter((entry: EmailDuplicateMatch | null): entry is EmailDuplicateMatch => !!entry)\n            .find((entry: EmailDuplicateMatch) => {\n              if (entry.id === recordId) return false\n              return matchMode === 'prefix'\n                ? entry.email.startsWith(normalized)\n                : entry.email === normalized\n            }) ?? null\n        if (!cancelled) {\n          setDuplicate(match)\n        }\n      } catch (error) {\n        if (cancelled) return\n        if ((error as Error)?.name === 'AbortError') return\n        setDuplicate(null)\n      } finally {\n        if (!cancelled) setChecking(false)\n      }\n    }, debounceMs)\n\n    return () => {\n      cancelled = true\n      controller.abort()\n      window.clearTimeout(timer)\n    }\n  }, [email, recordId, disabled, debounceMs, matchMode])\n\n  return { duplicate, checking }\n}\n"],
-  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,eAAe;AAexB,MAAM,sBAAsB;AAErB,SAAS,uBACd,OACA,EAAE,UAAU,UAAU,aAAa,qBAAqB,YAAY,QAAQ,IAAmC,CAAC,GAChH;AACA,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAqC,IAAI;AACjF,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AAEpD,QAAM,UAAU,MAAM;AACpB,QAAI,UAAU;AACZ,mBAAa,IAAI;AACjB,kBAAY,KAAK;AACjB;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAC3D,QAAI,CAAC,QAAQ,QAAQ;AACnB,mBAAa,IAAI;AACjB,kBAAY,KAAK;AACjB;AAAA,IACF;AAEA,UAAM,aAAa,QAAQ,YAAY;AACvC,QAAI,YAAY;AAChB,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,OAAO,WAAW,YAAY;AAC1C,kBAAY,IAAI;AAChB,UAAI;AACF,cAAM,aACJ,cAAc,WACV,mBAAmB,mBAAmB,UAAU,CAAC,KACjD,SAAS,mBAAmB,UAAU,CAAC;AAC7C,cAAM,OAAO,MAAM,QAA+B,yBAAyB,UAAU,sBAAsB;AAAA,UACzG,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,YAAI,CAAC,KAAK,IAAI;AACZ,cAAI,CAAC,UAAW,cAAa,IAAI;AACjC;AAAA,QACF;AACA,cAAM,UAAU,KAAK,UAAU,CAAC;AAChC,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,cAAM,QACJ,MACG,IAAI,CAAC,QAAQ;AACZ,cAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,gBAAM,OAAO;AACb,gBAAM,KAAK,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AACnD,gBAAM,cAAc,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAChF,gBAAM,aAAa,OAAO,KAAK,kBAAkB,WAAW,KAAK,cAAc,YAAY,IAAI;AAC/F,iBAAO,MAAM,eAAe,aACxB,EAAE,IAAI,aAAa,OAAO,WAAW,IACrC;AAAA,QACN,CAAC,EACA,OAAO,CAAC,UAAoE,CAAC,CAAC,KAAK,EACnF,KAAK,CAAC,UAA+B;AACpC,cAAI,MAAM,OAAO,SAAU,QAAO;AAClC,iBAAO,cAAc,WACjB,MAAM,MAAM,WAAW,UAAU,IACjC,MAAM,UAAU;AAAA,QACtB,CAAC,KAAK;AACV,YAAI,CAAC,WAAW;AACd,uBAAa,KAAK;AAAA,QACpB;AAAA,MACF,SAAS,OAAO;AACd,YAAI,UAAW;AACf,YAAK,OAAiB,SAAS,aAAc;AAC7C,qBAAa,IAAI;AAAA,MACnB,UAAE;AACA,YAAI,CAAC,UAAW,aAAY,KAAK;AAAA,MACnC;AAAA,IACF,GAAG,UAAU;AAEb,WAAO,MAAM;AACX,kBAAY;AACZ,iBAAW,MAAM;AACjB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,OAAO,UAAU,UAAU,YAAY,SAAS,CAAC;AAErD,SAAO,EAAE,WAAW,SAAS;AAC/B;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport type EmailDuplicateMatch = {\n  id: string\n  displayName: string\n  email: string\n}\n\ntype UseEmailDuplicateCheckOptions = {\n  recordId?: string | null\n  disabled?: boolean\n  debounceMs?: number\n  matchMode?: 'exact' | 'prefix'\n}\n\nconst DEFAULT_DEBOUNCE_MS = 300\n\nexport function useEmailDuplicateCheck(\n  email: string | null | undefined,\n  { recordId, disabled, debounceMs = DEFAULT_DEBOUNCE_MS, matchMode = 'exact' }: UseEmailDuplicateCheckOptions = {}\n) {\n  const [duplicate, setDuplicate] = React.useState<EmailDuplicateMatch | null>(null)\n  const [checking, setChecking] = React.useState(false)\n\n  React.useEffect(() => {\n    if (disabled) {\n      setDuplicate(null)\n      setChecking(false)\n      return\n    }\n\n    const trimmed = typeof email === 'string' ? email.trim() : ''\n    if (!trimmed.length) {\n      setDuplicate(null)\n      setChecking(false)\n      return\n    }\n\n    const normalized = trimmed.toLowerCase()\n    const excludedId = typeof recordId === 'string' && recordId.trim().length ? recordId.trim() : null\n    let cancelled = false\n    const controller = new AbortController()\n    const timer = window.setTimeout(async () => {\n      setChecking(true)\n      try {\n        const params = [\n          matchMode === 'prefix'\n            ? `emailStartsWith=${encodeURIComponent(normalized)}`\n            : `email=${encodeURIComponent(normalized)}`,\n          'pageSize=5',\n          'page=1',\n        ]\n        // The record being edited is never its own duplicate (#5534). Excluding it in the\n        // query \u2014 not only in the client-side scan below \u2014 also stops it from consuming one\n        // of the five returned slots and hiding a genuine duplicate.\n        if (excludedId) params.push(`excludeIds=${encodeURIComponent(excludedId)}`)\n        const call = await apiCall<{ items?: unknown[] }>(`/api/customers/people?${params.join('&')}`, {\n          signal: controller.signal,\n        })\n        if (!call.ok) {\n          if (!cancelled) setDuplicate(null)\n          return\n        }\n        const payload = call.result ?? {}\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        const match =\n          items\n            .map((raw) => {\n              if (!raw || typeof raw !== 'object') return null\n              const item = raw as Record<string, unknown>\n              const id = typeof item.id === 'string' ? item.id : null\n              const displayName = typeof item.display_name === 'string' ? item.display_name : null\n              const emailValue = typeof item.primary_email === 'string' ? item.primary_email.toLowerCase() : null\n              return id && displayName && emailValue\n                ? { id, displayName, email: emailValue }\n                : null\n            })\n            .filter((entry: EmailDuplicateMatch | null): entry is EmailDuplicateMatch => !!entry)\n            .find((entry: EmailDuplicateMatch) => {\n              if (excludedId && entry.id === excludedId) return false\n              return matchMode === 'prefix'\n                ? entry.email.startsWith(normalized)\n                : entry.email === normalized\n            }) ?? null\n        if (!cancelled) {\n          setDuplicate(match)\n        }\n      } catch (error) {\n        if (cancelled) return\n        if ((error as Error)?.name === 'AbortError') return\n        setDuplicate(null)\n      } finally {\n        if (!cancelled) setChecking(false)\n      }\n    }, debounceMs)\n\n    return () => {\n      cancelled = true\n      controller.abort()\n      window.clearTimeout(timer)\n    }\n  }, [email, recordId, disabled, debounceMs, matchMode])\n\n  return { duplicate, checking }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,eAAe;AAexB,MAAM,sBAAsB;AAErB,SAAS,uBACd,OACA,EAAE,UAAU,UAAU,aAAa,qBAAqB,YAAY,QAAQ,IAAmC,CAAC,GAChH;AACA,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAqC,IAAI;AACjF,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AAEpD,QAAM,UAAU,MAAM;AACpB,QAAI,UAAU;AACZ,mBAAa,IAAI;AACjB,kBAAY,KAAK;AACjB;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAC3D,QAAI,CAAC,QAAQ,QAAQ;AACnB,mBAAa,IAAI;AACjB,kBAAY,KAAK;AACjB;AAAA,IACF;AAEA,UAAM,aAAa,QAAQ,YAAY;AACvC,UAAM,aAAa,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,SAAS,KAAK,IAAI;AAC9F,QAAI,YAAY;AAChB,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,OAAO,WAAW,YAAY;AAC1C,kBAAY,IAAI;AAChB,UAAI;AACF,cAAM,SAAS;AAAA,UACb,cAAc,WACV,mBAAmB,mBAAmB,UAAU,CAAC,KACjD,SAAS,mBAAmB,UAAU,CAAC;AAAA,UAC3C;AAAA,UACA;AAAA,QACF;AAIA,YAAI,WAAY,QAAO,KAAK,cAAc,mBAAmB,UAAU,CAAC,EAAE;AAC1E,cAAM,OAAO,MAAM,QAA+B,yBAAyB,OAAO,KAAK,GAAG,CAAC,IAAI;AAAA,UAC7F,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,YAAI,CAAC,KAAK,IAAI;AACZ,cAAI,CAAC,UAAW,cAAa,IAAI;AACjC;AAAA,QACF;AACA,cAAM,UAAU,KAAK,UAAU,CAAC;AAChC,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,cAAM,QACJ,MACG,IAAI,CAAC,QAAQ;AACZ,cAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,gBAAM,OAAO;AACb,gBAAM,KAAK,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AACnD,gBAAM,cAAc,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAChF,gBAAM,aAAa,OAAO,KAAK,kBAAkB,WAAW,KAAK,cAAc,YAAY,IAAI;AAC/F,iBAAO,MAAM,eAAe,aACxB,EAAE,IAAI,aAAa,OAAO,WAAW,IACrC;AAAA,QACN,CAAC,EACA,OAAO,CAAC,UAAoE,CAAC,CAAC,KAAK,EACnF,KAAK,CAAC,UAA+B;AACpC,cAAI,cAAc,MAAM,OAAO,WAAY,QAAO;AAClD,iBAAO,cAAc,WACjB,MAAM,MAAM,WAAW,UAAU,IACjC,MAAM,UAAU;AAAA,QACtB,CAAC,KAAK;AACV,YAAI,CAAC,WAAW;AACd,uBAAa,KAAK;AAAA,QACpB;AAAA,MACF,SAAS,OAAO;AACd,YAAI,UAAW;AACf,YAAK,OAAiB,SAAS,aAAc;AAC7C,qBAAa,IAAI;AAAA,MACnB,UAAE;AACA,YAAI,CAAC,UAAW,aAAY,KAAK;AAAA,MACnC;AAAA,IACF,GAAG,UAAU;AAEb,WAAO,MAAM;AACX,kBAAY;AACZ,iBAAW,MAAM;AACjB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,OAAO,UAAU,UAAU,YAAY,SAAS,CAAC;AAErD,SAAO,EAAE,WAAW,SAAS;AAC/B;",
   "names": []
 }

package/dist/modules/devices/api/admin/devices/[id]/route.js

@@ -13,6 +13,8 @@ import { updateDeviceSchema } from "../../../../data/validators.js";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
 import { resolveDeviceActorUserId } from "../../../auth.js";
 import { executeUpdate, executeDeactivate } from "../../../deviceOps.js";
+import { serializeDeviceDetail, deviceDetailItemSchema } from "../../../deviceSerialization.js";
+import { DEPRECATED_SNAKE_CASE_NOTICE } from "../../../openapi.js";
 const logger = createLogger("devices");
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["devices.admin"] },
@@ -24,21 +26,6 @@ async function loadDevice(container, id, tenantId) {
   const em = container.resolve("em");
   return findOneWithDecryption(em, UserDevice, { id, tenantId, deletedAt: null }, void 0, { tenantId });
 }
-function serializeDevice(device) {
-  return {
-    id: device.id,
-    user_id: device.userId,
-    device_id: device.deviceId,
-    platform: device.platform,
-    client_app_version: device.clientAppVersion ?? null,
-    os_version: device.osVersion ?? null,
-    push_provider: device.pushProvider ?? null,
-    push_token_updated_at: device.pushTokenUpdatedAt ? device.pushTokenUpdatedAt.toISOString() : null,
-    last_seen_at: device.lastSeenAt ? device.lastSeenAt.toISOString() : null,
-    created_at: device.createdAt ? device.createdAt.toISOString() : null,
-    updated_at: device.updatedAt ? device.updatedAt.toISOString() : null
-  };
-}
 async function GET(req, { params }) {
   const { translate } = await resolveTranslations();
   try {
@@ -60,7 +47,7 @@ async function GET(req, { params }) {
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {
       return NextResponse.json({ error: translate("devices.errors.forbidden", "Access denied") }, { status: 403 });
     }
-    return NextResponse.json({ item: serializeDevice(device) });
+    return NextResponse.json({ item: serializeDeviceDetail(device) });
   } catch (err) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
@@ -154,28 +141,14 @@ async function DELETE(req, { params }) {
 }
 const okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() });
 const errorResponseSchema = z.object({ error: z.string() });
-const detailResponseSchema = z.object({
-  item: z.object({
-    id: z.string().uuid(),
-    user_id: z.string().uuid(),
-    device_id: z.string(),
-    platform: z.enum(["ios", "android", "web"]),
-    client_app_version: z.string().nullable(),
-    os_version: z.string().nullable(),
-    push_provider: z.string().nullable(),
-    push_token_updated_at: z.string().nullable(),
-    last_seen_at: z.string().nullable(),
-    created_at: z.string().nullable(),
-    updated_at: z.string().nullable()
-  })
-});
+const detailResponseSchema = z.object({ item: deviceDetailItemSchema });
 const openApi = {
   tag: "Devices (admin)",
   summary: "Admin: read, update or deactivate any device in the tenant",
   methods: {
     GET: {
       summary: "Get any device",
-      description: "Admin: fetch a single device by id (push_token is never returned).",
+      description: `Admin: fetch a single device by id (push_token is never returned). ${DEPRECATED_SNAKE_CASE_NOTICE}`,
       responses: [{ status: 200, description: "Device", schema: detailResponseSchema }],
       errors: [
         { status: 400, description: "Invalid id", schema: errorResponseSchema },

package/dist/modules/devices/api/admin/devices/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/devices/api/admin/devices/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { UserDevice } from '../../../../data/entities'\nimport { updateDeviceSchema } from '../../../../data/validators'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveDeviceActorUserId } from '../../../auth'\nimport { executeUpdate, executeDeactivate, type DeviceMutationContext } from '../../../deviceOps'\n\nconst logger = createLogger('devices')\n\n// Admin: read/update/deactivate ANY device in the tenant. Gated by devices.admin (no owner check).\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['devices.admin'] },\n  PUT: { requireAuth: true, requireFeatures: ['devices.admin'] },\n  DELETE: { requireAuth: true, requireFeatures: ['devices.admin'] },\n}\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nasync function loadDevice(\n  container: Awaited<ReturnType<typeof createRequestContainer>>,\n  id: string,\n  tenantId: string,\n): Promise<UserDevice | null> {\n  const em = container.resolve('em') as EntityManager\n  // push_token is encrypted at rest; the org is not known until the row loads, so pass tenant only \u2014\n  // the helper prefers each record's own tenant/org and treats this scope as a fallback.\n  return findOneWithDecryption(em, UserDevice, { id, tenantId, deletedAt: null }, undefined, { tenantId })\n}\n\n// push_token is a secret and is never returned.\nfunction serializeDevice(device: UserDevice) {\n  return {\n    id: device.id,\n    user_id: device.userId,\n    device_id: device.deviceId,\n    platform: device.platform,\n    client_app_version: device.clientAppVersion ?? null,\n    os_version: device.osVersion ?? null,\n    push_provider: device.pushProvider ?? null,\n    push_token_updated_at: device.pushTokenUpdatedAt ? device.pushTokenUpdatedAt.toISOString() : null,\n    last_seen_at: device.lastSeenAt ? device.lastSeenAt.toISOString() : null,\n    created_at: device.createdAt ? device.createdAt.toISOString() : null,\n    updated_at: device.updatedAt ? device.updatedAt.toISOString() : null,\n  }\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n    const device = await loadDevice(container, parsedParams.data.id, auth.tenantId)\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n    return NextResponse.json({ item: serializeDevice(device) })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.GET failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.load_failed', 'Failed to load device') }, { status: 500 })\n  }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const body = updateDeviceSchema.parse(await readJsonSafe(req, {}))\n    const device = await loadDevice(container, parsedParams.data.id, auth.tenantId)\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeUpdate(mctx, device, body)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.PUT failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.update_failed', 'Failed to update device') }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const device = await loadDevice(container, parsedParams.data.id, auth.tenantId)\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeDeactivate(mctx, device)\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.DELETE failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.delete_failed', 'Failed to delete device') }, { status: 500 })\n  }\n}\n\nconst okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() })\nconst errorResponseSchema = z.object({ error: z.string() })\nconst detailResponseSchema = z.object({\n  item: z.object({\n    id: z.string().uuid(),\n    user_id: z.string().uuid(),\n    device_id: z.string(),\n    platform: z.enum(['ios', 'android', 'web']),\n    client_app_version: z.string().nullable(),\n    os_version: z.string().nullable(),\n    push_provider: z.string().nullable(),\n    push_token_updated_at: z.string().nullable(),\n    last_seen_at: z.string().nullable(),\n    created_at: z.string().nullable(),\n    updated_at: z.string().nullable(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Devices (admin)',\n  summary: 'Admin: read, update or deactivate any device in the tenant',\n  methods: {\n    GET: {\n      summary: 'Get any device',\n      description: 'Admin: fetch a single device by id (push_token is never returned).',\n      responses: [{ status: 200, description: 'Device', schema: detailResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Missing devices.admin', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update any device',\n      description: 'Admin: update last-seen, app/OS metadata, and push token for any device. Set pushToken to null to clear it.',\n      requestBody: { schema: updateDeviceSchema },\n      responses: [{ status: 200, description: 'Device updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Missing devices.admin', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Deactivate any device',\n      description: 'Admin: soft-delete any device in the tenant.',\n      responses: [{ status: 200, description: 'Device deactivated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Missing