@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/dist/modules/auth/components/AclEditor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/components/AclEditor.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport Link from 'next/link'\nimport { hasFeature, matchFeature } from '@open-mercato/shared/security/features'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'\nimport { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'\n\nfunction toTitleCase(value: string): string {\n  return value.replace(/[-_.]/g, ' ').replace(/\\b\\w/g, (char) => char.toUpperCase())\n}\n\nfunction normalizeFeatureArray(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const dedup = new Set<string>()\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction formatWildcardLabel(moduleId: string, wildcard: string): string {\n  if (!wildcard.endsWith('.*')) return wildcard\n  const prefix = `${moduleId}.`\n  const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)\n  if (!suffix) return 'All features'\n  return `All ${suffix.split('.').map(toTitleCase).join(' / ')}`\n}\n\ntype Feature = { id: string; title: string; module: string; dependsOn?: string[] }\ntype ModuleInfo = { id: string; title: string }\ntype RoleListItem = { id?: string | null; name?: string | null }\ntype RoleListResponse = { items?: RoleListItem[] }\ntype RoleSummary = { id: string; name: string }\n\nfunction buildRoleSummaries(items: RoleListItem[], allowedNames: string[]): RoleSummary[] {\n  const summaries: RoleSummary[] = []\n  for (const role of items) {\n    const name = typeof role?.name === 'string' ? role.name : ''\n    if (!name || !allowedNames.includes(name)) continue\n    const hasValidId = typeof role?.id === 'string' && role.id.length > 0\n    const id = hasValidId ? (role!.id as string) : name\n    summaries.push({ id, name })\n  }\n  return summaries\n}\n\nexport type AclData = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype FeatureListResponse = { items?: Feature[]; modules?: ModuleInfo[] }\ntype AclPayload = {\n  hasCustomAcl?: boolean\n  isSuperAdmin?: boolean\n  features?: unknown\n  organizations?: unknown\n  updatedAt?: string | null\n}\ntype OrganizationListResponse = { items?: Array<{ id?: string; name?: string }> }\n\nfunction normalizeOrganizationOptions(items: OrganizationListResponse['items']): Array<{ id: string; name: string }> {\n  if (!Array.isArray(items)) return []\n  return items.reduce<Array<{ id: string; name: string }>>((acc, org) => {\n    if (!org) return acc\n    const id = typeof org.id === 'string' && org.id.trim().length > 0 ? org.id : null\n    if (!id) return acc\n    const name = typeof org.name === 'string' && org.name.trim().length > 0 ? org.name : id\n    acc.push({ id, name })\n    return acc\n  }, [])\n}\n\nasync function readJsonOr<T>(\n  url: string,\n  init: RequestInit | undefined,\n  fallback: T,\n): Promise<T> {\n  const call = await apiCall<T>(url, init, { fallback })\n  if (!call.ok) return fallback\n  return call.result ?? fallback\n}\n\nexport function AclEditor({\n  kind,\n  targetId,\n  canEditOrganizations,\n  value,\n  onChange,\n  onVersionChange,\n  userRoles,\n  currentUserIsSuperAdmin,\n  tenantId,\n  preserveOnTenantChange = false,\n}: {\n  kind: 'user' | 'role'\n  targetId: string\n  canEditOrganizations: boolean\n  value?: AclData\n  onChange?: (data: AclData) => void\n  /**\n   * Reports the loaded ACL row's `updatedAt` (or null when none exists) so the\n   * parent can send the optimistic-lock header on save and reject stale ACL\n   * overwrites (#2055).\n   */\n  onVersionChange?: (updatedAt: string | null) => void\n  userRoles?: string[]\n  currentUserIsSuperAdmin?: boolean\n  tenantId?: string | null\n  preserveOnTenantChange?: boolean\n}) {\n  const actorIsSuperAdmin = !!currentUserIsSuperAdmin\n  const [loading, setLoading] = React.useState(true)\n  const [features, setFeatures] = React.useState<Feature[]>([])\n  const t = useT()\n  const [modules, setModules] = React.useState<ModuleInfo[]>([])\n  const [granted, setGranted] = React.useState<string[]>(() => {\n    const normalized = normalizeFeatureArray(value?.features)\n    return actorIsSuperAdmin ? normalized : normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n  })\n  const [isSuperAdmin, setIsSuperAdmin] = React.useState(value?.isSuperAdmin || false)\n  const [organizations, setOrganizations] = React.useState<string[] | null>(value?.organizations ?? null)\n  const [orgOptions, setOrgOptions] = React.useState<{ id: string; name: string }[]>([])\n  const [hasCustomAcl, setHasCustomAcl] = React.useState(true)\n  const [overrideEnabled, setOverrideEnabled] = React.useState(false)\n  const [roleDetails, setRoleDetails] = React.useState<RoleSummary[]>([])\n\n  const actorSanitizeFeatures = React.useCallback(\n    (list: unknown): string[] => {\n      const normalized = normalizeFeatureArray(list)\n      if (actorIsSuperAdmin) return normalized\n      return normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n    },\n    [actorIsSuperAdmin],\n  )\n\n  const updateGranted = React.useCallback(\n    (updater: (prev: string[]) => string[]) => {\n      setGranted((prev) => actorSanitizeFeatures(updater(prev)))\n    },\n    [actorSanitizeFeatures],\n  )\n\n  const tenantIdRef = React.useRef(tenantId)\n  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])\n  const hasMountedRef = React.useRef(false)\n\n  const fetchAclState = React.useCallback(async (forTenantId: string | null | undefined, cancelledRef: { current: boolean }) => {\n    try {\n      const aclQuery = new URLSearchParams()\n      aclQuery.set(kind === 'user' ? 'userId' : 'roleId', targetId)\n      if (forTenantId) aclQuery.set('tenantId', forTenantId)\n      const aclQueryString = aclQuery.toString()\n      const aclJson = await readJsonOr<AclPayload>(\n        `/api/auth/${kind === 'user' ? 'users' : 'roles'}/acl${aclQueryString ? `?${aclQueryString}` : ''}`,\n        undefined,\n        { hasCustomAcl: true, isSuperAdmin: false, features: [], organizations: null },\n      )\n      if (cancelledRef.current) return\n      const customAclExists = aclJson.hasCustomAcl !== false\n      setHasCustomAcl(customAclExists)\n      setOverrideEnabled(customAclExists)\n      setIsSuperAdmin(!!aclJson.isSuperAdmin)\n      setGranted(actorSanitizeFeatures(aclJson.features))\n      setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])\n      onVersionChange?.(typeof aclJson.updatedAt === 'string' ? aclJson.updatedAt : null)\n    } catch {}\n  }, [kind, targetId, actorSanitizeFeatures, onVersionChange])\n\n  React.useEffect(() => {\n    const cancelled = { current: false }\n    async function load() {\n      setLoading(true)\n      try {\n        const fJson = await readJsonOr<FeatureListResponse>(\n          '/api/auth/features',\n          undefined,\n          { items: [], modules: [] },\n        )\n        if (!cancelled.current) {\n          setFeatures(fJson.items || [])\n          setModules(fJson.modules || [])\n        }\n      } catch {}\n      await fetchAclState(tenantIdRef.current, cancelled)\n      hasMountedRef.current = true\n      if (!cancelled.current) setLoading(false)\n    }\n    load()\n    return () => { cancelled.current = true }\n  }, [kind, targetId, fetchAclState])\n\n  React.useEffect(() => {\n    if (!hasMountedRef.current) return\n    if (preserveOnTenantChange) return\n    const cancelled = { current: false }\n    fetchAclState(tenantId, cancelled)\n    return () => { cancelled.current = true }\n  }, [tenantId, preserveOnTenantChange, fetchAclState])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadTenantScoped() {\n      if (canEditOrganizations) {\n        try {\n          const orgQuery = new URLSearchParams()\n          if (tenantId) orgQuery.set('tenantId', tenantId)\n          const orgQueryString = orgQuery.toString()\n          const oJson = await readJsonOr<OrganizationListResponse>(\n            `/api/directory/organizations${orgQueryString ? `?${orgQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) setOrgOptions(normalizeOrganizationOptions(oJson.items))\n        } catch {}\n      }\n      if (kind === 'user' && userRoles && userRoles.length > 0) {\n        try {\n          const roleQuery = new URLSearchParams({ pageSize: '100' })\n          if (tenantId) roleQuery.set('tenantId', tenantId)\n          const roleQueryString = roleQuery.toString()\n          const rolesJson = await readJsonOr<RoleListResponse>(\n            `/api/auth/roles${roleQueryString ? `?${roleQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) {\n            const allRoles = Array.isArray(rolesJson.items) ? rolesJson.items : []\n            const userRoleDetails: RoleSummary[] = buildRoleSummaries(allRoles, userRoles)\n            setRoleDetails(userRoleDetails)\n          }\n        } catch {}\n      }\n    }\n    loadTenantScoped()\n    return () => { cancelled = true }\n  }, [kind, canEditOrganizations, userRoles, tenantId])\n\n  // Notify parent of changes\n  React.useEffect(() => {\n    onChange?.({ isSuperAdmin, features: granted, organizations })\n  }, [isSuperAdmin, granted, organizations, onChange])\n\n  const grouped = React.useMemo(() => {\n    const moduleMap = new Map<string, string>()\n    for (const m of modules) {\n      moduleMap.set(m.id, m.title)\n    }\n    const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()\n    for (const f of features) {\n      const moduleId = f.module\n      const moduleTitle = moduleMap.get(moduleId) || moduleId\n      if (!map.has(moduleId)) {\n        map.set(moduleId, { moduleId, moduleTitle, features: [] })\n      }\n      map.get(moduleId)!.features.push(f)\n    }\n    return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))\n  }, [features, modules])\n\n  const hasGlobalWildcard = granted.includes('*')\n  const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0\n  const showOrganizationWarning =\n    (kind === 'role' || overrideEnabled) &&\n    canEditOrganizations &&\n    !isSuperAdmin &&\n    hasOrganizationRestriction &&\n    granted.length === 0\n\n  \n  const toggleWildcard = React.useCallback((wildcard: string, enable: boolean) => {\n    if (!actorIsSuperAdmin && enable && isTenantRestrictedFeature(wildcard)) return\n    updateGranted((prev) => {\n      if (enable) {\n        if (prev.includes(wildcard)) return prev\n        return [...prev, wildcard]\n      }\n      return prev.filter((feature) => feature !== wildcard)\n    })\n  }, [actorIsSuperAdmin, updateGranted])\n\n  const toggleModuleWildcard = React.useCallback((moduleId: string, enable: boolean) => {\n    toggleWildcard(`${moduleId}.*`, enable)\n  }, [toggleWildcard])\n\n  const isModuleWildcardEnabled = (moduleId: string) => {\n    return granted.includes(`${moduleId}.*`)\n  }\n\n  const isFeatureCoveredByWildcard = (featureId: string) =>\n    granted.some((feature) => (feature === '*' || feature.endsWith('.*')) && matchFeature(featureId, feature))\n\n  const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)\n\n  if (loading) return <div className=\"text-sm text-muted-foreground\">Loading ACL\u2026</div>\n\n  const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled\n\n  return (\n    <div className=\"space-y-4\">\n      {showRoleBanner && (\n        <div className=\"rounded-lg border border-blue-200 bg-blue-50 p-4\">\n          <div className=\"text-sm font-medium text-blue-900 mb-2\">\n            Permissions inherited from roles\n          </div>\n          <div className=\"text-sm text-blue-700 mb-3\">\n            This user currently inherits permissions from their assigned roles.\n            {roleDetails.length > 0 && (\n              <span>\n                {' '}Assigned roles:{' '}\n                {roleDetails.map((role, idx) => {\n                  const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`\n                  const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId\n                  return (\n                    <React.Fragment key={roleId}>\n                      {idx > 0 && ', '}\n                      <Link \n                        href={`/backend/roles/${roleId}/edit`}\n                        className=\"font-semibold text-blue-900 underline hover:text-blue-950 transition-colors\"\n                      >\n                        {roleName}\n                      </Link>\n                    </React.Fragment>\n                  )\n                })}\n              </span>\n            )}\n          </div>\n          <div className=\"flex items-center gap-2\">\n            <input \n              id=\"overrideAcl\" \n              type=\"checkbox\" \n              className=\"h-4 w-4\" \n              checked={overrideEnabled} \n              onChange={(e) => setOverrideEnabled(e.target.checked)} \n            />\n            <label htmlFor=\"overrideAcl\" className=\"text-sm text-blue-900 font-medium\">\n              Override permissions for this user only\n            </label>\n          </div>\n        </div>\n      )}\n      {(kind === 'role' || overrideEnabled) && (\n        <>\n          <div className=\"flex items-center gap-2\">\n            <input\n              id=\"isSuperAdmin\"\n              type=\"checkbox\"\n              className=\"h-4 w-4\"\n              checked={isSuperAdmin}\n              disabled={!actorIsSuperAdmin}\n              onChange={(e) => setIsSuperAdmin(!!e.target.checked)}\n            />\n            <label htmlFor=\"isSuperAdmin\" className=\"text-sm\">Super Admin (all features)</label>\n          </div>\n          {!actorIsSuperAdmin && (\n            <p className=\"text-xs text-muted-foreground\">Only super administrators can change this option.</p>\n          )}\n      {!isSuperAdmin && (\n        <>\n          {hasGlobalWildcard && (\n            <div className=\"rounded border border-blue-200 bg-blue-50 p-3\">\n              <div className=\"text-sm font-medium text-blue-900\">Global wildcard (*) enabled</div>\n              <div className=\"text-xs text-blue-700 mt-1\">This grants access to all features in the system.</div>\n              <Button\n                variant=\"outline\"\n                size=\"sm\"\n                className=\"mt-2\"\n                onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}\n              >\n                Remove global wildcard\n              </Button>\n            </div>\n          )}\n          {!hasGlobalWildcard && (\n            <AclDependencyDiagnosticsPanel\n              granted={granted}\n              catalog={features as readonly FeatureDescriptor[]}\n              onGrantedChange={updateGranted}\n              hideUnknownReferences={process.env.NODE_ENV === 'production'}\n            />\n          )}\n          <div className=\"grid grid-cols-1 md:grid-cols-2 gap-4\">\n            {grouped.map((group) => {\n              const moduleWildcard = isModuleWildcardEnabled(group.moduleId)\n              const nestedWildcards = Array.from(\n                new Set(\n                  granted.filter(\n                    (feature) =>\n                      feature !== '*' &&\n                      feature.endsWith('.*') &&\n                      feature.startsWith(`${group.moduleId}.`) &&\n                      feature !== `${group.moduleId}.*`,\n                  ),\n                ),\n              )\n                .map((wildcard) => {\n                  const prefix = wildcard.slice(0, -1)\n                  const relatedFeatures = group.features.filter((feature) => feature.id.startsWith(prefix))\n                  return { wildcard, features: relatedFeatures }\n                })\n                .sort((a, b) => a.wildcard.localeCompare(b.wildcard))\n              const nestedCoveredIds = new Set<string>()\n              for (const entry of nestedWildcards) {\n                for (const feature of entry.features) nestedCoveredIds.add(feature.id)\n              }\n              const moduleRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(`${group.moduleId}.*`)\n              const moduleCheckboxDisabled = hasGlobalWildcard || moduleRestricted\n              return (\n                <div key={group.moduleId} className=\"rounded border p-3\">\n                  <div className=\"flex items-center justify-between mb-3 pb-2 border-b\">\n                    <div className=\"text-sm font-medium\">{group.moduleTitle}</div>\n                    <div className=\"flex items-center gap-2\">\n                      <input \n                        id={`module-${group.moduleId}`} \n                        type=\"checkbox\" \n                        className=\"h-4 w-4\" \n                        checked={moduleWildcard || hasGlobalWildcard} \n                        disabled={moduleCheckboxDisabled}\n                        onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} \n                      />\n                      <label htmlFor={`module-${group.moduleId}`} className=\"text-sm text-muted-foreground\">\n                        All {moduleWildcard && !hasGlobalWildcard ? <span className=\"font-medium text-blue-600\">({group.moduleId}.*)</span> : ''}\n                        {moduleRestricted ? <span className=\"ml-2 text-xs font-medium text-muted-foreground\">(manage via super admin)</span> : null}\n                      </label>\n                    </div>\n                  </div>\n                {nestedWildcards.length > 0 && (\n                  <div className=\"space-y-3 mb-3\">\n                    {nestedWildcards.map(({ wildcard, features: wildcardFeatures }) => {\n                        const checked = granted.includes(wildcard) || hasGlobalWildcard || moduleWildcard\n                        const wildcardRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(wildcard)\n                        const disabled = hasGlobalWildcard || moduleWildcard || wildcardRestricted\n                        return (\n                          <div key={wildcard} className=\"space-y-2\">\n                            <div className=\"flex items-center gap-2\">\n                              <input\n                                id={`wildcard-${wildcard}`}\n                                type=\"checkbox\"\n                                className=\"h-4 w-4\"\n                                checked={checked}\n                                disabled={disabled}\n                                onChange={(e) => toggleWildcard(wildcard, !!e.target.checked)}\n                              />\n                              <label\n                                htmlFor={`wildcard-${wildcard}`}\n                                className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                              >\n                                {formatWildcardLabel(group.moduleId, wildcard)}{' '}\n                                <span className=\"text-muted-foreground text-xs font-mono\">({wildcard})</span>\n                                {wildcardRestricted ? (\n                                  <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                    {t('auth.acl.restricted', 'Restricted')}\n                                  </span>\n                                ) : null}\n                              </label>\n                            </div>\n                            {wildcardFeatures.length > 0 && (\n                              <div className=\"relative ml-6 pl-4 text-sm text-muted-foreground space-y-1\">\n                                <div className=\"absolute left-0 top-1 bottom-1 w-px bg-border\" aria-hidden />\n                                {wildcardFeatures.map((wf) => (\n                                  <div key={`${wildcard}-${wf.id}`} className=\"pl-2\">\n                                    <span>\n                                      {wf.title}{' '}\n                                      <span className=\"text-xs font-mono text-muted-foreground\">({wf.id})</span>\n                                    </span>\n                                  </div>\n                                ))}\n                              </div>\n                            )}\n                          </div>\n                        )\n                      })}\n                    </div>\n                  )}\n                  <div className=\"space-y-2\">\n                    {group.features.map((f) => {\n                      if (nestedCoveredIds.has(f.id)) return null\n                      const checked = isFeatureChecked(f.id)\n                      const isWildcardCovered = isFeatureCoveredByWildcard(f.id)\n                      const restricted = !actorIsSuperAdmin && isTenantRestrictedFeature(f.id)\n                      const disabled = isWildcardCovered || restricted\n                      return (\n                        <div key={f.id} className=\"flex items-center gap-2\">\n                          <input\n                            id={`f-${f.id}`}\n                            type=\"checkbox\"\n                            className=\"h-4 w-4\"\n                            checked={checked}\n                            disabled={disabled}\n                            onChange={(e) => {\n                              const on = !!e.target.checked\n                              updateGranted((prev) => {\n                                if (on) return [...prev, f.id]\n                                return prev.filter((x) => x !== f.id)\n                              })\n                            }}\n                          />\n                          <label\n                            htmlFor={`f-${f.id}`}\n                            className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                          >\n                            {f.title} <span className=\"text-muted-foreground text-xs\">({f.id})</span>\n                            {restricted ? (\n                              <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                {t('auth.acl.restricted', 'Restricted')}\n                              </span>\n                            ) : null}\n                          </label>\n                        </div>\n                      )\n                    })}\n                  </div>\n                </div>\n              )\n            })}\n          </div>\n        </>\n          )}\n          {canEditOrganizations && (\n            <div className=\"rounded border p-3\">\n              <div className=\"text-sm font-medium mb-2\">\n                {t('auth.acl.organizationsScope', 'Organizations scope')}\n              </div>\n              <div className=\"text-xs text-muted-foreground mb-2\">Empty = all organizations. Select one or more to restrict.</div>\n              <div className=\"grid grid-cols-1 md:grid-cols-2 gap-2\">\n                {orgOptions.map((o) => {\n                  const checked = organizations == null ? false : (organizations || []).includes(o.id)\n                  return (\n                    <div key={o.id} className=\"flex items-center gap-2\">\n                      <input id={`org-${o.id}`} type=\"checkbox\" className=\"h-4 w-4\" checked={checked} onChange={(e) => {\n                        const on = !!e.target.checked\n                        setOrganizations((prev) => {\n                          if (prev == null) return on ? [o.id] : []\n                          return on ? Array.from(new Set([...(prev || []), o.id])) : (prev || []).filter((x) => x !== o.id)\n                        })\n                      }} />\n                      <label htmlFor={`org-${o.id}`} className=\"text-sm\">{o.name}</label>\n                    </div>\n                  )\n                })}\n              </div>\n              <div className=\"mt-2\">\n                <Button variant=\"outline\" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>\n              </div>\n              {showOrganizationWarning && (\n                <div className=\"mt-3 rounded border border-amber-200 bg-amber-50 px-3 py-2 text-sm text-amber-900\">\n                  {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}\n                </div>\n              )}\n            </div>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"],
-  "mappings": ";AAmTsB,SAiEd,UAjEc,KAoBF,YApBE;AAlTtB,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,OAAO,UAAU;AACjB,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAAY;AAErB,SAAS,qCAAqC;AAE9C,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,QAAQ,UAAU,GAAG,EAAE,QAAQ,SAAS,CAAC,SAAS,KAAK,YAAY,CAAC;AACnF;AAEA,SAAS,sBAAsB,OAA0B;AACvD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAkB,UAA0B;AACvE,MAAI,CAAC,SAAS,SAAS,IAAI,EAAG,QAAO;AACrC,QAAM,SAAS,GAAG,QAAQ;AAC1B,QAAM,SAAS,SAAS,WAAW,MAAM,IAAI,SAAS,MAAM,OAAO,QAAQ,EAAE,IAAI,SAAS,MAAM,GAAG,EAAE;AACrG,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,OAAO,OAAO,MAAM,GAAG,EAAE,IAAI,WAAW,EAAE,KAAK,KAAK,CAAC;AAC9D;AAQA,SAAS,mBAAmB,OAAuB,cAAuC;AACxF,QAAM,YAA2B,CAAC;AAClC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,QAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,IAAI,EAAG;AAC3C,UAAM,aAAa,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS;AACpE,UAAM,KAAK,aAAc,KAAM,KAAgB;AAC/C,cAAU,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC7B;AACA,SAAO;AACT;AAkBA,SAAS,6BAA6B,OAA+E;AACnH,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAA4C,CAAC,KAAK,QAAQ;AACrE,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,KAAK,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,KAAK;AAC7E,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,IAAI,OAAO;AACrF,QAAI,KAAK,EAAE,IAAI,KAAK,CAAC;AACrB,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACP;AAEA,eAAe,WACb,KACA,MACA,UACY;AACZ,QAAM,OAAO,MAAM,QAAW,KAAK,MAAM,EAAE,SAAS,CAAC;AACrD,MAAI,CAAC,KAAK,GAAI,QAAO;AACrB,SAAO,KAAK,UAAU;AACxB;AAEO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAyB;AAC3B,GAgBG;AACD,QAAM,oBAAoB,CAAC,CAAC;AAC5B,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAoB,CAAC,CAAC;AAC5D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC7D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAmB,MAAM;AAC3D,UAAM,aAAa,sBAAsB,OAAO,QAAQ;AACxD,WAAO,oBAAoB,aAAa,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,EAC5G,CAAC;AACD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,OAAO,gBAAgB,KAAK;AACnF,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAA0B,OAAO,iBAAiB,IAAI;AACtG,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAyC,CAAC,CAAC;AACrF,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,IAAI;AAC3D,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAClE,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAwB,CAAC,CAAC;AAEtE,QAAM,wBAAwB,MAAM;AAAA,IAClC,CAAC,SAA4B;AAC3B,YAAM,aAAa,sBAAsB,IAAI;AAC7C,UAAI,kBAAmB,QAAO;AAC9B,aAAO,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,IAC3E;AAAA,IACA,CAAC,iBAAiB;AAAA,EACpB;AAEA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,CAAC,YAA0C;AACzC,iBAAW,CAAC,SAAS,sBAAsB,QAAQ,IAAI,CAAC,CAAC;AAAA,IAC3D;AAAA,IACA,CAAC,qBAAqB;AAAA,EACxB;AAEA,QAAM,cAAc,MAAM,OAAO,QAAQ;AACzC,QAAM,UAAU,MAAM;AAAE,gBAAY,UAAU;AAAA,EAAS,GAAG,CAAC,QAAQ,CAAC;AACpE,QAAM,gBAAgB,MAAM,OAAO,KAAK;AAExC,QAAM,gBAAgB,MAAM,YAAY,OAAO,aAAwC,iBAAuC;AAC5H,QAAI;AACF,YAAM,WAAW,IAAI,gBAAgB;AACrC,eAAS,IAAI,SAAS,SAAS,WAAW,UAAU,QAAQ;AAC5D,UAAI,YAAa,UAAS,IAAI,YAAY,WAAW;AACrD,YAAM,iBAAiB,SAAS,SAAS;AACzC,YAAM,UAAU,MAAM;AAAA,QACpB,aAAa,SAAS,SAAS,UAAU,OAAO,OAAO,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,QACjG;AAAA,QACA,EAAE,cAAc,MAAM,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AAAA,MAC/E;AACA,UAAI,aAAa,QAAS;AAC1B,YAAM,kBAAkB,QAAQ,iBAAiB;AACjD,sBAAgB,eAAe;AAC/B,yBAAmB,eAAe;AAClC,sBAAgB,CAAC,CAAC,QAAQ,YAAY;AACtC,iBAAW,sBAAsB,QAAQ,QAAQ,CAAC;AAClD,uBAAiB,QAAQ,iBAAiB,OAAO,OAAO,MAAM,QAAQ,QAAQ,aAAa,IAAI,QAAQ,gBAAgB,CAAC,CAAC;AACzH,wBAAkB,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI;AAAA,IACpF,QAAQ;AAAA,IAAC;AAAA,EACX,GAAG,CAAC,MAAM,UAAU,uBAAuB,eAAe,CAAC;AAE3D,QAAM,UAAU,MAAM;AACpB,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,QAC3B;AACA,YAAI,CAAC,UAAU,SAAS;AACtB,sBAAY,MAAM,SAAS,CAAC,CAAC;AAC7B,qBAAW,MAAM,WAAW,CAAC,CAAC;AAAA,QAChC;AAAA,MACF,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,YAAY,SAAS,SAAS;AAClD,oBAAc,UAAU;AACxB,UAAI,CAAC,UAAU,QAAS,YAAW,KAAK;AAAA,IAC1C;AACA,SAAK;AACL,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,MAAM,UAAU,aAAa,CAAC;AAElC,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,cAAc,QAAS;AAC5B,QAAI,uBAAwB;AAC5B,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,kBAAc,UAAU,SAAS;AACjC,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,UAAU,wBAAwB,aAAa,CAAC;AAEpD,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,WAAW,IAAI,gBAAgB;AACrC,cAAI,SAAU,UAAS,IAAI,YAAY,QAAQ;AAC/C,gBAAM,iBAAiB,SAAS,SAAS;AACzC,gBAAM,QAAQ,MAAM;AAAA,YAClB,+BAA+B,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,YACzE;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,UAAW,eAAc,6BAA6B,MAAM,KAAK,CAAC;AAAA,QACzE,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,UAAI,SAAS,UAAU,aAAa,UAAU,SAAS,GAAG;AACxD,YAAI;AACF,gBAAM,YAAY,IAAI,gBAAgB,EAAE,UAAU,MAAM,CAAC;AACzD,cAAI,SAAU,WAAU,IAAI,YAAY,QAAQ;AAChD,gBAAM,kBAAkB,UAAU,SAAS;AAC3C,gBAAM,YAAY,MAAM;AAAA,YACtB,kBAAkB,kBAAkB,IAAI,eAAe,KAAK,EAAE;AAAA,YAC9D;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,WAAW;AACd,kBAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,IAAI,UAAU,QAAQ,CAAC;AACrE,kBAAM,kBAAiC,mBAAmB,UAAU,SAAS;AAC7E,2BAAe,eAAe;AAAA,UAChC;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AACA,qBAAiB;AACjB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,sBAAsB,WAAW,QAAQ,CAAC;AAGpD,QAAM,UAAU,MAAM;AACpB,eAAW,EAAE,cAAc,UAAU,SAAS,cAAc,CAAC;AAAA,EAC/D,GAAG,CAAC,cAAc,SAAS,eAAe,QAAQ,CAAC;AAEnD,QAAM,UAAU,MAAM,QAAQ,MAAM;AAClC,UAAM,YAAY,oBAAI,IAAoB;AAC1C,eAAW,KAAK,SAAS;AACvB,gBAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAAA,IAC7B;AACA,UAAM,MAAM,oBAAI,IAA4E;AAC5F,eAAW,KAAK,UAAU;AACxB,YAAM,WAAW,EAAE;AACnB,YAAM,cAAc,UAAU,IAAI,QAAQ,KAAK;AAC/C,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACtB,YAAI,IAAI,UAAU,EAAE,UAAU,aAAa,UAAU,CAAC,EAAE,CAAC;AAAA,MAC3D;AACA,UAAI,IAAI,QAAQ,EAAG,SAAS,KAAK,CAAC;AAAA,IACpC;AACA,WAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,cAAc,EAAE,WAAW,CAAC;AAAA,EAC3F,GAAG,CAAC,UAAU,OAAO,CAAC;AAEtB,QAAM,oBAAoB,QAAQ,SAAS,GAAG;AAC9C,QAAM,6BAA6B,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS;AAC1F,QAAM,2BACH,SAAS,UAAU,oBACpB,wBACA,CAAC,gBACD,8BACA,QAAQ,WAAW;AAGrB,QAAM,iBAAiB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AAC9E,QAAI,CAAC,qBAAqB,UAAU,0BAA0B,QAAQ,EAAG;AACzE,kBAAc,CAAC,SAAS;AACtB,UAAI,QAAQ;AACV,YAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,eAAO,CAAC,GAAG,MAAM,QAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,OAAO,CAAC,YAAY,YAAY,QAAQ;AAAA,IACtD,CAAC;AAAA,EACH,GAAG,CAAC,mBAAmB,aAAa,CAAC;AAErC,QAAM,uBAAuB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AACpF,mBAAe,GAAG,QAAQ,MAAM,MAAM;AAAA,EACxC,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,0BAA0B,CAAC,aAAqB;AACpD,WAAO,QAAQ,SAAS,GAAG,QAAQ,IAAI;AAAA,EACzC;AAEA,QAAM,6BAA6B,CAAC,cAClC,QAAQ,KAAK,CAAC,aAAa,YAAY,OAAO,QAAQ,SAAS,IAAI,MAAM,aAAa,WAAW,OAAO,CAAC;AAE3G,QAAM,mBAAmB,CAAC,cAAsB,WAAW,SAAS,SAAS;AAE7E,MAAI,QAAS,QAAO,oBAAC,SAAI,WAAU,iCAAgC,+BAAY;AAE/E,QAAM,iBAAiB,SAAS,UAAU,CAAC,gBAAgB,CAAC;AAE5D,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,sBACC,qBAAC,SAAI,WAAU,oDACb;AAAA,0BAAC,SAAI,WAAU,0CAAyC,8CAExD;AAAA,MACA,qBAAC,SAAI,WAAU,8BAA6B;AAAA;AAAA,QAEzC,YAAY,SAAS,KACpB,qBAAC,UACE;AAAA;AAAA,UAAI;AAAA,UAAgB;AAAA,UACpB,YAAY,IAAI,CAAC,MAAM,QAAQ;AAC9B,kBAAM,SAAS,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,IAAI,KAAK,KAAK,QAAQ,GAAG;AACzF,kBAAM,WAAW,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,SAAS,IAAI,KAAK,OAAO;AACtF,mBACE,qBAAC,MAAM,UAAN,EACE;AAAA,oBAAM,KAAK;AAAA,cACZ;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAM,kBAAkB,MAAM;AAAA,kBAC9B,WAAU;AAAA,kBAET;AAAA;AAAA,cACH;AAAA,iBAPmB,MAQrB;AAAA,UAEJ,CAAC;AAAA,WACH;AAAA,SAEJ;AAAA,MACA,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,OAAO;AAAA;AAAA,QACtD;AAAA,QACA,oBAAC,WAAM,SAAQ,eAAc,WAAU,qCAAoC,qDAE3E;AAAA,SACF;AAAA,OACF;AAAA,KAEA,SAAS,UAAU,oBACnB,iCACE;AAAA,2BAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC;AAAA,YACX,UAAU,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,QACrD;AAAA,QACA,oBAAC,WAAM,SAAQ,gBAAe,WAAU,WAAU,wCAA0B;AAAA,SAC9E;AAAA,MACC,CAAC,qBACA,oBAAC,OAAE,WAAU,iCAAgC,+DAAiD;AAAA,MAEnG,CAAC,gBACA,iCACG;AAAA,6BACC,qBAAC,SAAI,WAAU,iDACb;AAAA,8BAAC,SAAI,WAAU,qCAAoC,yCAA2B;AAAA,UAC9E,oBAAC,SAAI,WAAU,8BAA6B,+DAAiD;AAAA,UAC7F;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,cAAc,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,MAAM,GAAG,CAAC;AAAA,cACrE;AAAA;AAAA,UAED;AAAA,WACF;AAAA,QAED,CAAC,qBACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA,SAAS;AAAA,YACT,iBAAiB;AAAA,YACjB,uBAAuB,QAAQ,IAAI,aAAa;AAAA;AAAA,QAClD;AAAA,QAEF,oBAAC,SAAI,WAAU,yCACZ,kBAAQ,IAAI,CAAC,UAAU;AACtB,gBAAM,iBAAiB,wBAAwB,MAAM,QAAQ;AAC7D,gBAAM,kBAAkB,MAAM;AAAA,YAC5B,IAAI;AAAA,cACF,QAAQ;AAAA,gBACN,CAAC,YACC,YAAY,OACZ,QAAQ,SAAS,IAAI,KACrB,QAAQ,WAAW,GAAG,MAAM,QAAQ,GAAG,KACvC,YAAY,GAAG,MAAM,QAAQ;AAAA,cACjC;AAAA,YACF;AAAA,UACF,EACG,IAAI,CAAC,aAAa;AACjB,kBAAM,SAAS,SAAS,MAAM,GAAG,EAAE;AACnC,kBAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC,YAAY,QAAQ,GAAG,WAAW,MAAM,CAAC;AACxF,mBAAO,EAAE,UAAU,UAAU,gBAAgB;AAAA,UAC/C,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtD,gBAAM,mBAAmB,oBAAI,IAAY;AACzC,qBAAW,SAAS,iBAAiB;AACnC,uBAAW,WAAW,MAAM,SAAU,kBAAiB,IAAI,QAAQ,EAAE;AAAA,UACvE;AACA,gBAAM,mBAAmB,CAAC,qBAAqB,0BAA0B,GAAG,MAAM,QAAQ,IAAI;AAC9F,gBAAM,yBAAyB,qBAAqB;AACpD,iBACE,qBAAC,SAAyB,WAAU,sBAClC;AAAA,iCAAC,SAAI,WAAU,wDACb;AAAA,kCAAC,SAAI,WAAU,uBAAuB,gBAAM,aAAY;AAAA,cACxD,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,UAAU,MAAM,QAAQ;AAAA,oBAC5B,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV,SAAS,kBAAkB;AAAA,oBAC3B,UAAU;AAAA,oBACV,UAAU,CAAC,MAAM,qBAAqB,MAAM,UAAU,EAAE,OAAO,OAAO;AAAA;AAAA,gBACxE;AAAA,gBACA,qBAAC,WAAM,SAAS,UAAU,MAAM,QAAQ,IAAI,WAAU,iCAAgC;AAAA;AAAA,kBAC/E,kBAAkB,CAAC,oBAAoB,qBAAC,UAAK,WAAU,6BAA4B;AAAA;AAAA,oBAAE,MAAM;AAAA,oBAAS;AAAA,qBAAG,IAAU;AAAA,kBACrH,mBAAmB,oBAAC,UAAK,WAAU,kDAAiD,sCAAwB,IAAU;AAAA,mBACzH;AAAA,iBACF;AAAA,eACF;AAAA,YACD,gBAAgB,SAAS,KACxB,oBAAC,SAAI,WAAU,kBACZ,0BAAgB,IAAI,CAAC,EAAE,UAAU,UAAU,iBAAiB,MAAM;AAC/D,oBAAM,UAAU,QAAQ,SAAS,QAAQ,KAAK,qBAAqB;AACnE,oBAAM,qBAAqB,CAAC,qBAAqB,0BAA0B,QAAQ;AACnF,oBAAM,WAAW,qBAAqB,kBAAkB;AACxD,qBACE,qBAAC,SAAmB,WAAU,aAC5B;AAAA,qCAAC,SAAI,WAAU,2BACb;AAAA;AAAA,oBAAC;AAAA;AAAA,sBACC,IAAI,YAAY,QAAQ;AAAA,sBACxB,MAAK;AAAA,sBACL,WAAU;AAAA,sBACV;AAAA,sBACA;AAAA,sBACA,UAAU,CAAC,MAAM,eAAe,UAAU,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,kBAC9D;AAAA,kBACA;AAAA,oBAAC;AAAA;AAAA,sBACC,SAAS,YAAY,QAAQ;AAAA,sBAC7B,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,sBAE5D;AAAA,4CAAoB,MAAM,UAAU,QAAQ;AAAA,wBAAG;AAAA,wBAChD,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,0BAAE;AAAA,0BAAS;AAAA,2BAAC;AAAA,wBACrE,qBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,kBACN;AAAA,mBACF;AAAA,gBACC,iBAAiB,SAAS,KACzB,qBAAC,SAAI,WAAU,8DACb;AAAA,sCAAC,SAAI,WAAU,iDAAgD,eAAW,MAAC;AAAA,kBAC1E,iBAAiB,IAAI,CAAC,OACrB,oBAAC,SAAiC,WAAU,QAC1C,+BAAC,UACE;AAAA,uBAAG;AAAA,oBAAO;AAAA,oBACX,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,sBAAE,GAAG;AAAA,sBAAG;AAAA,uBAAC;AAAA,qBACrE,KAJQ,GAAG,QAAQ,IAAI,GAAG,EAAE,EAK9B,CACD;AAAA,mBACH;AAAA,mBAlCM,QAoCV;AAAA,YAEJ,CAAC,GACH;AAAA,YAEF,oBAAC,SAAI,WAAU,aACZ,gBAAM,SAAS,IAAI,CAAC,MAAM;AACzB,kBAAI,iBAAiB,IAAI,EAAE,EAAE,EAAG,QAAO;AACvC,oBAAM,UAAU,iBAAiB,EAAE,EAAE;AACrC,oBAAM,oBAAoB,2BAA2B,EAAE,EAAE;AACzD,oBAAM,aAAa,CAAC,qBAAqB,0BAA0B,EAAE,EAAE;AACvE,oBAAM,WAAW,qBAAqB;AACtC,qBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,KAAK,EAAE,EAAE;AAAA,oBACb,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV;AAAA,oBACA;AAAA,oBACA,UAAU,CAAC,MAAM;AACf,4BAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,oCAAc,CAAC,SAAS;AACtB,4BAAI,GAAI,QAAO,CAAC,GAAG,MAAM,EAAE,EAAE;AAC7B,+BAAO,KAAK,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,sBACtC,CAAC;AAAA,oBACH;AAAA;AAAA,gBACF;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,KAAK,EAAE,EAAE;AAAA,oBAClB,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,oBAE5D;AAAA,wBAAE;AAAA,sBAAM;AAAA,sBAAC,qBAAC,UAAK,WAAU,iCAAgC;AAAA;AAAA,wBAAE,EAAE;AAAA,wBAAG;AAAA,yBAAC;AAAA,sBACjE,aACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,gBACN;AAAA,mBAzBQ,EAAE,EA0BZ;AAAA,YAEJ,CAAC,GACH;AAAA,eAvGQ,MAAM,QAwGhB;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEG,wBACC,qBAAC,SAAI,WAAU,sBACb;AAAA,4BAAC,SAAI,WAAU,4BACZ,YAAE,+BAA+B,qBAAqB,GACzD;AAAA,QACA,oBAAC,SAAI,WAAU,sCAAqC,wEAA0D;AAAA,QAC9G,oBAAC,SAAI,WAAU,yCACZ,qBAAW,IAAI,CAAC,MAAM;AACrB,gBAAM,UAAU,iBAAiB,OAAO,SAAS,iBAAiB,CAAC,GAAG,SAAS,EAAE,EAAE;AACnF,iBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA,gCAAC,WAAM,IAAI,OAAO,EAAE,EAAE,IAAI,MAAK,YAAW,WAAU,WAAU,SAAkB,UAAU,CAAC,MAAM;AAC/F,oBAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,+BAAiB,CAAC,SAAS;AACzB,oBAAI,QAAQ,KAAM,QAAO,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;AACxC,uBAAO,KAAK,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,QAAQ,CAAC,GAAI,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,cAClG,CAAC;AAAA,YACH,GAAG;AAAA,YACH,oBAAC,WAAM,SAAS,OAAO,EAAE,EAAE,IAAI,WAAU,WAAW,YAAE,MAAK;AAAA,eARnD,EAAE,EASZ;AAAA,QAEJ,CAAC,GACH;AAAA,QACA,oBAAC,SAAI,WAAU,QACb,8BAAC,UAAO,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAI,YAAE,kCAAkC,yBAAyB,GAAE,GACnI;AAAA,QACC,2BACC,oBAAC,SAAI,WAAU,qFACZ,YAAE,gCAAgC,mJAAmJ,GACxL;AAAA,SAEJ;AAAA,OAEJ;AAAA,KAEJ;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport Link from 'next/link'\nimport { hasFeature, matchFeature } from '@open-mercato/shared/security/features'\nimport { useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'\nimport { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'\n\nfunction normalizeFeatureArray(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const dedup = new Set<string>()\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction formatWildcardLabel(t: TranslateFn, moduleId: string, wildcard: string): string {\n  if (!wildcard.endsWith('.*')) return wildcard\n  const prefix = `${moduleId}.`\n  const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)\n  if (!suffix) return t('auth.acl.wildcards.allFeatures', 'All features')\n  const group = suffix\n    .split('.')\n    .map((segment) => segment.replace(/[-_]/g, ' ').replace(/\\b\\w/g, (char) => char.toUpperCase()))\n    .join(' / ')\n  return t('auth.acl.wildcards.allGroup', 'All permissions in {group}', { group })\n}\n\ntype Feature = { id: string; title: string; module: string; dependsOn?: string[] }\ntype ModuleInfo = { id: string; title: string }\ntype RoleListItem = { id?: string | null; name?: string | null }\ntype RoleListResponse = { items?: RoleListItem[] }\ntype RoleSummary = { id: string; name: string }\n\nfunction buildRoleSummaries(items: RoleListItem[], allowedNames: string[]): RoleSummary[] {\n  const summaries: RoleSummary[] = []\n  for (const role of items) {\n    const name = typeof role?.name === 'string' ? role.name : ''\n    if (!name || !allowedNames.includes(name)) continue\n    const hasValidId = typeof role?.id === 'string' && role.id.length > 0\n    const id = hasValidId ? (role!.id as string) : name\n    summaries.push({ id, name })\n  }\n  return summaries\n}\n\nexport type AclData = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype FeatureListResponse = { items?: Feature[]; modules?: ModuleInfo[] }\ntype AclPayload = {\n  hasCustomAcl?: boolean\n  isSuperAdmin?: boolean\n  features?: unknown\n  organizations?: unknown\n  updatedAt?: string | null\n}\ntype OrganizationListResponse = { items?: Array<{ id?: string; name?: string }> }\n\nfunction normalizeOrganizationOptions(items: OrganizationListResponse['items']): Array<{ id: string; name: string }> {\n  if (!Array.isArray(items)) return []\n  return items.reduce<Array<{ id: string; name: string }>>((acc, org) => {\n    if (!org) return acc\n    const id = typeof org.id === 'string' && org.id.trim().length > 0 ? org.id : null\n    if (!id) return acc\n    const name = typeof org.name === 'string' && org.name.trim().length > 0 ? org.name : id\n    acc.push({ id, name })\n    return acc\n  }, [])\n}\n\nasync function readJsonOr<T>(\n  url: string,\n  init: RequestInit | undefined,\n  fallback: T,\n): Promise<T> {\n  const call = await apiCall<T>(url, init, { fallback })\n  if (!call.ok) return fallback\n  return call.result ?? fallback\n}\n\nexport function AclEditor({\n  kind,\n  targetId,\n  canEditOrganizations,\n  value,\n  onChange,\n  onVersionChange,\n  userRoles,\n  currentUserIsSuperAdmin,\n  tenantId,\n  preserveOnTenantChange = false,\n}: {\n  kind: 'user' | 'role'\n  targetId: string\n  canEditOrganizations: boolean\n  value?: AclData\n  onChange?: (data: AclData) => void\n  /**\n   * Reports the loaded ACL row's `updatedAt` (or null when none exists) so the\n   * parent can send the optimistic-lock header on save and reject stale ACL\n   * overwrites (#2055).\n   */\n  onVersionChange?: (updatedAt: string | null) => void\n  userRoles?: string[]\n  currentUserIsSuperAdmin?: boolean\n  tenantId?: string | null\n  preserveOnTenantChange?: boolean\n}) {\n  const actorIsSuperAdmin = !!currentUserIsSuperAdmin\n  const [loading, setLoading] = React.useState(true)\n  const [features, setFeatures] = React.useState<Feature[]>([])\n  const t = useT()\n  const [modules, setModules] = React.useState<ModuleInfo[]>([])\n  const [granted, setGranted] = React.useState<string[]>(() => {\n    const normalized = normalizeFeatureArray(value?.features)\n    return actorIsSuperAdmin ? normalized : normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n  })\n  const [isSuperAdmin, setIsSuperAdmin] = React.useState(value?.isSuperAdmin || false)\n  const [organizations, setOrganizations] = React.useState<string[] | null>(value?.organizations ?? null)\n  const [orgOptions, setOrgOptions] = React.useState<{ id: string; name: string }[]>([])\n  const [hasCustomAcl, setHasCustomAcl] = React.useState(true)\n  const [overrideEnabled, setOverrideEnabled] = React.useState(false)\n  const [roleDetails, setRoleDetails] = React.useState<RoleSummary[]>([])\n\n  const actorSanitizeFeatures = React.useCallback(\n    (list: unknown): string[] => {\n      const normalized = normalizeFeatureArray(list)\n      if (actorIsSuperAdmin) return normalized\n      return normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n    },\n    [actorIsSuperAdmin],\n  )\n\n  const updateGranted = React.useCallback(\n    (updater: (prev: string[]) => string[]) => {\n      setGranted((prev) => actorSanitizeFeatures(updater(prev)))\n    },\n    [actorSanitizeFeatures],\n  )\n\n  const tenantIdRef = React.useRef(tenantId)\n  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])\n  const hasMountedRef = React.useRef(false)\n\n  const fetchAclState = React.useCallback(async (forTenantId: string | null | undefined, cancelledRef: { current: boolean }) => {\n    try {\n      const aclQuery = new URLSearchParams()\n      aclQuery.set(kind === 'user' ? 'userId' : 'roleId', targetId)\n      if (forTenantId) aclQuery.set('tenantId', forTenantId)\n      const aclQueryString = aclQuery.toString()\n      const aclJson = await readJsonOr<AclPayload>(\n        `/api/auth/${kind === 'user' ? 'users' : 'roles'}/acl${aclQueryString ? `?${aclQueryString}` : ''}`,\n        undefined,\n        { hasCustomAcl: true, isSuperAdmin: false, features: [], organizations: null },\n      )\n      if (cancelledRef.current) return\n      const customAclExists = aclJson.hasCustomAcl !== false\n      setHasCustomAcl(customAclExists)\n      setOverrideEnabled(customAclExists)\n      setIsSuperAdmin(!!aclJson.isSuperAdmin)\n      setGranted(actorSanitizeFeatures(aclJson.features))\n      setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])\n      onVersionChange?.(typeof aclJson.updatedAt === 'string' ? aclJson.updatedAt : null)\n    } catch {}\n  }, [kind, targetId, actorSanitizeFeatures, onVersionChange])\n\n  React.useEffect(() => {\n    const cancelled = { current: false }\n    async function load() {\n      setLoading(true)\n      try {\n        const fJson = await readJsonOr<FeatureListResponse>(\n          '/api/auth/features',\n          undefined,\n          { items: [], modules: [] },\n        )\n        if (!cancelled.current) {\n          setFeatures(fJson.items || [])\n          setModules(fJson.modules || [])\n        }\n      } catch {}\n      await fetchAclState(tenantIdRef.current, cancelled)\n      hasMountedRef.current = true\n      if (!cancelled.current) setLoading(false)\n    }\n    load()\n    return () => { cancelled.current = true }\n  }, [kind, targetId, fetchAclState])\n\n  React.useEffect(() => {\n    if (!hasMountedRef.current) return\n    if (preserveOnTenantChange) return\n    const cancelled = { current: false }\n    fetchAclState(tenantId, cancelled)\n    return () => { cancelled.current = true }\n  }, [tenantId, preserveOnTenantChange, fetchAclState])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadTenantScoped() {\n      if (canEditOrganizations) {\n        try {\n          const orgQuery = new URLSearchParams()\n          if (tenantId) orgQuery.set('tenantId', tenantId)\n          const orgQueryString = orgQuery.toString()\n          const oJson = await readJsonOr<OrganizationListResponse>(\n            `/api/directory/organizations${orgQueryString ? `?${orgQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) setOrgOptions(normalizeOrganizationOptions(oJson.items))\n        } catch {}\n      }\n      if (kind === 'user' && userRoles && userRoles.length > 0) {\n        try {\n          const roleQuery = new URLSearchParams({ pageSize: '100' })\n          if (tenantId) roleQuery.set('tenantId', tenantId)\n          const roleQueryString = roleQuery.toString()\n          const rolesJson = await readJsonOr<RoleListResponse>(\n            `/api/auth/roles${roleQueryString ? `?${roleQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) {\n            const allRoles = Array.isArray(rolesJson.items) ? rolesJson.items : []\n            const userRoleDetails: RoleSummary[] = buildRoleSummaries(allRoles, userRoles)\n            setRoleDetails(userRoleDetails)\n          }\n        } catch {}\n      }\n    }\n    loadTenantScoped()\n    return () => { cancelled = true }\n  }, [kind, canEditOrganizations, userRoles, tenantId])\n\n  // Notify parent of changes\n  React.useEffect(() => {\n    onChange?.({ isSuperAdmin, features: granted, organizations })\n  }, [isSuperAdmin, granted, organizations, onChange])\n\n  const grouped = React.useMemo(() => {\n    const moduleMap = new Map<string, string>()\n    for (const m of modules) {\n      moduleMap.set(m.id, t(`auth.acl.modules.${m.id}`, m.title))\n    }\n    const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()\n    for (const f of features) {\n      const moduleId = f.module\n      const moduleTitle = moduleMap.get(moduleId) || moduleId\n      const localizedFeature = {\n        ...f,\n        title: t(`auth.acl.features.${f.id}`, f.title),\n      }\n      if (!map.has(moduleId)) {\n        map.set(moduleId, { moduleId, moduleTitle, features: [] })\n      }\n      map.get(moduleId)!.features.push(localizedFeature)\n    }\n    return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))\n  }, [features, modules, t])\n\n  const localizedFeatures = React.useMemo(\n    () => grouped.flatMap((group) => group.features),\n    [grouped],\n  )\n\n  const hasGlobalWildcard = granted.includes('*')\n  const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0\n  const showOrganizationWarning =\n    (kind === 'role' || overrideEnabled) &&\n    canEditOrganizations &&\n    !isSuperAdmin &&\n    hasOrganizationRestriction &&\n    granted.length === 0\n\n  \n  const toggleWildcard = React.useCallback((wildcard: string, enable: boolean) => {\n    if (!actorIsSuperAdmin && enable && isTenantRestrictedFeature(wildcard)) return\n    updateGranted((prev) => {\n      if (enable) {\n        if (prev.includes(wildcard)) return prev\n        return [...prev, wildcard]\n      }\n      return prev.filter((feature) => feature !== wildcard)\n    })\n  }, [actorIsSuperAdmin, updateGranted])\n\n  const toggleModuleWildcard = React.useCallback((moduleId: string, enable: boolean) => {\n    toggleWildcard(`${moduleId}.*`, enable)\n  }, [toggleWildcard])\n\n  const isModuleWildcardEnabled = (moduleId: string) => {\n    return granted.includes(`${moduleId}.*`)\n  }\n\n  const isFeatureCoveredByWildcard = (featureId: string) =>\n    granted.some((feature) => (feature === '*' || feature.endsWith('.*')) && matchFeature(featureId, feature))\n\n  const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)\n\n  if (loading) {\n    return (\n      <div className=\"text-sm text-muted-foreground\">\n        {t('auth.acl.loading', 'Loading access control\u2026')}\n      </div>\n    )\n  }\n\n  const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled\n\n  return (\n    <div className=\"space-y-4\">\n      {showRoleBanner && (\n        <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n          <div className=\"text-sm font-medium text-status-info-text mb-2\">\n            {t('auth.acl.inherited.title', 'Permissions inherited from roles')}\n          </div>\n          <div className=\"text-sm text-status-info-text mb-3\">\n            {t('auth.acl.inherited.description', 'This user currently inherits permissions from their assigned roles.')}\n            {roleDetails.length > 0 && (\n              <span>\n                {' '}{t('auth.acl.inherited.assignedRoles', 'Assigned roles:')}{' '}\n                {roleDetails.map((role, idx) => {\n                  const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`\n                  const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId\n                  return (\n                    <React.Fragment key={roleId}>\n                      {idx > 0 && ', '}\n                      <Link \n                        href={`/backend/roles/${roleId}/edit`}\n                        className=\"font-semibold text-status-info-text underline\"\n                      >\n                        {roleName}\n                      </Link>\n                    </React.Fragment>\n                  )\n                })}\n              </span>\n            )}\n          </div>\n          <div className=\"flex items-center gap-2\">\n            <input \n              id=\"overrideAcl\" \n              type=\"checkbox\" \n              className=\"h-4 w-4\" \n              checked={overrideEnabled} \n              onChange={(e) => setOverrideEnabled(e.target.checked)} \n            />\n            <label htmlFor=\"overrideAcl\" className=\"text-sm text-status-info-text font-medium\">\n              {t('auth.acl.inherited.override', 'Override permissions for this user only')}\n            </label>\n          </div>\n        </div>\n      )}\n      {(kind === 'role' || overrideEnabled) && (\n        <>\n          <div className=\"flex items-center gap-2\">\n            <input\n              id=\"isSuperAdmin\"\n              type=\"checkbox\"\n              className=\"h-4 w-4\"\n              checked={isSuperAdmin}\n              disabled={!actorIsSuperAdmin}\n              onChange={(e) => setIsSuperAdmin(!!e.target.checked)}\n            />\n            <label htmlFor=\"isSuperAdmin\" className=\"text-sm\">\n              {t('auth.acl.superAdmin.label', 'Super Admin (all features)')}\n            </label>\n          </div>\n          {!actorIsSuperAdmin && (\n            <p className=\"text-xs text-muted-foreground\">\n              {t('auth.acl.superAdmin.hint', 'Only super administrators can change this option.')}\n            </p>\n          )}\n      {!isSuperAdmin && (\n        <>\n          {hasGlobalWildcard && (\n            <div className=\"rounded border border-status-info-border bg-status-info-bg p-3\">\n              <div className=\"text-sm font-medium text-status-info-text\">\n                {t('auth.acl.globalWildcard.title', 'Global wildcard (*) enabled')}\n              </div>\n              <div className=\"text-xs text-status-info-text mt-1\">\n                {t('auth.acl.globalWildcard.description', 'This grants access to all features in the system.')}\n              </div>\n              <Button\n                variant=\"outline\"\n                size=\"sm\"\n                className=\"mt-2\"\n                onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}\n              >\n                {t('auth.acl.globalWildcard.remove', 'Remove global wildcard')}\n              </Button>\n            </div>\n          )}\n          {!hasGlobalWildcard && (\n            <AclDependencyDiagnosticsPanel\n              granted={granted}\n              catalog={localizedFeatures as readonly FeatureDescriptor[]}\n              onGrantedChange={updateGranted}\n              hideUnknownReferences={process.env.NODE_ENV === 'production'}\n            />\n          )}\n          <div className=\"grid grid-cols-1 md:grid-cols-2 gap-4\">\n            {grouped.map((group) => {\n              const moduleWildcard = isModuleWildcardEnabled(group.moduleId)\n              const nestedWildcards = Array.from(\n                new Set(\n                  granted.filter(\n                    (feature) =>\n                      feature !== '*' &&\n                      feature.endsWith('.*') &&\n                      feature.startsWith(`${group.moduleId}.`) &&\n                      feature !== `${group.moduleId}.*`,\n                  ),\n                ),\n              )\n                .map((wildcard) => {\n                  const prefix = wildcard.slice(0, -1)\n                  const relatedFeatures = group.features.filter((feature) => feature.id.startsWith(prefix))\n                  return { wildcard, features: relatedFeatures }\n                })\n                .sort((a, b) => a.wildcard.localeCompare(b.wildcard))\n              const nestedCoveredIds = new Set<string>()\n              for (const entry of nestedWildcards) {\n                for (const feature of entry.features) nestedCoveredIds.add(feature.id)\n              }\n              const moduleRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(`${group.moduleId}.*`)\n              const moduleCheckboxDisabled = hasGlobalWildcard || moduleRestricted\n              return (\n                <div key={group.moduleId} className=\"rounded border p-3\">\n                  <div className=\"flex items-center justify-between mb-3 pb-2 border-b\">\n                    <div className=\"text-sm font-medium\">{group.moduleTitle}</div>\n                    <div className=\"flex items-center gap-2\">\n                      <input \n                        id={`module-${group.moduleId}`} \n                        type=\"checkbox\" \n                        className=\"h-4 w-4\" \n                        checked={moduleWildcard || hasGlobalWildcard} \n                        disabled={moduleCheckboxDisabled}\n                        onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} \n                      />\n                      <label htmlFor={`module-${group.moduleId}`} className=\"text-sm text-muted-foreground\">\n                        {t('auth.acl.allModuleFeatures', 'All')}{' '}\n                        {moduleWildcard && !hasGlobalWildcard ? <span className=\"font-medium text-status-info-text\">({group.moduleId}.*)</span> : ''}\n                        {moduleRestricted ? (\n                          <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                            {t('auth.acl.manageViaSuperAdmin', '(manage via super admin)')}\n                          </span>\n                        ) : null}\n                      </label>\n                    </div>\n                  </div>\n                {nestedWildcards.length > 0 && (\n                  <div className=\"space-y-3 mb-3\">\n                    {nestedWildcards.map(({ wildcard, features: wildcardFeatures }) => {\n                        const checked = granted.includes(wildcard) || hasGlobalWildcard || moduleWildcard\n                        const wildcardRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(wildcard)\n                        const disabled = hasGlobalWildcard || moduleWildcard || wildcardRestricted\n                        return (\n                          <div key={wildcard} className=\"space-y-2\">\n                            <div className=\"flex items-center gap-2\">\n                              <input\n                                id={`wildcard-${wildcard}`}\n                                type=\"checkbox\"\n                                className=\"h-4 w-4\"\n                                checked={checked}\n                                disabled={disabled}\n                                onChange={(e) => toggleWildcard(wildcard, !!e.target.checked)}\n                              />\n                              <label\n                                htmlFor={`wildcard-${wildcard}`}\n                                className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                              >\n                                {formatWildcardLabel(t, group.moduleId, wildcard)}{' '}\n                                <span className=\"text-muted-foreground text-xs font-mono\">({wildcard})</span>\n                                {wildcardRestricted ? (\n                                  <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                    {t('auth.acl.restricted', 'Restricted')}\n                                  </span>\n                                ) : null}\n                              </label>\n                            </div>\n                            {wildcardFeatures.length > 0 && (\n                              <div className=\"relative ml-6 pl-4 text-sm text-muted-foreground space-y-1\">\n                                <div className=\"absolute left-0 top-1 bottom-1 w-px bg-border\" aria-hidden />\n                                {wildcardFeatures.map((wf) => (\n                                  <div key={`${wildcard}-${wf.id}`} className=\"pl-2\">\n                                    <span>\n                                      {wf.title}{' '}\n                                      <span className=\"text-xs font-mono text-muted-foreground\">({wf.id})</span>\n                                    </span>\n                                  </div>\n                                ))}\n                              </div>\n                            )}\n                          </div>\n                        )\n                      })}\n                    </div>\n                  )}\n                  <div className=\"space-y-2\">\n                    {group.features.map((f) => {\n                      if (nestedCoveredIds.has(f.id)) return null\n                      const checked = isFeatureChecked(f.id)\n                      const isWildcardCovered = isFeatureCoveredByWildcard(f.id)\n                      const restricted = !actorIsSuperAdmin && isTenantRestrictedFeature(f.id)\n                      const disabled = isWildcardCovered || restricted\n                      return (\n                        <div key={f.id} className=\"flex items-center gap-2\">\n                          <input\n                            id={`f-${f.id}`}\n                            type=\"checkbox\"\n                            className=\"h-4 w-4\"\n                            checked={checked}\n                            disabled={disabled}\n                            onChange={(e) => {\n                              const on = !!e.target.checked\n                              updateGranted((prev) => {\n                                if (on) return [...prev, f.id]\n                                return prev.filter((x) => x !== f.id)\n                              })\n                            }}\n                          />\n                          <label\n                            htmlFor={`f-${f.id}`}\n                            className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                          >\n                            {f.title} <span className=\"text-muted-foreground text-xs\">({f.id})</span>\n                            {restricted ? (\n                              <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                {t('auth.acl.restricted', 'Restricted')}\n                              </span>\n                            ) : null}\n                          </label>\n                        </div>\n                      )\n                    })}\n                  </div>\n                </div>\n              )\n            })}\n          </div>\n        </>\n          )}\n          {canEditOrganizations && (\n            <div className=\"rounded border p-3\">\n              <div className=\"text-sm font-medium mb-2\">\n                {t('auth.acl.organizationsScope', 'Organizations scope')}\n              </div>\n              <div className=\"text-xs text-muted-foreground mb-2\">\n                {t('auth.acl.organizationsScopeHint', 'Empty means all organizations. Select one or more to restrict access.')}\n              </div>\n              <div className=\"grid grid-cols-1 md:grid-cols-2 gap-2\">\n                {orgOptions.map((o) => {\n                  const checked = organizations == null ? false : (organizations || []).includes(o.id)\n                  return (\n                    <div key={o.id} className=\"flex items-center gap-2\">\n                      <input id={`org-${o.id}`} type=\"checkbox\" className=\"h-4 w-4\" checked={checked} onChange={(e) => {\n                        const on = !!e.target.checked\n                        setOrganizations((prev) => {\n                          if (prev == null) return on ? [o.id] : []\n                          return on ? Array.from(new Set([...(prev || []), o.id])) : (prev || []).filter((x) => x !== o.id)\n                        })\n                      }} />\n                      <label htmlFor={`org-${o.id}`} className=\"text-sm\">{o.name}</label>\n                    </div>\n                  )\n                })}\n              </div>\n              <div className=\"mt-2\">\n                <Button variant=\"outline\" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>\n              </div>\n              {showOrganizationWarning && (\n                <div className=\"mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text\">\n                  {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}\n                </div>\n              )}\n            </div>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"],
+  "mappings": ";AA8TM,SAyEE,UAzEF,KAwBc,YAxBd;AA7TN,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,OAAO,UAAU;AACjB,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAA8B;AAEvC,SAAS,qCAAqC;AAE9C,SAAS,sBAAsB,OAA0B;AACvD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAgB,UAAkB,UAA0B;AACvF,MAAI,CAAC,SAAS,SAAS,IAAI,EAAG,QAAO;AACrC,QAAM,SAAS,GAAG,QAAQ;AAC1B,QAAM,SAAS,SAAS,WAAW,MAAM,IAAI,SAAS,MAAM,OAAO,QAAQ,EAAE,IAAI,SAAS,MAAM,GAAG,EAAE;AACrG,MAAI,CAAC,OAAQ,QAAO,EAAE,kCAAkC,cAAc;AACtE,QAAM,QAAQ,OACX,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,QAAQ,QAAQ,SAAS,GAAG,EAAE,QAAQ,SAAS,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,EAC7F,KAAK,KAAK;AACb,SAAO,EAAE,+BAA+B,8BAA8B,EAAE,MAAM,CAAC;AACjF;AAQA,SAAS,mBAAmB,OAAuB,cAAuC;AACxF,QAAM,YAA2B,CAAC;AAClC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,QAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,IAAI,EAAG;AAC3C,UAAM,aAAa,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS;AACpE,UAAM,KAAK,aAAc,KAAM,KAAgB;AAC/C,cAAU,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC7B;AACA,SAAO;AACT;AAkBA,SAAS,6BAA6B,OAA+E;AACnH,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAA4C,CAAC,KAAK,QAAQ;AACrE,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,KAAK,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,KAAK;AAC7E,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,IAAI,OAAO;AACrF,QAAI,KAAK,EAAE,IAAI,KAAK,CAAC;AACrB,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACP;AAEA,eAAe,WACb,KACA,MACA,UACY;AACZ,QAAM,OAAO,MAAM,QAAW,KAAK,MAAM,EAAE,SAAS,CAAC;AACrD,MAAI,CAAC,KAAK,GAAI,QAAO;AACrB,SAAO,KAAK,UAAU;AACxB;AAEO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAyB;AAC3B,GAgBG;AACD,QAAM,oBAAoB,CAAC,CAAC;AAC5B,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAoB,CAAC,CAAC;AAC5D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC7D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAmB,MAAM;AAC3D,UAAM,aAAa,sBAAsB,OAAO,QAAQ;AACxD,WAAO,oBAAoB,aAAa,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,EAC5G,CAAC;AACD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,OAAO,gBAAgB,KAAK;AACnF,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAA0B,OAAO,iBAAiB,IAAI;AACtG,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAyC,CAAC,CAAC;AACrF,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,IAAI;AAC3D,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAClE,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAwB,CAAC,CAAC;AAEtE,QAAM,wBAAwB,MAAM;AAAA,IAClC,CAAC,SAA4B;AAC3B,YAAM,aAAa,sBAAsB,IAAI;AAC7C,UAAI,kBAAmB,QAAO;AAC9B,aAAO,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,IAC3E;AAAA,IACA,CAAC,iBAAiB;AAAA,EACpB;AAEA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,CAAC,YAA0C;AACzC,iBAAW,CAAC,SAAS,sBAAsB,QAAQ,IAAI,CAAC,CAAC;AAAA,IAC3D;AAAA,IACA,CAAC,qBAAqB;AAAA,EACxB;AAEA,QAAM,cAAc,MAAM,OAAO,QAAQ;AACzC,QAAM,UAAU,MAAM;AAAE,gBAAY,UAAU;AAAA,EAAS,GAAG,CAAC,QAAQ,CAAC;AACpE,QAAM,gBAAgB,MAAM,OAAO,KAAK;AAExC,QAAM,gBAAgB,MAAM,YAAY,OAAO,aAAwC,iBAAuC;AAC5H,QAAI;AACF,YAAM,WAAW,IAAI,gBAAgB;AACrC,eAAS,IAAI,SAAS,SAAS,WAAW,UAAU,QAAQ;AAC5D,UAAI,YAAa,UAAS,IAAI,YAAY,WAAW;AACrD,YAAM,iBAAiB,SAAS,SAAS;AACzC,YAAM,UAAU,MAAM;AAAA,QACpB,aAAa,SAAS,SAAS,UAAU,OAAO,OAAO,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,QACjG;AAAA,QACA,EAAE,cAAc,MAAM,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AAAA,MAC/E;AACA,UAAI,aAAa,QAAS;AAC1B,YAAM,kBAAkB,QAAQ,iBAAiB;AACjD,sBAAgB,eAAe;AAC/B,yBAAmB,eAAe;AAClC,sBAAgB,CAAC,CAAC,QAAQ,YAAY;AACtC,iBAAW,sBAAsB,QAAQ,QAAQ,CAAC;AAClD,uBAAiB,QAAQ,iBAAiB,OAAO,OAAO,MAAM,QAAQ,QAAQ,aAAa,IAAI,QAAQ,gBAAgB,CAAC,CAAC;AACzH,wBAAkB,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI;AAAA,IACpF,QAAQ;AAAA,IAAC;AAAA,EACX,GAAG,CAAC,MAAM,UAAU,uBAAuB,eAAe,CAAC;AAE3D,QAAM,UAAU,MAAM;AACpB,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,QAC3B;AACA,YAAI,CAAC,UAAU,SAAS;AACtB,sBAAY,MAAM,SAAS,CAAC,CAAC;AAC7B,qBAAW,MAAM,WAAW,CAAC,CAAC;AAAA,QAChC;AAAA,MACF,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,YAAY,SAAS,SAAS;AAClD,oBAAc,UAAU;AACxB,UAAI,CAAC,UAAU,QAAS,YAAW,KAAK;AAAA,IAC1C;AACA,SAAK;AACL,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,MAAM,UAAU,aAAa,CAAC;AAElC,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,cAAc,QAAS;AAC5B,QAAI,uBAAwB;AAC5B,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,kBAAc,UAAU,SAAS;AACjC,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,UAAU,wBAAwB,aAAa,CAAC;AAEpD,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,WAAW,IAAI,gBAAgB;AACrC,cAAI,SAAU,UAAS,IAAI,YAAY,QAAQ;AAC/C,gBAAM,iBAAiB,SAAS,SAAS;AACzC,gBAAM,QAAQ,MAAM;AAAA,YAClB,+BAA+B,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,YACzE;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,UAAW,eAAc,6BAA6B,MAAM,KAAK,CAAC;AAAA,QACzE,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,UAAI,SAAS,UAAU,aAAa,UAAU,SAAS,GAAG;AACxD,YAAI;AACF,gBAAM,YAAY,IAAI,gBAAgB,EAAE,UAAU,MAAM,CAAC;AACzD,cAAI,SAAU,WAAU,IAAI,YAAY,QAAQ;AAChD,gBAAM,kBAAkB,UAAU,SAAS;AAC3C,gBAAM,YAAY,MAAM;AAAA,YACtB,kBAAkB,kBAAkB,IAAI,eAAe,KAAK,EAAE;AAAA,YAC9D;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,WAAW;AACd,kBAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,IAAI,UAAU,QAAQ,CAAC;AACrE,kBAAM,kBAAiC,mBAAmB,UAAU,SAAS;AAC7E,2BAAe,eAAe;AAAA,UAChC;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AACA,qBAAiB;AACjB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,sBAAsB,WAAW,QAAQ,CAAC;AAGpD,QAAM,UAAU,MAAM;AACpB,eAAW,EAAE,cAAc,UAAU,SAAS,cAAc,CAAC;AAAA,EAC/D,GAAG,CAAC,cAAc,SAAS,eAAe,QAAQ,CAAC;AAEnD,QAAM,UAAU,MAAM,QAAQ,MAAM;AAClC,UAAM,YAAY,oBAAI,IAAoB;AAC1C,eAAW,KAAK,SAAS;AACvB,gBAAU,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC;AAAA,IAC5D;AACA,UAAM,MAAM,oBAAI,IAA4E;AAC5F,eAAW,KAAK,UAAU;AACxB,YAAM,WAAW,EAAE;AACnB,YAAM,cAAc,UAAU,IAAI,QAAQ,KAAK;AAC/C,YAAM,mBAAmB;AAAA,QACvB,GAAG;AAAA,QACH,OAAO,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK;AAAA,MAC/C;AACA,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACtB,YAAI,IAAI,UAAU,EAAE,UAAU,aAAa,UAAU,CAAC,EAAE,CAAC;AAAA,MAC3D;AACA,UAAI,IAAI,QAAQ,EAAG,SAAS,KAAK,gBAAgB;AAAA,IACnD;AACA,WAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,cAAc,EAAE,WAAW,CAAC;AAAA,EAC3F,GAAG,CAAC,UAAU,SAAS,CAAC,CAAC;AAEzB,QAAM,oBAAoB,MAAM;AAAA,IAC9B,MAAM,QAAQ,QAAQ,CAAC,UAAU,MAAM,QAAQ;AAAA,IAC/C,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,oBAAoB,QAAQ,SAAS,GAAG;AAC9C,QAAM,6BAA6B,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS;AAC1F,QAAM,2BACH,SAAS,UAAU,oBACpB,wBACA,CAAC,gBACD,8BACA,QAAQ,WAAW;AAGrB,QAAM,iBAAiB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AAC9E,QAAI,CAAC,qBAAqB,UAAU,0BAA0B,QAAQ,EAAG;AACzE,kBAAc,CAAC,SAAS;AACtB,UAAI,QAAQ;AACV,YAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,eAAO,CAAC,GAAG,MAAM,QAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,OAAO,CAAC,YAAY,YAAY,QAAQ;AAAA,IACtD,CAAC;AAAA,EACH,GAAG,CAAC,mBAAmB,aAAa,CAAC;AAErC,QAAM,uBAAuB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AACpF,mBAAe,GAAG,QAAQ,MAAM,MAAM;AAAA,EACxC,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,0BAA0B,CAAC,aAAqB;AACpD,WAAO,QAAQ,SAAS,GAAG,QAAQ,IAAI;AAAA,EACzC;AAEA,QAAM,6BAA6B,CAAC,cAClC,QAAQ,KAAK,CAAC,aAAa,YAAY,OAAO,QAAQ,SAAS,IAAI,MAAM,aAAa,WAAW,OAAO,CAAC;AAE3G,QAAM,mBAAmB,CAAC,cAAsB,WAAW,SAAS,SAAS;AAE7E,MAAI,SAAS;AACX,WACE,oBAAC,SAAI,WAAU,iCACZ,YAAE,oBAAoB,8BAAyB,GAClD;AAAA,EAEJ;AAEA,QAAM,iBAAiB,SAAS,UAAU,CAAC,gBAAgB,CAAC;AAE5D,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,sBACC,qBAAC,SAAI,WAAU,qEACb;AAAA,0BAAC,SAAI,WAAU,kDACZ,YAAE,4BAA4B,kCAAkC,GACnE;AAAA,MACA,qBAAC,SAAI,WAAU,sCACZ;AAAA,UAAE,kCAAkC,qEAAqE;AAAA,QACzG,YAAY,SAAS,KACpB,qBAAC,UACE;AAAA;AAAA,UAAK,EAAE,oCAAoC,iBAAiB;AAAA,UAAG;AAAA,UAC/D,YAAY,IAAI,CAAC,MAAM,QAAQ;AAC9B,kBAAM,SAAS,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,IAAI,KAAK,KAAK,QAAQ,GAAG;AACzF,kBAAM,WAAW,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,SAAS,IAAI,KAAK,OAAO;AACtF,mBACE,qBAAC,MAAM,UAAN,EACE;AAAA,oBAAM,KAAK;AAAA,cACZ;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAM,kBAAkB,MAAM;AAAA,kBAC9B,WAAU;AAAA,kBAET;AAAA;AAAA,cACH;AAAA,iBAPmB,MAQrB;AAAA,UAEJ,CAAC;AAAA,WACH;AAAA,SAEJ;AAAA,MACA,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,OAAO;AAAA;AAAA,QACtD;AAAA,QACA,oBAAC,WAAM,SAAQ,eAAc,WAAU,6CACpC,YAAE,+BAA+B,yCAAyC,GAC7E;AAAA,SACF;AAAA,OACF;AAAA,KAEA,SAAS,UAAU,oBACnB,iCACE;AAAA,2BAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC;AAAA,YACX,UAAU,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,QACrD;AAAA,QACA,oBAAC,WAAM,SAAQ,gBAAe,WAAU,WACrC,YAAE,6BAA6B,4BAA4B,GAC9D;AAAA,SACF;AAAA,MACC,CAAC,qBACA,oBAAC,OAAE,WAAU,iCACV,YAAE,4BAA4B,mDAAmD,GACpF;AAAA,MAEL,CAAC,gBACA,iCACG;AAAA,6BACC,qBAAC,SAAI,WAAU,kEACb;AAAA,8BAAC,SAAI,WAAU,6CACZ,YAAE,iCAAiC,6BAA6B,GACnE;AAAA,UACA,oBAAC,SAAI,WAAU,sCACZ,YAAE,uCAAuC,mDAAmD,GAC/F;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,cAAc,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,MAAM,GAAG,CAAC;AAAA,cAEnE,YAAE,kCAAkC,wBAAwB;AAAA;AAAA,UAC/D;AAAA,WACF;AAAA,QAED,CAAC,qBACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA,SAAS;AAAA,YACT,iBAAiB;AAAA,YACjB,uBAAuB,QAAQ,IAAI,aAAa;AAAA;AAAA,QAClD;AAAA,QAEF,oBAAC,SAAI,WAAU,yCACZ,kBAAQ,IAAI,CAAC,UAAU;AACtB,gBAAM,iBAAiB,wBAAwB,MAAM,QAAQ;AAC7D,gBAAM,kBAAkB,MAAM;AAAA,YAC5B,IAAI;AAAA,cACF,QAAQ;AAAA,gBACN,CAAC,YACC,YAAY,OACZ,QAAQ,SAAS,IAAI,KACrB,QAAQ,WAAW,GAAG,MAAM,QAAQ,GAAG,KACvC,YAAY,GAAG,MAAM,QAAQ;AAAA,cACjC;AAAA,YACF;AAAA,UACF,EACG,IAAI,CAAC,aAAa;AACjB,kBAAM,SAAS,SAAS,MAAM,GAAG,EAAE;AACnC,kBAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC,YAAY,QAAQ,GAAG,WAAW,MAAM,CAAC;AACxF,mBAAO,EAAE,UAAU,UAAU,gBAAgB;AAAA,UAC/C,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtD,gBAAM,mBAAmB,oBAAI,IAAY;AACzC,qBAAW,SAAS,iBAAiB;AACnC,uBAAW,WAAW,MAAM,SAAU,kBAAiB,IAAI,QAAQ,EAAE;AAAA,UACvE;AACA,gBAAM,mBAAmB,CAAC,qBAAqB,0BAA0B,GAAG,MAAM,QAAQ,IAAI;AAC9F,gBAAM,yBAAyB,qBAAqB;AACpD,iBACE,qBAAC,SAAyB,WAAU,sBAClC;AAAA,iCAAC,SAAI,WAAU,wDACb;AAAA,kCAAC,SAAI,WAAU,uBAAuB,gBAAM,aAAY;AAAA,cACxD,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,UAAU,MAAM,QAAQ;AAAA,oBAC5B,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV,SAAS,kBAAkB;AAAA,oBAC3B,UAAU;AAAA,oBACV,UAAU,CAAC,MAAM,qBAAqB,MAAM,UAAU,EAAE,OAAO,OAAO;AAAA;AAAA,gBACxE;AAAA,gBACA,qBAAC,WAAM,SAAS,UAAU,MAAM,QAAQ,IAAI,WAAU,iCACnD;AAAA,oBAAE,8BAA8B,KAAK;AAAA,kBAAG;AAAA,kBACxC,kBAAkB,CAAC,oBAAoB,qBAAC,UAAK,WAAU,qCAAoC;AAAA;AAAA,oBAAE,MAAM;AAAA,oBAAS;AAAA,qBAAG,IAAU;AAAA,kBACzH,mBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,gCAAgC,0BAA0B,GAC/D,IACE;AAAA,mBACN;AAAA,iBACF;AAAA,eACF;AAAA,YACD,gBAAgB,SAAS,KACxB,oBAAC,SAAI,WAAU,kBACZ,0BAAgB,IAAI,CAAC,EAAE,UAAU,UAAU,iBAAiB,MAAM;AAC/D,oBAAM,UAAU,QAAQ,SAAS,QAAQ,KAAK,qBAAqB;AACnE,oBAAM,qBAAqB,CAAC,qBAAqB,0BAA0B,QAAQ;AACnF,oBAAM,WAAW,qBAAqB,kBAAkB;AACxD,qBACE,qBAAC,SAAmB,WAAU,aAC5B;AAAA,qCAAC,SAAI,WAAU,2BACb;AAAA;AAAA,oBAAC;AAAA;AAAA,sBACC,IAAI,YAAY,QAAQ;AAAA,sBACxB,MAAK;AAAA,sBACL,WAAU;AAAA,sBACV;AAAA,sBACA;AAAA,sBACA,UAAU,CAAC,MAAM,eAAe,UAAU,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,kBAC9D;AAAA,kBACA;AAAA,oBAAC;AAAA;AAAA,sBACC,SAAS,YAAY,QAAQ;AAAA,sBAC7B,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,sBAE5D;AAAA,4CAAoB,GAAG,MAAM,UAAU,QAAQ;AAAA,wBAAG;AAAA,wBACnD,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,0BAAE;AAAA,0BAAS;AAAA,2BAAC;AAAA,wBACrE,qBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,kBACN;AAAA,mBACF;AAAA,gBACC,iBAAiB,SAAS,KACzB,qBAAC,SAAI,WAAU,8DACb;AAAA,sCAAC,SAAI,WAAU,iDAAgD,eAAW,MAAC;AAAA,kBAC1E,iBAAiB,IAAI,CAAC,OACrB,oBAAC,SAAiC,WAAU,QAC1C,+BAAC,UACE;AAAA,uBAAG;AAAA,oBAAO;AAAA,oBACX,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,sBAAE,GAAG;AAAA,sBAAG;AAAA,uBAAC;AAAA,qBACrE,KAJQ,GAAG,QAAQ,IAAI,GAAG,EAAE,EAK9B,CACD;AAAA,mBACH;AAAA,mBAlCM,QAoCV;AAAA,YAEJ,CAAC,GACH;AAAA,YAEF,oBAAC,SAAI,WAAU,aACZ,gBAAM,SAAS,IAAI,CAAC,MAAM;AACzB,kBAAI,iBAAiB,IAAI,EAAE,EAAE,EAAG,QAAO;AACvC,oBAAM,UAAU,iBAAiB,EAAE,EAAE;AACrC,oBAAM,oBAAoB,2BAA2B,EAAE,EAAE;AACzD,oBAAM,aAAa,CAAC,qBAAqB,0BAA0B,EAAE,EAAE;AACvE,oBAAM,WAAW,qBAAqB;AACtC,qBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,KAAK,EAAE,EAAE;AAAA,oBACb,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV;AAAA,oBACA;AAAA,oBACA,UAAU,CAAC,MAAM;AACf,4BAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,oCAAc,CAAC,SAAS;AACtB,4BAAI,GAAI,QAAO,CAAC,GAAG,MAAM,EAAE,EAAE;AAC7B,+BAAO,KAAK,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,sBACtC,CAAC;AAAA,oBACH;AAAA;AAAA,gBACF;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,KAAK,EAAE,EAAE;AAAA,oBAClB,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,oBAE5D;AAAA,wBAAE;AAAA,sBAAM;AAAA,sBAAC,qBAAC,UAAK,WAAU,iCAAgC;AAAA;AAAA,wBAAE,EAAE;AAAA,wBAAG;AAAA,yBAAC;AAAA,sBACjE,aACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,gBACN;AAAA,mBAzBQ,EAAE,EA0BZ;AAAA,YAEJ,CAAC,GACH;AAAA,eA5GQ,MAAM,QA6GhB;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEG,wBACC,qBAAC,SAAI,WAAU,sBACb;AAAA,4BAAC,SAAI,WAAU,4BACZ,YAAE,+BAA+B,qBAAqB,GACzD;AAAA,QACA,oBAAC,SAAI,WAAU,sCACZ,YAAE,mCAAmC,uEAAuE,GAC/G;AAAA,QACA,oBAAC,SAAI,WAAU,yCACZ,qBAAW,IAAI,CAAC,MAAM;AACrB,gBAAM,UAAU,iBAAiB,OAAO,SAAS,iBAAiB,CAAC,GAAG,SAAS,EAAE,EAAE;AACnF,iBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA,gCAAC,WAAM,IAAI,OAAO,EAAE,EAAE,IAAI,MAAK,YAAW,WAAU,WAAU,SAAkB,UAAU,CAAC,MAAM;AAC/F,oBAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,+BAAiB,CAAC,SAAS;AACzB,oBAAI,QAAQ,KAAM,QAAO,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;AACxC,uBAAO,KAAK,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,QAAQ,CAAC,GAAI,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,cAClG,CAAC;AAAA,YACH,GAAG;AAAA,YACH,oBAAC,WAAM,SAAS,OAAO,EAAE,EAAE,IAAI,WAAU,WAAW,YAAE,MAAK;AAAA,eARnD,EAAE,EASZ;AAAA,QAEJ,CAAC,GACH;AAAA,QACA,oBAAC,SAAI,WAAU,QACb,8BAAC,UAAO,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAI,YAAE,kCAAkC,yBAAyB,GAAE,GACnI;AAAA,QACC,2BACC,oBAAC,SAAI,WAAU,oHACZ,YAAE,gCAAgC,mJAAmJ,GACxL;AAAA,SAEJ;AAAA,OAEJ;AAAA,KAEJ;AAEJ;",
   "names": []
 }

package/dist/modules/auth/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/data/entities.ts"],
-  "sourcesContent": ["import { Entity, Index, ManyToOne, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'users' })\n// Email uniqueness is per-tenant, enforced by a partial unique index\n// (`users_tenant_email_hash_uniq`) on `(tenant_id, email_hash)` over live rows\n// (`WHERE deleted_at IS NULL AND email_hash IS NOT NULL`), owned by raw SQL in\n// Migration20260610120000. It keys on the deterministic `email_hash`, not `email`, because\n// `email` is encrypted at rest with a per-row IV (see encryption.ts) \u2014 its ciphertext is\n// non-deterministic, so a unique index on it would not detect duplicates. A `@Unique`\n// decorator can't express a partial, tenant-scoped index, so the entity omits it \u2014 the\n// migration is the source of truth. A global unique constraint contradicts the multi-tenant\n// login flow and leaks cross-tenant account existence (#2934). Mirrors\n// `customer_users_tenant_email_hash_uniq`.\nexport class User {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  email!: string\n\n  @Property({ name: 'email_hash', type: 'text', nullable: true })\n  @Index({ name: 'users_email_hash_idx' })\n  emailHash?: string | null\n\n  @Property({ type: 'text', nullable: true })\n  name?: string | null\n\n  @Property({ name: 'password_hash', type: 'text', nullable: true })\n  passwordHash?: string | null\n\n  @Property({ name: 'is_confirmed', type: 'boolean', default: true })\n  isConfirmed: boolean = true\n\n  @Property({ name: 'last_login_at', type: Date, nullable: true })\n  lastLoginAt?: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date | null\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'roles' })\n@Unique({ properties: ['tenantId', 'name'] })\nexport class Role {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'min_active_holders', type: 'integer', default: 0 })\n  minActiveHolders: number = 0\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date | null\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'user_sidebar_preferences' })\n// Uniqueness is enforced by a partial unique index (`user_sidebar_preferences_active_unique_idx`)\n// scoped to live rows (`WHERE deleted_at IS NULL`) and owned by raw SQL in\n// Migration20260427143311. A `@Unique` decorator can't express a partial index,\n// so the entity intentionally omits it \u2014 the migration is the source of truth.\nexport class UserSidebarPreference {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  locale!: string\n\n  @Property({ name: 'settings_json', type: 'json', nullable: true })\n  settingsJson?: unknown\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'role_sidebar_preferences' })\n// Uniqueness is enforced by a partial unique index (`role_sidebar_preferences_active_unique_idx`)\n// scoped to live rows (`WHERE deleted_at IS NULL`) and owned by raw SQL in\n// Migration20260427143311. A `@Unique` decorator can't express a partial index,\n// so the entity intentionally omits it \u2014 the migration is the source of truth.\nexport class RoleSidebarPreference {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => Role)\n  role!: Role\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ type: 'text' })\n  locale!: string\n\n  @Property({ name: 'settings_json', type: 'json', nullable: true })\n  settingsJson?: unknown\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sidebar_variants' })\n// Uniqueness is enforced by a partial unique index (`sidebar_variants_active_name_unique_idx`)\n// scoped to live rows (`WHERE deleted_at IS NULL`) and owned by raw SQL in\n// Migration20260427143311. A `@Unique` decorator can't express a partial index,\n// so the entity intentionally omits it \u2014 the migration is the source of truth.\nexport class SidebarVariant {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  locale!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'settings_json', type: 'json', nullable: true })\n  settingsJson?: unknown\n\n  @Property({ name: 'is_active', type: 'boolean', default: false })\n  isActive: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'user_roles' })\n@Index({ name: 'user_roles_user_id_idx', properties: ['user'] })\n@Index({ name: 'user_roles_role_id_idx', properties: ['role'] })\nexport class UserRole {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @ManyToOne(() => Role)\n  role!: Role\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sessions' })\nexport class Session {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ type: 'text', unique: true })\n  token!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'password_resets' })\nexport class PasswordReset {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ type: 'text', unique: true })\n  token!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n// RBAC: Role-level ACL\n@Entity({ tableName: 'role_acls' })\nexport class RoleAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => Role)\n  role!: Role\n\n  // Tenant scope is mandatory for ACL evaluation\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  // Feature list (string-based). Use JSON array to preserve order and allow wildcards like \"example.*\".\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  // If true, user with this role can do everything regardless of features\n  @Property({ name: 'is_super_admin', type: 'boolean', default: false })\n  isSuperAdmin: boolean = false\n\n  // Visible organizations within the tenant; null/empty means all organizations\n  @Property({ name: 'organizations_json', type: 'json', nullable: true })\n  organizationsJson?: string[] | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n// RBAC: Per-user ACL override\n@Entity({ tableName: 'user_acls' })\nexport class UserAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  // Tenant scope is mandatory for ACL evaluation\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  // Feature list (string-based). Use JSON array to preserve order and allow wildcards like \"example.*\".\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  // If true, this user can do everything regardless of features\n  @Property({ name: 'is_super_admin', type: 'boolean', default: false })\n  isSuperAdmin: boolean = false\n\n  // Visible organizations within the tenant; null/empty means all organizations\n  @Property({ name: 'organizations_json', type: 'json', nullable: true })\n  organizationsJson?: string[] | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'user_consents' })\n@Unique({ properties: ['userId', 'tenantId', 'consentType'] })\nexport class UserConsent {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'consent_type', type: 'text' })\n  consentType!: string\n\n  @Property({ name: 'is_granted', type: 'boolean', default: false })\n  isGranted: boolean = false\n\n  @Property({ name: 'granted_at', type: Date, nullable: true })\n  grantedAt?: Date | null\n\n  @Property({ name: 'withdrawn_at', type: Date, nullable: true })\n  withdrawnAt?: Date | null\n\n  @Property({ type: 'text', nullable: true })\n  source?: string | null\n\n  @Property({ name: 'ip_address', type: 'text', nullable: true })\n  ipAddress?: string | null\n\n  @Property({ name: 'integrity_hash', type: 'text', nullable: true })\n  integrityHash?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,WAAW,YAAY,UAAU,cAAc;AAahE,IAAM,OAAN,MAAW;AAAA,EAAX;AAwBL,uBAAuB;AAMvB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAnCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,KAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,KAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,KAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,KAWX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC7D,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAAA,GAd5B,KAeX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjB/B,KAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApBtD,KAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAvBvD,KAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA1BpD,KA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7B7D,KA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAhCzG,KAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnCjD,KAoCX;AApCW,OAAN;AAAA,EAXN,OAAO,EAAE,WAAW,QAAQ,CAAC;AAAA,GAWjB;AAyCN,IAAM,OAAN,MAAW;AAAA,EAAX;AAWL,4BAA2B;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,KAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,KAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,KAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,WAAW,SAAS,EAAE,CAAC;AAAA,GAV1D,KAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAb7D,KAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAhBzG,KAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,KAoBX;AApBW,OAAN;AAAA,EAFN,OAAO,EAAE,WAAW,QAAQ,CAAC;AAAA,EAC7B,OAAO,EAAE,YAAY,CAAC,YAAY,MAAM,EAAE,CAAC;AAAA,GAC/B;AA4BN,IAAM,wBAAN,MAA4B;AAAA,EAA5B;AAoBL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAzBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,sBAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,sBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,sBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,sBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,sBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBtD,sBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,sBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAtB7E,sBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAzBjD,sBA0BX;AA1BW,wBAAN;AAAA,EALN,OAAO,EAAE,WAAW,2BAA2B,CAAC;AAAA,GAKpC;AAkCN,IAAM,wBAAN,MAA4B;AAAA,EAA5B;AAiBL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,sBAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,sBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,sBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,sBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbtD,sBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,sBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAnB7E,sBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBjD,sBAuBX;AAvBW,wBAAN;AAAA,EALN,OAAO,EAAE,WAAW,2BAA2B,CAAC;AAAA,GAKpC;AA+BN,IAAM,iBAAN,MAAqB;AAAA,EAArB;AAuBL,oBAAoB;AAGpB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,eAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,eAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,eAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,eAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,eAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAhBf,eAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBtD,eAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAtBrD,eAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzB7D,eA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA5B7E,eA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA/BjD,eAgCX;AAhCW,iBAAN;AAAA,EALN,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,GAK5B;AAsCN,IAAM,WAAN,MAAe;AAAA,EAAf;AAWL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAbE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,SAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,SAKX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAPV,SAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAV7D,SAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAbjD,SAcX;AAdW,WAAN;AAAA,EAHN,OAAO,EAAE,WAAW,aAAa,CAAC;AAAA,EAClC,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,EAC9D,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,GAClD;AAkBN,IAAM,UAAN,MAAc;AAAA,EAAd;AAcL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,QAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,QAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AAAA,GAP7B,QAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAVjC,QAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAb7D,QAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhBnD,QAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,QAoBX;AApBW,UAAN;AAAA,EADN,OAAO,EAAE,WAAW,WAAW,CAAC;AAAA,GACpB;AAwBN,IAAM,gBAAN,MAAoB;AAAA,EAApB;AAiBL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,cAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,cAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AAAA,GAP7B,cAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAVjC,cAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAb9C,cAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,cAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,cAoBX;AApBW,gBAAN;AAAA,EADN,OAAO,EAAE,WAAW,kBAAkB,CAAC;AAAA,GAC3B;AAyBN,IAAM,UAAN,MAAc;AAAA,EAAd;AAiBL,wBAAwB;AAOxB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA7BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,QAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,QAKX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GARlC,QASX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZtD,QAaX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAhB1D,QAiBX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApB3D,QAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAvB7D,QAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA1BzG,QA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7BjD,QA8BX;AA9BW,UAAN;AAAA,EADN,OAAO,EAAE,WAAW,YAAY,CAAC;AAAA,GACrB;AAmCN,IAAM,UAAN,MAAc;AAAA,EAAd;AAiBL,wBAAwB;AAOxB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA7BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,QAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,QAKX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GARlC,QASX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZtD,QAaX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAhB1D,QAiBX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApB3D,QAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAvB7D,QAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA1BzG,QA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7BjD,QA8BX;AA9BW,UAAN;AAAA,EADN,OAAO,EAAE,WAAW,YAAY,CAAC;AAAA,GACrB;AAmCN,IAAM,cAAN,MAAkB;AAAA,EAAlB;AAiBL,qBAAqB;AAkBrB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAxCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,YAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,YAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,YAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,YAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAbrC,YAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAhBtD,YAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,YAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBnD,YAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzB/B,YA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BnD,YA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/BvD,YAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlC7D,YAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GArC7E,YAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAxCjD,YAyCX;AAzCW,cAAN;AAAA,EAFN,OAAO,EAAE,WAAW,gBAAgB,CAAC;AAAA,EACrC,OAAO,EAAE,YAAY,CAAC,UAAU,YAAY,aAAa,EAAE,CAAC;AAAA,GAChD;",
+  "sourcesContent": ["import { Entity, Index, ManyToOne, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'users' })\n// Email uniqueness is per-tenant, enforced by a partial unique index\n// (`users_tenant_email_hash_uniq`) on `(tenant_id, email_hash)` over live rows\n// (`WHERE deleted_at IS NULL AND email_hash IS NOT NULL`), owned by raw SQL in\n// Migration20260610120000. It keys on the deterministic `email_hash`, not `email`, because\n// `email` is encrypted at rest with a per-row IV (see encryption.ts) \u2014 its ciphertext is\n// non-deterministic, so a unique index on it would not detect duplicates. A `@Unique`\n// decorator can't express a partial, tenant-scoped index, so the entity omits it \u2014 the\n// migration is the source of truth. A global unique constraint contradicts the multi-tenant\n// login flow and leaks cross-tenant account existence (#2934). Mirrors\n// `customer_users_tenant_email_hash_uniq`.\nexport class User {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  email!: string\n\n  @Property({ name: 'email_hash', type: 'text', nullable: true })\n  @Index({ name: 'users_email_hash_idx' })\n  emailHash?: string | null\n\n  @Property({ type: 'text', nullable: true })\n  name?: string | null\n\n  @Property({ name: 'password_hash', type: 'text', nullable: true })\n  passwordHash?: string | null\n\n  @Property({ name: 'is_confirmed', type: 'boolean', default: true })\n  isConfirmed: boolean = true\n\n  @Property({ name: 'last_login_at', type: Date, nullable: true })\n  lastLoginAt?: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date | null\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'roles' })\n@Unique({ properties: ['tenantId', 'name'] })\nexport class Role {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'min_active_holders', type: 'integer', default: 0 })\n  minActiveHolders: number = 0\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date | null\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'user_sidebar_preferences' })\n// Uniqueness is enforced by a partial unique index (`user_sidebar_preferences_active_unique_idx`)\n// scoped to live rows (`WHERE deleted_at IS NULL`) and owned by raw SQL in\n// Migration20260427143311. A `@Unique` decorator can't express a partial index,\n// so the entity intentionally omits it \u2014 the migration is the source of truth.\nexport class UserSidebarPreference {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  locale!: string\n\n  @Property({ name: 'settings_json', type: 'json', nullable: true })\n  settingsJson?: unknown\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'role_sidebar_preferences' })\n// Uniqueness is enforced by a partial unique index (`role_sidebar_preferences_active_unique_idx`)\n// scoped to live rows (`WHERE deleted_at IS NULL`) and owned by raw SQL in\n// Migration20260427143311. A `@Unique` decorator can't express a partial index,\n// so the entity intentionally omits it \u2014 the migration is the source of truth.\nexport class RoleSidebarPreference {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => Role)\n  role!: Role\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ type: 'text' })\n  locale!: string\n\n  @Property({ name: 'settings_json', type: 'json', nullable: true })\n  settingsJson?: unknown\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sidebar_variants' })\n// Uniqueness is enforced by a partial unique index (`sidebar_variants_active_name_unique_idx`)\n// scoped to live rows (`WHERE deleted_at IS NULL`) and owned by raw SQL in\n// Migration20260427143311. A `@Unique` decorator can't express a partial index,\n// so the entity intentionally omits it \u2014 the migration is the source of truth.\nexport class SidebarVariant {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  locale!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'settings_json', type: 'json', nullable: true })\n  settingsJson?: unknown\n\n  @Property({ name: 'is_active', type: 'boolean', default: false })\n  isActive: boolean = false\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'user_roles' })\n@Index({ name: 'user_roles_user_id_idx', properties: ['user'] })\n@Index({ name: 'user_roles_role_id_idx', properties: ['role'] })\nexport class UserRole {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @ManyToOne(() => Role)\n  role!: Role\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sessions' })\nexport class Session {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ type: 'text', unique: true })\n  token!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'password_resets' })\nexport class PasswordReset {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  @Property({ type: 'text', unique: true })\n  token!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n// RBAC: Role-level ACL\n@Entity({ tableName: 'role_acls' })\nexport class RoleAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => Role)\n  role!: Role\n\n  // Tenant scope is mandatory for ACL evaluation\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  // Feature list (string-based). Use JSON array to preserve order and allow wildcards like \"example.*\".\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  // If true, user with this role can do everything regardless of features\n  @Property({ name: 'is_super_admin', type: 'boolean', default: false })\n  isSuperAdmin: boolean = false\n\n  // Visible organizations within the tenant. `null` or the `__all__` sentinel means every\n  // organization. An EMPTY array is a deny-all scope for human principals \u2014 it projects to an\n  // empty accessible set so scoped reads and deletes fail closed (#4033). API-key principals\n  // read an empty list as \"inherit the key's own organization binding\" instead.\n  @Property({ name: 'organizations_json', type: 'json', nullable: true })\n  organizationsJson?: string[] | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n// RBAC: Per-user ACL override\n@Entity({ tableName: 'user_acls' })\nexport class UserAcl {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @ManyToOne(() => User)\n  user!: User\n\n  // Tenant scope is mandatory for ACL evaluation\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  // Feature list (string-based). Use JSON array to preserve order and allow wildcards like \"example.*\".\n  @Property({ name: 'features_json', type: 'json', nullable: true })\n  featuresJson?: string[] | null\n\n  // If true, this user can do everything regardless of features\n  @Property({ name: 'is_super_admin', type: 'boolean', default: false })\n  isSuperAdmin: boolean = false\n\n  // Visible organizations within the tenant; null/empty means all organizations\n  @Property({ name: 'organizations_json', type: 'json', nullable: true })\n  organizationsJson?: string[] | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'user_consents' })\n@Unique({ properties: ['userId', 'tenantId', 'consentType'] })\nexport class UserConsent {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'consent_type', type: 'text' })\n  consentType!: string\n\n  @Property({ name: 'is_granted', type: 'boolean', default: false })\n  isGranted: boolean = false\n\n  @Property({ name: 'granted_at', type: Date, nullable: true })\n  grantedAt?: Date | null\n\n  @Property({ name: 'withdrawn_at', type: Date, nullable: true })\n  withdrawnAt?: Date | null\n\n  @Property({ type: 'text', nullable: true })\n  source?: string | null\n\n  @Property({ name: 'ip_address', type: 'text', nullable: true })\n  ipAddress?: string | null\n\n  @Property({ name: 'integrity_hash', type: 'text', nullable: true })\n  integrityHash?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,WAAW,YAAY,UAAU,cAAc;AAahE,IAAM,OAAN,MAAW;AAAA,EAAX;AAwBL,uBAAuB;AAMvB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAnCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,KAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,KAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,KAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,KAWX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC7D,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAAA,GAd5B,KAeX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjB/B,KAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApBtD,KAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAvBvD,KAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA1BpD,KA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7B7D,KA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAhCzG,KAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnCjD,KAoCX;AApCW,OAAN;AAAA,EAXN,OAAO,EAAE,WAAW,QAAQ,CAAC;AAAA,GAWjB;AAyCN,IAAM,OAAN,MAAW;AAAA,EAAX;AAWL,4BAA2B;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,KAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,KAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,KAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,WAAW,SAAS,EAAE,CAAC;AAAA,GAV1D,KAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAb7D,KAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAhBzG,KAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,KAoBX;AApBW,OAAN;AAAA,EAFN,OAAO,EAAE,WAAW,QAAQ,CAAC;AAAA,EAC7B,OAAO,EAAE,YAAY,CAAC,YAAY,MAAM,EAAE,CAAC;AAAA,GAC/B;AA4BN,IAAM,wBAAN,MAA4B;AAAA,EAA5B;AAoBL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAzBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,sBAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,sBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,sBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,sBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,sBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBtD,sBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,sBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAtB7E,sBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAzBjD,sBA0BX;AA1BW,wBAAN;AAAA,EALN,OAAO,EAAE,WAAW,2BAA2B,CAAC;AAAA,GAKpC;AAkCN,IAAM,wBAAN,MAA4B;AAAA,EAA5B;AAiBL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAtBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,sBAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,sBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,sBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAVf,sBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbtD,sBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,sBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GAnB7E,sBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBjD,sBAuBX;AAvBW,wBAAN;AAAA,EALN,OAAO,EAAE,WAAW,2BAA2B,CAAC;AAAA,GAKpC;AA+BN,IAAM,iBAAN,MAAqB;AAAA,EAArB;AAuBL,oBAAoB;AAGpB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,eAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,eAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,eAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,eAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,eAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAhBf,eAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBtD,eAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAtBrD,eAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzB7D,eA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA5B7E,eA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA/BjD,eAgCX;AAhCW,iBAAN;AAAA,EALN,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,GAK5B;AAsCN,IAAM,WAAN,MAAe;AAAA,EAAf;AAWL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAbE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,SAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,SAKX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAPV,SAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAV7D,SAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAbjD,SAcX;AAdW,WAAN;AAAA,EAHN,OAAO,EAAE,WAAW,aAAa,CAAC;AAAA,EAClC,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,EAC9D,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,GAClD;AAkBN,IAAM,UAAN,MAAc;AAAA,EAAd;AAcL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,QAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,QAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AAAA,GAP7B,QAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAVjC,QAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAb7D,QAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhBnD,QAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,QAoBX;AApBW,UAAN;AAAA,EADN,OAAO,EAAE,WAAW,WAAW,CAAC;AAAA,GACpB;AAwBN,IAAM,gBAAN,MAAoB;AAAA,EAApB;AAiBL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,cAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,cAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AAAA,GAP7B,cAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAVjC,cAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAb9C,cAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB7D,cAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,cAoBX;AApBW,gBAAN;AAAA,EADN,OAAO,EAAE,WAAW,kBAAkB,CAAC;AAAA,GAC3B;AAyBN,IAAM,UAAN,MAAc;AAAA,EAAd;AAiBL,wBAAwB;AAUxB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAhCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,QAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,QAKX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GARlC,QASX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZtD,QAaX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAhB1D,QAiBX;AAOA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAvB3D,QAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA1B7D,QA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA7BzG,QA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhCjD,QAiCX;AAjCW,UAAN;AAAA,EADN,OAAO,EAAE,WAAW,YAAY,CAAC;AAAA,GACrB;AAsCN,IAAM,UAAN,MAAc;AAAA,EAAd;AAiBL,wBAAwB;AAOxB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA7BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,QAEX;AAGA;AAAA,EADC,UAAU,MAAM,IAAI;AAAA,GAJV,QAKX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GARlC,QASX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZtD,QAaX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAhB1D,QAiBX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApB3D,QAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAvB7D,QAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA1BzG,QA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7BjD,QA8BX;AA9BW,UAAN;AAAA,EADN,OAAO,EAAE,WAAW,YAAY,CAAC;AAAA,GACrB;AAmCN,IAAM,cAAN,MAAkB;AAAA,EAAlB;AAiBL,qBAAqB;AAkBrB,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAxCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,YAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,YAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,YAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,YAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAbrC,YAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAhBtD,YAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,YAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtBnD,YAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzB/B,YA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BnD,YA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/BvD,YAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlC7D,YAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GArC7E,YAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAxCjD,YAyCX;AAzCW,cAAN;AAAA,EAFN,OAAO,EAAE,WAAW,gBAAgB,CAAC;AAAA,EACrC,OAAO,EAAE,YAAY,CAAC,UAAU,YAAY,aAAa,EAAE,CAAC;AAAA,GAChD;",
   "names": []
 }

package/dist/modules/auth/data/validators.js

@@ -14,6 +14,9 @@ const confirmPasswordResetSchema = z.object({
   token: z.string().min(10),
   password: passwordSchema
 });
+const validatePasswordResetTokenSchema = z.object({
+  token: z.string().min(10)
+});
 const refreshSessionRequestSchema = z.object({
   refreshToken: z.string().min(1)
 });
@@ -117,6 +120,7 @@ export {
   sidebarVariantSettingsSchema,
   updateSidebarVariantInputSchema,
   userCreateSchema,
-  userLoginSchema
+  userLoginSchema,
+  validatePasswordResetTokenSchema
 };
 //# sourceMappingURL=validators.js.map

package/dist/modules/auth/data/validators.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/data/validators.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nconst passwordSchema = buildPasswordSchema()\n\n// Core auth validators\nexport const userLoginSchema = z.object({\n  email: z.string().email(),\n  password: z.string().min(6),\n  requireRole: z.string().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const requestPasswordResetSchema = z.object({\n  email: z.string().email(),\n})\n\nexport const confirmPasswordResetSchema = z.object({\n  token: z.string().min(10),\n  password: passwordSchema,\n})\n\nexport const refreshSessionRequestSchema = z.object({\n  refreshToken: z.string().min(1),\n})\n\nexport const sidebarPreferencesScopeSchema = z.union([\n  z.object({ type: z.literal('user') }),\n  z.object({ type: z.literal('role'), roleId: z.string().uuid() }),\n])\n\n// Sidebar settings shape shared by both `sidebarPreferencesInputSchema` (which\n// adds role-targeting fields) and the variants API (which uses just the\n// settings + name + isActive). Keeping the field constraints in one place\n// prevents drift between the preferences and variants surfaces.\nexport const sidebarVariantSettingsSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n})\n\nexport const createSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const updateSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const sidebarVariantRecordSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  isActive: z.boolean(),\n  settings: z.object({\n    version: z.number().int().positive(),\n    groupOrder: z.array(z.string()),\n    groupLabels: z.record(z.string(), z.string()),\n    itemLabels: z.record(z.string(), z.string()),\n    hiddenItems: z.array(z.string()),\n    itemOrder: z.record(z.string(), z.array(z.string())),\n  }),\n  createdAt: z.string(),\n  updatedAt: z.string().nullable(),\n})\n\nexport const sidebarPreferencesInputSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n  applyToRoles: z.array(z.string().uuid()).optional(),\n  clearRoleIds: z.array(z.string().uuid()).optional(),\n  scope: sidebarPreferencesScopeSchema.optional(),\n}).superRefine((value, ctx) => {\n  const scopeType = value.scope?.type ?? 'user'\n  if (scopeType === 'role') {\n    if ((value.applyToRoles?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['applyToRoles'],\n        message: 'applyToRoles is only valid when scope.type === \"user\"',\n      })\n    }\n    if ((value.clearRoleIds?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['clearRoleIds'],\n        message: 'clearRoleIds is only valid when scope.type === \"user\"',\n      })\n    }\n  }\n})\n\n// Optional helpers for CLI or admin forms\nexport const userCreateSchema = z.object({\n  email: z.string().email(),\n  name: z.preprocess(\n    (value) => {\n      if (typeof value !== 'string') return value\n      const trimmed = value.trim()\n      return trimmed.length ? trimmed : undefined\n    },\n    z.string().trim().min(1).max(120).optional(),\n  ),\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid(),\n  rolesCsv: z.string().optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nexport const featureCheckRequestSchema = z.object({\n  features: z.array(z.string().max(128)).max(50).describe('Feature identifiers to check'),\n}).describe('Batch feature check payload')\n\nexport type UserLoginInput = z.infer<typeof userLoginSchema>\nexport type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>\nexport type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>\nexport type RefreshSessionRequestInput = z.infer<typeof refreshSessionRequestSchema>\nexport type SidebarPreferencesInput = z.infer<typeof sidebarPreferencesInputSchema>\nexport type SidebarVariantSettingsInput = z.infer<typeof sidebarVariantSettingsSchema>\nexport type CreateSidebarVariantInput = z.infer<typeof createSidebarVariantInputSchema>\nexport type UpdateSidebarVariantInput = z.infer<typeof updateSidebarVariantInputSchema>\nexport type SidebarVariantRecordResponse = z.infer<typeof sidebarVariantRecordSchema>\nexport type UserCreateInput = z.infer<typeof userCreateSchema>\nexport type FeatureCheckRequestInput = z.infer<typeof featureCheckRequestSchema>\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,2BAA2B;AAEpC,MAAM,iBAAiB,oBAAoB;AAGpC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,UAAU;AACZ,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AAEM,MAAM,gCAAgC,EAAE,MAAM;AAAA,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,EACpC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAMM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AACvF,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,IACjB,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACnC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC9B,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC5C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC3C,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,EACrD,CAAC;AAAA,EACD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EACrF,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,OAAO,8BAA8B,SAAS;AAChD,CAAC,EAAE,YAAY,CAAC,OAAO,QAAQ;AAC7B,QAAM,YAAY,MAAM,OAAO,QAAQ;AACvC,MAAI,cAAc,QAAQ;AACxB,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE;AAAA,IACN,CAAC,UAAU;AACT,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,SAAS,UAAU;AAAA,IACpC;AAAA,IACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C;AAAA,EACA,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEO,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,8BAA8B;AACxF,CAAC,EAAE,SAAS,6BAA6B;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nconst passwordSchema = buildPasswordSchema()\n\n// Core auth validators\nexport const userLoginSchema = z.object({\n  email: z.string().email(),\n  password: z.string().min(6),\n  requireRole: z.string().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const requestPasswordResetSchema = z.object({\n  email: z.string().email(),\n})\n\nexport const confirmPasswordResetSchema = z.object({\n  token: z.string().min(10),\n  password: passwordSchema,\n})\n\nexport const validatePasswordResetTokenSchema = z.object({\n  token: z.string().min(10),\n})\n\nexport const refreshSessionRequestSchema = z.object({\n  refreshToken: z.string().min(1),\n})\n\nexport const sidebarPreferencesScopeSchema = z.union([\n  z.object({ type: z.literal('user') }),\n  z.object({ type: z.literal('role'), roleId: z.string().uuid() }),\n])\n\n// Sidebar settings shape shared by both `sidebarPreferencesInputSchema` (which\n// adds role-targeting fields) and the variants API (which uses just the\n// settings + name + isActive). Keeping the field constraints in one place\n// prevents drift between the preferences and variants surfaces.\nexport const sidebarVariantSettingsSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n})\n\nexport const createSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const updateSidebarVariantInputSchema = z.object({\n  name: z.string().trim().min(1).max(120).optional(),\n  settings: sidebarVariantSettingsSchema.optional(),\n  isActive: z.boolean().optional(),\n})\n\nexport const sidebarVariantRecordSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  isActive: z.boolean(),\n  settings: z.object({\n    version: z.number().int().positive(),\n    groupOrder: z.array(z.string()),\n    groupLabels: z.record(z.string(), z.string()),\n    itemLabels: z.record(z.string(), z.string()),\n    hiddenItems: z.array(z.string()),\n    itemOrder: z.record(z.string(), z.array(z.string())),\n  }),\n  createdAt: z.string(),\n  updatedAt: z.string().nullable(),\n})\n\nexport const sidebarPreferencesInputSchema = z.object({\n  version: z.number().int().positive().optional(),\n  groupOrder: z.array(z.string().min(1)).max(200).optional(),\n  groupLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  itemLabels: z.record(z.string().min(1), z.string().min(1).max(120)).optional(),\n  hiddenItems: z.array(z.string().min(1)).max(500).optional(),\n  itemOrder: z.record(z.string().min(1), z.array(z.string().min(1)).max(500)).optional(),\n  applyToRoles: z.array(z.string().uuid()).optional(),\n  clearRoleIds: z.array(z.string().uuid()).optional(),\n  scope: sidebarPreferencesScopeSchema.optional(),\n}).superRefine((value, ctx) => {\n  const scopeType = value.scope?.type ?? 'user'\n  if (scopeType === 'role') {\n    if ((value.applyToRoles?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['applyToRoles'],\n        message: 'applyToRoles is only valid when scope.type === \"user\"',\n      })\n    }\n    if ((value.clearRoleIds?.length ?? 0) > 0) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['clearRoleIds'],\n        message: 'clearRoleIds is only valid when scope.type === \"user\"',\n      })\n    }\n  }\n})\n\n// Optional helpers for CLI or admin forms\nexport const userCreateSchema = z.object({\n  email: z.string().email(),\n  name: z.preprocess(\n    (value) => {\n      if (typeof value !== 'string') return value\n      const trimmed = value.trim()\n      return trimmed.length ? trimmed : undefined\n    },\n    z.string().trim().min(1).max(120).optional(),\n  ),\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid(),\n  rolesCsv: z.string().optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nexport const featureCheckRequestSchema = z.object({\n  features: z.array(z.string().max(128)).max(50).describe('Feature identifiers to check'),\n}).describe('Batch feature check payload')\n\nexport type UserLoginInput = z.infer<typeof userLoginSchema>\nexport type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>\nexport type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>\nexport type ValidatePasswordResetTokenInput = z.infer<typeof validatePasswordResetTokenSchema>\nexport type RefreshSessionRequestInput = z.infer<typeof refreshSessionRequestSchema>\nexport type SidebarPreferencesInput = z.infer<typeof sidebarPreferencesInputSchema>\nexport type SidebarVariantSettingsInput = z.infer<typeof sidebarVariantSettingsSchema>\nexport type CreateSidebarVariantInput = z.infer<typeof createSidebarVariantInputSchema>\nexport type UpdateSidebarVariantInput = z.infer<typeof updateSidebarVariantInputSchema>\nexport type SidebarVariantRecordResponse = z.infer<typeof sidebarVariantRecordSchema>\nexport type UserCreateInput = z.infer<typeof userCreateSchema>\nexport type FeatureCheckRequestInput = z.infer<typeof featureCheckRequestSchema>\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,2BAA2B;AAEpC,MAAM,iBAAiB,oBAAoB;AAGpC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAAA,EACxB,UAAU;AACZ,CAAC;AAEM,MAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC1B,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AAEM,MAAM,gCAAgC,EAAE,MAAM;AAAA,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,EACpC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAMM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AACvF,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,UAAU,6BAA6B,SAAS;AAAA,EAChD,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,IACjB,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACnC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC9B,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC5C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IAC3C,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,EACrD,CAAC;AAAA,EACD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC9E,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EAC7E,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS;AAAA,EACrF,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAClD,OAAO,8BAA8B,SAAS;AAChD,CAAC,EAAE,YAAY,CAAC,OAAO,QAAQ;AAC7B,QAAM,YAAY,MAAM,OAAO,QAAQ;AACvC,MAAI,cAAc,QAAQ;AACxB,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,SAAK,MAAM,cAAc,UAAU,KAAK,GAAG;AACzC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE;AAAA,IACN,CAAC,UAAU;AACT,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,UAAU,MAAM,KAAK;AAC3B,aAAO,QAAQ,SAAS,UAAU;AAAA,IACpC;AAAA,IACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C;AAAA,EACA,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEO,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,8BAA8B;AACxF,CAAC,EAAE,SAAS,6BAA6B;",
   "names": []
 }

package/dist/modules/auth/di.js

@@ -6,17 +6,43 @@ import {
   isRbacDefaultCacheEnabled,
   resetRbacFallbackCache
 } from "@open-mercato/core/modules/auth/services/rbacDefaultCache";
+import { DefaultAuthPrincipalService } from "./services/principalService.js";
+function resolveOptionalCache(container) {
+  try {
+    return container.hasRegistration("cache") ? container.resolve("cache") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveOptionalOrganizationHierarchyService(container) {
+  try {
+    if (!container.hasRegistration("organizationHierarchyService")) return void 0;
+    const candidate = container.resolve("organizationHierarchyService");
+    return typeof candidate?.resolveAncestorIds === "function" ? candidate : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function register(container) {
   container.register({ authService: asClass(AuthService).scoped() });
-  if (isRbacDefaultCacheEnabled()) {
-    container.register({
-      rbacService: asFunction((cradle) => {
-        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache());
-      }).scoped()
-    });
-  } else {
-    container.register({ rbacService: asClass(RbacService).scoped() });
-  }
+  container.register({
+    authPrincipalService: asFunction(function authPrincipalServiceFactory(em) {
+      return new DefaultAuthPrincipalService(
+        em,
+        resolveOptionalOrganizationHierarchyService(container)
+      );
+    }).scoped()
+  });
+  container.register({
+    rbacService: asFunction(function rbacServiceFactory(em) {
+      const configuredCache = resolveOptionalCache(container);
+      return new RbacService(
+        em,
+        configuredCache ?? (isRbacDefaultCacheEnabled() ? createRbacFallbackCache() : void 0),
+        resolveOptionalOrganizationHierarchyService(container)
+      );
+    }).scoped()
+  });
 }
 export {
   register,

package/dist/modules/auth/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/auth/di.ts"],
-  "sourcesContent": ["import { asClass, asFunction } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  createRbacFallbackCache,\n  isRbacDefaultCacheEnabled,\n  resetRbacFallbackCache,\n} from '@open-mercato/core/modules/auth/services/rbacDefaultCache'\n\nexport { resetRbacFallbackCache }\n\nexport function register(container: AppContainer) {\n  // Register or override core auth service\n  container.register({ authService: asClass(AuthService).scoped() })\n  // RBAC service. The bare `asClass(...).scoped()` registration matches\n  // develop and is the default. Setting `OM_RBAC_DEFAULT_CACHE=on` opts\n  // into the in-process LRU fallback for deployments that don't wire a\n  // shared CacheStrategy (CLI scripts, lean test bootstraps). Production\n  // bootstraps that already register `cache` via `@open-mercato/cache`\n  // preempt this fallback because the container's existing `cache`\n  // registration wins when `RbacService` reaches for it.\n  if (isRbacDefaultCacheEnabled()) {\n    container.register({\n      rbacService: asFunction((cradle: { em: EntityManager; cache?: CacheStrategy }) => {\n        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache())\n      }).scoped(),\n    })\n  } else {\n    container.register({ rbacService: asClass(RbacService).scoped() })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS,kBAAkB;AAIpC,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIA,SAAS,SAAS,WAAyB;AAEhD,YAAU,SAAS,EAAE,aAAa,QAAQ,WAAW,EAAE,OAAO,EAAE,CAAC;AAQjE,MAAI,0BAA0B,GAAG;AAC/B,cAAU,SAAS;AAAA,MACjB,aAAa,WAAW,CAAC,WAAyD;AAChF,eAAO,IAAI,YAAY,OAAO,IAAI,OAAO,SAAS,wBAAwB,CAAC;AAAA,MAC7E,CAAC,EAAE,OAAO;AAAA,IACZ,CAAC;AAAA,EACH,OAAO;AACL,cAAU,SAAS,EAAE,aAAa,QAAQ,WAAW,EAAE,OAAO,EAAE,CAAC;AAAA,EACnE;AACF;",
+  "sourcesContent": ["import { asClass, asFunction } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  createRbacFallbackCache,\n  isRbacDefaultCacheEnabled,\n  resetRbacFallbackCache,\n} from '@open-mercato/core/modules/auth/services/rbacDefaultCache'\nimport { DefaultAuthPrincipalService } from './services/principalService'\n\nexport { resetRbacFallbackCache }\n\nfunction resolveOptionalCache(container: AppContainer): CacheStrategy | undefined {\n  try {\n    return container.hasRegistration('cache')\n      ? container.resolve<CacheStrategy>('cache')\n      : undefined\n  } catch {\n    return undefined\n  }\n}\n\nfunction resolveOptionalOrganizationHierarchyService(\n  container: AppContainer,\n): OrganizationHierarchyService | undefined {\n  try {\n    if (!container.hasRegistration('organizationHierarchyService')) return undefined\n    const candidate = container.resolve<OrganizationHierarchyService>('organizationHierarchyService')\n    return typeof candidate?.resolveAncestorIds === 'function' ? candidate : undefined\n  } catch {\n    return undefined\n  }\n}\n\nexport function register(container: AppContainer) {\n  // Register or override core auth service\n  container.register({ authService: asClass(AuthService).scoped() })\n  container.register({\n    authPrincipalService: asFunction(function authPrincipalServiceFactory(em: EntityManager) {\n      return new DefaultAuthPrincipalService(\n        em,\n        resolveOptionalOrganizationHierarchyService(container),\n      )\n    }).scoped(),\n  })\n  // Resolve optional infrastructure lazily so Auth still works when Directory\n  // is disabled and in lean CLI/test containers without a CacheStrategy.\n  // Setting `OM_RBAC_DEFAULT_CACHE=on` opts into the in-process fallback;\n  // an explicitly registered cache always wins.\n  container.register({\n    rbacService: asFunction(function rbacServiceFactory(em: EntityManager) {\n      const configuredCache = resolveOptionalCache(container)\n      return new RbacService(\n        em,\n        configuredCache ?? (isRbacDefaultCacheEnabled() ? createRbacFallbackCache() : undefined),\n        resolveOptionalOrganizationHierarchyService(container),\n      )\n    }).scoped(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS,kBAAkB;AAKpC,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAI5C,SAAS,qBAAqB,WAAoD;AAChF,MAAI;AACF,WAAO,UAAU,gBAAgB,OAAO,IACpC,UAAU,QAAuB,OAAO,IACxC;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4CACP,WAC0C;AAC1C,MAAI;AACF,QAAI,CAAC,UAAU,gBAAgB,8BAA8B,EAAG,QAAO;AACvE,UAAM,YAAY,UAAU,QAAsC,8BAA8B;AAChG,WAAO,OAAO,WAAW,uBAAuB,aAAa,YAAY;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,WAAyB;AAEhD,YAAU,SAAS,EAAE,aAAa,QAAQ,WAAW,EAAE,OAAO,EAAE,CAAC;AACjE,YAAU,SAAS;AAAA,IACjB,sBAAsB,WAAW,SAAS,4BAA4B,IAAmB;AACvF,aAAO,IAAI;AAAA,QACT;AAAA,QACA,4CAA4C,SAAS;AAAA,MACvD;AAAA,IACF,CAAC,EAAE,OAAO;AAAA,EACZ,CAAC;AAKD,YAAU,SAAS;AAAA,IACjB,aAAa,WAAW,SAAS,mBAAmB,IAAmB;AACrE,YAAM,kBAAkB,qBAAqB,SAAS;AACtD,aAAO,IAAI;AAAA,QACT;AAAA,QACA,oBAAoB,0BAA0B,IAAI,wBAAwB,IAAI;AAAA,QAC9E,4CAA4C,SAAS;AAAA,MACvD;AAAA,IACF,CAAC,EAAE,OAAO;AAAA,EACZ,CAAC;AACH;",
   "names": []
 }

package/dist/modules/auth/frontend/reset/[token]/page.js

@@ -5,8 +5,10 @@ import { Button } from "@open-mercato/ui/primitives/button";
 import { PasswordInput } from "@open-mercato/ui/primitives/password-input";
 import { Label } from "@open-mercato/ui/primitives/label";
 import { useEffect, useState } from "react";
+import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { Spinner } from "@open-mercato/ui/primitives/spinner";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from "@open-mercato/shared/lib/auth/passwordPolicy";
 function ResetWithTokenPage({ params }) {
@@ -15,12 +17,35 @@ function ResetWithTokenPage({ params }) {
   const [error, setError] = useState(null);
   const [submitting, setSubmitting] = useState(false);
   const [clientReady, setClientReady] = useState(false);
+  const [tokenState, setTokenState] = useState("checking");
   const passwordPolicy = getPasswordPolicy();
   const passwordRequirements = formatPasswordRequirements(passwordPolicy, t);
   const passwordDescription = passwordRequirements ? t("auth.password.requirements.help", "Password requirements: {requirements}", { requirements: passwordRequirements }) : "";
   useEffect(() => {
     setClientReady(true);
   }, []);
+  useEffect(() => {
+    let cancelled = false;
+    async function checkToken() {
+      const body = new FormData();
+      body.set("token", params.token);
+      try {
+        const { ok, result } = await apiCall(
+          "/api/auth/reset/validate",
+          { method: "POST", body }
+        );
+        if (cancelled) return;
+        setTokenState(ok && result?.valid === false ? "expired" : "usable");
+      } catch {
+        if (cancelled) return;
+        setTokenState("usable");
+      }
+    }
+    void checkToken();
+    return () => {
+      cancelled = true;
+    };
+  }, [params.token]);
   async function onSubmit(e) {
     e.preventDefault();
     setError(null);
@@ -59,6 +84,27 @@ function ResetWithTokenPage({ params }) {
       setSubmitting(false);
     }
   }
+  if (tokenState === "checking") {
+    return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
+      /* @__PURE__ */ jsx(CardHeader, { children: /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }) }),
+      /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", "data-auth-token-state": "checking", children: [
+        /* @__PURE__ */ jsx(Spinner, { size: "sm" }),
+        /* @__PURE__ */ jsx("span", { children: t("auth.reset.token.checking", "Checking your reset link...") })
+      ] }) })
+    ] }) });
+  }
+  if (tokenState === "expired") {
+    return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
+      /* @__PURE__ */ jsxs(CardHeader, { children: [
+        /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.token.expiredTitle", "This reset link is no longer valid") }),
+        /* @__PURE__ */ jsx(CardDescription, { children: t("auth.reset.token.expiredSubtitle", "It has already been used or has expired. Request a new link to set your password.") })
+      ] }),
+      /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("div", { className: "grid gap-3", "data-auth-token-state": "expired", children: [
+        /* @__PURE__ */ jsx(Button, { asChild: true, className: "w-full", children: /* @__PURE__ */ jsx(Link, { href: "/reset", children: t("auth.reset.token.requestNew", "Request a new link") }) }),
+        /* @__PURE__ */ jsx("div", { className: "text-center", children: /* @__PURE__ */ jsx(Link, { href: "/login", className: "text-xs text-muted-foreground underline", children: t("auth.reset.backToLogin", "Back to login") }) })
+      ] }) })
+    ] }) });
+  }
   return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
     /* @__PURE__ */ jsxs(CardHeader, { children: [
       /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }),