@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4351 entry points
+[build:core] found 4320 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/helpers/integration/api.js

@@ -1,4 +1,3 @@
-import { request as playwrightRequest } from "@playwright/test";
 import { DEFAULT_CREDENTIALS } from "./auth.js";
 const BASE_URL = process.env.BASE_URL?.trim() || null;
 function resolveUrl(path) {
@@ -90,21 +89,10 @@ async function postForm(request, path, data, options) {
     data: form.toString()
   });
 }
-async function withCredentialIsolatedRequest(use) {
-  const context = await playwrightRequest.newContext({
-    baseURL: BASE_URL ?? "http://localhost:3000"
-  });
-  try {
-    return await use(context);
-  } finally {
-    await context.dispose();
-  }
-}
 export {
   apiRequest,
   clearAuthTokenCache,
   getAuthToken,
-  postForm,
-  withCredentialIsolatedRequest
+  postForm
 };
 //# sourceMappingURL=api.js.map

package/dist/helpers/integration/api.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/api.ts"],
-  "sourcesContent": ["import { request as playwrightRequest, type APIRequestContext } from '@playwright/test';\nimport { DEFAULT_CREDENTIALS, type Role } from './auth';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n// Cached tokens per credential to dodge the login rate limit\n// (5 attempts/60s per email). Tokens are reused across tests in the same\n// Playwright worker; each worker still mints its own.\nconst tokenCache = new Map<string, { token: string; mintedAt: number }>();\nconst TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.\n\n/**\n * Drops cached tokens so the next getAuthToken() mints a fresh session.\n *\n * A cached token points at a `sessions` row. Anything that deletes those rows \u2014\n * deactivating the user, a password change, an explicit session purge \u2014 leaves the\n * cached token resolving to 401 for the rest of the TTL, and `apiRequest` neither\n * retries nor re-mints. A spec that revokes sessions for an account other specs also\n * use MUST call this afterwards.\n */\nexport function clearAuthTokenCache(): void {\n  tokenCache.clear();\n}\n\nexport async function getAuthToken(\n  request: APIRequestContext,\n  roleOrEmail: Role | string = 'admin',\n  password?: string,\n): Promise<string> {\n  const role = roleOrEmail in DEFAULT_CREDENTIALS ? (roleOrEmail as Role) : null;\n  const credentialAttempts: Array<{ email: string; password: string }> = [];\n\n  if (role) {\n    const configured = DEFAULT_CREDENTIALS[role];\n    credentialAttempts.push({ email: configured.email, password: password ?? configured.password });\n    if (!password) {\n      credentialAttempts.push({ email: `${role}@acme.com`, password: 'secret' });\n    }\n  } else {\n    credentialAttempts.push({ email: roleOrEmail, password: password ?? 'secret' });\n  }\n\n  const cacheKey = credentialAttempts\n    .map((entry) => `${entry.email}:${entry.password}`)\n    .join('|');\n  const cached = tokenCache.get(cacheKey);\n  if (cached && Date.now() - cached.mintedAt < TOKEN_TTL_MS) {\n    return cached.token;\n  }\n\n  let lastStatus = 0;\n\n  for (const attempt of credentialAttempts) {\n    const form = new URLSearchParams();\n    form.set('email', attempt.email);\n    form.set('password', attempt.password);\n\n    // Retry on 429 (auth rate limit kicks in after ~25-30 rapid attempts from\n    // the same test run). Capped exponential backoff: 1s, 2s, 4s; 3 retries.\n    for (let retry = 0; retry < 4; retry += 1) {\n      const response = await request.post(resolveUrl('/api/auth/login'), {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: form.toString(),\n      });\n\n      const raw = await response.text();\n      let body: Record<string, unknown> | null = null;\n      try {\n        body = raw ? (JSON.parse(raw) as Record<string, unknown>) : null;\n      } catch {\n        body = null;\n      }\n\n      lastStatus = response.status();\n      if (response.ok() && body && typeof body.token === 'string' && body.token) {\n        tokenCache.set(cacheKey, { token: body.token, mintedAt: Date.now() });\n        return body.token;\n      }\n      if (response.status() !== 429) break;\n      const backoffMs = 1000 * 2 ** retry;\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n    }\n  }\n\n  throw new Error(`Failed to obtain auth token (status ${lastStatus})`);\n}\n\nexport async function apiRequest(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: {\n    token: string;\n    data?: unknown;\n    timeout?: number;\n    retryTransport?: boolean;\n    headers?: Record<string, string>;\n  },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n    ...(options.headers ?? {}),\n  };\n  const timeout = options.timeout ?? 30_000;\n  let lastError: unknown = null;\n  const maxAttempts = options.retryTransport === false ? 1 : 2;\n  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {\n    try {\n      return await request.fetch(resolveUrl(path), { method, headers, data: options.data, timeout });\n    } catch (error) {\n      lastError = error;\n      const message = error instanceof Error ? error.message : '';\n      const retryable = /timeout|idle-session|socket|ECONNRESET|Target page, context or browser has been closed/i.test(message);\n      if (!retryable || attempt === maxAttempts - 1) throw error;\n      await new Promise((resolve) => setTimeout(resolve, 250));\n    }\n  }\n  throw lastError;\n}\n\nexport async function postForm(\n  request: APIRequestContext,\n  path: string,\n  data: Record<string, string>,\n  options?: { headers?: Record<string, string> },\n) {\n  const form = new URLSearchParams();\n  for (const [key, value] of Object.entries(data)) form.set(key, value);\n  return request.post(resolveUrl(path), {\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      ...(options?.headers ?? {}),\n    },\n    data: form.toString(),\n  });\n}\n\n/**\n * Runs `use` against a request context that shares no cookies with the caller's.\n *\n * The `request` fixture keeps a cookie jar, and `/api/auth/login` sets `auth_token`\n * on it. Every later call through that fixture therefore carries the LAST logged-in\n * user's session, even one that deliberately sends no Authorization header or an\n * `ApiKey` one.\n *\n * A spec asserting \"no credentials are rejected\" or \"this API key alone decides\n * access\" must therefore issue the request from a jar that never saw a login,\n * rather than assuming the fixture's jar is empty. TC-DOCUMENTS-009 and\n * TC-DOCUMENTS-018 both observably failed in the standalone lane \u2014 with the\n * replayed cookie visible in the trace \u2014 while passing in the ephemeral one, and\n * routing them through this helper fixed both.\n */\nexport async function withCredentialIsolatedRequest<T>(\n  use: (request: APIRequestContext) => Promise<T>,\n): Promise<T> {\n  // A hand-built context does not inherit the project's `use.baseURL` the way the\n  // `request` fixture does, so it has to repeat the config's own resolution \u2014 otherwise\n  // a relative path throws here on any run that leaves BASE_URL unset, while the same\n  // path works through the fixture.\n  const context = await playwrightRequest.newContext({\n    baseURL: BASE_URL ?? 'http://localhost:3000',\n  });\n  try {\n    return await use(context);\n  } finally {\n    await context.dispose();\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,WAAW,yBAAiD;AACrE,SAAS,2BAAsC;AAE/C,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAKA,MAAM,aAAa,oBAAI,IAAiD;AACxE,MAAM,eAAe,KAAK,KAAK;AAWxB,SAAS,sBAA4B;AAC1C,aAAW,MAAM;AACnB;AAEA,eAAsB,aACpB,SACA,cAA6B,SAC7B,UACiB;AACjB,QAAM,OAAO,eAAe,sBAAuB,cAAuB;AAC1E,QAAM,qBAAiE,CAAC;AAExE,MAAI,MAAM;AACR,UAAM,aAAa,oBAAoB,IAAI;AAC3C,uBAAmB,KAAK,EAAE,OAAO,WAAW,OAAO,UAAU,YAAY,WAAW,SAAS,CAAC;AAC9F,QAAI,CAAC,UAAU;AACb,yBAAmB,KAAK,EAAE,OAAO,GAAG,IAAI,aAAa,UAAU,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,OAAO;AACL,uBAAmB,KAAK,EAAE,OAAO,aAAa,UAAU,YAAY,SAAS,CAAC;AAAA,EAChF;AAEA,QAAM,WAAW,mBACd,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,EACjD,KAAK,GAAG;AACX,QAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,cAAc;AACzD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,aAAa;AAEjB,aAAW,WAAW,oBAAoB;AACxC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,SAAS,QAAQ,KAAK;AAC/B,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAIrC,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,WAAW,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG;AAAA,QACjE,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAED,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,OAAuC;AAC3C,UAAI;AACF,eAAO,MAAO,KAAK,MAAM,GAAG,IAAgC;AAAA,MAC9D,QAAQ;AACN,eAAO;AAAA,MACT;AAEA,mBAAa,SAAS,OAAO;AAC7B,UAAI,SAAS,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AACzE,mBAAW,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;AACpE,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,OAAO,MAAM,IAAK;AAC/B,YAAM,YAAY,MAAO,KAAK;AAC9B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uCAAuC,UAAU,GAAG;AACtE;AAEA,eAAsB,WACpB,SACA,QACA,MACA,SAOA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAI,QAAQ,WAAW,CAAC;AAAA,EAC1B;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,YAAqB;AACzB,QAAM,cAAc,QAAQ,mBAAmB,QAAQ,IAAI;AAC3D,WAAS,UAAU,GAAG,UAAU,aAAa,WAAW,GAAG;AACzD,QAAI;AACF,aAAO,MAAM,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAC/F,SAAS,OAAO;AACd,kBAAY;AACZ,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,YAAY,0FAA0F,KAAK,OAAO;AACxH,UAAI,CAAC,aAAa,YAAY,cAAc,EAAG,OAAM;AACrD,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,SACpB,SACA,MACA,MACA,SACA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAG,MAAK,IAAI,KAAK,KAAK;AACpE,SAAO,QAAQ,KAAK,WAAW,IAAI,GAAG;AAAA,IACpC,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAI,SAAS,WAAW,CAAC;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AACH;AAiBA,eAAsB,8BACpB,KACY;AAKZ,QAAM,UAAU,MAAM,kBAAkB,WAAW;AAAA,IACjD,SAAS,YAAY;AAAA,EACvB,CAAC;AACD,MAAI;AACF,WAAO,MAAM,IAAI,OAAO;AAAA,EAC1B,UAAE;AACA,UAAM,QAAQ,QAAQ;AAAA,EACxB;AACF;",
+  "sourcesContent": ["import { type APIRequestContext } from '@playwright/test';\nimport { DEFAULT_CREDENTIALS, type Role } from './auth';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n// Cached tokens per credential to dodge the login rate limit\n// (5 attempts/60s per email). Tokens are reused across tests in the same\n// Playwright worker; each worker still mints its own.\nconst tokenCache = new Map<string, { token: string; mintedAt: number }>();\nconst TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.\n\n/**\n * Drops cached tokens so the next getAuthToken() mints a fresh session.\n *\n * A cached token points at a `sessions` row. Anything that deletes those rows \u2014\n * deactivating the user, a password change, an explicit session purge \u2014 leaves the\n * cached token resolving to 401 for the rest of the TTL, and `apiRequest` neither\n * retries nor re-mints. A spec that revokes sessions for an account other specs also\n * use MUST call this afterwards.\n */\nexport function clearAuthTokenCache(): void {\n  tokenCache.clear();\n}\n\nexport async function getAuthToken(\n  request: APIRequestContext,\n  roleOrEmail: Role | string = 'admin',\n  password?: string,\n): Promise<string> {\n  const role = roleOrEmail in DEFAULT_CREDENTIALS ? (roleOrEmail as Role) : null;\n  const credentialAttempts: Array<{ email: string; password: string }> = [];\n\n  if (role) {\n    const configured = DEFAULT_CREDENTIALS[role];\n    credentialAttempts.push({ email: configured.email, password: password ?? configured.password });\n    if (!password) {\n      credentialAttempts.push({ email: `${role}@acme.com`, password: 'secret' });\n    }\n  } else {\n    credentialAttempts.push({ email: roleOrEmail, password: password ?? 'secret' });\n  }\n\n  const cacheKey = credentialAttempts\n    .map((entry) => `${entry.email}:${entry.password}`)\n    .join('|');\n  const cached = tokenCache.get(cacheKey);\n  if (cached && Date.now() - cached.mintedAt < TOKEN_TTL_MS) {\n    return cached.token;\n  }\n\n  let lastStatus = 0;\n\n  for (const attempt of credentialAttempts) {\n    const form = new URLSearchParams();\n    form.set('email', attempt.email);\n    form.set('password', attempt.password);\n\n    // Retry on 429 (auth rate limit kicks in after ~25-30 rapid attempts from\n    // the same test run). Capped exponential backoff: 1s, 2s, 4s; 3 retries.\n    for (let retry = 0; retry < 4; retry += 1) {\n      const response = await request.post(resolveUrl('/api/auth/login'), {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: form.toString(),\n      });\n\n      const raw = await response.text();\n      let body: Record<string, unknown> | null = null;\n      try {\n        body = raw ? (JSON.parse(raw) as Record<string, unknown>) : null;\n      } catch {\n        body = null;\n      }\n\n      lastStatus = response.status();\n      if (response.ok() && body && typeof body.token === 'string' && body.token) {\n        tokenCache.set(cacheKey, { token: body.token, mintedAt: Date.now() });\n        return body.token;\n      }\n      if (response.status() !== 429) break;\n      const backoffMs = 1000 * 2 ** retry;\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n    }\n  }\n\n  throw new Error(`Failed to obtain auth token (status ${lastStatus})`);\n}\n\nexport async function apiRequest(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: {\n    token: string;\n    data?: unknown;\n    timeout?: number;\n    retryTransport?: boolean;\n    headers?: Record<string, string>;\n  },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n    ...(options.headers ?? {}),\n  };\n  const timeout = options.timeout ?? 30_000;\n  let lastError: unknown = null;\n  const maxAttempts = options.retryTransport === false ? 1 : 2;\n  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {\n    try {\n      return await request.fetch(resolveUrl(path), { method, headers, data: options.data, timeout });\n    } catch (error) {\n      lastError = error;\n      const message = error instanceof Error ? error.message : '';\n      const retryable = /timeout|idle-session|socket|ECONNRESET|Target page, context or browser has been closed/i.test(message);\n      if (!retryable || attempt === maxAttempts - 1) throw error;\n      await new Promise((resolve) => setTimeout(resolve, 250));\n    }\n  }\n  throw lastError;\n}\n\nexport async function postForm(\n  request: APIRequestContext,\n  path: string,\n  data: Record<string, string>,\n  options?: { headers?: Record<string, string> },\n) {\n  const form = new URLSearchParams();\n  for (const [key, value] of Object.entries(data)) form.set(key, value);\n  return request.post(resolveUrl(path), {\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      ...(options?.headers ?? {}),\n    },\n    data: form.toString(),\n  });\n}\n"],
+  "mappings": "AACA,SAAS,2BAAsC;AAE/C,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAKA,MAAM,aAAa,oBAAI,IAAiD;AACxE,MAAM,eAAe,KAAK,KAAK;AAWxB,SAAS,sBAA4B;AAC1C,aAAW,MAAM;AACnB;AAEA,eAAsB,aACpB,SACA,cAA6B,SAC7B,UACiB;AACjB,QAAM,OAAO,eAAe,sBAAuB,cAAuB;AAC1E,QAAM,qBAAiE,CAAC;AAExE,MAAI,MAAM;AACR,UAAM,aAAa,oBAAoB,IAAI;AAC3C,uBAAmB,KAAK,EAAE,OAAO,WAAW,OAAO,UAAU,YAAY,WAAW,SAAS,CAAC;AAC9F,QAAI,CAAC,UAAU;AACb,yBAAmB,KAAK,EAAE,OAAO,GAAG,IAAI,aAAa,UAAU,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,OAAO;AACL,uBAAmB,KAAK,EAAE,OAAO,aAAa,UAAU,YAAY,SAAS,CAAC;AAAA,EAChF;AAEA,QAAM,WAAW,mBACd,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,EACjD,KAAK,GAAG;AACX,QAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,cAAc;AACzD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,aAAa;AAEjB,aAAW,WAAW,oBAAoB;AACxC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,SAAS,QAAQ,KAAK;AAC/B,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAIrC,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,WAAW,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG;AAAA,QACjE,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAED,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,OAAuC;AAC3C,UAAI;AACF,eAAO,MAAO,KAAK,MAAM,GAAG,IAAgC;AAAA,MAC9D,QAAQ;AACN,eAAO;AAAA,MACT;AAEA,mBAAa,SAAS,OAAO;AAC7B,UAAI,SAAS,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AACzE,mBAAW,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;AACpE,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,OAAO,MAAM,IAAK;AAC/B,YAAM,YAAY,MAAO,KAAK;AAC9B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uCAAuC,UAAU,GAAG;AACtE;AAEA,eAAsB,WACpB,SACA,QACA,MACA,SAOA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAI,QAAQ,WAAW,CAAC;AAAA,EAC1B;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,YAAqB;AACzB,QAAM,cAAc,QAAQ,mBAAmB,QAAQ,IAAI;AAC3D,WAAS,UAAU,GAAG,UAAU,aAAa,WAAW,GAAG;AACzD,QAAI;AACF,aAAO,MAAM,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAC/F,SAAS,OAAO;AACd,kBAAY;AACZ,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,YAAY,0FAA0F,KAAK,OAAO;AACxH,UAAI,CAAC,aAAa,YAAY,cAAc,EAAG,OAAM;AACrD,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,SACpB,SACA,MACA,MACA,SACA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAG,MAAK,IAAI,KAAK,KAAK;AACpE,SAAO,QAAQ,KAAK,WAAW,IAAI,GAAG;AAAA,IACpC,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAI,SAAS,WAAW,CAAC;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AACH;",
   "names": []
 }

package/dist/helpers/integration/communicationChannelsFixtures.js

@@ -40,24 +40,6 @@ async function seedInboundMessage(request, token, input) {
     )
   };
 }
-async function ingestInboundChatMessage(request, token, input) {
-  const response = await apiRequest(request, "POST", TEST_SEED_PATH, {
-    token,
-    data: { action: "ingest-inbound", ...input }
-  });
-  expect(
-    response.status(),
-    "POST /api/communication_channels/test-seed (ingest-inbound) should return 201 \u2014 a non-201 here means the hub rejected a sender with no email address"
-  ).toBe(201);
-  const body = await readJsonSafe(response);
-  return {
-    status: body?.status ?? "unknown",
-    messageId: body?.messageId ?? null,
-    conversationId: body?.conversationId ?? null,
-    channelLinkId: body?.channelLinkId ?? null,
-    channelType: body?.channelType ?? null
-  };
-}
 async function deleteChannelIfExists(request, token, channelId) {
   if (!token || !channelId) return;
   await apiRequest(
@@ -69,7 +51,6 @@ async function deleteChannelIfExists(request, token, channelId) {
 }
 export {
   deleteChannelIfExists,
-  ingestInboundChatMessage,
   isChannelSeedingAvailable,
   seedConnectedChannel,
   seedInboundMessage

package/dist/helpers/integration/communicationChannelsFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/communicationChannelsFixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\n/**\n * Communication-channels integration fixtures.\n *\n * These drive the TEST-ONLY seed endpoint `POST /api/communication_channels/test-seed`,\n * which is gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` (inert/404 in production). Use\n * {@link isChannelSeedingAvailable} to skip tests when the gate is off rather than\n * failing them.\n */\n\nexport type SeedAddressField =\n  | string\n  | { address: string; name?: string }\n  | Array<string | { address: string; name?: string }>;\n\nconst TEST_SEED_PATH = '/api/communication_channels/test-seed';\n\n/**\n * Probe whether the env-gated test-seed endpoint is enabled in the target app.\n * Returns false when the route answers 404 (flag off) so callers can `test.skip`.\n * The caller's token must hold `communication_channels.connect_user_channel`.\n */\nexport async function isChannelSeedingAvailable(\n  request: APIRequestContext,\n  token: string,\n): Promise<boolean> {\n  // A malformed body returns 422 when the gate is ON and 404 when it is OFF.\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: '__probe__' },\n  });\n  return response.status() !== 404;\n}\n\n/**\n * Seed a connected, network-free `__test_seed__` channel owned by the caller.\n * Returns the new channel id. Tear down with {@link deleteChannelIfExists}.\n */\nexport async function seedConnectedChannel(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    displayName?: string;\n    externalIdentifier?: string;\n    /**\n     * `chat` connects the non-email stub instead: a channel whose senders carry\n     * an opaque handle and no address, and whose `externalIdentifier` is NULL \u2014\n     * the shape a real Discord/Slack channel has. Use it for anything asserting\n     * the hub's sender-identity contract (#4975); the default `email` flavor\n     * cannot prove it, because it can only ever supply email-shaped data.\n     */\n    providerFlavor?: 'email' | 'chat';\n  } = {},\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'connect-channel', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (connect-channel) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{ channelId?: string }>(response);\n  return expectId(body?.channelId, 'connect-channel response should include channelId');\n}\n\n/**\n * Seed an inbound `MessageChannelLink` for `channelId` and emit\n * `communication_channels.message.received` through the real event bus. The\n * persistent customers link-channel-message-received subscriber is enqueued to\n * the `events` queue \u2014 drain it with `drainIntegrationQueue('events')`.\n *\n * Returns the created link + message ids (the message id is the platform\n * `messages.message` id, usable as `messageThreadId` to thread a follow-up).\n *\n * Pass `createThreadMapping: true` to also seed a `ChannelThreadMapping` for the\n * thread \u2014 required before exercising the reaction (`/messages/[id]/reactions`)\n * and thread-assign (`/threads/[id]/assign`) routes, which resolve the owning\n * channel through that mapping.\n */\nexport async function seedInboundMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    from?: SeedAddressField;\n    to?: SeedAddressField;\n    cc?: SeedAddressField;\n    subject?: string;\n    bodyText?: string;\n    messageId?: string;\n    inReplyTo?: string;\n    references?: string[];\n    messageThreadId?: string;\n    providerKey?: string;\n    createThreadMapping?: boolean;\n  },\n): Promise<{ channelLinkId: string; messageId: string; conversationId: string }> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'emit-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (emit-inbound) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    channelLinkId?: string;\n    messageId?: string;\n    conversationId?: string;\n  }>(response);\n  return {\n    channelLinkId: expectId(body?.channelLinkId, 'emit-inbound response should include channelLinkId'),\n    messageId: expectId(body?.messageId, 'emit-inbound response should include messageId'),\n    conversationId: expectId(\n      body?.conversationId,\n      'emit-inbound response should include conversationId',\n    ),\n  };\n}\n\n/**\n * Best-effort delete of a seeded channel via the owner-scoped DELETE route.\n * Safe to call with a null id in `finally`.\n */\n/**\n * Ingest an inbound chat message through the REAL `ingest_inbound_message`\n * command: the stub adapter normalizes the frame and the hub composes the\n * platform message via `messages.messages.compose`.\n *\n * Unlike {@link seedInboundMessage}, nothing here is short-circuited \u2014 no row is\n * inserted behind the compose path \u2014 so a hub contract the provider cannot\n * satisfy fails the test instead of hiding behind seeded data. That bypass is\n * exactly why CI was green while every real inbound Discord message was rejected\n * (#4975).\n *\n * The sender is identified only by `senderIdentifier` (a Discord snowflake, a\n * Slack member id, \u2026). There is deliberately no way to pass an address.\n */\nexport async function ingestInboundChatMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    senderIdentifier: string;\n    senderDisplayName?: string;\n    body?: string;\n    externalMessageId: string;\n    externalConversationId: string;\n  },\n): Promise<{\n  status: string;\n  messageId: string | null;\n  conversationId: string | null;\n  channelLinkId: string | null;\n  channelType: string | null;\n}> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'ingest-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (ingest-inbound) should return 201 \u2014 ' +\n      'a non-201 here means the hub rejected a sender with no email address',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    status?: string;\n    messageId?: string | null;\n    conversationId?: string | null;\n    channelLinkId?: string | null;\n    channelType?: string | null;\n  }>(response);\n  return {\n    status: body?.status ?? 'unknown',\n    messageId: body?.messageId ?? null,\n    conversationId: body?.conversationId ?? null,\n    channelLinkId: body?.channelLinkId ?? null,\n    channelType: body?.channelType ?? null,\n  };\n}\n\nexport async function deleteChannelIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  channelId: string | null,\n): Promise<void> {\n  if (!token || !channelId) return;\n  await apiRequest(\n    request,\n    'DELETE',\n    `/api/communication_channels/channels/${encodeURIComponent(channelId)}`,\n    { token },\n  ).catch(() => undefined);\n}\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAgBvC,MAAM,iBAAiB;AAOvB,eAAsB,0BACpB,SACA,OACkB;AAElB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC9B,CAAC;AACD,SAAO,SAAS,OAAO,MAAM;AAC/B;AAMA,eAAsB,qBACpB,SACA,OACA,QAWI,CAAC,GACY;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EAC9C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,MAAM,WAAW,mDAAmD;AACtF;AAgBA,eAAsB,mBACpB,SACA,OACA,OAc+E;AAC/E,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,gBAAgB,GAAG,MAAM;AAAA,EAC3C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAIhB,QAAQ;AACX,SAAO;AAAA,IACL,eAAe,SAAS,MAAM,eAAe,oDAAoD;AAAA,IACjG,WAAW,SAAS,MAAM,WAAW,gDAAgD;AAAA,IACrF,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;AAoBA,eAAsB,yBACpB,SACA,OACA,OAcC;AACD,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,kBAAkB,GAAG,MAAM;AAAA,EAC7C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EAEF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAMhB,QAAQ;AACX,SAAO;AAAA,IACL,QAAQ,MAAM,UAAU;AAAA,IACxB,WAAW,MAAM,aAAa;AAAA,IAC9B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,eAAe,MAAM,iBAAiB;AAAA,IACtC,aAAa,MAAM,eAAe;AAAA,EACpC;AACF;AAEA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,UAAW;AAC1B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,wCAAwC,mBAAmB,SAAS,CAAC;AAAA,IACrE,EAAE,MAAM;AAAA,EACV,EAAE,MAAM,MAAM,MAAS;AACzB;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\n/**\n * Communication-channels integration fixtures.\n *\n * These drive the TEST-ONLY seed endpoint `POST /api/communication_channels/test-seed`,\n * which is gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` (inert/404 in production). Use\n * {@link isChannelSeedingAvailable} to skip tests when the gate is off rather than\n * failing them.\n */\n\nexport type SeedAddressField =\n  | string\n  | { address: string; name?: string }\n  | Array<string | { address: string; name?: string }>;\n\nconst TEST_SEED_PATH = '/api/communication_channels/test-seed';\n\n/**\n * Probe whether the env-gated test-seed endpoint is enabled in the target app.\n * Returns false when the route answers 404 (flag off) so callers can `test.skip`.\n * The caller's token must hold `communication_channels.connect_user_channel`.\n */\nexport async function isChannelSeedingAvailable(\n  request: APIRequestContext,\n  token: string,\n): Promise<boolean> {\n  // A malformed body returns 422 when the gate is ON and 404 when it is OFF.\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: '__probe__' },\n  });\n  return response.status() !== 404;\n}\n\n/**\n * Seed a connected, network-free `__test_seed__` channel owned by the caller.\n * Returns the new channel id. Tear down with {@link deleteChannelIfExists}.\n */\nexport async function seedConnectedChannel(\n  request: APIRequestContext,\n  token: string,\n  input: { displayName?: string; externalIdentifier?: string } = {},\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'connect-channel', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (connect-channel) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{ channelId?: string }>(response);\n  return expectId(body?.channelId, 'connect-channel response should include channelId');\n}\n\n/**\n * Seed an inbound `MessageChannelLink` for `channelId` and emit\n * `communication_channels.message.received` through the real event bus. The\n * persistent customers link-channel-message-received subscriber is enqueued to\n * the `events` queue \u2014 drain it with `drainIntegrationQueue('events')`.\n *\n * Returns the created link + message ids (the message id is the platform\n * `messages.message` id, usable as `messageThreadId` to thread a follow-up).\n *\n * Pass `createThreadMapping: true` to also seed a `ChannelThreadMapping` for the\n * thread \u2014 required before exercising the reaction (`/messages/[id]/reactions`)\n * and thread-assign (`/threads/[id]/assign`) routes, which resolve the owning\n * channel through that mapping.\n */\nexport async function seedInboundMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    from?: SeedAddressField;\n    to?: SeedAddressField;\n    cc?: SeedAddressField;\n    subject?: string;\n    bodyText?: string;\n    messageId?: string;\n    inReplyTo?: string;\n    references?: string[];\n    messageThreadId?: string;\n    providerKey?: string;\n    createThreadMapping?: boolean;\n  },\n): Promise<{ channelLinkId: string; messageId: string; conversationId: string }> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'emit-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (emit-inbound) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    channelLinkId?: string;\n    messageId?: string;\n    conversationId?: string;\n  }>(response);\n  return {\n    channelLinkId: expectId(body?.channelLinkId, 'emit-inbound response should include channelLinkId'),\n    messageId: expectId(body?.messageId, 'emit-inbound response should include messageId'),\n    conversationId: expectId(\n      body?.conversationId,\n      'emit-inbound response should include conversationId',\n    ),\n  };\n}\n\n/**\n * Best-effort delete of a seeded channel via the owner-scoped DELETE route.\n * Safe to call with a null id in `finally`.\n */\nexport async function deleteChannelIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  channelId: string | null,\n): Promise<void> {\n  if (!token || !channelId) return;\n  await apiRequest(\n    request,\n    'DELETE',\n    `/api/communication_channels/channels/${encodeURIComponent(channelId)}`,\n    { token },\n  ).catch(() => undefined);\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAgBvC,MAAM,iBAAiB;AAOvB,eAAsB,0BACpB,SACA,OACkB;AAElB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC9B,CAAC;AACD,SAAO,SAAS,OAAO,MAAM;AAC/B;AAMA,eAAsB,qBACpB,SACA,OACA,QAA+D,CAAC,GAC/C;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EAC9C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,MAAM,WAAW,mDAAmD;AACtF;AAgBA,eAAsB,mBACpB,SACA,OACA,OAc+E;AAC/E,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,gBAAgB,GAAG,MAAM;AAAA,EAC3C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAIhB,QAAQ;AACX,SAAO;AAAA,IACL,eAAe,SAAS,MAAM,eAAe,oDAAoD;AAAA,IACjG,WAAW,SAAS,MAAM,WAAW,gDAAgD;AAAA,IACrF,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,UAAW;AAC1B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,wCAAwC,mBAAmB,SAAS,CAAC;AAAA,IACrE,EAAE,MAAM;AAAA,EACV,EAAE,MAAM,MAAM,MAAS;AACzB;",
   "names": []
 }

package/dist/modules/api_keys/api/keys/route.js

@@ -249,7 +249,7 @@ const crud = makeCrudRoute({
       scopedCtx.__apiKeyRoles = roleEntities;
       scopedCtx.__apiKeyRoleIds = roleIds;
       const allowedIds = ctx.organizationScope?.allowedIds ?? null;
-      const organizationId = Object.prototype.hasOwnProperty.call(input, "organizationId") ? input.organizationId ?? null : ctx.selectedOrganizationId ?? auth.orgId ?? null;
+      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null;
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx);
       if (!isOrganizationAccessAllowed({
         isSuperAdmin,

package/dist/modules/api_keys/api/keys/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_keys/api/keys/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = Object.prototype.hasOwnProperty.call(input, 'organizationId')\n        ? input.organizationId ?? null\n        : ctx.selectedOrganizationId ?? auth.orgId ?? null\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      if (\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: organizationId,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,OAAO,UAAU,eAAe,KAAK,OAAO,gBAAgB,IAC/E,MAAM,kBAAkB,OACxB,IAAI,0BAA0B,KAAK,SAAS;AAChD,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,UACE,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,MACxB,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzH;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      if (\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: organizationId,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,UACE,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB;AAAA,MACxB,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzH;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/api_keys/backend/api-keys/page.js

@@ -29,7 +29,6 @@ function ApiKeysListPage() {
   const [page, setPage] = React.useState(1);
   const [total, setTotal] = React.useState(0);
   const [totalPages, setTotalPages] = React.useState(1);
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false);
   const [search, setSearch] = React.useState("");
   const [isLoading, setIsLoading] = React.useState(true);
   const [reloadToken, setReloadToken] = React.useState(0);
@@ -62,7 +61,6 @@ function ApiKeysListPage() {
           setRows(Array.isArray(payload.items) ? payload.items : []);
           setTotal(payload.total || 0);
           setTotalPages(payload.totalPages || 1);
-          setTotalIsCapped(payload?.totalIsCapped === true);
         }
       } catch (error) {
         if (!cancelled) {
@@ -174,7 +172,7 @@ function ApiKeysListPage() {
             createLabel: t("api_keys.list.actions.create")
           }
         ),
-        pagination: { page, pageSize: 20, total, totalPages, totalIsCapped, onPageChange: setPage },
+        pagination: { page, pageSize: 20, total, totalPages, onPageChange: setPage },
         isLoading
       }
     ) }),

package/dist/modules/api_keys/backend/api-keys/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_keys/backend/api-keys/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/api_keys/extension-points'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\n\ntype RoleSummary = { id: string; name: string | null }\n\ntype Row = {\n  id: string\n  name: string\n  description: string | null\n  keyPrefix: string\n  organizationId: string | null\n  organizationName: string | null\n  createdAt: string\n  lastUsedAt: string | null\n  expiresAt: string | null\n  roles: RoleSummary[]\n  updatedAt?: string | null\n}\n\ntype ResponsePayload = {\n  items: Row[]\n  total: number\n  page: number\n  totalPages: number\n  totalIsCapped?: boolean\n}\n\nfunction formatDate(value: string | null, t: (key: string, params?: Record<string, string | number>) => string) {\n  if (!value) return t('api_keys.list.noDate')\n  try {\n    const date = new Date(value)\n    if (Number.isNaN(date.getTime())) return t('api_keys.list.noDate')\n    return date.toLocaleString()\n  } catch {\n    return t('api_keys.list.noDate')\n  }\n}\n\nexport default function ApiKeysListPage() {\n  const [rows, setRows] = React.useState<Row[]>([])\n  const [page, setPage] = React.useState(1)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [totalIsCapped, setTotalIsCapped] = React.useState(false)\n  const [search, setSearch] = React.useState('')\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const scopeVersion = useOrganizationScopeVersion()\n  const t = useT()\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const params = new URLSearchParams()\n        params.set('page', String(page))\n        params.set('pageSize', '20')\n        if (search) params.set('search', search)\n        const fallback: ResponsePayload = { items: [], total: 0, page, totalPages: 1 }\n        const call = await apiCall<ResponsePayload>(\n          `/api/api_keys/keys?${params.toString()}`,\n          undefined,\n          { fallback },\n        )\n        if (!call.ok) {\n          const errorPayload = call.result as { error?: string } | undefined\n          const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('api_keys.list.error.loadFailed')\n          flash(message, 'error')\n          return\n        }\n        const payload = call.result ?? fallback\n        if (!cancelled) {\n          setRows(Array.isArray(payload.items) ? payload.items : [])\n          setTotal(payload.total || 0)\n          setTotalPages(payload.totalPages || 1)\n          setTotalIsCapped(payload?.totalIsCapped === true)\n        }\n      } catch (error) {\n        if (!cancelled) {\n          const message = error instanceof Error ? error.message : t('api_keys.list.error.loadFailed')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [page, search, reloadToken, scopeVersion, t])\n\n  const handleDelete = React.useCallback(async (row: Row) => {\n    const confirmed = await confirm({\n      title: t('api_keys.list.confirmDelete', { name: row.name }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(row.updatedAt),\n        () => apiCall<{ error?: string }>(\n          `/api/api_keys/keys?id=${encodeURIComponent(row.id)}`,\n          { method: 'DELETE' },\n          { fallback: null },\n        ),\n      )\n      if (!call.ok) {\n        const errorPayload = call.result as { error?: string } | undefined\n        const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('api_keys.list.error.deleteFailed')\n        flash(message, 'error')\n        return\n      }\n      flash(t('api_keys.list.success.deleted'), 'success')\n      setReloadToken((token) => token + 1)\n    } catch (error) {\n      const message = error instanceof Error ? error.message : t('api_keys.list.error.deleteFailed')\n      flash(message, 'error')\n    }\n  }, [confirm, t])\n\n  const columns = React.useMemo<ColumnDef<Row>[]>(() => [\n    { accessorKey: 'name', header: t('api_keys.list.columns.name') },\n    {\n      accessorKey: 'keyPrefix',\n      header: t('api_keys.list.columns.key'),\n      cell: ({ row }) => <code className=\"text-xs\">{row.original.keyPrefix}\u2026</code>,\n    },\n    {\n      accessorKey: 'organizationName',\n      header: t('api_keys.list.columns.organization'),\n      cell: ({ row }) => row.original.organizationName || t('api_keys.list.noDate'),\n    },\n    {\n      accessorKey: 'roles',\n      header: t('api_keys.list.columns.roles'),\n      cell: ({ row }) => (\n        <div className=\"flex flex-wrap gap-1\">\n          {row.original.roles.length === 0 && <span className=\"text-muted-foreground text-xs\">{t('api_keys.list.noRoles')}</span>}\n          {row.original.roles.map((role) => (\n            <span\n              key={role.id}\n              className=\"inline-flex items-center rounded-full border px-2 py-0.5 text-xs font-medium\"\n            >\n              {role.name || role.id}\n            </span>\n          ))}\n        </div>\n      ),\n    },\n    {\n      accessorKey: 'lastUsedAt',\n      header: t('api_keys.list.columns.lastUsed'),\n      cell: ({ row }) => formatDate(row.original.lastUsedAt, t),\n    },\n    {\n      accessorKey: 'expiresAt',\n      header: t('api_keys.list.columns.expires'),\n      cell: ({ row }) => formatDate(row.original.expiresAt, t),\n    },\n  ], [t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('api_keys.list.title')}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/api-keys/create\">{t('api_keys.list.actions.create')}</Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(value) => { setSearch(value); setPage(1) }}\n          perspective={{ tableId: extensionPoints.hosts.apiKeysTable.tableId }}\n          rowActions={(row) => (\n            <RowActions items={[\n              { id: 'delete', label: t('common.delete'), destructive: true, onSelect: () => { void handleDelete(row) } },\n            ]} />\n          )}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('api_keys.list.title')}\n              createHref=\"/backend/api-keys/create\"\n              createLabel={t('api_keys.list.actions.create')}\n            />\n          )}\n          pagination={{ page, pageSize: 20, total, totalPages, totalIsCapped, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
-  "mappings": ";AA4IyB,SAYqB,KAZrB;AA3IzB,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,sBAAsB;AAE/B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AA0BjC,SAAS,WAAW,OAAsB,GAAsE;AAC9G,MAAI,CAAC,MAAO,QAAO,EAAE,sBAAsB;AAC3C,MAAI;AACF,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,QAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO,EAAE,sBAAsB;AACjE,WAAO,KAAK,eAAe;AAAA,EAC7B,QAAQ;AACN,WAAO,EAAE,sBAAsB;AAAA,EACjC;AACF;AAEe,SAAR,kBAAmC;AACxC,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAgB,CAAC,CAAC;AAChD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,eAAe,4BAA4B;AACjD,QAAM,IAAI,KAAK;AACf,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAE3D,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,SAAS,IAAI,gBAAgB;AACnC,eAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,eAAO,IAAI,YAAY,IAAI;AAC3B,YAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,cAAM,WAA4B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,YAAY,EAAE;AAC7E,cAAM,OAAO,MAAM;AAAA,UACjB,sBAAsB,OAAO,SAAS,CAAC;AAAA,UACvC;AAAA,UACA,EAAE,SAAS;AAAA,QACb;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,eAAe,KAAK;AAC1B,gBAAM,UAAU,OAAO,cAAc,UAAU,WAAW,aAAa,QAAQ,EAAE,gCAAgC;AACjH,gBAAM,SAAS,OAAO;AACtB;AAAA,QACF;AACA,cAAM,UAAU,KAAK,UAAU;AAC/B,YAAI,CAAC,WAAW;AACd,kBAAQ,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACzD,mBAAS,QAAQ,SAAS,CAAC;AAC3B,wBAAc,QAAQ,cAAc,CAAC;AACrC,2BAAiB,SAAS,kBAAkB,IAAI;AAAA,QAClD;AAAA,MACF,SAAS,OAAO;AACd,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,gCAAgC;AAC3F,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,QAAQ,aAAa,cAAc,CAAC,CAAC;AAE/C,QAAM,eAAe,MAAM,YAAY,OAAO,QAAa;AACzD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,IAAI,KAAK,CAAC;AAAA,MAC1D,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,IAAI,SAAS;AAAA,QACvC,MAAM;AAAA,UACJ,yBAAyB,mBAAmB,IAAI,EAAE,CAAC;AAAA,UACnD,EAAE,QAAQ,SAAS;AAAA,UACnB,EAAE,UAAU,KAAK;AAAA,QACnB;AAAA,MACF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK;AAC1B,cAAM,UAAU,OAAO,cAAc,UAAU,WAAW,aAAa,QAAQ,EAAE,kCAAkC;AACnH,cAAM,SAAS,OAAO;AACtB;AAAA,MACF;AACA,YAAM,EAAE,+BAA+B,GAAG,SAAS;AACnD,qBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,IACrC,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,kCAAkC;AAC7F,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,CAAC,CAAC;AAEf,QAAM,UAAU,MAAM,QAA0B,MAAM;AAAA,IACpD,EAAE,aAAa,QAAQ,QAAQ,EAAE,4BAA4B,EAAE;AAAA,IAC/D;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,2BAA2B;AAAA,MACrC,MAAM,CAAC,EAAE,IAAI,MAAM,qBAAC,UAAK,WAAU,WAAW;AAAA,YAAI,SAAS;AAAA,QAAU;AAAA,SAAC;AAAA,IACxE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,oCAAoC;AAAA,MAC9C,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,oBAAoB,EAAE,sBAAsB;AAAA,IAC9E;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,6BAA6B;AAAA,MACvC,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,wBACZ;AAAA,YAAI,SAAS,MAAM,WAAW,KAAK,oBAAC,UAAK,WAAU,iCAAiC,YAAE,uBAAuB,GAAE;AAAA,QAC/G,IAAI,SAAS,MAAM,IAAI,CAAC,SACvB;AAAA,UAAC;AAAA;AAAA,YAEC,WAAU;AAAA,YAET,eAAK,QAAQ,KAAK;AAAA;AAAA,UAHd,KAAK;AAAA,QAIZ,CACD;AAAA,SACH;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,gCAAgC;AAAA,MAC1C,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,YAAY,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,+BAA+B;AAAA,MACzC,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,WAAW,CAAC;AAAA,IACzD;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qBAAqB;AAAA,QAC9B,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,4BAA4B,YAAE,8BAA8B,GAAE,GAC3E;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,aAAa,EAAE,SAAS,gBAAgB,MAAM,aAAa,QAAQ;AAAA,QACnE,YAAY,CAAC,QACX,oBAAC,cAAW,OAAO;AAAA,UACjB,EAAE,IAAI,UAAU,OAAO,EAAE,eAAe,GAAG,aAAa,MAAM,UAAU,MAAM;AAAE,iBAAK,aAAa,GAAG;AAAA,UAAE,EAAE;AAAA,QAC3G,GAAG;AAAA,QAEL,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,qBAAqB;AAAA,YACnC,YAAW;AAAA,YACX,aAAa,EAAE,8BAA8B;AAAA;AAAA,QAC/C;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,IAAI,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA,QAC1F;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/api_keys/extension-points'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\n\ntype RoleSummary = { id: string; name: string | null }\n\ntype Row = {\n  id: string\n  name: string\n  description: string | null\n  keyPrefix: string\n  organizationId: string | null\n  organizationName: string | null\n  createdAt: string\n  lastUsedAt: string | null\n  expiresAt: string | null\n  roles: RoleSummary[]\n  updatedAt?: string | null\n}\n\ntype ResponsePayload = {\n  items: Row[]\n  total: number\n  page: number\n  totalPages: number\n}\n\nfunction formatDate(value: string | null, t: (key: string, params?: Record<string, string | number>) => string) {\n  if (!value) return t('api_keys.list.noDate')\n  try {\n    const date = new Date(value)\n    if (Number.isNaN(date.getTime())) return t('api_keys.list.noDate')\n    return date.toLocaleString()\n  } catch {\n    return t('api_keys.list.noDate')\n  }\n}\n\nexport default function ApiKeysListPage() {\n  const [rows, setRows] = React.useState<Row[]>([])\n  const [page, setPage] = React.useState(1)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const scopeVersion = useOrganizationScopeVersion()\n  const t = useT()\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const params = new URLSearchParams()\n        params.set('page', String(page))\n        params.set('pageSize', '20')\n        if (search) params.set('search', search)\n        const fallback: ResponsePayload = { items: [], total: 0, page, totalPages: 1 }\n        const call = await apiCall<ResponsePayload>(\n          `/api/api_keys/keys?${params.toString()}`,\n          undefined,\n          { fallback },\n        )\n        if (!call.ok) {\n          const errorPayload = call.result as { error?: string } | undefined\n          const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('api_keys.list.error.loadFailed')\n          flash(message, 'error')\n          return\n        }\n        const payload = call.result ?? fallback\n        if (!cancelled) {\n          setRows(Array.isArray(payload.items) ? payload.items : [])\n          setTotal(payload.total || 0)\n          setTotalPages(payload.totalPages || 1)\n        }\n      } catch (error) {\n        if (!cancelled) {\n          const message = error instanceof Error ? error.message : t('api_keys.list.error.loadFailed')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [page, search, reloadToken, scopeVersion, t])\n\n  const handleDelete = React.useCallback(async (row: Row) => {\n    const confirmed = await confirm({\n      title: t('api_keys.list.confirmDelete', { name: row.name }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(row.updatedAt),\n        () => apiCall<{ error?: string }>(\n          `/api/api_keys/keys?id=${encodeURIComponent(row.id)}`,\n          { method: 'DELETE' },\n          { fallback: null },\n        ),\n      )\n      if (!call.ok) {\n        const errorPayload = call.result as { error?: string } | undefined\n        const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('api_keys.list.error.deleteFailed')\n        flash(message, 'error')\n        return\n      }\n      flash(t('api_keys.list.success.deleted'), 'success')\n      setReloadToken((token) => token + 1)\n    } catch (error) {\n      const message = error instanceof Error ? error.message : t('api_keys.list.error.deleteFailed')\n      flash(message, 'error')\n    }\n  }, [confirm, t])\n\n  const columns = React.useMemo<ColumnDef<Row>[]>(() => [\n    { accessorKey: 'name', header: t('api_keys.list.columns.name') },\n    {\n      accessorKey: 'keyPrefix',\n      header: t('api_keys.list.columns.key'),\n      cell: ({ row }) => <code className=\"text-xs\">{row.original.keyPrefix}\u2026</code>,\n    },\n    {\n      accessorKey: 'organizationName',\n      header: t('api_keys.list.columns.organization'),\n      cell: ({ row }) => row.original.organizationName || t('api_keys.list.noDate'),\n    },\n    {\n      accessorKey: 'roles',\n      header: t('api_keys.list.columns.roles'),\n      cell: ({ row }) => (\n        <div className=\"flex flex-wrap gap-1\">\n          {row.original.roles.length === 0 && <span className=\"text-muted-foreground text-xs\">{t('api_keys.list.noRoles')}</span>}\n          {row.original.roles.map((role) => (\n            <span\n              key={role.id}\n              className=\"inline-flex items-center rounded-full border px-2 py-0.5 text-xs font-medium\"\n            >\n              {role.name || role.id}\n            </span>\n          ))}\n        </div>\n      ),\n    },\n    {\n      accessorKey: 'lastUsedAt',\n      header: t('api_keys.list.columns.lastUsed'),\n      cell: ({ row }) => formatDate(row.original.lastUsedAt, t),\n    },\n    {\n      accessorKey: 'expiresAt',\n      header: t('api_keys.list.columns.expires'),\n      cell: ({ row }) => formatDate(row.original.expiresAt, t),\n    },\n  ], [t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('api_keys.list.title')}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/api-keys/create\">{t('api_keys.list.actions.create')}</Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(value) => { setSearch(value); setPage(1) }}\n          perspective={{ tableId: extensionPoints.hosts.apiKeysTable.tableId }}\n          rowActions={(row) => (\n            <RowActions items={[\n              { id: 'delete', label: t('common.delete'), destructive: true, onSelect: () => { void handleDelete(row) } },\n            ]} />\n          )}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('api_keys.list.title')}\n              createHref=\"/backend/api-keys/create\"\n              createLabel={t('api_keys.list.actions.create')}\n            />\n          )}\n          pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAyIyB,SAYqB,KAZrB;AAxIzB,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,sBAAsB;AAE/B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AAyBjC,SAAS,WAAW,OAAsB,GAAsE;AAC9G,MAAI,CAAC,MAAO,QAAO,EAAE,sBAAsB;AAC3C,MAAI;AACF,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,QAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO,EAAE,sBAAsB;AACjE,WAAO,KAAK,eAAe;AAAA,EAC7B,QAAQ;AACN,WAAO,EAAE,sBAAsB;AAAA,EACjC;AACF;AAEe,SAAR,kBAAmC;AACxC,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAgB,CAAC,CAAC;AAChD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,eAAe,4BAA4B;AACjD,QAAM,IAAI,KAAK;AACf,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAE3D,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,SAAS,IAAI,gBAAgB;AACnC,eAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,eAAO,IAAI,YAAY,IAAI;AAC3B,YAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,cAAM,WAA4B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,YAAY,EAAE;AAC7E,cAAM,OAAO,MAAM;AAAA,UACjB,sBAAsB,OAAO,SAAS,CAAC;AAAA,UACvC;AAAA,UACA,EAAE,SAAS;AAAA,QACb;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,eAAe,KAAK;AAC1B,gBAAM,UAAU,OAAO,cAAc,UAAU,WAAW,aAAa,QAAQ,EAAE,gCAAgC;AACjH,gBAAM,SAAS,OAAO;AACtB;AAAA,QACF;AACA,cAAM,UAAU,KAAK,UAAU;AAC/B,YAAI,CAAC,WAAW;AACd,kBAAQ,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACzD,mBAAS,QAAQ,SAAS,CAAC;AAC3B,wBAAc,QAAQ,cAAc,CAAC;AAAA,QACvC;AAAA,MACF,SAAS,OAAO;AACd,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,gCAAgC;AAC3F,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,QAAQ,aAAa,cAAc,CAAC,CAAC;AAE/C,QAAM,eAAe,MAAM,YAAY,OAAO,QAAa;AACzD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,IAAI,KAAK,CAAC;AAAA,MAC1D,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,IAAI,SAAS;AAAA,QACvC,MAAM;AAAA,UACJ,yBAAyB,mBAAmB,IAAI,EAAE,CAAC;AAAA,UACnD,EAAE,QAAQ,SAAS;AAAA,UACnB,EAAE,UAAU,KAAK;AAAA,QACnB;AAAA,MACF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK;AAC1B,cAAM,UAAU,OAAO,cAAc,UAAU,WAAW,aAAa,QAAQ,EAAE,kCAAkC;AACnH,cAAM,SAAS,OAAO;AACtB;AAAA,MACF;AACA,YAAM,EAAE,+BAA+B,GAAG,SAAS;AACnD,qBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,IACrC,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,kCAAkC;AAC7F,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,CAAC,CAAC;AAEf,QAAM,UAAU,MAAM,QAA0B,MAAM;AAAA,IACpD,EAAE,aAAa,QAAQ,QAAQ,EAAE,4BAA4B,EAAE;AAAA,IAC/D;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,2BAA2B;AAAA,MACrC,MAAM,CAAC,EAAE,IAAI,MAAM,qBAAC,UAAK,WAAU,WAAW;AAAA,YAAI,SAAS;AAAA,QAAU;AAAA,SAAC;AAAA,IACxE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,oCAAoC;AAAA,MAC9C,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,oBAAoB,EAAE,sBAAsB;AAAA,IAC9E;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,6BAA6B;AAAA,MACvC,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,wBACZ;AAAA,YAAI,SAAS,MAAM,WAAW,KAAK,oBAAC,UAAK,WAAU,iCAAiC,YAAE,uBAAuB,GAAE;AAAA,QAC/G,IAAI,SAAS,MAAM,IAAI,CAAC,SACvB;AAAA,UAAC;AAAA;AAAA,YAEC,WAAU;AAAA,YAET,eAAK,QAAQ,KAAK;AAAA;AAAA,UAHd,KAAK;AAAA,QAIZ,CACD;AAAA,SACH;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,gCAAgC;AAAA,MAC1C,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,YAAY,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,+BAA+B;AAAA,MACzC,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,WAAW,CAAC;AAAA,IACzD;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qBAAqB;AAAA,QAC9B,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,4BAA4B,YAAE,8BAA8B,GAAE,GAC3E;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,aAAa,EAAE,SAAS,gBAAgB,MAAM,aAAa,QAAQ;AAAA,QACnE,YAAY,CAAC,QACX,oBAAC,cAAW,OAAO;AAAA,UACjB,EAAE,IAAI,UAAU,OAAO,EAAE,eAAe,GAAG,aAAa,MAAM,UAAU,MAAM;AAAE,iBAAK,aAAa,GAAG;AAAA,UAAE,EAAE;AAAA,QAC3G,GAAG;AAAA,QAEL,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,qBAAqB;AAAA,YACnC,YAAW;AAAA,YACX,aAAa,EAAE,8BAA8B;AAAA;AAAA,QAC/C;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,IAAI,OAAO,YAAY,cAAc,QAAQ;AAAA,QAC3E;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": []
 }

package/dist/modules/attachments/api/route.js

@@ -189,7 +189,7 @@ async function GET(req) {
   const currentPage = usePaging ? Math.max(1, page) : null;
   const currentPageSize = usePaging ? pageSize : null;
   const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize)) : null;
-  const pageOffset = usePaging ? (currentPage - 1) * currentPageSize : void 0;
+  const pageOffset = usePaging ? (Math.min(currentPage, totalPages) - 1) * currentPageSize : void 0;
   const items = await findWithDecryption(
     em,
     Attachment,
@@ -229,7 +229,7 @@ async function GET(req) {
     }),
     ...usePaging ? {
       total,
-      page: currentPage,
+      page: Math.min(currentPage, totalPages),
       pageSize: currentPageSize,
       totalPages
     } : {}