devices.admin', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,uCAAuC;AAChD,SAAS,gCAAgC;AACzC,SAAS,eAAe,yBAAqD;AAE7E,MAAM,SAAS,aAAa,SAAS;AAG9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAEA,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEvD,eAAe,WACb,WACA,IACA,UAC4B;AAC5B,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,SAAO,sBAAsB,IAAI,YAAY,EAAE,IAAI,UAAU,WAAW,KAAK,GAAG,QAAW,EAAE,SAAS,CAAC;AACzG;AAGA,SAAS,gBAAgB,QAAoB;AAC3C,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,IAClB,UAAU,OAAO;AAAA,IACjB,oBAAoB,OAAO,oBAAoB;AAAA,IAC/C,YAAY,OAAO,aAAa;AAAA,IAChC,eAAe,OAAO,gBAAgB;AAAA,IACtC,uBAAuB,OAAO,qBAAqB,OAAO,mBAAmB,YAAY,IAAI;AAAA,IAC7F,cAAc,OAAO,aAAa,OAAO,WAAW,YAAY,IAAI;AAAA,IACpE,YAAY,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAChE,YAAY,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,EAClE;AACF;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AACA,UAAM,SAAS,MAAM,WAAW,WAAW,aAAa,KAAK,IAAI,KAAK,QAAQ;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AACA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,GAAG;AACpG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AACA,WAAO,aAAa,KAAK,EAAE,MAAM,gBAAgB,MAAM,EAAE,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,8BAA8B,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvH;AACF;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,OAAO,mBAAmB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACjE,UAAM,SAAS,MAAM,WAAW,WAAW,aAAa,KAAK,IAAI,KAAK,QAAQ;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,GAAG;AACpG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AACA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,cAAc,MAAM,QAAQ,IAAI;AAAA,EAC/C,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,SAAS,MAAM,WAAW,WAAW,aAAa,KAAK,IAAI,KAAK,QAAQ;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,GAAG;AACpG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AACA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,kBAAkB,MAAM,MAAM;AAAA,EAC7C,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC3F,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC1D,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,WAAW,EAAE,OAAO;AAAA,IACpB,UAAU,EAAE,KAAK,CAAC,OAAO,WAAW,KAAK,CAAC;AAAA,IAC1C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,IACxC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3C,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,UAAU,QAAQ,qBAAqB,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,oBAAoB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,mBAAmB;AAAA,MAC1C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,iBAAiB,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB,CAAC;AAAA,MACxF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,oBAAoB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { UserDevice } from '../../../../data/entities'\nimport { updateDeviceSchema } from '../../../../data/validators'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveDeviceActorUserId } from '../../../auth'\nimport { executeUpdate, executeDeactivate, type DeviceMutationContext } from '../../../deviceOps'\nimport { serializeDeviceDetail, deviceDetailItemSchema } from '../../../deviceSerialization'\nimport { DEPRECATED_SNAKE_CASE_NOTICE } from '../../../openapi'\n\nconst logger = createLogger('devices')\n\n// Admin: read/update/deactivate ANY device in the tenant. Gated by devices.admin (no owner check).\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['devices.admin'] },\n  PUT: { requireAuth: true, requireFeatures: ['devices.admin'] },\n  DELETE: { requireAuth: true, requireFeatures: ['devices.admin'] },\n}\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nasync function loadDevice(\n  container: Awaited<ReturnType<typeof createRequestContainer>>,\n  id: string,\n  tenantId: string,\n): Promise<UserDevice | null> {\n  const em = container.resolve('em') as EntityManager\n  // push_token is encrypted at rest; the org is not known until the row loads, so pass tenant only \u2014\n  // the helper prefers each record's own tenant/org and treats this scope as a fallback.\n  return findOneWithDecryption(em, UserDevice, { id, tenantId, deletedAt: null }, undefined, { tenantId })\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n    const device = await loadDevice(container, parsedParams.data.id, auth.tenantId)\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n    return NextResponse.json({ item: serializeDeviceDetail(device) })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.GET failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.load_failed', 'Failed to load device') }, { status: 500 })\n  }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const body = updateDeviceSchema.parse(await readJsonSafe(req, {}))\n    const device = await loadDevice(container, parsedParams.data.id, auth.tenantId)\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeUpdate(mctx, device, body)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.PUT failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.update_failed', 'Failed to update device') }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const device = await loadDevice(container, parsedParams.data.id, auth.tenantId)\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeDeactivate(mctx, device)\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.DELETE failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.delete_failed', 'Failed to delete device') }, { status: 500 })\n  }\n}\n\nconst okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() })\nconst errorResponseSchema = z.object({ error: z.string() })\nconst detailResponseSchema = z.object({ item: deviceDetailItemSchema })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Devices (admin)',\n  summary: 'Admin: read, update or deactivate any device in the tenant',\n  methods: {\n    GET: {\n      summary: 'Get any device',\n      description: `Admin: fetch a single device by id (push_token is never returned). ${DEPRECATED_SNAKE_CASE_NOTICE}`,\n      responses: [{ status: 200, description: 'Device', schema: detailResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Missing devices.admin', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update any device',\n      description: 'Admin: update last-seen, app/OS metadata, and push token for any device. Set pushToken to null to clear it.',\n      requestBody: { schema: updateDeviceSchema },\n      responses: [{ status: 200, description: 'Device updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Missing devices.admin', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Deactivate any device',\n      description: 'Admin: soft-delete any device in the tenant.',\n      responses: [{ status: 200, description: 'Device deactivated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Missing devices.admin', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,uCAAuC;AAChD,SAAS,gCAAgC;AACzC,SAAS,eAAe,yBAAqD;AAC7E,SAAS,uBAAuB,8BAA8B;AAC9D,SAAS,oCAAoC;AAE7C,MAAM,SAAS,aAAa,SAAS;AAG9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAEA,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEvD,eAAe,WACb,WACA,IACA,UAC4B;AAC5B,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,SAAO,sBAAsB,IAAI,YAAY,EAAE,IAAI,UAAU,WAAW,KAAK,GAAG,QAAW,EAAE,SAAS,CAAC;AACzG;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AACA,UAAM,SAAS,MAAM,WAAW,WAAW,aAAa,KAAK,IAAI,KAAK,QAAQ;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AACA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,GAAG;AACpG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AACA,WAAO,aAAa,KAAK,EAAE,MAAM,sBAAsB,MAAM,EAAE,CAAC;AAAA,EAClE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,8BAA8B,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvH;AACF;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,OAAO,mBAAmB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACjE,UAAM,SAAS,MAAM,WAAW,WAAW,aAAa,KAAK,IAAI,KAAK,QAAQ;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,GAAG;AACpG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AACA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,cAAc,MAAM,QAAQ,IAAI;AAAA,EAC/C,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,SAAS,MAAM,WAAW,WAAW,aAAa,KAAK,IAAI,KAAK,QAAQ;AAC9E,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,GAAG;AACpG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AACA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,kBAAkB,MAAM,MAAM;AAAA,EAC7C,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC3F,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC1D,MAAM,uBAAuB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa,sEAAsE,4BAA4B;AAAA,MAC/G,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,UAAU,QAAQ,qBAAqB,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,oBAAoB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,mBAAmB;AAAA,MAC1C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,iBAAiB,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB,CAAC;AAAA,MACxF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,oBAAoB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }