@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/dist/modules/customer_accounts/extension-points.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/extension-points.ts"],
-  "sourcesContent": ["import { dataTableExtensionHost, defineModuleExtensionPoints } from '@open-mercato/shared/modules/widgets/extension-points'\n\nexport const extensionPoints = defineModuleExtensionPoints({\n  moduleId: 'customer_accounts',\n  hosts: {\n    usersTable: dataTableExtensionHost({ tableId: 'customer_accounts.admin.users', source: 'backend/customer_accounts/users/page.tsx' }),\n    rolesTable: dataTableExtensionHost({ tableId: 'customer_accounts.admin.roles', source: 'backend/customer_accounts/roles/page.tsx' }),\n  },\n})\n\nexport default extensionPoints\n"],
-  "mappings": "AAAA,SAAS,wBAAwB,mCAAmC;AAE7D,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,OAAO;AAAA,IACL,YAAY,uBAAuB,EAAE,SAAS,iCAAiC,QAAQ,2CAA2C,CAAC;AAAA,IACnI,YAAY,uBAAuB,EAAE,SAAS,iCAAiC,QAAQ,2CAA2C,CAAC;AAAA,EACrI;AACF,CAAC;AAED,IAAO,2BAAQ;",
+  "sourcesContent": ["import { dataTableExtensionHost, defineModuleExtensionPoints } from '@open-mercato/shared/modules/widgets/extension-points'\n\nexport const extensionPoints = defineModuleExtensionPoints({\n  moduleId: 'customer_accounts',\n  hosts: {\n    usersTable: dataTableExtensionHost({ tableId: 'customer_accounts.admin.users', source: 'backend/customer_accounts/users/PortalUsersPageClient.tsx' }),\n    rolesTable: dataTableExtensionHost({ tableId: 'customer_accounts.admin.roles', source: 'backend/customer_accounts/roles/page.tsx' }),\n  },\n})\n\nexport default extensionPoints\n"],
+  "mappings": "AAAA,SAAS,wBAAwB,mCAAmC;AAE7D,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,OAAO;AAAA,IACL,YAAY,uBAAuB,EAAE,SAAS,iCAAiC,QAAQ,4DAA4D,CAAC;AAAA,IACpJ,YAAY,uBAAuB,EAAE,SAAS,iCAAiC,QAAQ,2CAA2C,CAAC;AAAA,EACrI;AACF,CAAC;AAED,IAAO,2BAAQ;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/portalUrl.js

@@ -0,0 +1,69 @@
+const FORWARDED_HOST_HEADER = "x-forwarded-host";
+const HOST_HEADER = "host";
+const FORWARDED_PROTO_HEADER = "x-forwarded-proto";
+const HOST_PATTERN = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+const PROTOCOL_PATTERN = /^https?$/i;
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+const PORTAL_ORG_SLUG_PLACEHOLDER = "[org-slug]";
+function firstHeaderValue(raw) {
+  if (typeof raw !== "string") return null;
+  const value = raw.split(",")[0]?.trim() ?? "";
+  return value.length > 0 ? value : null;
+}
+function readHost(headers) {
+  const forwarded = firstHeaderValue(headers.get(FORWARDED_HOST_HEADER));
+  const host = forwarded ?? firstHeaderValue(headers.get(HOST_HEADER));
+  if (!host) return null;
+  return HOST_PATTERN.test(host) ? host.toLowerCase() : null;
+}
+function readProtocol(headers, host) {
+  const forwarded = firstHeaderValue(headers.get(FORWARDED_PROTO_HEADER));
+  if (forwarded && PROTOCOL_PATTERN.test(forwarded)) return forwarded.toLowerCase();
+  const configured = configuredOrigin();
+  if (configured) {
+    try {
+      const parsed = new URL(configured);
+      if (parsed.host.toLowerCase() === host) return parsed.protocol.replace(":", "");
+    } catch {
+    }
+  }
+  const hostname = host.replace(/:\d{1,5}$/, "");
+  return LOOPBACK_HOSTS.has(hostname) ? "http" : "https";
+}
+function configuredOrigin() {
+  const candidates = [process.env.APP_URL, process.env.NEXT_PUBLIC_APP_URL];
+  for (const candidate of candidates) {
+    const value = candidate?.trim();
+    if (!value) continue;
+    try {
+      const parsed = new URL(value);
+      if (PROTOCOL_PATTERN.test(parsed.protocol.replace(":", ""))) return parsed.origin;
+    } catch {
+    }
+  }
+  return "";
+}
+function resolvePortalRequestOrigin(headers) {
+  if (headers && typeof headers.get === "function") {
+    const host = readHost(headers);
+    if (host) return `${readProtocol(headers, host)}://${host}`;
+  }
+  return configuredOrigin();
+}
+function normalizeOrigin(origin) {
+  if (typeof origin !== "string") return "";
+  return origin.trim().replace(/\/+$/, "");
+}
+function buildPortalUrlPattern(origin) {
+  return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`;
+}
+function buildPortalRootUrl(origin) {
+  return `${normalizeOrigin(origin)}/portal`;
+}
+export {
+  PORTAL_ORG_SLUG_PLACEHOLDER,
+  buildPortalRootUrl,
+  buildPortalUrlPattern,
+  resolvePortalRequestOrigin
+};
+//# sourceMappingURL=portalUrl.js.map

package/dist/modules/customer_accounts/lib/portalUrl.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/portalUrl.ts"],
+  "sourcesContent": ["// Resolve the browser-visible origin on the server so the admin portal-address\n// hints are already correct in the first server-rendered paint. Deriving the\n// origin from `window.location.origin` during render made the server HTML and\n// the hydrated client output disagree, which React reported as a hydration\n// error and repaired with a visible flicker of the portal address (#5457).\n//\n// `resolvePortalRequestOrigin` is deliberately named apart from the shared\n// `resolveRequestOrigin` in `@open-mercato/shared/lib/url`: that one takes a\n// `Request` and reads the protocol off `req.url`, which a server component does\n// not have \u2014 it only has `headers()`. This one also validates the untrusted host\n// header before the value reaches rendered text or a link href, and infers the\n// protocol when the proxy stays quiet, so the two are not interchangeable.\n\nexport type RequestHeaderReader = {\n  get(name: string): string | null | undefined\n}\n\nconst FORWARDED_HOST_HEADER = 'x-forwarded-host'\nconst HOST_HEADER = 'host'\nconst FORWARDED_PROTO_HEADER = 'x-forwarded-proto'\n\n// Host headers are client-controlled, so only a plain `host[:port]` or bracketed\n// IPv6 literal is accepted before it reaches rendered text and link hrefs.\nconst HOST_PATTERN = /^(?:[a-z0-9.-]+|\\[[0-9a-f:.]+\\])(?::\\d{1,5})?$/i\nconst PROTOCOL_PATTERN = /^https?$/i\n// Bracketed, because HOST_PATTERN only accepts a colon-bearing host in that form.\nconst LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]'])\n\nexport const PORTAL_ORG_SLUG_PLACEHOLDER = '[org-slug]'\n\nfunction firstHeaderValue(raw: string | null | undefined): string | null {\n  if (typeof raw !== 'string') return null\n  // Proxy chains append values, so the client-facing hop is the first entry.\n  const value = raw.split(',')[0]?.trim() ?? ''\n  return value.length > 0 ? value : null\n}\n\nfunction readHost(headers: RequestHeaderReader): string | null {\n  const forwarded = firstHeaderValue(headers.get(FORWARDED_HOST_HEADER))\n  const host = forwarded ?? firstHeaderValue(headers.get(HOST_HEADER))\n  if (!host) return null\n  return HOST_PATTERN.test(host) ? host.toLowerCase() : null\n}\n\nfunction readProtocol(headers: RequestHeaderReader, host: string): string {\n  const forwarded = firstHeaderValue(headers.get(FORWARDED_PROTO_HEADER))\n  if (forwarded && PROTOCOL_PATTERN.test(forwarded)) return forwarded.toLowerCase()\n  // An operator who configured APP_URL has named the canonical origin explicitly;\n  // when it points at this very host, trust it over any inference below. Without\n  // this, a plain-HTTP deployment behind a proxy that omits x-forwarded-proto\n  // would render https:// links that do not work.\n  const configured = configuredOrigin()\n  if (configured) {\n    try {\n      const parsed = new URL(configured)\n      if (parsed.host.toLowerCase() === host) return parsed.protocol.replace(':', '')\n    } catch {\n      // configuredOrigin() already parsed this successfully; ignore defensively.\n    }\n  }\n  // Otherwise a terminating proxy that omits the header is serving a public\n  // hostname over TLS far more often than not; only loopback hosts default to http.\n  const hostname = host.replace(/:\\d{1,5}$/, '')\n  return LOOPBACK_HOSTS.has(hostname) ? 'http' : 'https'\n}\n\nfunction configuredOrigin(): string {\n  const candidates = [process.env.APP_URL, process.env.NEXT_PUBLIC_APP_URL]\n  for (const candidate of candidates) {\n    const value = candidate?.trim()\n    if (!value) continue\n    try {\n      const parsed = new URL(value)\n      if (PROTOCOL_PATTERN.test(parsed.protocol.replace(':', ''))) return parsed.origin\n    } catch {\n      // A malformed APP_URL must not break the page \u2014 fall through to the next candidate.\n    }\n  }\n  return ''\n}\n\n/**\n * Resolve the origin the current request was made to, mirroring the value\n * `window.location.origin` reports in the browser. Falls back to the configured\n * app URL, then to an empty string so callers render a root-relative path that\n * is identical on the server and the client.\n *\n * Named apart from `resolveRequestOrigin` in `@open-mercato/shared/lib/url` \u2014\n * see the note at the top of this file for why the two cannot be merged.\n */\nexport function resolvePortalRequestOrigin(headers: RequestHeaderReader | null | undefined): string {\n  if (headers && typeof headers.get === 'function') {\n    const host = readHost(headers)\n    if (host) return `${readProtocol(headers, host)}://${host}`\n  }\n  return configuredOrigin()\n}\n\nfunction normalizeOrigin(origin: string | null | undefined): string {\n  if (typeof origin !== 'string') return ''\n  return origin.trim().replace(/\\/+$/, '')\n}\n\n/** Display pattern for a tenant portal address, e.g. `https://app.example.com/[org-slug]/portal`. */\nexport function buildPortalUrlPattern(origin: string | null | undefined): string {\n  return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`\n}\n\n/** Portal entry point used by the \"Open Portal\" action on admin pages. */\nexport function buildPortalRootUrl(origin: string | null | undefined): string {\n  return `${normalizeOrigin(origin)}/portal`\n}\n"],
+  "mappings": "AAiBA,MAAM,wBAAwB;AAC9B,MAAM,cAAc;AACpB,MAAM,yBAAyB;AAI/B,MAAM,eAAe;AACrB,MAAM,mBAAmB;AAEzB,MAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAE3D,MAAM,8BAA8B;AAE3C,SAAS,iBAAiB,KAA+C;AACvE,MAAI,OAAO,QAAQ,SAAU,QAAO;AAEpC,QAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAC3C,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,SAAS,SAAS,SAA6C;AAC7D,QAAM,YAAY,iBAAiB,QAAQ,IAAI,qBAAqB,CAAC;AACrE,QAAM,OAAO,aAAa,iBAAiB,QAAQ,IAAI,WAAW,CAAC;AACnE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,aAAa,KAAK,IAAI,IAAI,KAAK,YAAY,IAAI;AACxD;AAEA,SAAS,aAAa,SAA8B,MAAsB;AACxE,QAAM,YAAY,iBAAiB,QAAQ,IAAI,sBAAsB,CAAC;AACtE,MAAI,aAAa,iBAAiB,KAAK,SAAS,EAAG,QAAO,UAAU,YAAY;AAKhF,QAAM,aAAa,iBAAiB;AACpC,MAAI,YAAY;AACd,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,UAAU;AACjC,UAAI,OAAO,KAAK,YAAY,MAAM,KAAM,QAAO,OAAO,SAAS,QAAQ,KAAK,EAAE;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,WAAW,KAAK,QAAQ,aAAa,EAAE;AAC7C,SAAO,eAAe,IAAI,QAAQ,IAAI,SAAS;AACjD;AAEA,SAAS,mBAA2B;AAClC,QAAM,aAAa,CAAC,QAAQ,IAAI,SAAS,QAAQ,IAAI,mBAAmB;AACxE,aAAW,aAAa,YAAY;AAClC,UAAM,QAAQ,WAAW,KAAK;AAC9B,QAAI,CAAC,MAAO;AACZ,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,UAAI,iBAAiB,KAAK,OAAO,SAAS,QAAQ,KAAK,EAAE,CAAC,EAAG,QAAO,OAAO;AAAA,IAC7E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAWO,SAAS,2BAA2B,SAAyD;AAClG,MAAI,WAAW,OAAO,QAAQ,QAAQ,YAAY;AAChD,UAAM,OAAO,SAAS,OAAO;AAC7B,QAAI,KAAM,QAAO,GAAG,aAAa,SAAS,IAAI,CAAC,MAAM,IAAI;AAAA,EAC3D;AACA,SAAO,iBAAiB;AAC1B;AAEA,SAAS,gBAAgB,QAA2C;AAClE,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACzC;AAGO,SAAS,sBAAsB,QAA2C;AAC/E,SAAO,GAAG,gBAAgB,MAAM,CAAC,IAAI,2BAA2B;AAClE;AAGO,SAAS,mBAAmB,QAA2C;AAC5E,SAAO,GAAG,gBAAgB,MAAM,CAAC;AACnC;",
+  "names": []
+}

package/dist/modules/customer_accounts/services/domainMappingService.js

@@ -7,15 +7,8 @@ import {
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { emitCustomerAccountsEvent } from "@open-mercato/core/modules/customer_accounts/events";
 import { normalizeHostname, tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
-import { findOrganizationInTenant } from "@open-mercato/core/modules/customer_accounts/lib/organizationLookup";
 import { platformDomains } from "@open-mercato/core/modules/customer_accounts/lib/platformDomains";
 import { detectProxy, isInKnownProxyRange } from "@open-mercato/core/modules/customer_accounts/lib/proxyRanges";
-class DomainMappingOrgScopeError extends Error {
-  constructor(organizationId) {
-    super(`[internal] organizationId ${organizationId} does not belong to the caller's tenant`);
-    this.name = "DomainMappingOrgScopeError";
-  }
-}
 const DOMAIN_ROUTING_TAG = "domain_routing";
 const RESOLVE_KEY_PREFIX = "domain_routing:resolve";
 const ACTIVE_BY_ORG_KEY_PREFIX = "domain_routing:active-by-org";
@@ -193,8 +186,6 @@ class DomainMappingService {
   // -------------------------------------------------------------------------
   async register(input) {
     const hostname = normalizeHostname(input.hostname);
-    const organization = await findOrganizationInTenant(this.em, input.organizationId, input.tenantId);
-    if (!organization) throw new DomainMappingOrgScopeError(input.organizationId);
     let replacesDomain = null;
     if (input.replacesDomainId) {
       replacesDomain = await this.em.findOne(DomainMapping, {
@@ -500,7 +491,6 @@ const __testing__ = {
   Resolver
 };
 export {
-  DomainMappingOrgScopeError,
   DomainMappingService,
   __testing__
 };

package/dist/modules/customer_accounts/services/domainMappingService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/domainMappingService.ts"],
-  "sourcesContent": ["import { Resolver, promises as dnsPromises } from 'node:dns'\nimport { request as httpsRequest } from 'node:https'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  DomainMapping,\n  type DomainStatus,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'\n\nexport class DomainMappingOrgScopeError extends Error {\n  constructor(organizationId: string) {\n    super(`[internal] organizationId ${organizationId} does not belong to the caller's tenant`)\n    this.name = 'DomainMappingOrgScopeError'\n  }\n}\n\nconst DOMAIN_ROUTING_TAG = 'domain_routing'\nconst RESOLVE_KEY_PREFIX = 'domain_routing:resolve'\nconst ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'\nconst RESOLVE_TTL_MS = 5 * 60_000\nconst TLS_HEALTH_CHECK_TIMEOUT_MS = 10_000\nconst TLS_HEALTH_CHECK_RETRY_DELAYS_MS = [1_000, 4_000, 16_000]\nconst DEFAULT_DNS_RECHECK_THRESHOLD_MS = 5 * 60_000\nconst DEFAULT_TLS_MAX_RETRIES = 6\n\nexport type ResolveResult = {\n  domainMappingId: string\n  hostname: string\n  tenantId: string\n  organizationId: string\n  orgSlug: string | null\n  status: DomainStatus\n}\n\nexport type DnsDiagnostics = {\n  expectedCnameTarget: string\n  expectedARecordTarget: string | null\n  detectedRecords: Array<{ type: 'CNAME' | 'A'; value: string; proxy?: string }>\n  reverseResolve?: { attempted: boolean; originHeaderPresent: boolean }\n  suggestion: string\n}\n\nexport type VerifyResult = {\n  domainMapping: DomainMapping\n  diagnostics?: DnsDiagnostics\n}\n\nexport type RegisterInput = {\n  hostname: string\n  organizationId: string\n  tenantId: string\n  replacesDomainId?: string\n}\n\ntype CacheService = {\n  get(key: string, options?: unknown): Promise<unknown>\n  set(key: string, value: unknown, options?: { ttl?: number; tags?: string[] }): Promise<void>\n  deleteByTags(tags: string[]): Promise<number>\n}\n\ntype DnsResolverContract = {\n  resolveCname(hostname: string): Promise<string[]>\n  resolve4(hostname: string): Promise<string[]>\n}\n\ntype HealthCheckContract = (hostname: string, timeoutMs: number) => Promise<{\n  ok: boolean\n  originHeaderPresent: boolean\n  reason?: string\n}>\n\nconst defaultDnsResolver: DnsResolverContract = {\n  async resolveCname(hostname) {\n    try {\n      return await dnsPromises.resolveCname(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n  async resolve4(hostname) {\n    try {\n      return await dnsPromises.resolve4(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n}\n\nconst defaultHealthCheck: HealthCheckContract = (hostname, timeoutMs) =>\n  new Promise((resolve) => {\n    const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()\n    const req = httpsRequest(\n      {\n        host: hostname,\n        port: 443,\n        path: '/api/customer_accounts/domain-check',\n        method: 'GET',\n        headers: { 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },\n        timeout: timeoutMs,\n      },\n      (res) => {\n        const headerValue = res.headers[headerName]\n        const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue\n        const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'\n        const status = res.statusCode ?? 0\n        res.resume() // discard body\n        resolve({\n          ok: status >= 200 && status < 400,\n          originHeaderPresent,\n          reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,\n        })\n      },\n    )\n    req.on('timeout', () => {\n      req.destroy(new Error('TLS health check timed out'))\n    })\n    req.on('error', (err) => {\n      resolve({ ok: false, originHeaderPresent: false, reason: (err as Error).message })\n    })\n    req.end()\n  })\n\nexport class DomainMappingService {\n  private cache: CacheService | null\n  private dns: DnsResolverContract\n  private healthCheckImpl: HealthCheckContract\n\n  constructor(\n    private em: EntityManager,\n    deps?: {\n      cacheService?: CacheService\n      dnsResolver?: DnsResolverContract\n      healthCheck?: HealthCheckContract\n    },\n  ) {\n    this.cache = deps?.cacheService ?? null\n    this.dns = deps?.dnsResolver ?? defaultDnsResolver\n    this.healthCheckImpl = deps?.healthCheck ?? defaultHealthCheck\n  }\n\n  // -------------------------------------------------------------------------\n  // Read paths\n  // -------------------------------------------------------------------------\n\n  async findById(id: string, scope?: { tenantId?: string }): Promise<DomainMapping | null> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.findOne(DomainMapping, where as never)\n  }\n\n  async findByOrganization(\n    organizationId: string,\n    scope?: { tenantId?: string },\n  ): Promise<DomainMapping[]> {\n    const where: Record<string, unknown> = { organizationId }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.find(DomainMapping, where as never, { orderBy: { createdAt: 'asc' } })\n  }\n\n  async resolveByHostname(input: string): Promise<ResolveResult | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n\n    const cacheKey = `${RESOLVE_KEY_PREFIX}:${hostname}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as ResolveResult | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const result = await this.lookupResolveResult(hostname)\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`],\n      })\n    }\n    return result\n  }\n\n  async isAllowedForTls(input: string): Promise<{ organizationId: string; status: DomainStatus } | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n    const row = await this.em.findOne(DomainMapping, {\n      hostname,\n      status: { $in: ['active', 'verified'] },\n    } as never)\n    if (!row) return null\n    return { organizationId: row.organizationId, status: row.status }\n  }\n\n  async resolveActiveByOrg(organizationId: string): Promise<{ hostname: string; status: DomainStatus } | null> {\n    const cacheKey = `${ACTIVE_BY_ORG_KEY_PREFIX}:${organizationId}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as { hostname: string; status: DomainStatus } | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const row = await this.em.findOne(DomainMapping, {\n      organizationId,\n      status: 'active',\n    } as never)\n    const result = row ? { hostname: row.hostname, status: row.status } : null\n\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:org:${organizationId}`],\n      })\n    }\n    return result\n  }\n\n  async resolveAll(): Promise<ResolveResult[]> {\n    const rows = await this.em.find(DomainMapping, { status: 'active' } as never)\n    if (rows.length === 0) return []\n    const orgIds = Array.from(new Set(rows.map((r) => r.organizationId)))\n    const orgs = await this.em.find(Organization, { id: { $in: orgIds } } as never)\n    const slugByOrg = new Map<string, string | null>(orgs.map((o) => [o.id, o.slug ?? null]))\n\n    return rows.map<ResolveResult>((row) => ({\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: slugByOrg.get(row.organizationId) ?? null,\n      status: row.status,\n    }))\n  }\n\n  // -------------------------------------------------------------------------\n  // Worker queries\n  // -------------------------------------------------------------------------\n\n  async findPendingVerification(threshold?: { olderThanMs?: number }): Promise<DomainMapping[]> {\n    const olderThan = threshold?.olderThanMs ?? DEFAULT_DNS_RECHECK_THRESHOLD_MS\n    const cutoff = new Date(Date.now() - olderThan)\n    return this.em.find(\n      DomainMapping,\n      {\n        status: { $in: ['pending', 'dns_failed'] },\n        $or: [{ lastDnsCheckAt: null }, { lastDnsCheckAt: { $lt: cutoff } }],\n      } as never,\n      { orderBy: { lastDnsCheckAt: 'asc' } },\n    )\n  }\n\n  async findPendingTls(options?: { maxRetries?: number; batchSize?: number }): Promise<DomainMapping[]> {\n    const maxRetries = options?.maxRetries ?? DEFAULT_TLS_MAX_RETRIES\n    const limit = options?.batchSize ?? 50\n    return this.em.find(\n      DomainMapping,\n      {\n        $or: [\n          { status: 'verified' },\n          { status: 'tls_failed', tlsRetryCount: { $lt: maxRetries } },\n        ],\n      } as never,\n      { orderBy: { updatedAt: 'asc' }, limit },\n    )\n  }\n\n  // -------------------------------------------------------------------------\n  // Write paths\n  // -------------------------------------------------------------------------\n\n  async register(input: RegisterInput): Promise<DomainMapping> {\n    const hostname = normalizeHostname(input.hostname)\n    const organization = await findOrganizationInTenant(this.em, input.organizationId, input.tenantId)\n    if (!organization) throw new DomainMappingOrgScopeError(input.organizationId)\n\n    let replacesDomain: DomainMapping | null = null\n    if (input.replacesDomainId) {\n      replacesDomain = await this.em.findOne(DomainMapping, {\n        id: input.replacesDomainId,\n        tenantId: input.tenantId,\n      } as never)\n    }\n\n    const entity = this.em.create(DomainMapping, {\n      hostname,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      replacesDomain: replacesDomain ?? null,\n      provider: 'traefik',\n      status: 'pending',\n      tlsRetryCount: 0,\n      createdAt: new Date(),\n    } as never)\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.created', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      status: entity.status,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n\n    return entity\n  }\n\n  async verify(id: string): Promise<VerifyResult> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n\n    const expectedCname = process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? ''\n    const expectedARecord = process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null\n    const now = new Date()\n    entity.lastDnsCheckAt = now\n\n    const verification = await this.runDnsVerification(entity.hostname, {\n      expectedCname,\n      expectedARecord,\n    })\n\n    if (verification.ok) {\n      entity.status = 'verified'\n      entity.verifiedAt = now\n      entity.dnsFailureReason = null\n      entity.tlsRetryCount = 0\n      entity.tlsFailureReason = null\n      await this.em.persist(entity).flush()\n      await emitCustomerAccountsEvent('customer_accounts.domain_mapping.verified', {\n        id: entity.id,\n        hostname: entity.hostname,\n        organizationId: entity.organizationId,\n        tenantId: entity.tenantId,\n      } as never)\n      await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n      return { domainMapping: entity }\n    }\n\n    entity.status = 'dns_failed'\n    entity.dnsFailureReason = verification.reason\n    await this.em.persist(entity).flush()\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.dns_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: verification.reason,\n      detectedRecords: verification.diagnostics.detectedRecords,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return { domainMapping: entity, diagnostics: verification.diagnostics }\n  }\n\n  async activate(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot transition to active from ${entity.status}`)\n    }\n\n    entity.status = 'active'\n    entity.tlsRetryCount = 0\n    entity.tlsFailureReason = null\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.activated', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n    } as never)\n\n    if (entity.replacesDomain) {\n      const replaced = await this.em.findOne(DomainMapping, {\n        id: (entity.replacesDomain as unknown as { id: string }).id,\n      } as never)\n      if (replaced) {\n        const replacedHostname = replaced.hostname\n        const replacedOrg = replaced.organizationId\n        this.em.remove(replaced)\n        await this.em.flush()\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.replaced', {\n          id: entity.id,\n          hostname: entity.hostname,\n          organizationId: entity.organizationId,\n          tenantId: entity.tenantId,\n          replacedDomainId: replaced.id,\n          replacedHostname,\n        } as never)\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n          id: replaced.id,\n          hostname: replacedHostname,\n          organizationId: replacedOrg,\n          tenantId: replaced.tenantId,\n        } as never)\n        await this.invalidateCacheFor(replacedHostname, replacedOrg)\n      }\n    }\n\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  async remove(id: string, scope?: { tenantId?: string }): Promise<void> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    const entity = await this.em.findOne(DomainMapping, where as never)\n    if (!entity) return\n\n    const hostname = entity.hostname\n    const organizationId = entity.organizationId\n    const tenantId = entity.tenantId\n\n    this.em.remove(entity)\n    await this.em.flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n      id,\n      hostname,\n      organizationId,\n      tenantId,\n    } as never)\n    await this.invalidateCacheFor(hostname, organizationId)\n  }\n\n  async healthCheck(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot run health check from status ${entity.status}`)\n    }\n\n    let lastReason: string | null = null\n    for (let attempt = 0; attempt < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length; attempt++) {\n      const result = await this.healthCheckImpl(entity.hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (result.ok) {\n        return this.activate(entity.id)\n      }\n      lastReason = result.reason ?? 'TLS health check failed'\n      if (attempt + 1 < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length) {\n        await delay(TLS_HEALTH_CHECK_RETRY_DELAYS_MS[attempt])\n      }\n    }\n\n    entity.status = 'tls_failed'\n    entity.tlsFailureReason = lastReason ?? 'TLS health check failed'\n    entity.tlsRetryCount = (entity.tlsRetryCount ?? 0) + 1\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.tls_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: entity.tlsFailureReason,\n      retryCount: entity.tlsRetryCount,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async lookupResolveResult(hostname: string): Promise<ResolveResult | null> {\n    const row = await this.em.findOne(DomainMapping, { hostname, status: 'active' } as never)\n    if (!row) return null\n    const org = await this.em.findOne(Organization, { id: row.organizationId } as never)\n    return {\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: org?.slug ?? null,\n      status: row.status,\n    }\n  }\n\n  private async invalidateCacheFor(hostname: string, organizationId: string | null): Promise<void> {\n    if (!this.cache) return\n    const tags = [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`]\n    if (organizationId) tags.push(`${DOMAIN_ROUTING_TAG}:org:${organizationId}`)\n    try {\n      await this.cache.deleteByTags(tags)\n    } catch {\n      // Cache invalidation is best-effort \u2014 TTL backstop ensures eventual consistency.\n    }\n  }\n\n  private async runDnsVerification(\n    hostname: string,\n    expected: { expectedCname: string; expectedARecord: string | null },\n  ): Promise<\n    | {\n        ok: true\n        method: 'cname' | 'a-record' | 'reverse-resolve'\n        diagnostics: DnsDiagnostics\n      }\n    | { ok: false; reason: string; diagnostics: DnsDiagnostics }\n  > {\n    const detectedRecords: DnsDiagnostics['detectedRecords'] = []\n    const baseDiag = (overrides?: Partial<DnsDiagnostics>): DnsDiagnostics => ({\n      expectedCnameTarget: expected.expectedCname,\n      expectedARecordTarget: expected.expectedARecord,\n      detectedRecords,\n      suggestion: overrides?.suggestion ?? '',\n      reverseResolve: overrides?.reverseResolve,\n    })\n\n    // Phase 1: CNAME\n    let cnameRecords: string[] = []\n    try {\n      cnameRecords = await this.dns.resolveCname(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (CNAME): ${(err as Error).message}`,\n        diagnostics: baseDiag({\n          suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.',\n        }),\n      }\n    }\n    for (const cname of cnameRecords) detectedRecords.push({ type: 'CNAME', value: cname })\n\n    if (expected.expectedCname && cnameRecords.length > 0) {\n      const expectedCname = tryNormalizeHostname(expected.expectedCname) ?? expected.expectedCname.toLowerCase()\n      const match = cnameRecords.some((c) => (tryNormalizeHostname(c) ?? c.toLowerCase()) === expectedCname)\n      if (match) {\n        return {\n          ok: true,\n          method: 'cname',\n          diagnostics: baseDiag({\n            suggestion: 'CNAME record matches the expected target.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: `CNAME points to ${cnameRecords.join(', ')} instead of ${expected.expectedCname}`,\n        diagnostics: baseDiag({\n          suggestion: `Update your CNAME record to point to ${expected.expectedCname}.`,\n        }),\n      }\n    }\n\n    // Phase 2: A record\n    let aRecords: string[] = []\n    try {\n      aRecords = await this.dns.resolve4(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (A): ${(err as Error).message}`,\n        diagnostics: baseDiag({ suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.' }),\n      }\n    }\n    for (const a of aRecords) {\n      const proxy = detectProxy(a)\n      detectedRecords.push({ type: 'A', value: a, ...(proxy ? { proxy } : {}) })\n    }\n\n    if (aRecords.length === 0) {\n      return {\n        ok: false,\n        reason: `No CNAME or A record found for ${hostname}`,\n        diagnostics: baseDiag({\n          suggestion: expected.expectedARecord\n            ? `For a subdomain, add a CNAME record pointing to ${expected.expectedCname}. For an apex domain, add an A record pointing to ${expected.expectedARecord}. DNS propagation can take up to 48 hours.`\n            : `Add a CNAME record pointing to ${expected.expectedCname}. DNS propagation can take up to 48 hours.`,\n        }),\n      }\n    }\n\n    if (expected.expectedARecord && aRecords.includes(expected.expectedARecord)) {\n      return {\n        ok: true,\n        method: 'a-record',\n        diagnostics: baseDiag({ suggestion: 'A record matches the expected target.' }),\n      }\n    }\n\n    // Phase 3: reverse-resolve through proxy\n    const proxiedRecords = aRecords.filter((ip) => isInKnownProxyRange(ip))\n    if (proxiedRecords.length > 0) {\n      const probe = await this.healthCheckImpl(hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (probe.ok && probe.originHeaderPresent) {\n        return {\n          ok: true,\n          method: 'reverse-resolve',\n          diagnostics: baseDiag({\n            reverseResolve: { attempted: true, originHeaderPresent: true },\n            suggestion: 'Domain is proxied \u2014 reverse-resolve confirmed traffic reaches our origin.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: 'A record points to a known proxy IP, but reverse-resolve over HTTPS did not reach our server',\n        diagnostics: baseDiag({\n          reverseResolve: { attempted: true, originHeaderPresent: false },\n          suggestion: expected.expectedCname\n            ? `Your DNS uses a proxy. Either disable the proxy and add a CNAME \u2192 ${expected.expectedCname}, or configure your proxy to forward traffic to ${expected.expectedCname}.`\n            : 'Disable the DNS proxy or configure it to forward traffic to our platform.',\n        }),\n      }\n    }\n\n    return {\n      ok: false,\n      reason: expected.expectedARecord\n        ? `A record points to ${aRecords.join(', ')} instead of ${expected.expectedARecord}`\n        : `A record points to ${aRecords.join(', ')} but apex-domain registration is not enabled on this deployment`,\n      diagnostics: baseDiag({\n        suggestion: expected.expectedARecord\n          ? `Update your A record to point to ${expected.expectedARecord}.`\n          : `Apex-domain registration is not enabled on this deployment. Use a subdomain (e.g., shop.${hostname}) and add a CNAME pointing to ${expected.expectedCname}.`,\n      }),\n    }\n  }\n}\n\n// Re-exported for tests; allow injection of fakes.\nexport const __testing__ = {\n  DEFAULT_DNS_RECHECK_THRESHOLD_MS,\n  DEFAULT_TLS_MAX_RETRIES,\n  TLS_HEALTH_CHECK_RETRY_DELAYS_MS,\n  RESOLVE_TTL_MS,\n  DOMAIN_ROUTING_TAG,\n  defaultHealthCheck,\n  defaultDnsResolver,\n  Resolver,\n}\n"],
-  "mappings": "AAAA,SAAS,UAAU,YAAY,mBAAmB;AAClD,SAAS,WAAW,oBAAoB;AACxC,SAAS,cAAc,aAAa;AAEpC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,gCAAgC;AACzC,SAAS,uBAAuB;AAChC,SAAS,aAAa,2BAA2B;AAE1C,MAAM,mCAAmC,MAAM;AAAA,EACpD,YAAY,gBAAwB;AAClC,UAAM,6BAA6B,cAAc,yCAAyC;AAC1F,SAAK,OAAO;AAAA,EACd;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,8BAA8B;AACpC,MAAM,mCAAmC,CAAC,KAAO,KAAO,IAAM;AAC9D,MAAM,mCAAmC,IAAI;AAC7C,MAAM,0BAA0B;AAgDhC,MAAM,qBAA0C;AAAA,EAC9C,MAAM,aAAa,UAAU;AAC3B,QAAI;AACF,aAAO,MAAM,YAAY,aAAa,QAAQ;AAAA,IAChD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU;AACvB,QAAI;AACF,aAAO,MAAM,YAAY,SAAS,QAAQ;AAAA,IAC5C,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,qBAA0C,CAAC,UAAU,cACzD,IAAI,QAAQ,CAAC,YAAY;AACvB,QAAM,cAAc,QAAQ,IAAI,iCAAiC,yBAAyB,YAAY;AACtG,QAAM,MAAM;AAAA,IACV;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,EAAE,yBAAyB,QAAQ,IAAI,uBAAuB,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,cAAc,IAAI,QAAQ,UAAU;AAC1C,YAAM,eAAe,MAAM,QAAQ,WAAW,IAAI,YAAY,CAAC,IAAI;AACnE,YAAM,sBAAsB,OAAO,iBAAiB,YAAY,iBAAiB;AACjF,YAAM,SAAS,IAAI,cAAc;AACjC,UAAI,OAAO;AACX,cAAQ;AAAA,QACN,IAAI,UAAU,OAAO,SAAS;AAAA,QAC9B;AAAA,QACA,QAAQ,UAAU,OAAO,SAAS,MAAM,SAAY,QAAQ,MAAM;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,GAAG,WAAW,MAAM;AACtB,QAAI,QAAQ,IAAI,MAAM,4BAA4B,CAAC;AAAA,EACrD,CAAC;AACD,MAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,YAAQ,EAAE,IAAI,OAAO,qBAAqB,OAAO,QAAS,IAAc,QAAQ,CAAC;AAAA,EACnF,CAAC;AACD,MAAI,IAAI;AACV,CAAC;AAEI,MAAM,qBAAqB;AAAA,EAKhC,YACU,IACR,MAKA;AANQ;AAOR,SAAK,QAAQ,MAAM,gBAAgB;AACnC,SAAK,MAAM,MAAM,eAAe;AAChC,SAAK,kBAAkB,MAAM,eAAe;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,IAAY,OAA8D;AACvF,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,QAAQ,eAAe,KAAc;AAAA,EACtD;AAAA,EAEA,MAAM,mBACJ,gBACA,OAC0B;AAC1B,UAAM,QAAiC,EAAE,eAAe;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,KAAK,eAAe,OAAgB,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,kBAAkB,OAA8C;AACpE,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AAEjD,UAAM,WAAW,GAAG,kBAAkB,IAAI,QAAQ;AAClD,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AAAA,MAChE,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,OAAiF;AACrG,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AACjD,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,UAAU,UAAU,EAAE;AAAA,IACxC,CAAU;AACV,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,EAAE,gBAAgB,IAAI,gBAAgB,QAAQ,IAAI,OAAO;AAAA,EAClE;AAAA,EAEA,MAAM,mBAAmB,gBAAoF;AAC3G,UAAM,WAAW,GAAG,wBAAwB,IAAI,cAAc;AAC9D,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ;AAAA,IACV,CAAU;AACV,UAAM,SAAS,MAAM,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,IAAI;AAEtE,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAAA,MAC1E,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAuC;AAC3C,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,eAAe,EAAE,QAAQ,SAAS,CAAU;AAC5E,QAAI,KAAK,WAAW,EAAG,QAAO,CAAC;AAC/B,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACpE,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAU;AAC9E,UAAM,YAAY,IAAI,IAA2B,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;AAExF,WAAO,KAAK,IAAmB,CAAC,SAAS;AAAA,MACvC,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,UAAU,IAAI,IAAI,cAAc,KAAK;AAAA,MAC9C,QAAQ,IAAI;AAAA,IACd,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,wBAAwB,WAAgE;AAC5F,UAAM,YAAY,WAAW,eAAe;AAC5C,UAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;AAC9C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,EAAE;AAAA,QACzC,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,CAAC;AAAA,MACrE;AAAA,MACA,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAiF;AACpG,UAAM,aAAa,SAAS,cAAc;AAC1C,UAAM,QAAQ,SAAS,aAAa;AACpC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,KAAK;AAAA,UACH,EAAE,QAAQ,WAAW;AAAA,UACrB,EAAE,QAAQ,cAAc,eAAe,EAAE,KAAK,WAAW,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,GAAG,MAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAA8C;AAC3D,UAAM,WAAW,kBAAkB,MAAM,QAAQ;AACjD,UAAM,eAAe,MAAM,yBAAyB,KAAK,IAAI,MAAM,gBAAgB,MAAM,QAAQ;AACjG,QAAI,CAAC,aAAc,OAAM,IAAI,2BAA2B,MAAM,cAAc;AAE5E,QAAI,iBAAuC;AAC3C,QAAI,MAAM,kBAAkB;AAC1B,uBAAiB,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,MAClB,CAAU;AAAA,IACZ;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,eAAe;AAAA,MAC3C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAU;AACV,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AAEpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAmC;AAC9C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAE5D,UAAM,gBAAgB,QAAQ,IAAI,8BAA8B;AAChE,UAAM,kBAAkB,QAAQ,IAAI,iCAAiC;AACrE,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,iBAAiB;AAExB,UAAM,eAAe,MAAM,KAAK,mBAAmB,OAAO,UAAU;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,IAAI;AACnB,aAAO,SAAS;AAChB,aAAO,aAAa;AACpB,aAAO,mBAAmB;AAC1B,aAAO,gBAAgB;AACvB,aAAO,mBAAmB;AAC1B,YAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,YAAM,0BAA0B,6CAA6C;AAAA,QAC3E,IAAI,OAAO;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,MACnB,CAAU;AACV,YAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,aAAO,EAAE,eAAe,OAAO;AAAA,IACjC;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,aAAa;AACvC,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,aAAa;AAAA,MACrB,iBAAiB,aAAa,YAAY;AAAA,IAC5C,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO,EAAE,eAAe,QAAQ,aAAa,aAAa,YAAY;AAAA,EACxE;AAAA,EAEA,MAAM,SAAS,IAAoC;AACjD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,qCAAqC,OAAO,MAAM,EAAE;AAAA,IACzF;AAEA,WAAO,SAAS;AAChB,WAAO,gBAAgB;AACvB,WAAO,mBAAmB;AAC1B,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,8CAA8C;AAAA,MAC5E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,IACnB,CAAU;AAEV,QAAI,OAAO,gBAAgB;AACzB,YAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAK,OAAO,eAA6C;AAAA,MAC3D,CAAU;AACV,UAAI,UAAU;AACZ,cAAM,mBAAmB,SAAS;AAClC,cAAM,cAAc,SAAS;AAC7B,aAAK,GAAG,OAAO,QAAQ;AACvB,cAAM,KAAK,GAAG,MAAM;AACpB,cAAM,0BAA0B,6CAA6C;AAAA,UAC3E,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB,UAAU,OAAO;AAAA,UACjB,kBAAkB,SAAS;AAAA,UAC3B;AAAA,QACF,CAAU;AACV,cAAM,0BAA0B,4CAA4C;AAAA,UAC1E,IAAI,SAAS;AAAA,UACb,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,UAAU,SAAS;AAAA,QACrB,CAAU;AACV,cAAM,KAAK,mBAAmB,kBAAkB,WAAW;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAY,OAA8C;AACrE,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,KAAc;AAClE,QAAI,CAAC,OAAQ;AAEb,UAAM,WAAW,OAAO;AACxB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,WAAW,OAAO;AAExB,SAAK,GAAG,OAAO,MAAM;AACrB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AACV,UAAM,KAAK,mBAAmB,UAAU,cAAc;AAAA,EACxD;AAAA,EAEA,MAAM,YAAY,IAAoC;AACpD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,wCAAwC,OAAO,MAAM,EAAE;AAAA,IAC5F;AAEA,QAAI,aAA4B;AAChC,aAAS,UAAU,GAAG,UAAU,iCAAiC,QAAQ,WAAW;AAClF,YAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,UAAU,2BAA2B;AACtF,UAAI,OAAO,IAAI;AACb,eAAO,KAAK,SAAS,OAAO,EAAE;AAAA,MAChC;AACA,mBAAa,OAAO,UAAU;AAC9B,UAAI,UAAU,IAAI,iCAAiC,QAAQ;AACzD,cAAM,MAAM,iCAAiC,OAAO,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,cAAc;AACxC,WAAO,iBAAiB,OAAO,iBAAiB,KAAK;AACrD,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAoB,UAAiD;AACjF,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,UAAU,QAAQ,SAAS,CAAU;AACxF,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,IAAI,IAAI,eAAe,CAAU;AACnF,WAAO;AAAA,MACL,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,KAAK,QAAQ;AAAA,MACtB,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,UAAkB,gBAA8C;AAC/F,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AACrE,QAAI,eAAgB,MAAK,KAAK,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAC3E,QAAI;AACF,YAAM,KAAK,MAAM,aAAa,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,UACA,UAQA;AACA,UAAM,kBAAqD,CAAC;AAC5D,UAAM,WAAW,CAAC,eAAyD;AAAA,MACzE,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB,SAAS;AAAA,MAChC;AAAA,MACA,YAAY,WAAW,cAAc;AAAA,MACrC,gBAAgB,WAAW;AAAA,IAC7B;AAGA,QAAI,eAAyB,CAAC;AAC9B,QAAI;AACF,qBAAe,MAAM,KAAK,IAAI,aAAa,QAAQ;AAAA,IACrD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,6BAA8B,IAAc,OAAO;AAAA,QAC3D,aAAa,SAAS;AAAA,UACpB,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,SAAS,aAAc,iBAAgB,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,CAAC;AAEtF,QAAI,SAAS,iBAAiB,aAAa,SAAS,GAAG;AACrD,YAAM,gBAAgB,qBAAqB,SAAS,aAAa,KAAK,SAAS,cAAc,YAAY;AACzG,YAAM,QAAQ,aAAa,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAAK,EAAE,YAAY,OAAO,aAAa;AACrG,UAAI,OAAO;AACT,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,mBAAmB,aAAa,KAAK,IAAI,CAAC,eAAe,SAAS,aAAa;AAAA,QACvF,aAAa,SAAS;AAAA,UACpB,YAAY,wCAAwC,SAAS,aAAa;AAAA,QAC5E,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,WAAqB,CAAC;AAC1B,QAAI;AACF,iBAAW,MAAM,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC7C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,yBAA0B,IAAc,OAAO;AAAA,QACvD,aAAa,SAAS,EAAE,YAAY,8DAA8D,CAAC;AAAA,MACrG;AAAA,IACF;AACA,eAAW,KAAK,UAAU;AACxB,YAAM,QAAQ,YAAY,CAAC;AAC3B,sBAAgB,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,IAC3E;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,kCAAkC,QAAQ;AAAA,QAClD,aAAa,SAAS;AAAA,UACpB,YAAY,SAAS,kBACjB,mDAAmD,SAAS,aAAa,qDAAqD,SAAS,eAAe,+CACtJ,kCAAkC,SAAS,aAAa;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,SAAS,SAAS,eAAe,GAAG;AAC3E,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS,EAAE,YAAY,wCAAwC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,UAAM,iBAAiB,SAAS,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;AACtE,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,QAAQ,MAAM,KAAK,gBAAgB,UAAU,2BAA2B;AAC9E,UAAI,MAAM,MAAM,MAAM,qBAAqB;AACzC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,KAAK;AAAA,YAC7D,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS;AAAA,UACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,MAAM;AAAA,UAC9D,YAAY,SAAS,gBACjB,0EAAqE,SAAS,aAAa,mDAAmD,SAAS,aAAa,MACpK;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,SAAS,kBACb,sBAAsB,SAAS,KAAK,IAAI,CAAC,eAAe,SAAS,eAAe,KAChF,sBAAsB,SAAS,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,SAAS;AAAA,QACpB,YAAY,SAAS,kBACjB,oCAAoC,SAAS,eAAe,MAC5D,2FAA2F,QAAQ,iCAAiC,SAAS,aAAa;AAAA,MAChK,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["import { Resolver, promises as dnsPromises } from 'node:dns'\nimport { request as httpsRequest } from 'node:https'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  DomainMapping,\n  type DomainStatus,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'\n\nconst DOMAIN_ROUTING_TAG = 'domain_routing'\nconst RESOLVE_KEY_PREFIX = 'domain_routing:resolve'\nconst ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'\nconst RESOLVE_TTL_MS = 5 * 60_000\nconst TLS_HEALTH_CHECK_TIMEOUT_MS = 10_000\nconst TLS_HEALTH_CHECK_RETRY_DELAYS_MS = [1_000, 4_000, 16_000]\nconst DEFAULT_DNS_RECHECK_THRESHOLD_MS = 5 * 60_000\nconst DEFAULT_TLS_MAX_RETRIES = 6\n\nexport type ResolveResult = {\n  domainMappingId: string\n  hostname: string\n  tenantId: string\n  organizationId: string\n  orgSlug: string | null\n  status: DomainStatus\n}\n\nexport type DnsDiagnostics = {\n  expectedCnameTarget: string\n  expectedARecordTarget: string | null\n  detectedRecords: Array<{ type: 'CNAME' | 'A'; value: string; proxy?: string }>\n  reverseResolve?: { attempted: boolean; originHeaderPresent: boolean }\n  suggestion: string\n}\n\nexport type VerifyResult = {\n  domainMapping: DomainMapping\n  diagnostics?: DnsDiagnostics\n}\n\nexport type RegisterInput = {\n  hostname: string\n  organizationId: string\n  tenantId: string\n  replacesDomainId?: string\n}\n\ntype CacheService = {\n  get(key: string, options?: unknown): Promise<unknown>\n  set(key: string, value: unknown, options?: { ttl?: number; tags?: string[] }): Promise<void>\n  deleteByTags(tags: string[]): Promise<number>\n}\n\ntype DnsResolverContract = {\n  resolveCname(hostname: string): Promise<string[]>\n  resolve4(hostname: string): Promise<string[]>\n}\n\ntype HealthCheckContract = (hostname: string, timeoutMs: number) => Promise<{\n  ok: boolean\n  originHeaderPresent: boolean\n  reason?: string\n}>\n\nconst defaultDnsResolver: DnsResolverContract = {\n  async resolveCname(hostname) {\n    try {\n      return await dnsPromises.resolveCname(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n  async resolve4(hostname) {\n    try {\n      return await dnsPromises.resolve4(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n}\n\nconst defaultHealthCheck: HealthCheckContract = (hostname, timeoutMs) =>\n  new Promise((resolve) => {\n    const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()\n    const req = httpsRequest(\n      {\n        host: hostname,\n        port: 443,\n        path: '/api/customer_accounts/domain-check',\n        method: 'GET',\n        headers: { 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },\n        timeout: timeoutMs,\n      },\n      (res) => {\n        const headerValue = res.headers[headerName]\n        const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue\n        const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'\n        const status = res.statusCode ?? 0\n        res.resume() // discard body\n        resolve({\n          ok: status >= 200 && status < 400,\n          originHeaderPresent,\n          reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,\n        })\n      },\n    )\n    req.on('timeout', () => {\n      req.destroy(new Error('TLS health check timed out'))\n    })\n    req.on('error', (err) => {\n      resolve({ ok: false, originHeaderPresent: false, reason: (err as Error).message })\n    })\n    req.end()\n  })\n\nexport class DomainMappingService {\n  private cache: CacheService | null\n  private dns: DnsResolverContract\n  private healthCheckImpl: HealthCheckContract\n\n  constructor(\n    private em: EntityManager,\n    deps?: {\n      cacheService?: CacheService\n      dnsResolver?: DnsResolverContract\n      healthCheck?: HealthCheckContract\n    },\n  ) {\n    this.cache = deps?.cacheService ?? null\n    this.dns = deps?.dnsResolver ?? defaultDnsResolver\n    this.healthCheckImpl = deps?.healthCheck ?? defaultHealthCheck\n  }\n\n  // -------------------------------------------------------------------------\n  // Read paths\n  // -------------------------------------------------------------------------\n\n  async findById(id: string, scope?: { tenantId?: string }): Promise<DomainMapping | null> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.findOne(DomainMapping, where as never)\n  }\n\n  async findByOrganization(\n    organizationId: string,\n    scope?: { tenantId?: string },\n  ): Promise<DomainMapping[]> {\n    const where: Record<string, unknown> = { organizationId }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.find(DomainMapping, where as never, { orderBy: { createdAt: 'asc' } })\n  }\n\n  async resolveByHostname(input: string): Promise<ResolveResult | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n\n    const cacheKey = `${RESOLVE_KEY_PREFIX}:${hostname}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as ResolveResult | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const result = await this.lookupResolveResult(hostname)\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`],\n      })\n    }\n    return result\n  }\n\n  async isAllowedForTls(input: string): Promise<{ organizationId: string; status: DomainStatus } | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n    const row = await this.em.findOne(DomainMapping, {\n      hostname,\n      status: { $in: ['active', 'verified'] },\n    } as never)\n    if (!row) return null\n    return { organizationId: row.organizationId, status: row.status }\n  }\n\n  async resolveActiveByOrg(organizationId: string): Promise<{ hostname: string; status: DomainStatus } | null> {\n    const cacheKey = `${ACTIVE_BY_ORG_KEY_PREFIX}:${organizationId}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as { hostname: string; status: DomainStatus } | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const row = await this.em.findOne(DomainMapping, {\n      organizationId,\n      status: 'active',\n    } as never)\n    const result = row ? { hostname: row.hostname, status: row.status } : null\n\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:org:${organizationId}`],\n      })\n    }\n    return result\n  }\n\n  async resolveAll(): Promise<ResolveResult[]> {\n    const rows = await this.em.find(DomainMapping, { status: 'active' } as never)\n    if (rows.length === 0) return []\n    const orgIds = Array.from(new Set(rows.map((r) => r.organizationId)))\n    const orgs = await this.em.find(Organization, { id: { $in: orgIds } } as never)\n    const slugByOrg = new Map<string, string | null>(orgs.map((o) => [o.id, o.slug ?? null]))\n\n    return rows.map<ResolveResult>((row) => ({\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: slugByOrg.get(row.organizationId) ?? null,\n      status: row.status,\n    }))\n  }\n\n  // -------------------------------------------------------------------------\n  // Worker queries\n  // -------------------------------------------------------------------------\n\n  async findPendingVerification(threshold?: { olderThanMs?: number }): Promise<DomainMapping[]> {\n    const olderThan = threshold?.olderThanMs ?? DEFAULT_DNS_RECHECK_THRESHOLD_MS\n    const cutoff = new Date(Date.now() - olderThan)\n    return this.em.find(\n      DomainMapping,\n      {\n        status: { $in: ['pending', 'dns_failed'] },\n        $or: [{ lastDnsCheckAt: null }, { lastDnsCheckAt: { $lt: cutoff } }],\n      } as never,\n      { orderBy: { lastDnsCheckAt: 'asc' } },\n    )\n  }\n\n  async findPendingTls(options?: { maxRetries?: number; batchSize?: number }): Promise<DomainMapping[]> {\n    const maxRetries = options?.maxRetries ?? DEFAULT_TLS_MAX_RETRIES\n    const limit = options?.batchSize ?? 50\n    return this.em.find(\n      DomainMapping,\n      {\n        $or: [\n          { status: 'verified' },\n          { status: 'tls_failed', tlsRetryCount: { $lt: maxRetries } },\n        ],\n      } as never,\n      { orderBy: { updatedAt: 'asc' }, limit },\n    )\n  }\n\n  // -------------------------------------------------------------------------\n  // Write paths\n  // -------------------------------------------------------------------------\n\n  async register(input: RegisterInput): Promise<DomainMapping> {\n    const hostname = normalizeHostname(input.hostname)\n\n    let replacesDomain: DomainMapping | null = null\n    if (input.replacesDomainId) {\n      replacesDomain = await this.em.findOne(DomainMapping, {\n        id: input.replacesDomainId,\n        tenantId: input.tenantId,\n      } as never)\n    }\n\n    const entity = this.em.create(DomainMapping, {\n      hostname,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      replacesDomain: replacesDomain ?? null,\n      provider: 'traefik',\n      status: 'pending',\n      tlsRetryCount: 0,\n      createdAt: new Date(),\n    } as never)\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.created', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      status: entity.status,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n\n    return entity\n  }\n\n  async verify(id: string): Promise<VerifyResult> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n\n    const expectedCname = process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? ''\n    const expectedARecord = process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null\n    const now = new Date()\n    entity.lastDnsCheckAt = now\n\n    const verification = await this.runDnsVerification(entity.hostname, {\n      expectedCname,\n      expectedARecord,\n    })\n\n    if (verification.ok) {\n      entity.status = 'verified'\n      entity.verifiedAt = now\n      entity.dnsFailureReason = null\n      entity.tlsRetryCount = 0\n      entity.tlsFailureReason = null\n      await this.em.persist(entity).flush()\n      await emitCustomerAccountsEvent('customer_accounts.domain_mapping.verified', {\n        id: entity.id,\n        hostname: entity.hostname,\n        organizationId: entity.organizationId,\n        tenantId: entity.tenantId,\n      } as never)\n      await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n      return { domainMapping: entity }\n    }\n\n    entity.status = 'dns_failed'\n    entity.dnsFailureReason = verification.reason\n    await this.em.persist(entity).flush()\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.dns_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: verification.reason,\n      detectedRecords: verification.diagnostics.detectedRecords,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return { domainMapping: entity, diagnostics: verification.diagnostics }\n  }\n\n  async activate(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot transition to active from ${entity.status}`)\n    }\n\n    entity.status = 'active'\n    entity.tlsRetryCount = 0\n    entity.tlsFailureReason = null\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.activated', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n    } as never)\n\n    if (entity.replacesDomain) {\n      const replaced = await this.em.findOne(DomainMapping, {\n        id: (entity.replacesDomain as unknown as { id: string }).id,\n      } as never)\n      if (replaced) {\n        const replacedHostname = replaced.hostname\n        const replacedOrg = replaced.organizationId\n        this.em.remove(replaced)\n        await this.em.flush()\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.replaced', {\n          id: entity.id,\n          hostname: entity.hostname,\n          organizationId: entity.organizationId,\n          tenantId: entity.tenantId,\n          replacedDomainId: replaced.id,\n          replacedHostname,\n        } as never)\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n          id: replaced.id,\n          hostname: replacedHostname,\n          organizationId: replacedOrg,\n          tenantId: replaced.tenantId,\n        } as never)\n        await this.invalidateCacheFor(replacedHostname, replacedOrg)\n      }\n    }\n\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  async remove(id: string, scope?: { tenantId?: string }): Promise<void> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    const entity = await this.em.findOne(DomainMapping, where as never)\n    if (!entity) return\n\n    const hostname = entity.hostname\n    const organizationId = entity.organizationId\n    const tenantId = entity.tenantId\n\n    this.em.remove(entity)\n    await this.em.flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n      id,\n      hostname,\n      organizationId,\n      tenantId,\n    } as never)\n    await this.invalidateCacheFor(hostname, organizationId)\n  }\n\n  async healthCheck(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot run health check from status ${entity.status}`)\n    }\n\n    let lastReason: string | null = null\n    for (let attempt = 0; attempt < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length; attempt++) {\n      const result = await this.healthCheckImpl(entity.hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (result.ok) {\n        return this.activate(entity.id)\n      }\n      lastReason = result.reason ?? 'TLS health check failed'\n      if (attempt + 1 < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length) {\n        await delay(TLS_HEALTH_CHECK_RETRY_DELAYS_MS[attempt])\n      }\n    }\n\n    entity.status = 'tls_failed'\n    entity.tlsFailureReason = lastReason ?? 'TLS health check failed'\n    entity.tlsRetryCount = (entity.tlsRetryCount ?? 0) + 1\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.tls_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: entity.tlsFailureReason,\n      retryCount: entity.tlsRetryCount,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async lookupResolveResult(hostname: string): Promise<ResolveResult | null> {\n    const row = await this.em.findOne(DomainMapping, { hostname, status: 'active' } as never)\n    if (!row) return null\n    const org = await this.em.findOne(Organization, { id: row.organizationId } as never)\n    return {\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: org?.slug ?? null,\n      status: row.status,\n    }\n  }\n\n  private async invalidateCacheFor(hostname: string, organizationId: string | null): Promise<void> {\n    if (!this.cache) return\n    const tags = [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`]\n    if (organizationId) tags.push(`${DOMAIN_ROUTING_TAG}:org:${organizationId}`)\n    try {\n      await this.cache.deleteByTags(tags)\n    } catch {\n      // Cache invalidation is best-effort \u2014 TTL backstop ensures eventual consistency.\n    }\n  }\n\n  private async runDnsVerification(\n    hostname: string,\n    expected: { expectedCname: string; expectedARecord: string | null },\n  ): Promise<\n    | {\n        ok: true\n        method: 'cname' | 'a-record' | 'reverse-resolve'\n        diagnostics: DnsDiagnostics\n      }\n    | { ok: false; reason: string; diagnostics: DnsDiagnostics }\n  > {\n    const detectedRecords: DnsDiagnostics['detectedRecords'] = []\n    const baseDiag = (overrides?: Partial<DnsDiagnostics>): DnsDiagnostics => ({\n      expectedCnameTarget: expected.expectedCname,\n      expectedARecordTarget: expected.expectedARecord,\n      detectedRecords,\n      suggestion: overrides?.suggestion ?? '',\n      reverseResolve: overrides?.reverseResolve,\n    })\n\n    // Phase 1: CNAME\n    let cnameRecords: string[] = []\n    try {\n      cnameRecords = await this.dns.resolveCname(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (CNAME): ${(err as Error).message}`,\n        diagnostics: baseDiag({\n          suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.',\n        }),\n      }\n    }\n    for (const cname of cnameRecords) detectedRecords.push({ type: 'CNAME', value: cname })\n\n    if (expected.expectedCname && cnameRecords.length > 0) {\n      const expectedCname = tryNormalizeHostname(expected.expectedCname) ?? expected.expectedCname.toLowerCase()\n      const match = cnameRecords.some((c) => (tryNormalizeHostname(c) ?? c.toLowerCase()) === expectedCname)\n      if (match) {\n        return {\n          ok: true,\n          method: 'cname',\n          diagnostics: baseDiag({\n            suggestion: 'CNAME record matches the expected target.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: `CNAME points to ${cnameRecords.join(', ')} instead of ${expected.expectedCname}`,\n        diagnostics: baseDiag({\n          suggestion: `Update your CNAME record to point to ${expected.expectedCname}.`,\n        }),\n      }\n    }\n\n    // Phase 2: A record\n    let aRecords: string[] = []\n    try {\n      aRecords = await this.dns.resolve4(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (A): ${(err as Error).message}`,\n        diagnostics: baseDiag({ suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.' }),\n      }\n    }\n    for (const a of aRecords) {\n      const proxy = detectProxy(a)\n      detectedRecords.push({ type: 'A', value: a, ...(proxy ? { proxy } : {}) })\n    }\n\n    if (aRecords.length === 0) {\n      return {\n        ok: false,\n        reason: `No CNAME or A record found for ${hostname}`,\n        diagnostics: baseDiag({\n          suggestion: expected.expectedARecord\n            ? `For a subdomain, add a CNAME record pointing to ${expected.expectedCname}. For an apex domain, add an A record pointing to ${expected.expectedARecord}. DNS propagation can take up to 48 hours.`\n            : `Add a CNAME record pointing to ${expected.expectedCname}. DNS propagation can take up to 48 hours.`,\n        }),\n      }\n    }\n\n    if (expected.expectedARecord && aRecords.includes(expected.expectedARecord)) {\n      return {\n        ok: true,\n        method: 'a-record',\n        diagnostics: baseDiag({ suggestion: 'A record matches the expected target.' }),\n      }\n    }\n\n    // Phase 3: reverse-resolve through proxy\n    const proxiedRecords = aRecords.filter((ip) => isInKnownProxyRange(ip))\n    if (proxiedRecords.length > 0) {\n      const probe = await this.healthCheckImpl(hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (probe.ok && probe.originHeaderPresent) {\n        return {\n          ok: true,\n          method: 'reverse-resolve',\n          diagnostics: baseDiag({\n            reverseResolve: { attempted: true, originHeaderPresent: true },\n            suggestion: 'Domain is proxied \u2014 reverse-resolve confirmed traffic reaches our origin.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: 'A record points to a known proxy IP, but reverse-resolve over HTTPS did not reach our server',\n        diagnostics: baseDiag({\n          reverseResolve: { attempted: true, originHeaderPresent: false },\n          suggestion: expected.expectedCname\n            ? `Your DNS uses a proxy. Either disable the proxy and add a CNAME \u2192 ${expected.expectedCname}, or configure your proxy to forward traffic to ${expected.expectedCname}.`\n            : 'Disable the DNS proxy or configure it to forward traffic to our platform.',\n        }),\n      }\n    }\n\n    return {\n      ok: false,\n      reason: expected.expectedARecord\n        ? `A record points to ${aRecords.join(', ')} instead of ${expected.expectedARecord}`\n        : `A record points to ${aRecords.join(', ')} but apex-domain registration is not enabled on this deployment`,\n      diagnostics: baseDiag({\n        suggestion: expected.expectedARecord\n          ? `Update your A record to point to ${expected.expectedARecord}.`\n          : `Apex-domain registration is not enabled on this deployment. Use a subdomain (e.g., shop.${hostname}) and add a CNAME pointing to ${expected.expectedCname}.`,\n      }),\n    }\n  }\n}\n\n// Re-exported for tests; allow injection of fakes.\nexport const __testing__ = {\n  DEFAULT_DNS_RECHECK_THRESHOLD_MS,\n  DEFAULT_TLS_MAX_RETRIES,\n  TLS_HEALTH_CHECK_RETRY_DELAYS_MS,\n  RESOLVE_TTL_MS,\n  DOMAIN_ROUTING_TAG,\n  defaultHealthCheck,\n  defaultDnsResolver,\n  Resolver,\n}\n"],
+  "mappings": "AAAA,SAAS,UAAU,YAAY,mBAAmB;AAClD,SAAS,WAAW,oBAAoB;AACxC,SAAS,cAAc,aAAa;AAEpC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,uBAAuB;AAChC,SAAS,aAAa,2BAA2B;AAEjD,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,8BAA8B;AACpC,MAAM,mCAAmC,CAAC,KAAO,KAAO,IAAM;AAC9D,MAAM,mCAAmC,IAAI;AAC7C,MAAM,0BAA0B;AAgDhC,MAAM,qBAA0C;AAAA,EAC9C,MAAM,aAAa,UAAU;AAC3B,QAAI;AACF,aAAO,MAAM,YAAY,aAAa,QAAQ;AAAA,IAChD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU;AACvB,QAAI;AACF,aAAO,MAAM,YAAY,SAAS,QAAQ;AAAA,IAC5C,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,qBAA0C,CAAC,UAAU,cACzD,IAAI,QAAQ,CAAC,YAAY;AACvB,QAAM,cAAc,QAAQ,IAAI,iCAAiC,yBAAyB,YAAY;AACtG,QAAM,MAAM;AAAA,IACV;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,EAAE,yBAAyB,QAAQ,IAAI,uBAAuB,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,cAAc,IAAI,QAAQ,UAAU;AAC1C,YAAM,eAAe,MAAM,QAAQ,WAAW,IAAI,YAAY,CAAC,IAAI;AACnE,YAAM,sBAAsB,OAAO,iBAAiB,YAAY,iBAAiB;AACjF,YAAM,SAAS,IAAI,cAAc;AACjC,UAAI,OAAO;AACX,cAAQ;AAAA,QACN,IAAI,UAAU,OAAO,SAAS;AAAA,QAC9B;AAAA,QACA,QAAQ,UAAU,OAAO,SAAS,MAAM,SAAY,QAAQ,MAAM;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,GAAG,WAAW,MAAM;AACtB,QAAI,QAAQ,IAAI,MAAM,4BAA4B,CAAC;AAAA,EACrD,CAAC;AACD,MAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,YAAQ,EAAE,IAAI,OAAO,qBAAqB,OAAO,QAAS,IAAc,QAAQ,CAAC;AAAA,EACnF,CAAC;AACD,MAAI,IAAI;AACV,CAAC;AAEI,MAAM,qBAAqB;AAAA,EAKhC,YACU,IACR,MAKA;AANQ;AAOR,SAAK,QAAQ,MAAM,gBAAgB;AACnC,SAAK,MAAM,MAAM,eAAe;AAChC,SAAK,kBAAkB,MAAM,eAAe;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,IAAY,OAA8D;AACvF,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,QAAQ,eAAe,KAAc;AAAA,EACtD;AAAA,EAEA,MAAM,mBACJ,gBACA,OAC0B;AAC1B,UAAM,QAAiC,EAAE,eAAe;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,KAAK,eAAe,OAAgB,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,kBAAkB,OAA8C;AACpE,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AAEjD,UAAM,WAAW,GAAG,kBAAkB,IAAI,QAAQ;AAClD,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AAAA,MAChE,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,OAAiF;AACrG,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AACjD,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,UAAU,UAAU,EAAE;AAAA,IACxC,CAAU;AACV,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,EAAE,gBAAgB,IAAI,gBAAgB,QAAQ,IAAI,OAAO;AAAA,EAClE;AAAA,EAEA,MAAM,mBAAmB,gBAAoF;AAC3G,UAAM,WAAW,GAAG,wBAAwB,IAAI,cAAc;AAC9D,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ;AAAA,IACV,CAAU;AACV,UAAM,SAAS,MAAM,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,IAAI;AAEtE,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAAA,MAC1E,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAuC;AAC3C,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,eAAe,EAAE,QAAQ,SAAS,CAAU;AAC5E,QAAI,KAAK,WAAW,EAAG,QAAO,CAAC;AAC/B,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACpE,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAU;AAC9E,UAAM,YAAY,IAAI,IAA2B,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;AAExF,WAAO,KAAK,IAAmB,CAAC,SAAS;AAAA,MACvC,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,UAAU,IAAI,IAAI,cAAc,KAAK;AAAA,MAC9C,QAAQ,IAAI;AAAA,IACd,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,wBAAwB,WAAgE;AAC5F,UAAM,YAAY,WAAW,eAAe;AAC5C,UAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;AAC9C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,EAAE;AAAA,QACzC,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,CAAC;AAAA,MACrE;AAAA,MACA,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAiF;AACpG,UAAM,aAAa,SAAS,cAAc;AAC1C,UAAM,QAAQ,SAAS,aAAa;AACpC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,KAAK;AAAA,UACH,EAAE,QAAQ,WAAW;AAAA,UACrB,EAAE,QAAQ,cAAc,eAAe,EAAE,KAAK,WAAW,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,GAAG,MAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAA8C;AAC3D,UAAM,WAAW,kBAAkB,MAAM,QAAQ;AAEjD,QAAI,iBAAuC;AAC3C,QAAI,MAAM,kBAAkB;AAC1B,uBAAiB,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,MAClB,CAAU;AAAA,IACZ;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,eAAe;AAAA,MAC3C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAU;AACV,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AAEpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAmC;AAC9C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAE5D,UAAM,gBAAgB,QAAQ,IAAI,8BAA8B;AAChE,UAAM,kBAAkB,QAAQ,IAAI,iCAAiC;AACrE,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,iBAAiB;AAExB,UAAM,eAAe,MAAM,KAAK,mBAAmB,OAAO,UAAU;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,IAAI;AACnB,aAAO,SAAS;AAChB,aAAO,aAAa;AACpB,aAAO,mBAAmB;AAC1B,aAAO,gBAAgB;AACvB,aAAO,mBAAmB;AAC1B,YAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,YAAM,0BAA0B,6CAA6C;AAAA,QAC3E,IAAI,OAAO;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,MACnB,CAAU;AACV,YAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,aAAO,EAAE,eAAe,OAAO;AAAA,IACjC;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,aAAa;AACvC,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,aAAa;AAAA,MACrB,iBAAiB,aAAa,YAAY;AAAA,IAC5C,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO,EAAE,eAAe,QAAQ,aAAa,aAAa,YAAY;AAAA,EACxE;AAAA,EAEA,MAAM,SAAS,IAAoC;AACjD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,qCAAqC,OAAO,MAAM,EAAE;AAAA,IACzF;AAEA,WAAO,SAAS;AAChB,WAAO,gBAAgB;AACvB,WAAO,mBAAmB;AAC1B,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,8CAA8C;AAAA,MAC5E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,IACnB,CAAU;AAEV,QAAI,OAAO,gBAAgB;AACzB,YAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAK,OAAO,eAA6C;AAAA,MAC3D,CAAU;AACV,UAAI,UAAU;AACZ,cAAM,mBAAmB,SAAS;AAClC,cAAM,cAAc,SAAS;AAC7B,aAAK,GAAG,OAAO,QAAQ;AACvB,cAAM,KAAK,GAAG,MAAM;AACpB,cAAM,0BAA0B,6CAA6C;AAAA,UAC3E,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB,UAAU,OAAO;AAAA,UACjB,kBAAkB,SAAS;AAAA,UAC3B;AAAA,QACF,CAAU;AACV,cAAM,0BAA0B,4CAA4C;AAAA,UAC1E,IAAI,SAAS;AAAA,UACb,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,UAAU,SAAS;AAAA,QACrB,CAAU;AACV,cAAM,KAAK,mBAAmB,kBAAkB,WAAW;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAY,OAA8C;AACrE,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,KAAc;AAClE,QAAI,CAAC,OAAQ;AAEb,UAAM,WAAW,OAAO;AACxB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,WAAW,OAAO;AAExB,SAAK,GAAG,OAAO,MAAM;AACrB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AACV,UAAM,KAAK,mBAAmB,UAAU,cAAc;AAAA,EACxD;AAAA,EAEA,MAAM,YAAY,IAAoC;AACpD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,wCAAwC,OAAO,MAAM,EAAE;AAAA,IAC5F;AAEA,QAAI,aAA4B;AAChC,aAAS,UAAU,GAAG,UAAU,iCAAiC,QAAQ,WAAW;AAClF,YAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,UAAU,2BAA2B;AACtF,UAAI,OAAO,IAAI;AACb,eAAO,KAAK,SAAS,OAAO,EAAE;AAAA,MAChC;AACA,mBAAa,OAAO,UAAU;AAC9B,UAAI,UAAU,IAAI,iCAAiC,QAAQ;AACzD,cAAM,MAAM,iCAAiC,OAAO,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,cAAc;AACxC,WAAO,iBAAiB,OAAO,iBAAiB,KAAK;AACrD,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAoB,UAAiD;AACjF,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,UAAU,QAAQ,SAAS,CAAU;AACxF,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,IAAI,IAAI,eAAe,CAAU;AACnF,WAAO;AAAA,MACL,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,KAAK,QAAQ;AAAA,MACtB,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,UAAkB,gBAA8C;AAC/F,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AACrE,QAAI,eAAgB,MAAK,KAAK,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAC3E,QAAI;AACF,YAAM,KAAK,MAAM,aAAa,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,UACA,UAQA;AACA,UAAM,kBAAqD,CAAC;AAC5D,UAAM,WAAW,CAAC,eAAyD;AAAA,MACzE,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB,SAAS;AAAA,MAChC;AAAA,MACA,YAAY,WAAW,cAAc;AAAA,MACrC,gBAAgB,WAAW;AAAA,IAC7B;AAGA,QAAI,eAAyB,CAAC;AAC9B,QAAI;AACF,qBAAe,MAAM,KAAK,IAAI,aAAa,QAAQ;AAAA,IACrD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,6BAA8B,IAAc,OAAO;AAAA,QAC3D,aAAa,SAAS;AAAA,UACpB,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,SAAS,aAAc,iBAAgB,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,CAAC;AAEtF,QAAI,SAAS,iBAAiB,aAAa,SAAS,GAAG;AACrD,YAAM,gBAAgB,qBAAqB,SAAS,aAAa,KAAK,SAAS,cAAc,YAAY;AACzG,YAAM,QAAQ,aAAa,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAAK,EAAE,YAAY,OAAO,aAAa;AACrG,UAAI,OAAO;AACT,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,mBAAmB,aAAa,KAAK,IAAI,CAAC,eAAe,SAAS,aAAa;AAAA,QACvF,aAAa,SAAS;AAAA,UACpB,YAAY,wCAAwC,SAAS,aAAa;AAAA,QAC5E,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,WAAqB,CAAC;AAC1B,QAAI;AACF,iBAAW,MAAM,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC7C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,yBAA0B,IAAc,OAAO;AAAA,QACvD,aAAa,SAAS,EAAE,YAAY,8DAA8D,CAAC;AAAA,MACrG;AAAA,IACF;AACA,eAAW,KAAK,UAAU;AACxB,YAAM,QAAQ,YAAY,CAAC;AAC3B,sBAAgB,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,IAC3E;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,kCAAkC,QAAQ;AAAA,QAClD,aAAa,SAAS;AAAA,UACpB,YAAY,SAAS,kBACjB,mDAAmD,SAAS,aAAa,qDAAqD,SAAS,eAAe,+CACtJ,kCAAkC,SAAS,aAAa;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,SAAS,SAAS,eAAe,GAAG;AAC3E,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS,EAAE,YAAY,wCAAwC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,UAAM,iBAAiB,SAAS,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;AACtE,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,QAAQ,MAAM,KAAK,gBAAgB,UAAU,2BAA2B;AAC9E,UAAI,MAAM,MAAM,MAAM,qBAAqB;AACzC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,KAAK;AAAA,YAC7D,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS;AAAA,UACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,MAAM;AAAA,UAC9D,YAAY,SAAS,gBACjB,0EAAqE,SAAS,aAAa,mDAAmD,SAAS,aAAa,MACpK;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,SAAS,kBACb,sBAAsB,SAAS,KAAK,IAAI,CAAC,eAAe,SAAS,eAAe,KAChF,sBAAsB,SAAS,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,SAAS;AAAA,QACpB,YAAY,SAAS,kBACjB,oCAAoC,SAAS,eAAe,MAC5D,2FAA2F,QAAQ,iCAAiC,SAAS,aAAa;AAAA,MAChK,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/modules/customers/ai-tools/companies-pack.js

@@ -18,7 +18,7 @@ const listCompaniesInput = z.object({
 const listCompaniesTool = defineApiBackedAiTool({
   name: "customers.list_companies",
   displayName: "List companies",
-  description: 'Search / list companies for the caller tenant + organization. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor ("at least N", render it as "N+"), and pagination is exhausted only when a page returns fewer than limit items \u2014 never when offset reaches total.',
+  description: "Search / list companies for the caller tenant + organization. Returns { items, total, limit, offset }.",
   inputSchema: listCompaniesInput,
   requiredFeatures: ["customers.companies.view"],
   toOperation: (input, ctx) => {
@@ -53,9 +53,6 @@ const listCompaniesTool = defineApiBackedAiTool({
         sizeBucket: row.size_bucket ?? row.sizeBucket ?? null
       })),
       total: typeof data.total === "number" ? data.total : 0,
-      // A capped count reports a floor: phrase the total as "at least N" and
-      // never treat it as proof that pagination is exhausted.
-      totalIsCapped: data.totalIsCapped === true,
       limit,
       offset
     };

package/dist/modules/customers/ai-tools/companies-pack.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/ai-tools/companies-pack.ts"],
-  "sourcesContent": ["/**\n * `customers.list_companies` + `customers.get_company` (Phase 1 WS-C, Step 3.9).\n *\n * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:\n * `customers.list_companies` is now an API-backed wrapper over\n * `GET /api/customers/companies`. Tool name, schema, requiredFeatures, and\n * output shape are unchanged.\n *\n * Phase 3c of the same spec migrates `customers.get_company` to a single\n * in-process call to `GET /api/customers/companies/<id>?include=...` over the\n * documented aggregate detail route. Tool name, schema, requiredFeatures, and\n * output shape are unchanged.\n */\nimport { z } from 'zod'\nimport { defineApiBackedAiTool } from '@open-mercato/ai-assistant/modules/ai_assistant/lib/api-backed-tool'\nimport {\n  createAiApiOperationRunner,\n  type AiApiOperationRequest,\n  type AiToolExecutionContext,\n} from '@open-mercato/ai-assistant/modules/ai_assistant/lib/ai-api-operation-runner'\nimport { assertTenantScope, type CustomersAiToolDefinition, type CustomersToolContext } from './types'\nimport {\n  buildRelatedRecords,\n  toCustomerListSummary,\n  toIso,\n  type CustomerRelatedRecords,\n} from './_shared'\n\nconst listCompaniesInput = z\n  .object({\n    q: z.string().trim().optional().describe('Search text matched against display name / email / domain. Omit or leave empty to list all.'),\n    limit: z.number().int().min(1).max(100).optional().describe('Maximum rows to return (default 50, max 100).'),\n    offset: z.number().int().min(0).optional().describe('Number of rows to skip (default 0).'),\n    tags: z.array(z.string().uuid()).optional().describe('Restrict to companies carrying at least one of these tag ids.'),\n  })\n  .passthrough()\n\ntype ListCompaniesInput = z.infer<typeof listCompaniesInput>\n\ntype ListCompaniesApiItem = {\n  id?: string\n  display_name?: string | null\n  displayName?: string | null\n  primary_email?: string | null\n  primaryEmail?: string | null\n  primary_phone?: string | null\n  primaryPhone?: string | null\n  status?: string | null\n  lifecycle_stage?: string | null\n  lifecycleStage?: string | null\n  source?: string | null\n  owner_user_id?: string | null\n  ownerUserId?: string | null\n  organization_id?: string | null\n  organizationId?: string | null\n  tenant_id?: string | null\n  tenantId?: string | null\n  domain?: string | null\n  website_url?: string | null\n  websiteUrl?: string | null\n  industry?: string | null\n  size_bucket?: string | null\n  sizeBucket?: string | null\n  created_at?: string | null\n  createdAt?: string | null\n}\n\ntype ListCompaniesApiResponse = {\n  items?: ListCompaniesApiItem[]\n  total?: number\n}\n\ntype ListCompaniesOutput = {\n  items: Array<Record<string, unknown>>\n  total: number\n  limit: number\n  offset: number\n}\n\nconst listCompaniesTool = defineApiBackedAiTool<\n  ListCompaniesInput,\n  ListCompaniesApiResponse,\n  ListCompaniesOutput\n>({\n  name: 'customers.list_companies',\n  displayName: 'List companies',\n  description:\n    'Search / list companies for the caller tenant + organization. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor (\"at least N\", render it as \"N+\"), and pagination is exhausted only when a page returns fewer than limit items \u2014 never when offset reaches total.',\n  inputSchema: listCompaniesInput,\n  requiredFeatures: ['customers.companies.view'],\n  toOperation: (input, ctx) => {\n    assertTenantScope(ctx as unknown as CustomersToolContext)\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const page = Math.floor(offset / limit) + 1\n\n    const query: Record<string, string | number | boolean | null | undefined> = {\n      page,\n      pageSize: limit,\n    }\n    if (input.q?.trim()) query.search = input.q.trim()\n    if (input.tags && input.tags.length > 0) query.tagIds = input.tags.join(',')\n\n    const operation: AiApiOperationRequest = {\n      method: 'GET',\n      path: '/customers/companies',\n      query,\n    }\n    return operation\n  },\n  mapResponse: (response, input) => {\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const data = (response.data ?? {}) as ListCompaniesApiResponse\n    const rawItems: ListCompaniesApiItem[] = Array.isArray(data.items) ? data.items : []\n    return {\n      items: rawItems.map((row) => ({\n        ...toCustomerListSummary(row),\n        domain: row.domain ?? null,\n        websiteUrl: row.website_url ?? row.websiteUrl ?? null,\n        industry: row.industry ?? null,\n        sizeBucket: row.size_bucket ?? row.sizeBucket ?? null,\n      })),\n      total: typeof data.total === 'number' ? data.total : 0,\n      // A capped count reports a floor: phrase the total as \"at least N\" and\n      // never treat it as proof that pagination is exhausted.\n      totalIsCapped: (data as { totalIsCapped?: boolean }).totalIsCapped === true,\n      limit,\n      offset,\n    }\n  },\n}) as unknown as CustomersAiToolDefinition\n\nconst getCompanyInput = z.object({\n  companyId: z.string().uuid().describe('Company entity id (UUID).'),\n  includeRelated: z\n    .boolean()\n    .optional()\n    .describe('When true, include notes, activities, deals, people, addresses, tasks, and tags (each capped at 100).'),\n})\n\ntype GetCompanyInput = z.infer<typeof getCompanyInput>\n\nconst getCompanyTool: CustomersAiToolDefinition = {\n  name: 'customers.get_company',\n  displayName: 'Get company',\n  description:\n    'Fetch a company customer record by id with profile fields and (optionally) notes, activities, deals, people, addresses, tasks, tags, and custom fields. Returns { found: false } when outside tenant/org scope.',\n  inputSchema: getCompanyInput,\n  requiredFeatures: ['customers.companies.view'],\n  tags: ['read', 'customers'],\n  handler: async (rawInput, ctx) => {\n    const { tenantId: _tenantId } = assertTenantScope(ctx)\n    void _tenantId\n    const input: GetCompanyInput = getCompanyInput.parse(rawInput)\n    const includeRelated = !!input.includeRelated\n\n    const operation: AiApiOperationRequest = {\n      method: 'GET',\n      path: `/customers/companies/${input.companyId}`,\n    }\n    if (includeRelated) {\n      operation.query = {\n        include: 'addresses,comments,activities,interactions,deals,todos,people',\n      }\n    }\n\n    const runner = createAiApiOperationRunner(ctx as unknown as AiToolExecutionContext)\n    const response = await runner.run<Record<string, unknown>>(operation)\n    if (!response.success) {\n      if (response.statusCode === 404 || response.statusCode === 403) {\n        return { found: false as const, companyId: input.companyId }\n      }\n      throw new Error(response.error ?? `Failed to fetch company ${input.companyId}`)\n    }\n    const data = (response.data ?? {}) as Record<string, unknown>\n    const companyRow = (data.company ?? null) as Record<string, unknown> | null\n    if (!companyRow) {\n      return { found: false as const, companyId: input.companyId }\n    }\n    const profileRow = (data.profile ?? null) as Record<string, unknown> | null\n    const customFields = (data.customFields ?? {}) as Record<string, unknown>\n\n    let related: CustomerRelatedRecords | null = null\n    if (includeRelated) {\n      related = buildRelatedRecords(data, { includePeople: true })\n    }\n    return {\n      found: true as const,\n      company: {\n        id: companyRow.id,\n        displayName: companyRow.displayName ?? null,\n        description: companyRow.description ?? null,\n        primaryEmail: companyRow.primaryEmail ?? null,\n        primaryPhone: companyRow.primaryPhone ?? null,\n        status: companyRow.status ?? null,\n        lifecycleStage: companyRow.lifecycleStage ?? null,\n        source: companyRow.source ?? null,\n        ownerUserId: companyRow.ownerUserId ?? null,\n        organizationId: companyRow.organizationId ?? null,\n        tenantId: companyRow.tenantId ?? null,\n        createdAt: toIso(companyRow.createdAt),\n        updatedAt: toIso(companyRow.updatedAt),\n      },\n      profile: profileRow\n        ? {\n            id: profileRow.id,\n            legalName: profileRow.legalName ?? null,\n            brandName: profileRow.brandName ?? null,\n            domain: profileRow.domain ?? null,\n            websiteUrl: profileRow.websiteUrl ?? null,\n            industry: profileRow.industry ?? null,\n            sizeBucket: profileRow.sizeBucket ?? null,\n            annualRevenue: profileRow.annualRevenue ?? null,\n          }\n        : null,\n      customFields,\n      related,\n    }\n  },\n}\n\nexport const companiesAiTools: CustomersAiToolDefinition[] = [listCompaniesTool, getCompanyTool]\n\nexport default companiesAiTools\n"],
-  "mappings": "AAaA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,yBAAoF;AAC7F;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,qBAAqB,EACxB,OAAO;AAAA,EACN,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,6FAA6F;AAAA,EACtI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,+CAA+C;AAAA,EAC3G,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACzF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,+DAA+D;AACtH,CAAC,EACA,YAAY;AA4Cf,MAAM,oBAAoB,sBAIxB;AAAA,EACA,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,aAAa,CAAC,OAAO,QAAQ;AAC3B,sBAAkB,GAAsC;AACxD,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAO,KAAK,MAAM,SAAS,KAAK,IAAI;AAE1C,UAAM,QAAsE;AAAA,MAC1E;AAAA,MACA,UAAU;AAAA,IACZ;AACA,QAAI,MAAM,GAAG,KAAK,EAAG,OAAM,SAAS,MAAM,EAAE,KAAK;AACjD,QAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EAAG,OAAM,SAAS,MAAM,KAAK,KAAK,GAAG;AAE3E,UAAM,YAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,aAAa,CAAC,UAAU,UAAU;AAChC,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAQ,SAAS,QAAQ,CAAC;AAChC,UAAM,WAAmC,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AACnF,WAAO;AAAA,MACL,OAAO,SAAS,IAAI,CAAC,SAAS;AAAA,QAC5B,GAAG,sBAAsB,GAAG;AAAA,QAC5B,QAAQ,IAAI,UAAU;AAAA,QACtB,YAAY,IAAI,eAAe,IAAI,cAAc;AAAA,QACjD,UAAU,IAAI,YAAY;AAAA,QAC1B,YAAY,IAAI,eAAe,IAAI,cAAc;AAAA,MACnD,EAAE;AAAA,MACF,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAAA;AAAA;AAAA,MAGrD,eAAgB,KAAqC,kBAAkB;AAAA,MACvE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,2BAA2B;AAAA,EACjE,gBAAgB,EACb,QAAQ,EACR,SAAS,EACT,SAAS,uGAAuG;AACrH,CAAC;AAID,MAAM,iBAA4C;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,MAAM,CAAC,QAAQ,WAAW;AAAA,EAC1B,SAAS,OAAO,UAAU,QAAQ;AAChC,UAAM,EAAE,UAAU,UAAU,IAAI,kBAAkB,GAAG;AACrD,SAAK;AACL,UAAM,QAAyB,gBAAgB,MAAM,QAAQ;AAC7D,UAAM,iBAAiB,CAAC,CAAC,MAAM;AAE/B,UAAM,YAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM,wBAAwB,MAAM,SAAS;AAAA,IAC/C;AACA,QAAI,gBAAgB;AAClB,gBAAU,QAAQ;AAAA,QAChB,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS,2BAA2B,GAAwC;AAClF,UAAM,WAAW,MAAM,OAAO,IAA6B,SAAS;AACpE,QAAI,CAAC,SAAS,SAAS;AACrB,UAAI,SAAS,eAAe,OAAO,SAAS,eAAe,KAAK;AAC9D,eAAO,EAAE,OAAO,OAAgB,WAAW,MAAM,UAAU;AAAA,MAC7D;AACA,YAAM,IAAI,MAAM,SAAS,SAAS,2BAA2B,MAAM,SAAS,EAAE;AAAA,IAChF;AACA,UAAM,OAAQ,SAAS,QAAQ,CAAC;AAChC,UAAM,aAAc,KAAK,WAAW;AACpC,QAAI,CAAC,YAAY;AACf,aAAO,EAAE,OAAO,OAAgB,WAAW,MAAM,UAAU;AAAA,IAC7D;AACA,UAAM,aAAc,KAAK,WAAW;AACpC,UAAM,eAAgB,KAAK,gBAAgB,CAAC;AAE5C,QAAI,UAAyC;AAC7C,QAAI,gBAAgB;AAClB,gBAAU,oBAAoB,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IAC7D;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,SAAS;AAAA,QACP,IAAI,WAAW;AAAA,QACf,aAAa,WAAW,eAAe;AAAA,QACvC,aAAa,WAAW,eAAe;AAAA,QACvC,cAAc,WAAW,gBAAgB;AAAA,QACzC,cAAc,WAAW,gBAAgB;AAAA,QACzC,QAAQ,WAAW,UAAU;AAAA,QAC7B,gBAAgB,WAAW,kBAAkB;AAAA,QAC7C,QAAQ,WAAW,UAAU;AAAA,QAC7B,aAAa,WAAW,eAAe;AAAA,QACvC,gBAAgB,WAAW,kBAAkB;AAAA,QAC7C,UAAU,WAAW,YAAY;AAAA,QACjC,WAAW,MAAM,WAAW,SAAS;AAAA,QACrC,WAAW,MAAM,WAAW,SAAS;AAAA,MACvC;AAAA,MACA,SAAS,aACL;AAAA,QACE,IAAI,WAAW;AAAA,QACf,WAAW,WAAW,aAAa;AAAA,QACnC,WAAW,WAAW,aAAa;AAAA,QACnC,QAAQ,WAAW,UAAU;AAAA,QAC7B,YAAY,WAAW,cAAc;AAAA,QACrC,UAAU,WAAW,YAAY;AAAA,QACjC,YAAY,WAAW,cAAc;AAAA,QACrC,eAAe,WAAW,iBAAiB;AAAA,MAC7C,IACA;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mBAAgD,CAAC,mBAAmB,cAAc;AAE/F,IAAO,yBAAQ;",
+  "sourcesContent": ["/**\n * `customers.list_companies` + `customers.get_company` (Phase 1 WS-C, Step 3.9).\n *\n * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:\n * `customers.list_companies` is now an API-backed wrapper over\n * `GET /api/customers/companies`. Tool name, schema, requiredFeatures, and\n * output shape are unchanged.\n *\n * Phase 3c of the same spec migrates `customers.get_company` to a single\n * in-process call to `GET /api/customers/companies/<id>?include=...` over the\n * documented aggregate detail route. Tool name, schema, requiredFeatures, and\n * output shape are unchanged.\n */\nimport { z } from 'zod'\nimport { defineApiBackedAiTool } from '@open-mercato/ai-assistant/modules/ai_assistant/lib/api-backed-tool'\nimport {\n  createAiApiOperationRunner,\n  type AiApiOperationRequest,\n  type AiToolExecutionContext,\n} from '@open-mercato/ai-assistant/modules/ai_assistant/lib/ai-api-operation-runner'\nimport { assertTenantScope, type CustomersAiToolDefinition, type CustomersToolContext } from './types'\nimport {\n  buildRelatedRecords,\n  toCustomerListSummary,\n  toIso,\n  type CustomerRelatedRecords,\n} from './_shared'\n\nconst listCompaniesInput = z\n  .object({\n    q: z.string().trim().optional().describe('Search text matched against display name / email / domain. Omit or leave empty to list all.'),\n    limit: z.number().int().min(1).max(100).optional().describe('Maximum rows to return (default 50, max 100).'),\n    offset: z.number().int().min(0).optional().describe('Number of rows to skip (default 0).'),\n    tags: z.array(z.string().uuid()).optional().describe('Restrict to companies carrying at least one of these tag ids.'),\n  })\n  .passthrough()\n\ntype ListCompaniesInput = z.infer<typeof listCompaniesInput>\n\ntype ListCompaniesApiItem = {\n  id?: string\n  display_name?: string | null\n  displayName?: string | null\n  primary_email?: string | null\n  primaryEmail?: string | null\n  primary_phone?: string | null\n  primaryPhone?: string | null\n  status?: string | null\n  lifecycle_stage?: string | null\n  lifecycleStage?: string | null\n  source?: string | null\n  owner_user_id?: string | null\n  ownerUserId?: string | null\n  organization_id?: string | null\n  organizationId?: string | null\n  tenant_id?: string | null\n  tenantId?: string | null\n  domain?: string | null\n  website_url?: string | null\n  websiteUrl?: string | null\n  industry?: string | null\n  size_bucket?: string | null\n  sizeBucket?: string | null\n  created_at?: string | null\n  createdAt?: string | null\n}\n\ntype ListCompaniesApiResponse = {\n  items?: ListCompaniesApiItem[]\n  total?: number\n}\n\ntype ListCompaniesOutput = {\n  items: Array<Record<string, unknown>>\n  total: number\n  limit: number\n  offset: number\n}\n\nconst listCompaniesTool = defineApiBackedAiTool<\n  ListCompaniesInput,\n  ListCompaniesApiResponse,\n  ListCompaniesOutput\n>({\n  name: 'customers.list_companies',\n  displayName: 'List companies',\n  description:\n    'Search / list companies for the caller tenant + organization. Returns { items, total, limit, offset }.',\n  inputSchema: listCompaniesInput,\n  requiredFeatures: ['customers.companies.view'],\n  toOperation: (input, ctx) => {\n    assertTenantScope(ctx as unknown as CustomersToolContext)\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const page = Math.floor(offset / limit) + 1\n\n    const query: Record<string, string | number | boolean | null | undefined> = {\n      page,\n      pageSize: limit,\n    }\n    if (input.q?.trim()) query.search = input.q.trim()\n    if (input.tags && input.tags.length > 0) query.tagIds = input.tags.join(',')\n\n    const operation: AiApiOperationRequest = {\n      method: 'GET',\n      path: '/customers/companies',\n      query,\n    }\n    return operation\n  },\n  mapResponse: (response, input) => {\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const data = (response.data ?? {}) as ListCompaniesApiResponse\n    const rawItems: ListCompaniesApiItem[] = Array.isArray(data.items) ? data.items : []\n    return {\n      items: rawItems.map((row) => ({\n        ...toCustomerListSummary(row),\n        domain: row.domain ?? null,\n        websiteUrl: row.website_url ?? row.websiteUrl ?? null,\n        industry: row.industry ?? null,\n        sizeBucket: row.size_bucket ?? row.sizeBucket ?? null,\n      })),\n      total: typeof data.total === 'number' ? data.total : 0,\n      limit,\n      offset,\n    }\n  },\n}) as unknown as CustomersAiToolDefinition\n\nconst getCompanyInput = z.object({\n  companyId: z.string().uuid().describe('Company entity id (UUID).'),\n  includeRelated: z\n    .boolean()\n    .optional()\n    .describe('When true, include notes, activities, deals, people, addresses, tasks, and tags (each capped at 100).'),\n})\n\ntype GetCompanyInput = z.infer<typeof getCompanyInput>\n\nconst getCompanyTool: CustomersAiToolDefinition = {\n  name: 'customers.get_company',\n  displayName: 'Get company',\n  description:\n    'Fetch a company customer record by id with profile fields and (optionally) notes, activities, deals, people, addresses, tasks, tags, and custom fields. Returns { found: false } when outside tenant/org scope.',\n  inputSchema: getCompanyInput,\n  requiredFeatures: ['customers.companies.view'],\n  tags: ['read', 'customers'],\n  handler: async (rawInput, ctx) => {\n    const { tenantId: _tenantId } = assertTenantScope(ctx)\n    void _tenantId\n    const input: GetCompanyInput = getCompanyInput.parse(rawInput)\n    const includeRelated = !!input.includeRelated\n\n    const operation: AiApiOperationRequest = {\n      method: 'GET',\n      path: `/customers/companies/${input.companyId}`,\n    }\n    if (includeRelated) {\n      operation.query = {\n        include: 'addresses,comments,activities,interactions,deals,todos,people',\n      }\n    }\n\n    const runner = createAiApiOperationRunner(ctx as unknown as AiToolExecutionContext)\n    const response = await runner.run<Record<string, unknown>>(operation)\n    if (!response.success) {\n      if (response.statusCode === 404 || response.statusCode === 403) {\n        return { found: false as const, companyId: input.companyId }\n      }\n      throw new Error(response.error ?? `Failed to fetch company ${input.companyId}`)\n    }\n    const data = (response.data ?? {}) as Record<string, unknown>\n    const companyRow = (data.company ?? null) as Record<string, unknown> | null\n    if (!companyRow) {\n      return { found: false as const, companyId: input.companyId }\n    }\n    const profileRow = (data.profile ?? null) as Record<string, unknown> | null\n    const customFields = (data.customFields ?? {}) as Record<string, unknown>\n\n    let related: CustomerRelatedRecords | null = null\n    if (includeRelated) {\n      related = buildRelatedRecords(data, { includePeople: true })\n    }\n    return {\n      found: true as const,\n      company: {\n        id: companyRow.id,\n        displayName: companyRow.displayName ?? null,\n        description: companyRow.description ?? null,\n        primaryEmail: companyRow.primaryEmail ?? null,\n        primaryPhone: companyRow.primaryPhone ?? null,\n        status: companyRow.status ?? null,\n        lifecycleStage: companyRow.lifecycleStage ?? null,\n        source: companyRow.source ?? null,\n        ownerUserId: companyRow.ownerUserId ?? null,\n        organizationId: companyRow.organizationId ?? null,\n        tenantId: companyRow.tenantId ?? null,\n        createdAt: toIso(companyRow.createdAt),\n        updatedAt: toIso(companyRow.updatedAt),\n      },\n      profile: profileRow\n        ? {\n            id: profileRow.id,\n            legalName: profileRow.legalName ?? null,\n            brandName: profileRow.brandName ?? null,\n            domain: profileRow.domain ?? null,\n            websiteUrl: profileRow.websiteUrl ?? null,\n            industry: profileRow.industry ?? null,\n            sizeBucket: profileRow.sizeBucket ?? null,\n            annualRevenue: profileRow.annualRevenue ?? null,\n          }\n        : null,\n      customFields,\n      related,\n    }\n  },\n}\n\nexport const companiesAiTools: CustomersAiToolDefinition[] = [listCompaniesTool, getCompanyTool]\n\nexport default companiesAiTools\n"],
+  "mappings": "AAaA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,yBAAoF;AAC7F;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,qBAAqB,EACxB,OAAO;AAAA,EACN,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,6FAA6F;AAAA,EACtI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,+CAA+C;AAAA,EAC3G,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACzF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,+DAA+D;AACtH,CAAC,EACA,YAAY;AA4Cf,MAAM,oBAAoB,sBAIxB;AAAA,EACA,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,aAAa,CAAC,OAAO,QAAQ;AAC3B,sBAAkB,GAAsC;AACxD,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAO,KAAK,MAAM,SAAS,KAAK,IAAI;AAE1C,UAAM,QAAsE;AAAA,MAC1E;AAAA,MACA,UAAU;AAAA,IACZ;AACA,QAAI,MAAM,GAAG,KAAK,EAAG,OAAM,SAAS,MAAM,EAAE,KAAK;AACjD,QAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EAAG,OAAM,SAAS,MAAM,KAAK,KAAK,GAAG;AAE3E,UAAM,YAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,aAAa,CAAC,UAAU,UAAU;AAChC,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAQ,SAAS,QAAQ,CAAC;AAChC,UAAM,WAAmC,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AACnF,WAAO;AAAA,MACL,OAAO,SAAS,IAAI,CAAC,SAAS;AAAA,QAC5B,GAAG,sBAAsB,GAAG;AAAA,QAC5B,QAAQ,IAAI,UAAU;AAAA,QACtB,YAAY,IAAI,eAAe,IAAI,cAAc;AAAA,QACjD,UAAU,IAAI,YAAY;AAAA,QAC1B,YAAY,IAAI,eAAe,IAAI,cAAc;AAAA,MACnD,EAAE;AAAA,MACF,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAAA,MACrD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,2BAA2B;AAAA,EACjE,gBAAgB,EACb,QAAQ,EACR,SAAS,EACT,SAAS,uGAAuG;AACrH,CAAC;AAID,MAAM,iBAA4C;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,MAAM,CAAC,QAAQ,WAAW;AAAA,EAC1B,SAAS,OAAO,UAAU,QAAQ;AAChC,UAAM,EAAE,UAAU,UAAU,IAAI,kBAAkB,GAAG;AACrD,SAAK;AACL,UAAM,QAAyB,gBAAgB,MAAM,QAAQ;AAC7D,UAAM,iBAAiB,CAAC,CAAC,MAAM;AAE/B,UAAM,YAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM,wBAAwB,MAAM,SAAS;AAAA,IAC/C;AACA,QAAI,gBAAgB;AAClB,gBAAU,QAAQ;AAAA,QAChB,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS,2BAA2B,GAAwC;AAClF,UAAM,WAAW,MAAM,OAAO,IAA6B,SAAS;AACpE,QAAI,CAAC,SAAS,SAAS;AACrB,UAAI,SAAS,eAAe,OAAO,SAAS,eAAe,KAAK;AAC9D,eAAO,EAAE,OAAO,OAAgB,WAAW,MAAM,UAAU;AAAA,MAC7D;AACA,YAAM,IAAI,MAAM,SAAS,SAAS,2BAA2B,MAAM,SAAS,EAAE;AAAA,IAChF;AACA,UAAM,OAAQ,SAAS,QAAQ,CAAC;AAChC,UAAM,aAAc,KAAK,WAAW;AACpC,QAAI,CAAC,YAAY;AACf,aAAO,EAAE,OAAO,OAAgB,WAAW,MAAM,UAAU;AAAA,IAC7D;AACA,UAAM,aAAc,KAAK,WAAW;AACpC,UAAM,eAAgB,KAAK,gBAAgB,CAAC;AAE5C,QAAI,UAAyC;AAC7C,QAAI,gBAAgB;AAClB,gBAAU,oBAAoB,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IAC7D;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,SAAS;AAAA,QACP,IAAI,WAAW;AAAA,QACf,aAAa,WAAW,eAAe;AAAA,QACvC,aAAa,WAAW,eAAe;AAAA,QACvC,cAAc,WAAW,gBAAgB;AAAA,QACzC,cAAc,WAAW,gBAAgB;AAAA,QACzC,QAAQ,WAAW,UAAU;AAAA,QAC7B,gBAAgB,WAAW,kBAAkB;AAAA,QAC7C,QAAQ,WAAW,UAAU;AAAA,QAC7B,aAAa,WAAW,eAAe;AAAA,QACvC,gBAAgB,WAAW,kBAAkB;AAAA,QAC7C,UAAU,WAAW,YAAY;AAAA,QACjC,WAAW,MAAM,WAAW,SAAS;AAAA,QACrC,WAAW,MAAM,WAAW,SAAS;AAAA,MACvC;AAAA,MACA,SAAS,aACL;AAAA,QACE,IAAI,WAAW;AAAA,QACf,WAAW,WAAW,aAAa;AAAA,QACnC,WAAW,WAAW,aAAa;AAAA,QACnC,QAAQ,WAAW,UAAU;AAAA,QAC7B,YAAY,WAAW,cAAc;AAAA,QACrC,UAAU,WAAW,YAAY;AAAA,QACjC,YAAY,WAAW,cAAc;AAAA,QACrC,eAAe,WAAW,iBAAiB;AAAA,MAC7C,IACA;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mBAAgD,CAAC,mBAAmB,cAAc;AAE/F,IAAO,yBAAQ;",
   "names": []
 }

package/dist/modules/customers/ai-tools/deal-analyzer-pack.js

@@ -106,25 +106,14 @@ const analyzeDealsToolDefinition = {
         lastActivityByDeal.set(refId, activityDate);
       }
     }
-    const dealById = new Map(deals.map((deal) => [deal.id, deal]));
-    const scopedDealIds = Array.from(dealById.keys());
     const personLinkWhere = {
-      deal: { $in: scopedDealIds }
+      deal: { $in: dealIds }
     };
-    const personLinksRaw = await em.find(
+    const personLinks = await em.find(
       CustomerDealPersonLink,
       personLinkWhere,
       { limit: 500 }
     );
-    const personLinks = personLinksRaw.filter((link) => {
-      const dealRefId = refIdOf(link.deal);
-      if (!dealRefId) return false;
-      const scopedDeal = dealById.get(dealRefId);
-      if (!scopedDeal) return false;
-      if (scopedDeal.tenantId !== tenantId) return false;
-      if (ctx.organizationId && scopedDeal.organizationId !== ctx.organizationId) return false;
-      return true;
-    });
     const linksByDeal = /* @__PURE__ */ new Map();
     for (const link of personLinks) {
       const dealRefId = refIdOf(link.deal);

package/dist/modules/customers/ai-tools/deal-analyzer-pack.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/ai-tools/deal-analyzer-pack.ts"],
-  "sourcesContent": ["/**\n * `customers.analyze_deals` \u2014 analytical read-only tool for the deal_analyzer\n * agent (Step d1 of the deal-analyzer-demo).\n *\n * Reads deals scoped to the caller tenant/org, enriches each deal with the\n * most recent activity timestamp (days-since-last-activity), computes a simple\n * healthScore, and returns a ranked list. The handler issues two bounded DB\n * reads (deals + activities) \u2014 no N+1.\n *\n * `customers.update_deal_stage` already exists in deals-pack.ts and is\n * imported and re-exported here so the deal_analyzer agent's `allowedTools`\n * list can reference both under a single pack. The tool itself is NOT\n * redeclared here.\n */\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  CustomerDeal,\n  CustomerActivity,\n  CustomerDealPersonLink,\n  CustomerEntity,\n} from '../data/entities'\nimport {\n  assertTenantScope,\n  type CustomersAiToolDefinition,\n  type CustomersToolContext,\n} from './types'\n\nfunction refIdOf(ref: unknown): string | undefined {\n  if (!ref) return undefined\n  if (typeof ref === 'string') return ref\n  if (typeof ref === 'object' && typeof (ref as { id?: unknown }).id === 'string') {\n    return (ref as { id: string }).id\n  }\n  return undefined\n}\n\nfunction resolveEm(ctx: CustomersToolContext): EntityManager {\n  return ctx.container.resolve<EntityManager>('em')\n}\n\nfunction clamp(value: number, min: number, max: number): number {\n  return Math.min(Math.max(value, min), max)\n}\n\n/**\n * Compute a health score for a deal:\n *   healthScore = clamp((30 - daysSinceLastActivity) / 30 * 100, 0, 100)\n * A deal with activity within the last 30 days scores > 0. Deals with no\n * activity default to daysSinceLastActivity = activityWindow so they score 0.\n * Exported for unit testing.\n */\nexport function computeHealthScore(daysSinceLastActivity: number): number {\n  return clamp(((30 - daysSinceLastActivity) / 30) * 100, 0, 100)\n}\n\nconst analyzeDealsInput = z.object({\n  dealStageFilter: z\n    .string()\n    .optional()\n    .describe(\n      'Optional pipeline stage name or status slug to restrict results (e.g. \"open\", \"qualification\", \"negotiation\").',\n    ),\n  daysOfActivityWindow: z\n    .number()\n    .int()\n    .min(1)\n    .max(365)\n    .default(30)\n    .describe(\n      'Number of days to look back for \"last activity\" calculation. Deals with no activity in this window are flagged as stalled. Default 30.',\n    ),\n  limit: z\n    .number()\n    .int()\n    .min(1)\n    .max(100)\n    .default(25)\n    .describe('Maximum number of deals to return, ranked by healthScore ascending (most at-risk first). Default 25.'),\n})\n\ntype AnalyzeDealsInput = z.infer<typeof analyzeDealsInput>\n\ntype DealAnalysisItem = {\n  id: string\n  title: string\n  value: number | null\n  valueCurrency: string | null\n  stage: string | null\n  status: string\n  daysSinceLastActivity: number\n  primaryContact: string | null\n  healthScore: number\n}\n\ntype AnalyzeDealsOutput = {\n  deals: DealAnalysisItem[]\n  totalAnalyzed: number\n  stalledCount: number\n  windowDays: number\n}\n\nexport function msTodays(ms: number): number {\n  return Math.floor(ms / (1000 * 60 * 60 * 24))\n}\n\nconst analyzeDealsToolDefinition: CustomersAiToolDefinition<AnalyzeDealsInput, AnalyzeDealsOutput> = {\n  name: 'customers.analyze_deals',\n  displayName: 'Analyze deals',\n  description:\n    'Fetch and analyze open deals for the caller tenant. Returns each deal with its days-since-last-activity and a health score (0\u2013100, lower = more stalled). Results are ranked most-at-risk first.',\n  inputSchema: analyzeDealsInput as z.ZodType<AnalyzeDealsInput>,\n  requiredFeatures: ['customers.deals.view'],\n  tags: ['read', 'customers', 'analytics'],\n  isMutation: false,\n  handler: async (rawInput, ctx): Promise<AnalyzeDealsOutput> => {\n    const { tenantId } = assertTenantScope(ctx)\n    const input = analyzeDealsInput.parse(rawInput)\n    const em = resolveEm(ctx)\n    const scope = { tenantId, organizationId: ctx.organizationId }\n\n    // Build deal filter\n    const dealWhere: Record<string, unknown> = {\n      tenantId,\n      deletedAt: null,\n    }\n    if (ctx.organizationId) dealWhere.organizationId = ctx.organizationId\n    // Apply stage/status filter when provided. `$or` is composed with the\n    // outer `deletedAt: null` filter \u2014 both must hold \u2014 so the caller-supplied\n    // value matches either the canonical status slug or the stage label.\n    if (input.dealStageFilter) {\n      const filterValue = input.dealStageFilter.trim()\n      if (filterValue.length) {\n        dealWhere.$or = [\n          { status: filterValue },\n          { pipelineStage: filterValue },\n        ]\n      }\n    }\n\n    const deals = await findWithDecryption<CustomerDeal>(\n      em,\n      CustomerDeal,\n      dealWhere as any,\n      {\n        orderBy: { updatedAt: 'desc' },\n        limit: Math.min(input.limit * 4, 400), // Fetch extra so we can rank properly\n      },\n      scope,\n    )\n\n    if (!deals.length) {\n      return { deals: [], totalAnalyzed: 0, stalledCount: 0, windowDays: input.daysOfActivityWindow }\n    }\n\n    const dealIds = deals.map((d) => d.id)\n\n    // Fetch most recent activity per deal within the window in one batch.\n    // CustomerActivity has encrypted columns (subject, body); use the\n    // tenant-aware helper even though this query only reads occurredAt/deal,\n    // so future readers cannot accidentally surface ciphertext.\n    const activityWhere: Record<string, unknown> = {\n      deal: { $in: dealIds },\n      tenantId,\n    }\n    if (ctx.organizationId) activityWhere.organizationId = ctx.organizationId\n    const activities = await findWithDecryption<CustomerActivity>(\n      em,\n      CustomerActivity,\n      activityWhere as any,\n      {\n        orderBy: { occurredAt: 'desc' },\n        limit: 1000,\n      },\n      scope,\n    )\n\n    const lastActivityByDeal = new Map<string, Date>()\n    for (const activity of activities) {\n      const refId = refIdOf((activity as { deal?: unknown }).deal)\n      if (!refId) continue\n      const activityDate = activity.occurredAt ?? activity.createdAt\n      if (!activityDate) continue\n      const existing = lastActivityByDeal.get(refId)\n      if (!existing || activityDate > existing) {\n        lastActivityByDeal.set(refId, activityDate)\n      }\n    }\n\n    // Fetch primary contacts for deals in one batch. CustomerDealPersonLink\n    // has no encrypted columns, but the linked CustomerEntity.display_name is\n    // encrypted, so resolve names via findWithDecryption rather than\n    // populating the relation through raw em.find.\n    // Defense-in-depth: `customer_deal_people` carries no tenant/org columns,\n    // so DB-level scoping is via the tenant-filtered `dealIds` set. Filter the\n    // returned rows against the caller-scoped deals map so a future refactor\n    // that widens `dealIds` cannot surface cross-tenant links.\n    const dealById = new Map<string, CustomerDeal>(deals.map((deal) => [deal.id, deal]))\n    const scopedDealIds = Array.from(dealById.keys())\n    const personLinkWhere: Record<string, unknown> = {\n      deal: { $in: scopedDealIds },\n    }\n    const personLinksRaw = await em.find(\n      CustomerDealPersonLink,\n      personLinkWhere as any,\n      { limit: 500 },\n    )\n    const personLinks = personLinksRaw.filter((link) => {\n      const dealRefId = refIdOf((link as { deal?: unknown }).deal)\n      if (!dealRefId) return false\n      const scopedDeal = dealById.get(dealRefId)\n      if (!scopedDeal) return false\n      if (scopedDeal.tenantId !== tenantId) return false\n      if (ctx.organizationId && scopedDeal.organizationId !== ctx.organizationId) return false\n      return true\n    })\n\n    const linksByDeal = new Map<string, string>() // dealId \u2192 personId (first link wins)\n    for (const link of personLinks) {\n      const dealRefId = refIdOf((link as { deal?: unknown }).deal)\n      const personRefId = refIdOf((link as { person?: unknown }).person)\n      if (!dealRefId || !personRefId) continue\n      if (!linksByDeal.has(dealRefId)) linksByDeal.set(dealRefId, personRefId)\n    }\n\n    const primaryContactByDeal = new Map<string, string>()\n    const personIds = Array.from(new Set(linksByDeal.values()))\n    if (personIds.length) {\n      const personWhere: Record<string, unknown> = {\n        id: { $in: personIds },\n        tenantId,\n      }\n      if (ctx.organizationId) personWhere.organizationId = ctx.organizationId\n      const persons = await findWithDecryption<CustomerEntity>(\n        em,\n        CustomerEntity,\n        personWhere as any,\n        undefined,\n        scope,\n      )\n      const nameByPersonId = new Map<string, string>()\n      for (const person of persons) {\n        const name = person.displayName\n        if (typeof name === 'string' && name.length) {\n          nameByPersonId.set(person.id, name)\n        }\n      }\n      for (const [dealId, personId] of linksByDeal) {\n        const name = nameByPersonId.get(personId)\n        if (name) primaryContactByDeal.set(dealId, name)\n      }\n    }\n\n    const now = Date.now()\n    const analyzed: DealAnalysisItem[] = deals.map((deal) => {\n      const lastActivity = lastActivityByDeal.get(deal.id)\n      const daysSinceLastActivity = lastActivity\n        ? msTodays(now - lastActivity.getTime())\n        : input.daysOfActivityWindow // Treat as fully stalled when no activity\n      const value = deal.valueAmount ? parseFloat(String(deal.valueAmount)) : null\n      return {\n        id: deal.id,\n        title: deal.title,\n        value: Number.isFinite(value) ? value : null,\n        valueCurrency: deal.valueCurrency ?? null,\n        stage: deal.pipelineStage ?? deal.status ?? null,\n        status: deal.status ?? 'open',\n        daysSinceLastActivity,\n        primaryContact: primaryContactByDeal.get(deal.id) ?? null,\n        healthScore: Math.round(computeHealthScore(daysSinceLastActivity)),\n      }\n    })\n\n    // Sort most-at-risk first (lowest health score first, then by value desc)\n    analyzed.sort((a, b) => {\n      if (a.healthScore !== b.healthScore) return a.healthScore - b.healthScore\n      const aVal = a.value ?? 0\n      const bVal = b.value ?? 0\n      return bVal - aVal\n    })\n\n    const truncated = analyzed.slice(0, input.limit)\n    const stalledCount = truncated.filter(\n      (d) => d.daysSinceLastActivity >= input.daysOfActivityWindow,\n    ).length\n\n    return {\n      deals: truncated,\n      totalAnalyzed: deals.length,\n      stalledCount,\n      windowDays: input.daysOfActivityWindow,\n    }\n  },\n}\n\nexport const dealAnalyzerAiTools: CustomersAiToolDefinition[] = [\n  analyzeDealsToolDefinition as unknown as CustomersAiToolDefinition,\n]\n\nexport default dealAnalyzerAiTools\n"],
-  "mappings": "AAeA,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AAEP,SAAS,QAAQ,KAAkC;AACjD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,MAAI,OAAO,QAAQ,YAAY,OAAQ,IAAyB,OAAO,UAAU;AAC/E,WAAQ,IAAuB;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAA0C;AAC3D,SAAO,IAAI,UAAU,QAAuB,IAAI;AAClD;AAEA,SAAS,MAAM,OAAe,KAAa,KAAqB;AAC9D,SAAO,KAAK,IAAI,KAAK,IAAI,OAAO,GAAG,GAAG,GAAG;AAC3C;AASO,SAAS,mBAAmB,uBAAuC;AACxE,SAAO,OAAQ,KAAK,yBAAyB,KAAM,KAAK,GAAG,GAAG;AAChE;AAEA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,iBAAiB,EACd,OAAO,EACP,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,sBAAsB,EACnB,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAG,EACP,QAAQ,EAAE,EACV;AAAA,IACC;AAAA,EACF;AAAA,EACF,OAAO,EACJ,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAG,EACP,QAAQ,EAAE,EACV,SAAS,sGAAsG;AACpH,CAAC;AAuBM,SAAS,SAAS,IAAoB;AAC3C,SAAO,KAAK,MAAM,MAAM,MAAO,KAAK,KAAK,GAAG;AAC9C;AAEA,MAAM,6BAA+F;AAAA,EACnG,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,MAAM,CAAC,QAAQ,aAAa,WAAW;AAAA,EACvC,YAAY;AAAA,EACZ,SAAS,OAAO,UAAU,QAAqC;AAC7D,UAAM,EAAE,SAAS,IAAI,kBAAkB,GAAG;AAC1C,UAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAC9C,UAAM,KAAK,UAAU,GAAG;AACxB,UAAM,QAAQ,EAAE,UAAU,gBAAgB,IAAI,eAAe;AAG7D,UAAM,YAAqC;AAAA,MACzC;AAAA,MACA,WAAW;AAAA,IACb;AACA,QAAI,IAAI,eAAgB,WAAU,iBAAiB,IAAI;AAIvD,QAAI,MAAM,iBAAiB;AACzB,YAAM,cAAc,MAAM,gBAAgB,KAAK;AAC/C,UAAI,YAAY,QAAQ;AACtB,kBAAU,MAAM;AAAA,UACd,EAAE,QAAQ,YAAY;AAAA,UACtB,EAAE,eAAe,YAAY;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO,KAAK,IAAI,MAAM,QAAQ,GAAG,GAAG;AAAA;AAAA,MACtC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,cAAc,GAAG,YAAY,MAAM,qBAAqB;AAAA,IAChG;AAEA,UAAM,UAAU,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;AAMrC,UAAM,gBAAyC;AAAA,MAC7C,MAAM,EAAE,KAAK,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,QAAI,IAAI,eAAgB,eAAc,iBAAiB,IAAI;AAC3D,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,YAAY,OAAO;AAAA,QAC9B,OAAO;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAEA,UAAM,qBAAqB,oBAAI,IAAkB;AACjD,eAAW,YAAY,YAAY;AACjC,YAAM,QAAQ,QAAS,SAAgC,IAAI;AAC3D,UAAI,CAAC,MAAO;AACZ,YAAM,eAAe,SAAS,cAAc,SAAS;AACrD,UAAI,CAAC,aAAc;AACnB,YAAM,WAAW,mBAAmB,IAAI,KAAK;AAC7C,UAAI,CAAC,YAAY,eAAe,UAAU;AACxC,2BAAmB,IAAI,OAAO,YAAY;AAAA,MAC5C;AAAA,IACF;AAUA,UAAM,WAAW,IAAI,IAA0B,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACnF,UAAM,gBAAgB,MAAM,KAAK,SAAS,KAAK,CAAC;AAChD,UAAM,kBAA2C;AAAA,MAC/C,MAAM,EAAE,KAAK,cAAc;AAAA,IAC7B;AACA,UAAM,iBAAiB,MAAM,GAAG;AAAA,MAC9B;AAAA,MACA;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,UAAM,cAAc,eAAe,OAAO,CAAC,SAAS;AAClD,YAAM,YAAY,QAAS,KAA4B,IAAI;AAC3D,UAAI,CAAC,UAAW,QAAO;AACvB,YAAM,aAAa,SAAS,IAAI,SAAS;AACzC,UAAI,CAAC,WAAY,QAAO;AACxB,UAAI,WAAW,aAAa,SAAU,QAAO;AAC7C,UAAI,IAAI,kBAAkB,WAAW,mBAAmB,IAAI,eAAgB,QAAO;AACnF,aAAO;AAAA,IACT,CAAC;AAED,UAAM,cAAc,oBAAI,IAAoB;AAC5C,eAAW,QAAQ,aAAa;AAC9B,YAAM,YAAY,QAAS,KAA4B,IAAI;AAC3D,YAAM,cAAc,QAAS,KAA8B,MAAM;AACjE,UAAI,CAAC,aAAa,CAAC,YAAa;AAChC,UAAI,CAAC,YAAY,IAAI,SAAS,EAAG,aAAY,IAAI,WAAW,WAAW;AAAA,IACzE;AAEA,UAAM,uBAAuB,oBAAI,IAAoB;AACrD,UAAM,YAAY,MAAM,KAAK,IAAI,IAAI,YAAY,OAAO,CAAC,CAAC;AAC1D,QAAI,UAAU,QAAQ;AACpB,YAAM,cAAuC;AAAA,QAC3C,IAAI,EAAE,KAAK,UAAU;AAAA,QACrB;AAAA,MACF;AACA,UAAI,IAAI,eAAgB,aAAY,iBAAiB,IAAI;AACzD,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,iBAAiB,oBAAI,IAAoB;AAC/C,iBAAW,UAAU,SAAS;AAC5B,cAAM,OAAO,OAAO;AACpB,YAAI,OAAO,SAAS,YAAY,KAAK,QAAQ;AAC3C,yBAAe,IAAI,OAAO,IAAI,IAAI;AAAA,QACpC;AAAA,MACF;AACA,iBAAW,CAAC,QAAQ,QAAQ,KAAK,aAAa;AAC5C,cAAM,OAAO,eAAe,IAAI,QAAQ;AACxC,YAAI,KAAM,sBAAqB,IAAI,QAAQ,IAAI;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,WAA+B,MAAM,IAAI,CAAC,SAAS;AACvD,YAAM,eAAe,mBAAmB,IAAI,KAAK,EAAE;AACnD,YAAM,wBAAwB,eAC1B,SAAS,MAAM,aAAa,QAAQ,CAAC,IACrC,MAAM;AACV,YAAM,QAAQ,KAAK,cAAc,WAAW,OAAO,KAAK,WAAW,CAAC,IAAI;AACxE,aAAO;AAAA,QACL,IAAI,KAAK;AAAA,QACT,OAAO,KAAK;AAAA,QACZ,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAAA,QACxC,eAAe,KAAK,iBAAiB;AAAA,QACrC,OAAO,KAAK,iBAAiB,KAAK,UAAU;AAAA,QAC5C,QAAQ,KAAK,UAAU;AAAA,QACvB;AAAA,QACA,gBAAgB,qBAAqB,IAAI,KAAK,EAAE,KAAK;AAAA,QACrD,aAAa,KAAK,MAAM,mBAAmB,qBAAqB,CAAC;AAAA,MACnE;AAAA,IACF,CAAC;AAGD,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,UAAI,EAAE,gBAAgB,EAAE,YAAa,QAAO,EAAE,cAAc,EAAE;AAC9D,YAAM,OAAO,EAAE,SAAS;AACxB,YAAM,OAAO,EAAE,SAAS;AACxB,aAAO,OAAO;AAAA,IAChB,CAAC;AAED,UAAM,YAAY,SAAS,MAAM,GAAG,MAAM,KAAK;AAC/C,UAAM,eAAe,UAAU;AAAA,MAC7B,CAAC,MAAM,EAAE,yBAAyB,MAAM;AAAA,IAC1C,EAAE;AAEF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,eAAe,MAAM;AAAA,MACrB;AAAA,MACA,YAAY,MAAM;AAAA,IACpB;AAAA,EACF;AACF;AAEO,MAAM,sBAAmD;AAAA,EAC9D;AACF;AAEA,IAAO,6BAAQ;",
+  "sourcesContent": ["/**\n * `customers.analyze_deals` \u2014 analytical read-only tool for the deal_analyzer\n * agent (Step d1 of the deal-analyzer-demo).\n *\n * Reads deals scoped to the caller tenant/org, enriches each deal with the\n * most recent activity timestamp (days-since-last-activity), computes a simple\n * healthScore, and returns a ranked list. The handler issues two bounded DB\n * reads (deals + activities) \u2014 no N+1.\n *\n * `customers.update_deal_stage` already exists in deals-pack.ts and is\n * imported and re-exported here so the deal_analyzer agent's `allowedTools`\n * list can reference both under a single pack. The tool itself is NOT\n * redeclared here.\n */\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  CustomerDeal,\n  CustomerActivity,\n  CustomerDealPersonLink,\n  CustomerEntity,\n} from '../data/entities'\nimport {\n  assertTenantScope,\n  type CustomersAiToolDefinition,\n  type CustomersToolContext,\n} from './types'\n\nfunction refIdOf(ref: unknown): string | undefined {\n  if (!ref) return undefined\n  if (typeof ref === 'string') return ref\n  if (typeof ref === 'object' && typeof (ref as { id?: unknown }).id === 'string') {\n    return (ref as { id: string }).id\n  }\n  return undefined\n}\n\nfunction resolveEm(ctx: CustomersToolContext): EntityManager {\n  return ctx.container.resolve<EntityManager>('em')\n}\n\nfunction clamp(value: number, min: number, max: number): number {\n  return Math.min(Math.max(value, min), max)\n}\n\n/**\n * Compute a health score for a deal:\n *   healthScore = clamp((30 - daysSinceLastActivity) / 30 * 100, 0, 100)\n * A deal with activity within the last 30 days scores > 0. Deals with no\n * activity default to daysSinceLastActivity = activityWindow so they score 0.\n * Exported for unit testing.\n */\nexport function computeHealthScore(daysSinceLastActivity: number): number {\n  return clamp(((30 - daysSinceLastActivity) / 30) * 100, 0, 100)\n}\n\nconst analyzeDealsInput = z.object({\n  dealStageFilter: z\n    .string()\n    .optional()\n    .describe(\n      'Optional pipeline stage name or status slug to restrict results (e.g. \"open\", \"qualification\", \"negotiation\").',\n    ),\n  daysOfActivityWindow: z\n    .number()\n    .int()\n    .min(1)\n    .max(365)\n    .default(30)\n    .describe(\n      'Number of days to look back for \"last activity\" calculation. Deals with no activity in this window are flagged as stalled. Default 30.',\n    ),\n  limit: z\n    .number()\n    .int()\n    .min(1)\n    .max(100)\n    .default(25)\n    .describe('Maximum number of deals to return, ranked by healthScore ascending (most at-risk first). Default 25.'),\n})\n\ntype AnalyzeDealsInput = z.infer<typeof analyzeDealsInput>\n\ntype DealAnalysisItem = {\n  id: string\n  title: string\n  value: number | null\n  valueCurrency: string | null\n  stage: string | null\n  status: string\n  daysSinceLastActivity: number\n  primaryContact: string | null\n  healthScore: number\n}\n\ntype AnalyzeDealsOutput = {\n  deals: DealAnalysisItem[]\n  totalAnalyzed: number\n  stalledCount: number\n  windowDays: number\n}\n\nexport function msTodays(ms: number): number {\n  return Math.floor(ms / (1000 * 60 * 60 * 24))\n}\n\nconst analyzeDealsToolDefinition: CustomersAiToolDefinition<AnalyzeDealsInput, AnalyzeDealsOutput> = {\n  name: 'customers.analyze_deals',\n  displayName: 'Analyze deals',\n  description:\n    'Fetch and analyze open deals for the caller tenant. Returns each deal with its days-since-last-activity and a health score (0\u2013100, lower = more stalled). Results are ranked most-at-risk first.',\n  inputSchema: analyzeDealsInput as z.ZodType<AnalyzeDealsInput>,\n  requiredFeatures: ['customers.deals.view'],\n  tags: ['read', 'customers', 'analytics'],\n  isMutation: false,\n  handler: async (rawInput, ctx): Promise<AnalyzeDealsOutput> => {\n    const { tenantId } = assertTenantScope(ctx)\n    const input = analyzeDealsInput.parse(rawInput)\n    const em = resolveEm(ctx)\n    const scope = { tenantId, organizationId: ctx.organizationId }\n\n    // Build deal filter\n    const dealWhere: Record<string, unknown> = {\n      tenantId,\n      deletedAt: null,\n    }\n    if (ctx.organizationId) dealWhere.organizationId = ctx.organizationId\n    // Apply stage/status filter when provided. `$or` is composed with the\n    // outer `deletedAt: null` filter \u2014 both must hold \u2014 so the caller-supplied\n    // value matches either the canonical status slug or the stage label.\n    if (input.dealStageFilter) {\n      const filterValue = input.dealStageFilter.trim()\n      if (filterValue.length) {\n        dealWhere.$or = [\n          { status: filterValue },\n          { pipelineStage: filterValue },\n        ]\n      }\n    }\n\n    const deals = await findWithDecryption<CustomerDeal>(\n      em,\n      CustomerDeal,\n      dealWhere as any,\n      {\n        orderBy: { updatedAt: 'desc' },\n        limit: Math.min(input.limit * 4, 400), // Fetch extra so we can rank properly\n      },\n      scope,\n    )\n\n    if (!deals.length) {\n      return { deals: [], totalAnalyzed: 0, stalledCount: 0, windowDays: input.daysOfActivityWindow }\n    }\n\n    const dealIds = deals.map((d) => d.id)\n\n    // Fetch most recent activity per deal within the window in one batch.\n    // CustomerActivity has encrypted columns (subject, body); use the\n    // tenant-aware helper even though this query only reads occurredAt/deal,\n    // so future readers cannot accidentally surface ciphertext.\n    const activityWhere: Record<string, unknown> = {\n      deal: { $in: dealIds },\n      tenantId,\n    }\n    if (ctx.organizationId) activityWhere.organizationId = ctx.organizationId\n    const activities = await findWithDecryption<CustomerActivity>(\n      em,\n      CustomerActivity,\n      activityWhere as any,\n      {\n        orderBy: { occurredAt: 'desc' },\n        limit: 1000,\n      },\n      scope,\n    )\n\n    const lastActivityByDeal = new Map<string, Date>()\n    for (const activity of activities) {\n      const refId = refIdOf((activity as { deal?: unknown }).deal)\n      if (!refId) continue\n      const activityDate = activity.occurredAt ?? activity.createdAt\n      if (!activityDate) continue\n      const existing = lastActivityByDeal.get(refId)\n      if (!existing || activityDate > existing) {\n        lastActivityByDeal.set(refId, activityDate)\n      }\n    }\n\n    // Fetch primary contacts for deals in one batch. CustomerDealPersonLink\n    // has no encrypted columns, but the linked CustomerEntity.display_name is\n    // encrypted, so resolve names via findWithDecryption rather than\n    // populating the relation through raw em.find.\n    const personLinkWhere: Record<string, unknown> = {\n      deal: { $in: dealIds },\n    }\n    const personLinks = await em.find(\n      CustomerDealPersonLink,\n      personLinkWhere as any,\n      { limit: 500 },\n    )\n\n    const linksByDeal = new Map<string, string>() // dealId \u2192 personId (first link wins)\n    for (const link of personLinks) {\n      const dealRefId = refIdOf((link as { deal?: unknown }).deal)\n      const personRefId = refIdOf((link as { person?: unknown }).person)\n      if (!dealRefId || !personRefId) continue\n      if (!linksByDeal.has(dealRefId)) linksByDeal.set(dealRefId, personRefId)\n    }\n\n    const primaryContactByDeal = new Map<string, string>()\n    const personIds = Array.from(new Set(linksByDeal.values()))\n    if (personIds.length) {\n      const personWhere: Record<string, unknown> = {\n        id: { $in: personIds },\n        tenantId,\n      }\n      if (ctx.organizationId) personWhere.organizationId = ctx.organizationId\n      const persons = await findWithDecryption<CustomerEntity>(\n        em,\n        CustomerEntity,\n        personWhere as any,\n        undefined,\n        scope,\n      )\n      const nameByPersonId = new Map<string, string>()\n      for (const person of persons) {\n        const name = person.displayName\n        if (typeof name === 'string' && name.length) {\n          nameByPersonId.set(person.id, name)\n        }\n      }\n      for (const [dealId, personId] of linksByDeal) {\n        const name = nameByPersonId.get(personId)\n        if (name) primaryContactByDeal.set(dealId, name)\n      }\n    }\n\n    const now = Date.now()\n    const analyzed: DealAnalysisItem[] = deals.map((deal) => {\n      const lastActivity = lastActivityByDeal.get(deal.id)\n      const daysSinceLastActivity = lastActivity\n        ? msTodays(now - lastActivity.getTime())\n        : input.daysOfActivityWindow // Treat as fully stalled when no activity\n      const value = deal.valueAmount ? parseFloat(String(deal.valueAmount)) : null\n      return {\n        id: deal.id,\n        title: deal.title,\n        value: Number.isFinite(value) ? value : null,\n        valueCurrency: deal.valueCurrency ?? null,\n        stage: deal.pipelineStage ?? deal.status ?? null,\n        status: deal.status ?? 'open',\n        daysSinceLastActivity,\n        primaryContact: primaryContactByDeal.get(deal.id) ?? null,\n        healthScore: Math.round(computeHealthScore(daysSinceLastActivity)),\n      }\n    })\n\n    // Sort most-at-risk first (lowest health score first, then by value desc)\n    analyzed.sort((a, b) => {\n      if (a.healthScore !== b.healthScore) return a.healthScore - b.healthScore\n      const aVal = a.value ?? 0\n      const bVal = b.value ?? 0\n      return bVal - aVal\n    })\n\n    const truncated = analyzed.slice(0, input.limit)\n    const stalledCount = truncated.filter(\n      (d) => d.daysSinceLastActivity >= input.daysOfActivityWindow,\n    ).length\n\n    return {\n      deals: truncated,\n      totalAnalyzed: deals.length,\n      stalledCount,\n      windowDays: input.daysOfActivityWindow,\n    }\n  },\n}\n\nexport const dealAnalyzerAiTools: CustomersAiToolDefinition[] = [\n  analyzeDealsToolDefinition as unknown as CustomersAiToolDefinition,\n]\n\nexport default dealAnalyzerAiTools\n"],
+  "mappings": "AAeA,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AAEP,SAAS,QAAQ,KAAkC;AACjD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,MAAI,OAAO,QAAQ,YAAY,OAAQ,IAAyB,OAAO,UAAU;AAC/E,WAAQ,IAAuB;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAA0C;AAC3D,SAAO,IAAI,UAAU,QAAuB,IAAI;AAClD;AAEA,SAAS,MAAM,OAAe,KAAa,KAAqB;AAC9D,SAAO,KAAK,IAAI,KAAK,IAAI,OAAO,GAAG,GAAG,GAAG;AAC3C;AASO,SAAS,mBAAmB,uBAAuC;AACxE,SAAO,OAAQ,KAAK,yBAAyB,KAAM,KAAK,GAAG,GAAG;AAChE;AAEA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,iBAAiB,EACd,OAAO,EACP,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,sBAAsB,EACnB,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAG,EACP,QAAQ,EAAE,EACV;AAAA,IACC;AAAA,EACF;AAAA,EACF,OAAO,EACJ,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAG,EACP,QAAQ,EAAE,EACV,SAAS,sGAAsG;AACpH,CAAC;AAuBM,SAAS,SAAS,IAAoB;AAC3C,SAAO,KAAK,MAAM,MAAM,MAAO,KAAK,KAAK,GAAG;AAC9C;AAEA,MAAM,6BAA+F;AAAA,EACnG,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,MAAM,CAAC,QAAQ,aAAa,WAAW;AAAA,EACvC,YAAY;AAAA,EACZ,SAAS,OAAO,UAAU,QAAqC;AAC7D,UAAM,EAAE,SAAS,IAAI,kBAAkB,GAAG;AAC1C,UAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAC9C,UAAM,KAAK,UAAU,GAAG;AACxB,UAAM,QAAQ,EAAE,UAAU,gBAAgB,IAAI,eAAe;AAG7D,UAAM,YAAqC;AAAA,MACzC;AAAA,MACA,WAAW;AAAA,IACb;AACA,QAAI,IAAI,eAAgB,WAAU,iBAAiB,IAAI;AAIvD,QAAI,MAAM,iBAAiB;AACzB,YAAM,cAAc,MAAM,gBAAgB,KAAK;AAC/C,UAAI,YAAY,QAAQ;AACtB,kBAAU,MAAM;AAAA,UACd,EAAE,QAAQ,YAAY;AAAA,UACtB,EAAE,eAAe,YAAY;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO,KAAK,IAAI,MAAM,QAAQ,GAAG,GAAG;AAAA;AAAA,MACtC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,cAAc,GAAG,YAAY,MAAM,qBAAqB;AAAA,IAChG;AAEA,UAAM,UAAU,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;AAMrC,UAAM,gBAAyC;AAAA,MAC7C,MAAM,EAAE,KAAK,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,QAAI,IAAI,eAAgB,eAAc,iBAAiB,IAAI;AAC3D,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,YAAY,OAAO;AAAA,QAC9B,OAAO;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAEA,UAAM,qBAAqB,oBAAI,IAAkB;AACjD,eAAW,YAAY,YAAY;AACjC,YAAM,QAAQ,QAAS,SAAgC,IAAI;AAC3D,UAAI,CAAC,MAAO;AACZ,YAAM,eAAe,SAAS,cAAc,SAAS;AACrD,UAAI,CAAC,aAAc;AACnB,YAAM,WAAW,mBAAmB,IAAI,KAAK;AAC7C,UAAI,CAAC,YAAY,eAAe,UAAU;AACxC,2BAAmB,IAAI,OAAO,YAAY;AAAA,MAC5C;AAAA,IACF;AAMA,UAAM,kBAA2C;AAAA,MAC/C,MAAM,EAAE,KAAK,QAAQ;AAAA,IACvB;AACA,UAAM,cAAc,MAAM,GAAG;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,UAAM,cAAc,oBAAI,IAAoB;AAC5C,eAAW,QAAQ,aAAa;AAC9B,YAAM,YAAY,QAAS,KAA4B,IAAI;AAC3D,YAAM,cAAc,QAAS,KAA8B,MAAM;AACjE,UAAI,CAAC,aAAa,CAAC,YAAa;AAChC,UAAI,CAAC,YAAY,IAAI,SAAS,EAAG,aAAY,IAAI,WAAW,WAAW;AAAA,IACzE;AAEA,UAAM,uBAAuB,oBAAI,IAAoB;AACrD,UAAM,YAAY,MAAM,KAAK,IAAI,IAAI,YAAY,OAAO,CAAC,CAAC;AAC1D,QAAI,UAAU,QAAQ;AACpB,YAAM,cAAuC;AAAA,QAC3C,IAAI,EAAE,KAAK,UAAU;AAAA,QACrB;AAAA,MACF;AACA,UAAI,IAAI,eAAgB,aAAY,iBAAiB,IAAI;AACzD,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,iBAAiB,oBAAI,IAAoB;AAC/C,iBAAW,UAAU,SAAS;AAC5B,cAAM,OAAO,OAAO;AACpB,YAAI,OAAO,SAAS,YAAY,KAAK,QAAQ;AAC3C,yBAAe,IAAI,OAAO,IAAI,IAAI;AAAA,QACpC;AAAA,MACF;AACA,iBAAW,CAAC,QAAQ,QAAQ,KAAK,aAAa;AAC5C,cAAM,OAAO,eAAe,IAAI,QAAQ;AACxC,YAAI,KAAM,sBAAqB,IAAI,QAAQ,IAAI;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,WAA+B,MAAM,IAAI,CAAC,SAAS;AACvD,YAAM,eAAe,mBAAmB,IAAI,KAAK,EAAE;AACnD,YAAM,wBAAwB,eAC1B,SAAS,MAAM,aAAa,QAAQ,CAAC,IACrC,MAAM;AACV,YAAM,QAAQ,KAAK,cAAc,WAAW,OAAO,KAAK,WAAW,CAAC,IAAI;AACxE,aAAO;AAAA,QACL,IAAI,KAAK;AAAA,QACT,OAAO,KAAK;AAAA,QACZ,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAAA,QACxC,eAAe,KAAK,iBAAiB;AAAA,QACrC,OAAO,KAAK,iBAAiB,KAAK,UAAU;AAAA,QAC5C,QAAQ,KAAK,UAAU;AAAA,QACvB;AAAA,QACA,gBAAgB,qBAAqB,IAAI,KAAK,EAAE,KAAK;AAAA,QACrD,aAAa,KAAK,MAAM,mBAAmB,qBAAqB,CAAC;AAAA,MACnE;AAAA,IACF,CAAC;AAGD,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,UAAI,EAAE,gBAAgB,EAAE,YAAa,QAAO,EAAE,cAAc,EAAE;AAC9D,YAAM,OAAO,EAAE,SAAS;AACxB,YAAM,OAAO,EAAE,SAAS;AACxB,aAAO,OAAO;AAAA,IAChB,CAAC;AAED,UAAM,YAAY,SAAS,MAAM,GAAG,MAAM,KAAK;AAC/C,UAAM,eAAe,UAAU;AAAA,MAC7B,CAAC,MAAM,EAAE,yBAAyB,MAAM;AAAA,IAC1C,EAAE;AAEF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,eAAe,MAAM;AAAA,MACrB;AAAA,MACA,YAAY,MAAM;AAAA,IACpB;AAAA,EACF;AACF;AAEO,MAAM,sBAAmD;AAAA,EAC9D;AACF;AAEA,IAAO,6BAAQ;",
   "names": []
 }