@open-mercato/core 0.7.1-develop.7104.1.1dd769bf1a → 0.7.1-develop.7106.1.53fe9dd1b1

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4362 entry points
+[build:core] found 4363 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/users/acl/route.js

@@ -245,7 +245,7 @@ async function PUT(req) {
     return NextResponse.json({
       error: translate(
         "auth.acl.organizationWarning",
-        "Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving."
+        "Organization restrictions require at least one feature override. Add a feature or module wildcard, or clear the organization scope before saving."
       )
     }, { status: 400 });
   }
@@ -328,7 +328,7 @@ const openApi = {
     },
     PUT: {
       summary: "Update user ACL",
-      description: "Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.",
+      description: "Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. Authorization evaluates the merged ACL, so a partial request returns 403 when a preserved grant is outside the actor's grantable ACL. An organization-scoped non-super-admin override requires at least one feature grant.",
       requestBody: {
         contentType: "application/json",
         schema: putSchema

package/dist/modules/auth/api/users/acl/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/api/users/acl/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminUserTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  AUTH_USER_ACL_UPDATE_COMMAND_ID,\n  type AclUpdateResult,\n  type UserAclUpdateInput,\n} from '@open-mercato/core/modules/auth/commands/acl'\n\nconst getSchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  userId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst userAclResponseSchema = z.object({\n  hasCustomAcl: z.boolean(),\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst userAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst userAclErrorSchema = z.object({ error: z.string() })\n\ntype TenantResolution = { tenantId: string | null } | { error: NextResponse }\n\n/**\n * The single tenant scope both handlers work in. GET and PUT MUST resolve it the\n * same way: the admin user form PUTs the ACL panel's state on every save, so a\n * GET that reads a narrower scope than the PUT writes hands the operator an\n * empty form and turns the next name-only edit into a silent revocation, with no\n * `updatedAt` to arm the optimistic lock against it.\n *\n * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a\n * global account legitimately signs in with `auth.tenantId === null` and the\n * scope has to come from the target user instead. That fallback is reserved for\n * a super admin: for anyone else it would let the target pick the scope its own\n * access is then checked against, and it decrypts a possibly foreign user ahead\n * of every guard. A tenant-less non-super-admin therefore resolves to `null`,\n * which reads as \"no override\" and refuses to write \u2014 the behaviour that held\n * before this route resolved a scope at all. The read is also skipped whenever a\n * tenant is already known.\n *\n * An explicit `tenantId` wins, mirroring the role ACL route (additive there and\n * here; no caller sends it yet) \u2014 but only for a super admin or for the actor's\n * own tenant, so it cannot widen anyone's reach. The result is that for a\n * non-super-admin the resolved scope is always the actor's own.\n */\nasync function resolveAclTenantId(args: {\n  em: EntityManager\n  auth: NonNullable<AuthContext>\n  actorIsSuperAdmin: boolean\n  userId: string\n  requestedTenantId?: string\n}): Promise<TenantResolution> {\n  const authTenantId = args.auth.tenantId ?? null\n  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {\n    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }\n  }\n  const known = args.requestedTenantId ?? authTenantId\n  if (known) return { tenantId: known }\n  if (!args.actorIsSuperAdmin) return { tenantId: null }\n  const targetUser = await findOneWithDecryption(\n    args.em,\n    User,\n    { id: args.userId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: args.auth.orgId ?? null },\n  )\n  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    userId: url.searchParams.get('userId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  // An unresolvable scope reads as \"no override\", which is what PUT then refuses\n  // to write (`Tenant required`) \u2014 so the pair still cannot destroy a row.\n  const tenantId = resolution.tenantId\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const acl = tenantId\n    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n    : null\n  const response = acl\n    ? {\n        hasCustomAcl: true,\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.userId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.user_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId,\n    query: { userId: parsed.data.userId, tenantId },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  // The scope the row is read and written in. `auth.tenantId` is `string | null`\n  // \u2014 never `undefined`, since every producer normalizes with `?? null` \u2014 so the\n  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched\n  // no row, leaving create/update to fail the NOT NULL constraint and clear to\n  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500\n  // into a working, correctly scoped write.\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  const tenantId = resolution.tenantId\n  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits\n  // cannot silently clobber each other (#2055). Strictly additive \u2014 a no-op when\n  // the client sends no expected-version header; skipped when no ACL row exists.\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.user_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false\n  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []\n  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null\n\n  // A per-user ACL is an absolute override, so an omitted dimension must keep\n  // its stored value. Normalizing an omitted `features` to `[]` or an omitted\n  // `organizations` to `null` turned a single-dimension edit into a silent\n  // clear, deleting the row and widening the user back to their full role.\n  const featuresWereProvided = parsed.data.features !== undefined\n  const requestedFeatures = featuresWereProvided\n    ? normalizeGrantFeatureList(parsed.data.features)\n    : existingFeatures\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n\n  try {\n    await assertActorCanGrantAcl({\n      em: em as EntityManager,\n      rbacService: rbacService as RbacService,\n      actorUserId: auth.sub,\n      tenantId: actorTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // An omitted feature list is already stored and in effect. Re-sanitizing it\n  // during an unrelated organization edit would silently revoke grants the\n  // actor did not touch, so only an explicitly submitted list is sanitized.\n  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can grant super admin access.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  // Retaining an organization-only override with no features would revoke every\n  // role-granted feature instead of narrowing the role. Refuse that state rather\n  // than persisting it or silently dropping the organization scope.\n  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate(\n        'auth.acl.organizationWarning',\n        'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.',\n      ),\n    }, { status: 400 })\n  }\n\n  // An unrestricted organization list carries no override on its own, and the guard\n  // above already refused the restricted-but-featureless case, so the override is\n  // custom exactly when it grants super admin or at least one feature.\n  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0\n\n  // What the caller asked for, handed to the command only when it exceeds what\n  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant\n  // escalations; what reaches the strip is quieter \u2014 a restricted grant the\n  // actor does hold \u2014 and it leaves before/after identical, so the audit entry\n  // would otherwise be indistinguishable from a no-op and skipped as one.\n  //\n  // Features are the only axis that can be trimmed. A super-admin request is\n  // either honoured or refused outright above, never silently downgraded, so\n  // comparing the two flags here would be dead weight.\n  //\n  // Deliberately independent of the `sanitized` response flag below:\n  // `hasRestrictedChanges` stays false when the trimmed result equals the\n  // existing ACL, to avoid nagging the user about a save that changed nothing \u2014\n  // but that is precisely an attempt the trail must keep.\n  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))\n\n  // Route the write through the command bus so the permission change lands in\n  // the action log. The command owns the transactional write (or removal) and\n  // the RBAC cache invalidation that used to live here.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  // A tenant-less actor edits an override in the target user's tenant, so their\n  // organization belongs to a tenant the entry is not about. The bus resolves\n  // the log row's organization as `metadata.organizationId ??\n  // ctx.selectedOrganizationId ?? ctx.auth.orgId` \u2014 a `??` chain, so the\n  // handler's `resolveOrganizationId` cannot express \"explicitly no\n  // organization\" and the actor's would be restored. Strip it from the context\n  // instead, exactly as the roles route does: otherwise the entry carries a\n  // (target tenant, foreign organization) pair that `ActionLogService` \u2014 which\n  // filters organization with strict equality \u2014 can never surface for anyone.\n  const isForeignTenant = tenantId !== (auth.tenantId ?? null)\n  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth: isForeignTenant ? { ...auth, orgId: null } : auth,\n    organizationScope: null,\n    selectedOrganizationId: actorOrgId,\n    organizationIds: actorOrgId ? [actorOrgId] : null,\n    request: req,\n  }\n  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {\n    input: {\n      userId: parsed.data.userId,\n      tenantId,\n      isSuperAdmin: effectiveIsSuperAdmin,\n      features: effectiveFeatures,\n      organizations: requestedOrganizations,\n      clear: !hasCustomAcl,\n      requested: strippedFeatures.length ? { features: requestedFeatures } : null,\n    },\n    ctx: commandCtx,\n  })\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin),\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\n// Whether the caller expressed an intentional narrowing. `null` and `__all__`\n// are the two documented ways to say \"every organization\"; an empty list is the\n// editor's \"no organization picked\" state (\"Empty = all organizations\"), which\n// is not a restriction an administrator chose. Only a concrete list narrows, so\n// only a concrete list has to justify itself against the feature grant below.\nfunction hasOrganizationRestriction(organizations: string[] | null): boolean {\n  if (!organizations || organizations.length === 0) return false\n  return !organizations.includes('__all__')\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction hasRestrictedChanges(requested: string[], effective: string[], existing: string[]): boolean {\n  if (requested.length === effective.length) return false\n  const effectiveSet = new Set(effective)\n  const existingSet = new Set(existing)\n  // If the effective set matches existing, we only trimmed restricted duplicates and should not report\n  if (effectiveSet.size === existingSet.size) {\n    let identical = true\n    for (const value of effectiveSet) {\n      if (!existingSet.has(value)) {\n        identical = false\n        break\n      }\n    }\n    if (identical) return false\n  }\n  return true\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch user ACL',\n      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },\n        { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user ACL',\n      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminUserTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  AUTH_USER_ACL_UPDATE_COMMAND_ID,\n  type AclUpdateResult,\n  type UserAclUpdateInput,\n} from '@open-mercato/core/modules/auth/commands/acl'\n\nconst getSchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  userId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst userAclResponseSchema = z.object({\n  hasCustomAcl: z.boolean(),\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst userAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst userAclErrorSchema = z.object({ error: z.string() })\n\ntype TenantResolution = { tenantId: string | null } | { error: NextResponse }\n\n/**\n * The single tenant scope both handlers work in. GET and PUT MUST resolve it the\n * same way: the admin user form PUTs the ACL panel's state on every save, so a\n * GET that reads a narrower scope than the PUT writes hands the operator an\n * empty form and turns the next name-only edit into a silent revocation, with no\n * `updatedAt` to arm the optimistic lock against it.\n *\n * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a\n * global account legitimately signs in with `auth.tenantId === null` and the\n * scope has to come from the target user instead. That fallback is reserved for\n * a super admin: for anyone else it would let the target pick the scope its own\n * access is then checked against, and it decrypts a possibly foreign user ahead\n * of every guard. A tenant-less non-super-admin therefore resolves to `null`,\n * which reads as \"no override\" and refuses to write \u2014 the behaviour that held\n * before this route resolved a scope at all. The read is also skipped whenever a\n * tenant is already known.\n *\n * An explicit `tenantId` wins, mirroring the role ACL route (additive there and\n * here; no caller sends it yet) \u2014 but only for a super admin or for the actor's\n * own tenant, so it cannot widen anyone's reach. The result is that for a\n * non-super-admin the resolved scope is always the actor's own.\n */\nasync function resolveAclTenantId(args: {\n  em: EntityManager\n  auth: NonNullable<AuthContext>\n  actorIsSuperAdmin: boolean\n  userId: string\n  requestedTenantId?: string\n}): Promise<TenantResolution> {\n  const authTenantId = args.auth.tenantId ?? null\n  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {\n    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }\n  }\n  const known = args.requestedTenantId ?? authTenantId\n  if (known) return { tenantId: known }\n  if (!args.actorIsSuperAdmin) return { tenantId: null }\n  const targetUser = await findOneWithDecryption(\n    args.em,\n    User,\n    { id: args.userId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: args.auth.orgId ?? null },\n  )\n  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    userId: url.searchParams.get('userId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  // An unresolvable scope reads as \"no override\", which is what PUT then refuses\n  // to write (`Tenant required`) \u2014 so the pair still cannot destroy a row.\n  const tenantId = resolution.tenantId\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const acl = tenantId\n    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n    : null\n  const response = acl\n    ? {\n        hasCustomAcl: true,\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.userId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.user_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId,\n    query: { userId: parsed.data.userId, tenantId },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  // The scope the row is read and written in. `auth.tenantId` is `string | null`\n  // \u2014 never `undefined`, since every producer normalizes with `?? null` \u2014 so the\n  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched\n  // no row, leaving create/update to fail the NOT NULL constraint and clear to\n  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500\n  // into a working, correctly scoped write.\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  const tenantId = resolution.tenantId\n  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits\n  // cannot silently clobber each other (#2055). Strictly additive \u2014 a no-op when\n  // the client sends no expected-version header; skipped when no ACL row exists.\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.user_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false\n  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []\n  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null\n\n  // A per-user ACL is an absolute override, so an omitted dimension must keep\n  // its stored value. Normalizing an omitted `features` to `[]` or an omitted\n  // `organizations` to `null` turned a single-dimension edit into a silent\n  // clear, deleting the row and widening the user back to their full role.\n  const featuresWereProvided = parsed.data.features !== undefined\n  const requestedFeatures = featuresWereProvided\n    ? normalizeGrantFeatureList(parsed.data.features)\n    : existingFeatures\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n\n  try {\n    await assertActorCanGrantAcl({\n      em: em as EntityManager,\n      rbacService: rbacService as RbacService,\n      actorUserId: auth.sub,\n      tenantId: actorTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // An omitted feature list is already stored and in effect. Re-sanitizing it\n  // during an unrelated organization edit would silently revoke grants the\n  // actor did not touch, so only an explicitly submitted list is sanitized.\n  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can grant super admin access.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  // Retaining an organization-only override with no features would revoke every\n  // role-granted feature instead of narrowing the role. Refuse that state rather\n  // than persisting it or silently dropping the organization scope.\n  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate(\n        'auth.acl.organizationWarning',\n        'Organization restrictions require at least one feature override. Add a feature or module wildcard, or clear the organization scope before saving.',\n      ),\n    }, { status: 400 })\n  }\n\n  // An unrestricted organization list carries no override on its own, and the guard\n  // above already refused the restricted-but-featureless case, so the override is\n  // custom exactly when it grants super admin or at least one feature.\n  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0\n\n  // What the caller asked for, handed to the command only when it exceeds what\n  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant\n  // escalations; what reaches the strip is quieter \u2014 a restricted grant the\n  // actor does hold \u2014 and it leaves before/after identical, so the audit entry\n  // would otherwise be indistinguishable from a no-op and skipped as one.\n  //\n  // Features are the only axis that can be trimmed. A super-admin request is\n  // either honoured or refused outright above, never silently downgraded, so\n  // comparing the two flags here would be dead weight.\n  //\n  // Deliberately independent of the `sanitized` response flag below:\n  // `hasRestrictedChanges` stays false when the trimmed result equals the\n  // existing ACL, to avoid nagging the user about a save that changed nothing \u2014\n  // but that is precisely an attempt the trail must keep.\n  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))\n\n  // Route the write through the command bus so the permission change lands in\n  // the action log. The command owns the transactional write (or removal) and\n  // the RBAC cache invalidation that used to live here.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  // A tenant-less actor edits an override in the target user's tenant, so their\n  // organization belongs to a tenant the entry is not about. The bus resolves\n  // the log row's organization as `metadata.organizationId ??\n  // ctx.selectedOrganizationId ?? ctx.auth.orgId` \u2014 a `??` chain, so the\n  // handler's `resolveOrganizationId` cannot express \"explicitly no\n  // organization\" and the actor's would be restored. Strip it from the context\n  // instead, exactly as the roles route does: otherwise the entry carries a\n  // (target tenant, foreign organization) pair that `ActionLogService` \u2014 which\n  // filters organization with strict equality \u2014 can never surface for anyone.\n  const isForeignTenant = tenantId !== (auth.tenantId ?? null)\n  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth: isForeignTenant ? { ...auth, orgId: null } : auth,\n    organizationScope: null,\n    selectedOrganizationId: actorOrgId,\n    organizationIds: actorOrgId ? [actorOrgId] : null,\n    request: req,\n  }\n  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {\n    input: {\n      userId: parsed.data.userId,\n      tenantId,\n      isSuperAdmin: effectiveIsSuperAdmin,\n      features: effectiveFeatures,\n      organizations: requestedOrganizations,\n      clear: !hasCustomAcl,\n      requested: strippedFeatures.length ? { features: requestedFeatures } : null,\n    },\n    ctx: commandCtx,\n  })\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin),\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\n// Whether the caller expressed an intentional narrowing. `null` and `__all__`\n// are the two documented ways to say \"every organization\"; an empty list is the\n// editor's \"no organization picked\" state (\"Empty = all organizations\"), which\n// is not a restriction an administrator chose. Only a concrete list narrows, so\n// only a concrete list has to justify itself against the feature grant below.\nfunction hasOrganizationRestriction(organizations: string[] | null): boolean {\n  if (!organizations || organizations.length === 0) return false\n  return !organizations.includes('__all__')\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction hasRestrictedChanges(requested: string[], effective: string[], existing: string[]): boolean {\n  if (requested.length === effective.length) return false\n  const effectiveSet = new Set(effective)\n  const existingSet = new Set(existing)\n  // If the effective set matches existing, we only trimmed restricted duplicates and should not report\n  if (effectiveSet.size === existingSet.size) {\n    let identical = true\n    for (const value of effectiveSet) {\n      if (!existingSet.has(value)) {\n        identical = false\n        break\n      }\n    }\n    if (identical) return false\n  }\n  return true\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch user ACL',\n      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },\n        { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user ACL',\n      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. Authorization evaluates the merged ACL, so a partial request returns 403 when a preserved grant is outside the actor\\'s grantable ACL. An organization-scoped non-super-admin override requires at least one feature grant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
   "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8CAA8C;AACvD,SAAS,2BAA2B;AAEpC,SAAS,MAAM,eAAe;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,6BAA6B;AAEtC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,OAGK;AAEP,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AA0BzD,eAAe,mBAAmB,MAMJ;AAC5B,QAAM,eAAe,KAAK,KAAK,YAAY;AAC3C,MAAI,KAAK,qBAAqB,KAAK,sBAAsB,gBAAgB,CAAC,KAAK,mBAAmB;AAChG,WAAO,EAAE,OAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC7E;AACA,QAAM,QAAQ,KAAK,qBAAqB;AACxC,MAAI,MAAO,QAAO,EAAE,UAAU,MAAM;AACpC,MAAI,CAAC,KAAK,kBAAmB,QAAO,EAAE,UAAU,KAAK;AACrD,QAAM,aAAa,MAAM;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,IAAI,KAAK,OAAO;AAAA,IAClB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK,KAAK,SAAS,KAAK;AAAA,EAC5D;AACA,SAAO,EAAE,UAAU,YAAY,WAAW,OAAO,WAAW,QAAQ,IAAI,KAAK;AAC/E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAKnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAG7C,QAAM,WAAW,WAAW;AAE5B,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MAAM,WACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC,IACvE;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc;AAAA,IACd,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAEnG,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,SAAS;AAAA,IAC9C,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAMnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAQtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAC7C,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAErF,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC;AAInF,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,CAAC,CAAC,IAAI,eAAe;AACxD,QAAM,mBAAmB,MAAM,0BAA0B,IAAI,YAAY,IAAI,CAAC;AAC9E,QAAM,wBAAwB,MAAM,uBAAuB,IAAI,iBAAiB,IAAI;AAMpF,QAAM,uBAAuB,OAAO,KAAK,aAAa;AACtD,QAAM,oBAAoB,uBACtB,0BAA0B,OAAO,KAAK,QAAQ,IAC9C;AACJ,QAAM,yBAAyB,OAAO,KAAK,kBAAkB,SACzD,wBACA,uBAAuB,OAAO,KAAK,aAAa;AAEpD,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAE1D,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,MACV,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAKA,QAAM,oBAAoB,qBAAqB,CAAC,uBAC5C,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,yDAAyD;AAAA,IAC3E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,CAAC,yBAAyB,kBAAkB,WAAW,KAAK,2BAA2B,sBAAsB,GAAG;AAClH,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAKA,QAAM,eAAe,yBAAyB,kBAAkB,SAAS;AAgBzE,QAAM,mBAAmB,kBAAkB,OAAO,CAAC,YAAY,CAAC,kBAAkB,SAAS,OAAO,CAAC;AAKnG,QAAM,aAAa,UAAU,QAAQ,YAAY;AAUjD,QAAM,kBAAkB,cAAc,KAAK,YAAY;AACvD,QAAM,aAAa,kBAAkB,OAAO,KAAK,SAAS;AAC1D,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA,MAAM,kBAAkB,EAAE,GAAG,MAAM,OAAO,KAAK,IAAI;AAAA,IACnD,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,aAAa,CAAC,UAAU,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACA,QAAM,WAAW,QAA6C,iCAAiC;AAAA,IAC7F,OAAO;AAAA,MACL,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,OAAO,CAAC;AAAA,MACR,WAAW,iBAAiB,SAAS,EAAE,UAAU,kBAAkB,IAAI;AAAA,IACzE;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,qBAAqB,mBAAmB,mBAAmB,gBAAgB,KAAK,0BAA0B;AAAA,EAC9I,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAOA,SAAS,2BAA2B,eAAyC;AAC3E,MAAI,CAAC,iBAAiB,cAAc,WAAW,EAAG,QAAO;AACzD,SAAO,CAAC,cAAc,SAAS,SAAS;AAC1C;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,qBAAqB,WAAqB,WAAqB,UAA6B;AACnG,MAAI,UAAU,WAAW,UAAU,OAAQ,QAAO;AAClD,QAAM,eAAe,IAAI,IAAI,SAAS;AACtC,QAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,MAAI,aAAa,SAAS,YAAY,MAAM;AAC1C,QAAI,YAAY;AAChB,eAAW,SAAS,cAAc;AAChC,UAAI,CAAC,YAAY,IAAI,KAAK,GAAG;AAC3B,oBAAY;AACZ;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,mBAAmB;AAAA,MACnH;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,mBAAmB;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/settings/CustomerAccountsSettingsPageClient.js

@@ -11,10 +11,13 @@ const DEMO_CREDENTIALS = [
   { email: "bob.smith@example.com", password: "Password123!", role: "Buyer" },
   { email: "carol.white@example.com", password: "Password123!", role: "Viewer" }
 ];
-function CustomerAccountsSettingsPageClient({ portalOrigin }) {
+function CustomerAccountsSettingsPageClient({ portalOrigin, portalOrgSlug = null }) {
   const t = useT();
   const portalUrl = useMemo(() => buildPortalUrlPattern(portalOrigin), [portalOrigin]);
-  const portalRootUrl = useMemo(() => buildPortalRootUrl(portalOrigin), [portalOrigin]);
+  const portalRootUrl = useMemo(
+    () => portalOrgSlug ? buildPortalRootUrl(portalOrigin, portalOrgSlug) : null,
+    [portalOrigin, portalOrgSlug]
+  );
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx("div", { className: "px-3 py-3 md:px-6 md:py-4", children: /* @__PURE__ */ jsx(
       FormHeader,
@@ -32,7 +35,7 @@ function CustomerAccountsSettingsPageClient({ portalOrigin }) {
           /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: t("customer_accounts.settings.portal_access.url_label", "Portal URL pattern:") }),
           /* @__PURE__ */ jsx("code", { className: "mt-1 block rounded bg-muted px-3 py-2 text-sm font-mono", children: portalUrl })
         ] }),
-        /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", size: "sm", asChild: true, children: /* @__PURE__ */ jsx("a", { href: portalRootUrl, target: "_blank", rel: "noopener noreferrer", children: t("customer_accounts.settings.portal_access.open_portal", "Open Portal") }) }) }),
+        portalRootUrl ? /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", size: "sm", asChild: true, children: /* @__PURE__ */ jsx("a", { href: portalRootUrl, target: "_blank", rel: "noopener noreferrer", children: t("customer_accounts.settings.portal_access.open_portal", "Open Portal") }) }) }) : null,
         /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: t(
           "customer_accounts.settings.portal_access.slug_note",
           "The organization slug is auto-generated from the organization name. You can view and manage organizations in Directory \u2192 Organizations."

package/dist/modules/customer_accounts/backend/customer_accounts/settings/CustomerAccountsSettingsPageClient.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/backend/customer_accounts/settings/CustomerAccountsSettingsPageClient.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport { useMemo } from 'react'\nimport Link from 'next/link'\nimport { FormHeader } from '@open-mercato/ui/backend/forms'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'\n\nconst DEMO_CREDENTIALS = [\n  { email: 'alice.johnson@example.com', password: 'Password123!', role: 'Portal Admin' },\n  { email: 'bob.smith@example.com', password: 'Password123!', role: 'Buyer' },\n  { email: 'carol.white@example.com', password: 'Password123!', role: 'Viewer' },\n] as const\n\nexport type CustomerAccountsSettingsPageClientProps = {\n  portalOrigin: string\n}\n\nexport function CustomerAccountsSettingsPageClient({ portalOrigin }: CustomerAccountsSettingsPageClientProps) {\n  const t = useT()\n\n  const portalUrl = useMemo(() => buildPortalUrlPattern(portalOrigin), [portalOrigin])\n  const portalRootUrl = useMemo(() => buildPortalRootUrl(portalOrigin), [portalOrigin])\n\n  return (\n    <>\n      <div className=\"px-3 py-3 md:px-6 md:py-4\">\n        <FormHeader\n          mode=\"detail\"\n          title={t('customer_accounts.settings.title', 'Portal Settings')}\n          backHref=\"/backend/customer_accounts/users\"\n          backLabel={t('customer_accounts.settings.back', 'Customer Users')}\n        />\n      </div>\n\n      <div className=\"max-w-2xl space-y-6\">\n        <div className=\"rounded-lg border p-4 space-y-3\">\n          <h3 className=\"text-sm font-semibold\">\n            {t('customer_accounts.settings.portal_access.title', 'Portal Access')}\n          </h3>\n          <div>\n            <p className=\"text-sm text-muted-foreground\">\n              {t('customer_accounts.settings.portal_access.url_label', 'Portal URL pattern:')}\n            </p>\n            <code className=\"mt-1 block rounded bg-muted px-3 py-2 text-sm font-mono\">\n              {portalUrl}\n            </code>\n          </div>\n          <div>\n            <Button type=\"button\" variant=\"outline\" size=\"sm\" asChild>\n              <a href={portalRootUrl} target=\"_blank\" rel=\"noopener noreferrer\">\n                {t('customer_accounts.settings.portal_access.open_portal', 'Open Portal')}\n              </a>\n            </Button>\n          </div>\n          <p className=\"text-xs text-muted-foreground\">\n            {t(\n              'customer_accounts.settings.portal_access.slug_note',\n              'The organization slug is auto-generated from the organization name. You can view and manage organizations in Directory \\u2192 Organizations.',\n            )}\n          </p>\n          <p className=\"text-xs text-muted-foreground\">\n            <Link href=\"/backend/directory/organizations\" className=\"text-primary underline underline-offset-4 hover:text-primary/80\">\n              {t('customer_accounts.settings.portal_access.manage_orgs', 'Manage Organizations')}\n            </Link>\n          </p>\n        </div>\n\n        <div className=\"rounded-lg border p-4 space-y-3\">\n          <h3 className=\"text-sm font-semibold\">\n            {t('customer_accounts.settings.demo_credentials.title', 'Demo Credentials')}\n          </h3>\n          <div className=\"overflow-x-auto\">\n            <table className=\"w-full text-sm\">\n              <thead>\n                <tr className=\"border-b text-left\">\n                  <th className=\"pb-2 pr-4 font-medium text-muted-foreground\">\n                    {t('customer_accounts.settings.demo_credentials.email', 'Email')}\n                  </th>\n                  <th className=\"pb-2 pr-4 font-medium text-muted-foreground\">\n                    {t('customer_accounts.settings.demo_credentials.password', 'Password')}\n                  </th>\n                  <th className=\"pb-2 font-medium text-muted-foreground\">\n                    {t('customer_accounts.settings.demo_credentials.role', 'Role')}\n                  </th>\n                </tr>\n              </thead>\n              <tbody>\n                {DEMO_CREDENTIALS.map((cred) => (\n                  <tr key={cred.email} className=\"border-b last:border-0\">\n                    <td className=\"py-2 pr-4 font-mono text-xs\">{cred.email}</td>\n                    <td className=\"py-2 pr-4 font-mono text-xs\">{cred.password}</td>\n                    <td className=\"py-2 text-xs\">{cred.role}</td>\n                  </tr>\n                ))}\n              </tbody>\n            </table>\n          </div>\n          <p className=\"text-xs text-muted-foreground\">\n            {t(\n              'customer_accounts.settings.demo_credentials.note',\n              'These credentials are only available if example data was seeded during setup.',\n            )}\n          </p>\n        </div>\n\n        <div className=\"rounded-lg border p-4 space-y-3\">\n          <h3 className=\"text-sm font-semibold\">\n            {t('customer_accounts.settings.quick_links.title', 'Quick Links')}\n          </h3>\n          <ul className=\"space-y-2\">\n            <li>\n              <Link href=\"/backend/customer_accounts/users\" className=\"text-sm text-primary underline underline-offset-4 hover:text-primary/80\">\n                {t('customer_accounts.settings.quick_links.manage_users', 'Manage customer users')}\n              </Link>\n            </li>\n            <li>\n              <Link href=\"/backend/customer_accounts/roles\" className=\"text-sm text-primary underline underline-offset-4 hover:text-primary/80\">\n                {t('customer_accounts.settings.quick_links.manage_roles', 'Manage customer roles')}\n              </Link>\n            </li>\n            <li>\n              <a\n                href=\"https://docs.open-mercato.com/framework/modules/customer-portal\"\n                target=\"_blank\"\n                rel=\"noopener noreferrer\"\n                className=\"text-sm text-primary underline underline-offset-4 hover:text-primary/80\"\n              >\n                {t('customer_accounts.settings.quick_links.portal_docs', 'Portal documentation')}\n              </a>\n            </li>\n          </ul>\n        </div>\n      </div>\n    </>\n  )\n}\n"],
-  "mappings": ";AA0BI,mBAEI,KAaE,YAfN;AAxBJ,SAAS,eAAe;AACxB,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,oBAAoB,6BAA6B;AAE1D,MAAM,mBAAmB;AAAA,EACvB,EAAE,OAAO,6BAA6B,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACrF,EAAE,OAAO,yBAAyB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,EAC1E,EAAE,OAAO,2BAA2B,UAAU,gBAAgB,MAAM,SAAS;AAC/E;AAMO,SAAS,mCAAmC,EAAE,aAAa,GAA4C;AAC5G,QAAM,IAAI,KAAK;AAEf,QAAM,YAAY,QAAQ,MAAM,sBAAsB,YAAY,GAAG,CAAC,YAAY,CAAC;AACnF,QAAM,gBAAgB,QAAQ,MAAM,mBAAmB,YAAY,GAAG,CAAC,YAAY,CAAC;AAEpF,SACE,iCACE;AAAA,wBAAC,SAAI,WAAU,6BACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO,EAAE,oCAAoC,iBAAiB;AAAA,QAC9D,UAAS;AAAA,QACT,WAAW,EAAE,mCAAmC,gBAAgB;AAAA;AAAA,IAClE,GACF;AAAA,IAEA,qBAAC,SAAI,WAAU,uBACb;AAAA,2BAAC,SAAI,WAAU,mCACb;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,kDAAkD,eAAe,GACtE;AAAA,QACA,qBAAC,SACC;AAAA,8BAAC,OAAE,WAAU,iCACV,YAAE,sDAAsD,qBAAqB,GAChF;AAAA,UACA,oBAAC,UAAK,WAAU,2DACb,qBACH;AAAA,WACF;AAAA,QACA,oBAAC,SACC,8BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAO,MACvD,8BAAC,OAAE,MAAM,eAAe,QAAO,UAAS,KAAI,uBACzC,YAAE,wDAAwD,aAAa,GAC1E,GACF,GACF;AAAA,QACA,oBAAC,OAAE,WAAU,iCACV;AAAA,UACC;AAAA,UACA;AAAA,QACF,GACF;AAAA,QACA,oBAAC,OAAE,WAAU,iCACX,8BAAC,QAAK,MAAK,oCAAmC,WAAU,mEACrD,YAAE,wDAAwD,sBAAsB,GACnF,GACF;AAAA,SACF;AAAA,MAEA,qBAAC,SAAI,WAAU,mCACb;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,qDAAqD,kBAAkB,GAC5E;AAAA,QACA,oBAAC,SAAI,WAAU,mBACb,+BAAC,WAAM,WAAU,kBACf;AAAA,8BAAC,WACC,+BAAC,QAAG,WAAU,sBACZ;AAAA,gCAAC,QAAG,WAAU,+CACX,YAAE,qDAAqD,OAAO,GACjE;AAAA,YACA,oBAAC,QAAG,WAAU,+CACX,YAAE,wDAAwD,UAAU,GACvE;AAAA,YACA,oBAAC,QAAG,WAAU,0CACX,YAAE,oDAAoD,MAAM,GAC/D;AAAA,aACF,GACF;AAAA,UACA,oBAAC,WACE,2BAAiB,IAAI,CAAC,SACrB,qBAAC,QAAoB,WAAU,0BAC7B;AAAA,gCAAC,QAAG,WAAU,+BAA+B,eAAK,OAAM;AAAA,YACxD,oBAAC,QAAG,WAAU,+BAA+B,eAAK,UAAS;AAAA,YAC3D,oBAAC,QAAG,WAAU,gBAAgB,eAAK,MAAK;AAAA,eAHjC,KAAK,KAId,CACD,GACH;AAAA,WACF,GACF;AAAA,QACA,oBAAC,OAAE,WAAU,iCACV;AAAA,UACC;AAAA,UACA;AAAA,QACF,GACF;AAAA,SACF;AAAA,MAEA,qBAAC,SAAI,WAAU,mCACb;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,gDAAgD,aAAa,GAClE;AAAA,QACA,qBAAC,QAAG,WAAU,aACZ;AAAA,8BAAC,QACC,8BAAC,QAAK,MAAK,oCAAmC,WAAU,2EACrD,YAAE,uDAAuD,uBAAuB,GACnF,GACF;AAAA,UACA,oBAAC,QACC,8BAAC,QAAK,MAAK,oCAAmC,WAAU,2EACrD,YAAE,uDAAuD,uBAAuB,GACnF,GACF;AAAA,UACA,oBAAC,QACC;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,QAAO;AAAA,cACP,KAAI;AAAA,cACJ,WAAU;AAAA,cAET,YAAE,sDAAsD,sBAAsB;AAAA;AAAA,UACjF,GACF;AAAA,WACF;AAAA,SACF;AAAA,OACF;AAAA,KACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport { useMemo } from 'react'\nimport Link from 'next/link'\nimport { FormHeader } from '@open-mercato/ui/backend/forms'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'\n\nconst DEMO_CREDENTIALS = [\n  { email: 'alice.johnson@example.com', password: 'Password123!', role: 'Portal Admin' },\n  { email: 'bob.smith@example.com', password: 'Password123!', role: 'Buyer' },\n  { email: 'carol.white@example.com', password: 'Password123!', role: 'Viewer' },\n] as const\n\nexport type CustomerAccountsSettingsPageClientProps = {\n  portalOrigin: string\n  portalOrgSlug?: string | null\n}\n\nexport function CustomerAccountsSettingsPageClient({ portalOrigin, portalOrgSlug = null }: CustomerAccountsSettingsPageClientProps) {\n  const t = useT()\n\n  const portalUrl = useMemo(() => buildPortalUrlPattern(portalOrigin), [portalOrigin])\n  const portalRootUrl = useMemo(\n    () => (portalOrgSlug ? buildPortalRootUrl(portalOrigin, portalOrgSlug) : null),\n    [portalOrigin, portalOrgSlug],\n  )\n\n  return (\n    <>\n      <div className=\"px-3 py-3 md:px-6 md:py-4\">\n        <FormHeader\n          mode=\"detail\"\n          title={t('customer_accounts.settings.title', 'Portal Settings')}\n          backHref=\"/backend/customer_accounts/users\"\n          backLabel={t('customer_accounts.settings.back', 'Customer Users')}\n        />\n      </div>\n\n      <div className=\"max-w-2xl space-y-6\">\n        <div className=\"rounded-lg border p-4 space-y-3\">\n          <h3 className=\"text-sm font-semibold\">\n            {t('customer_accounts.settings.portal_access.title', 'Portal Access')}\n          </h3>\n          <div>\n            <p className=\"text-sm text-muted-foreground\">\n              {t('customer_accounts.settings.portal_access.url_label', 'Portal URL pattern:')}\n            </p>\n            <code className=\"mt-1 block rounded bg-muted px-3 py-2 text-sm font-mono\">\n              {portalUrl}\n            </code>\n          </div>\n          {portalRootUrl ? (\n            <div>\n              <Button type=\"button\" variant=\"outline\" size=\"sm\" asChild>\n                <a href={portalRootUrl} target=\"_blank\" rel=\"noopener noreferrer\">\n                  {t('customer_accounts.settings.portal_access.open_portal', 'Open Portal')}\n                </a>\n              </Button>\n            </div>\n          ) : null}\n          <p className=\"text-xs text-muted-foreground\">\n            {t(\n              'customer_accounts.settings.portal_access.slug_note',\n              'The organization slug is auto-generated from the organization name. You can view and manage organizations in Directory \\u2192 Organizations.',\n            )}\n          </p>\n          <p className=\"text-xs text-muted-foreground\">\n            <Link href=\"/backend/directory/organizations\" className=\"text-primary underline underline-offset-4 hover:text-primary/80\">\n              {t('customer_accounts.settings.portal_access.manage_orgs', 'Manage Organizations')}\n            </Link>\n          </p>\n        </div>\n\n        <div className=\"rounded-lg border p-4 space-y-3\">\n          <h3 className=\"text-sm font-semibold\">\n            {t('customer_accounts.settings.demo_credentials.title', 'Demo Credentials')}\n          </h3>\n          <div className=\"overflow-x-auto\">\n            <table className=\"w-full text-sm\">\n              <thead>\n                <tr className=\"border-b text-left\">\n                  <th className=\"pb-2 pr-4 font-medium text-muted-foreground\">\n                    {t('customer_accounts.settings.demo_credentials.email', 'Email')}\n                  </th>\n                  <th className=\"pb-2 pr-4 font-medium text-muted-foreground\">\n                    {t('customer_accounts.settings.demo_credentials.password', 'Password')}\n                  </th>\n                  <th className=\"pb-2 font-medium text-muted-foreground\">\n                    {t('customer_accounts.settings.demo_credentials.role', 'Role')}\n                  </th>\n                </tr>\n              </thead>\n              <tbody>\n                {DEMO_CREDENTIALS.map((cred) => (\n                  <tr key={cred.email} className=\"border-b last:border-0\">\n                    <td className=\"py-2 pr-4 font-mono text-xs\">{cred.email}</td>\n                    <td className=\"py-2 pr-4 font-mono text-xs\">{cred.password}</td>\n                    <td className=\"py-2 text-xs\">{cred.role}</td>\n                  </tr>\n                ))}\n              </tbody>\n            </table>\n          </div>\n          <p className=\"text-xs text-muted-foreground\">\n            {t(\n              'customer_accounts.settings.demo_credentials.note',\n              'These credentials are only available if example data was seeded during setup.',\n            )}\n          </p>\n        </div>\n\n        <div className=\"rounded-lg border p-4 space-y-3\">\n          <h3 className=\"text-sm font-semibold\">\n            {t('customer_accounts.settings.quick_links.title', 'Quick Links')}\n          </h3>\n          <ul className=\"space-y-2\">\n            <li>\n              <Link href=\"/backend/customer_accounts/users\" className=\"text-sm text-primary underline underline-offset-4 hover:text-primary/80\">\n                {t('customer_accounts.settings.quick_links.manage_users', 'Manage customer users')}\n              </Link>\n            </li>\n            <li>\n              <Link href=\"/backend/customer_accounts/roles\" className=\"text-sm text-primary underline underline-offset-4 hover:text-primary/80\">\n                {t('customer_accounts.settings.quick_links.manage_roles', 'Manage customer roles')}\n              </Link>\n            </li>\n            <li>\n              <a\n                href=\"https://docs.open-mercato.com/framework/modules/customer-portal\"\n                target=\"_blank\"\n                rel=\"noopener noreferrer\"\n                className=\"text-sm text-primary underline underline-offset-4 hover:text-primary/80\"\n              >\n                {t('customer_accounts.settings.quick_links.portal_docs', 'Portal documentation')}\n              </a>\n            </li>\n          </ul>\n        </div>\n      </div>\n    </>\n  )\n}\n"],
+  "mappings": ";AA8BI,mBAEI,KAaE,YAfN;AA5BJ,SAAS,eAAe;AACxB,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,oBAAoB,6BAA6B;AAE1D,MAAM,mBAAmB;AAAA,EACvB,EAAE,OAAO,6BAA6B,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACrF,EAAE,OAAO,yBAAyB,UAAU,gBAAgB,MAAM,QAAQ;AAAA,EAC1E,EAAE,OAAO,2BAA2B,UAAU,gBAAgB,MAAM,SAAS;AAC/E;AAOO,SAAS,mCAAmC,EAAE,cAAc,gBAAgB,KAAK,GAA4C;AAClI,QAAM,IAAI,KAAK;AAEf,QAAM,YAAY,QAAQ,MAAM,sBAAsB,YAAY,GAAG,CAAC,YAAY,CAAC;AACnF,QAAM,gBAAgB;AAAA,IACpB,MAAO,gBAAgB,mBAAmB,cAAc,aAAa,IAAI;AAAA,IACzE,CAAC,cAAc,aAAa;AAAA,EAC9B;AAEA,SACE,iCACE;AAAA,wBAAC,SAAI,WAAU,6BACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,OAAO,EAAE,oCAAoC,iBAAiB;AAAA,QAC9D,UAAS;AAAA,QACT,WAAW,EAAE,mCAAmC,gBAAgB;AAAA;AAAA,IAClE,GACF;AAAA,IAEA,qBAAC,SAAI,WAAU,uBACb;AAAA,2BAAC,SAAI,WAAU,mCACb;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,kDAAkD,eAAe,GACtE;AAAA,QACA,qBAAC,SACC;AAAA,8BAAC,OAAE,WAAU,iCACV,YAAE,sDAAsD,qBAAqB,GAChF;AAAA,UACA,oBAAC,UAAK,WAAU,2DACb,qBACH;AAAA,WACF;AAAA,QACC,gBACC,oBAAC,SACC,8BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAO,MACvD,8BAAC,OAAE,MAAM,eAAe,QAAO,UAAS,KAAI,uBACzC,YAAE,wDAAwD,aAAa,GAC1E,GACF,GACF,IACE;AAAA,QACJ,oBAAC,OAAE,WAAU,iCACV;AAAA,UACC;AAAA,UACA;AAAA,QACF,GACF;AAAA,QACA,oBAAC,OAAE,WAAU,iCACX,8BAAC,QAAK,MAAK,oCAAmC,WAAU,mEACrD,YAAE,wDAAwD,sBAAsB,GACnF,GACF;AAAA,SACF;AAAA,MAEA,qBAAC,SAAI,WAAU,mCACb;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,qDAAqD,kBAAkB,GAC5E;AAAA,QACA,oBAAC,SAAI,WAAU,mBACb,+BAAC,WAAM,WAAU,kBACf;AAAA,8BAAC,WACC,+BAAC,QAAG,WAAU,sBACZ;AAAA,gCAAC,QAAG,WAAU,+CACX,YAAE,qDAAqD,OAAO,GACjE;AAAA,YACA,oBAAC,QAAG,WAAU,+CACX,YAAE,wDAAwD,UAAU,GACvE;AAAA,YACA,oBAAC,QAAG,WAAU,0CACX,YAAE,oDAAoD,MAAM,GAC/D;AAAA,aACF,GACF;AAAA,UACA,oBAAC,WACE,2BAAiB,IAAI,CAAC,SACrB,qBAAC,QAAoB,WAAU,0BAC7B;AAAA,gCAAC,QAAG,WAAU,+BAA+B,eAAK,OAAM;AAAA,YACxD,oBAAC,QAAG,WAAU,+BAA+B,eAAK,UAAS;AAAA,YAC3D,oBAAC,QAAG,WAAU,gBAAgB,eAAK,MAAK;AAAA,eAHjC,KAAK,KAId,CACD,GACH;AAAA,WACF,GACF;AAAA,QACA,oBAAC,OAAE,WAAU,iCACV;AAAA,UACC;AAAA,UACA;AAAA,QACF,GACF;AAAA,SACF;AAAA,MAEA,qBAAC,SAAI,WAAU,mCACb;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,gDAAgD,aAAa,GAClE;AAAA,QACA,qBAAC,QAAG,WAAU,aACZ;AAAA,8BAAC,QACC,8BAAC,QAAK,MAAK,oCAAmC,WAAU,2EACrD,YAAE,uDAAuD,uBAAuB,GACnF,GACF;AAAA,UACA,oBAAC,QACC,8BAAC,QAAK,MAAK,oCAAmC,WAAU,2EACrD,YAAE,uDAAuD,uBAAuB,GACnF,GACF;AAAA,UACA,oBAAC,QACC;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,QAAO;AAAA,cACP,KAAI;AAAA,cACJ,WAAU;AAAA,cAET,YAAE,sDAAsD,sBAAsB;AAAA;AAAA,UACjF,GACF;AAAA,WACF;AAAA,SACF;AAAA,OACF;AAAA,KACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/settings/page.js

@@ -2,10 +2,12 @@ import { jsx } from "react/jsx-runtime";
 import { headers } from "next/headers";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { resolvePortalRequestOrigin } from "../../../lib/portalUrl.js";
+import { resolveCurrentOrgPortalSlug } from "../../../lib/portalOrgSlug.js";
 import { CustomerAccountsSettingsPageClient } from "./CustomerAccountsSettingsPageClient.js";
 async function CustomerAccountsSettingsPage() {
   const portalOrigin = resolvePortalRequestOrigin(await headers());
-  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { className: "space-y-6", children: /* @__PURE__ */ jsx(CustomerAccountsSettingsPageClient, { portalOrigin }) }) });
+  const portalOrgSlug = await resolveCurrentOrgPortalSlug();
+  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { className: "space-y-6", children: /* @__PURE__ */ jsx(CustomerAccountsSettingsPageClient, { portalOrigin, portalOrgSlug }) }) });
 }
 export {
   CustomerAccountsSettingsPage as default

package/dist/modules/customer_accounts/backend/customer_accounts/settings/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/backend/customer_accounts/settings/page.tsx"],
-  "sourcesContent": ["import { headers } from 'next/headers'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { resolvePortalRequestOrigin } from '../../../lib/portalUrl'\nimport { CustomerAccountsSettingsPageClient } from './CustomerAccountsSettingsPageClient'\n\nexport default async function CustomerAccountsSettingsPage() {\n  const portalOrigin = resolvePortalRequestOrigin(await headers())\n  return (\n    <Page>\n      {/* space-y-6 preserves the gap the page header previously got as a direct <Page> child. */}\n      <PageBody className=\"space-y-6\">\n        <CustomerAccountsSettingsPageClient portalOrigin={portalOrigin} />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": "AAWQ;AAXR,SAAS,eAAe;AACxB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,kCAAkC;AAC3C,SAAS,0CAA0C;AAEnD,eAAO,+BAAsD;AAC3D,QAAM,eAAe,2BAA2B,MAAM,QAAQ,CAAC;AAC/D,SACE,oBAAC,QAEC,8BAAC,YAAS,WAAU,aAClB,8BAAC,sCAAmC,cAA4B,GAClE,GACF;AAEJ;",
+  "sourcesContent": ["import { headers } from 'next/headers'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { resolvePortalRequestOrigin } from '../../../lib/portalUrl'\nimport { resolveCurrentOrgPortalSlug } from '../../../lib/portalOrgSlug'\nimport { CustomerAccountsSettingsPageClient } from './CustomerAccountsSettingsPageClient'\n\nexport default async function CustomerAccountsSettingsPage() {\n  const portalOrigin = resolvePortalRequestOrigin(await headers())\n  const portalOrgSlug = await resolveCurrentOrgPortalSlug()\n  return (\n    <Page>\n      {/* space-y-6 preserves the gap the page header previously got as a direct <Page> child. */}\n      <PageBody className=\"space-y-6\">\n        <CustomerAccountsSettingsPageClient portalOrigin={portalOrigin} portalOrgSlug={portalOrgSlug} />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": "AAaQ;AAbR,SAAS,eAAe;AACxB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,kCAAkC;AAC3C,SAAS,mCAAmC;AAC5C,SAAS,0CAA0C;AAEnD,eAAO,+BAAsD;AAC3D,QAAM,eAAe,2BAA2B,MAAM,QAAQ,CAAC;AAC/D,QAAM,gBAAgB,MAAM,4BAA4B;AACxD,SACE,oBAAC,QAEC,8BAAC,YAAS,WAAU,aAClB,8BAAC,sCAAmC,cAA4B,eAA8B,GAChG,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.js

@@ -183,7 +183,7 @@ function CreateUserDialog({
     ] })
   ] }) });
 }
-function PortalUsersPageClient({ portalOrigin }) {
+function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }) {
   const { confirm, ConfirmDialogElement } = useConfirmDialog();
   const t = useT();
   const router = useRouter();
@@ -430,19 +430,19 @@ function PortalUsersPageClient({ portalOrigin }) {
             ] })
           }
         ),
-        /* @__PURE__ */ jsx(
+        portalOrgSlug ? /* @__PURE__ */ jsx(
           Button,
           {
             type: "button",
             variant: "outline",
             size: "sm",
             asChild: true,
-            children: /* @__PURE__ */ jsxs("a", { href: buildPortalRootUrl(portalOrigin), target: "_blank", rel: "noopener noreferrer", children: [
+            children: /* @__PURE__ */ jsxs("a", { href: buildPortalRootUrl(portalOrigin, portalOrgSlug), target: "_blank", rel: "noopener noreferrer", children: [
               /* @__PURE__ */ jsx(Globe, { className: "size-4" }),
               t("customer_accounts.admin.portalInfo.open", "Open Portal")
             ] })
           }
-        )
+        ) : null
       ] })
     ] }) }),
     /* @__PURE__ */ jsx(

package/dist/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/customer_accounts/extension-points'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Globe, Settings } from 'lucide-react'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\nimport { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'\n\ntype UserRow = {\n  id: string\n  displayName: string\n  email: string\n  emailVerified: boolean\n  isActive: boolean\n  lastLoginAt: string | null\n  roles: Array<{ id: string; name: string; slug: string }>\n  createdAt: string\n  updatedAt?: string | null\n  personEntityId: string | null\n  customerEntityId: string | null\n}\n\ntype UsersResponse = {\n  items?: UserRow[]\n  total?: number\n  totalPages?: number\n  totalIsCapped?: boolean\n}\n\nfunction formatDate(value: string | null | undefined, fallback: string): string {\n  if (!value) return fallback\n  const date = new Date(value)\n  if (Number.isNaN(date.getTime())) return fallback\n  return date.toLocaleDateString()\n}\n\nasync function fetchRoleFilterOptions(): Promise<Array<{ value: string; label: string; id: string }>> {\n  try {\n    const call = await apiCall<{ items?: Array<{ id: string; name: string }> }>(\n      '/api/customer_accounts/admin/roles?pageSize=100',\n    )\n    if (!call.ok) return []\n    const items = Array.isArray(call.result?.items) ? call.result!.items : []\n    return items\n      .filter((item) => typeof item?.id === 'string' && typeof item?.name === 'string')\n      .map((item) => ({ value: item.id, label: item.name, id: item.id }))\n  } catch {\n    return []\n  }\n}\n\nfunction CreateUserDialog({\n  open,\n  onOpenChange,\n  roleOptions,\n  onCreated,\n  onRunMutation,\n}: {\n  open: boolean\n  onOpenChange: (next: boolean) => void\n  roleOptions: Array<{ id: string; label: string }>\n  onCreated: () => void\n  onRunMutation: <T>(operation: () => Promise<T>) => Promise<T>\n}) {\n  const t = useT()\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [password, setPassword] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const resetForm = React.useCallback(() => {\n    setEmail('')\n    setDisplayName('')\n    setPassword('')\n    setSelectedRoleIds([])\n  }, [])\n\n  const handleSubmit = React.useCallback(async (event: React.FormEvent) => {\n    event.preventDefault()\n    if (!email.trim() || !displayName.trim() || !password.trim()) {\n      flash(t('customer_accounts.admin.createUser.error.required', 'Email, name, and password are required'), 'error')\n      return\n    }\n    setIsSubmitting(true)\n    try {\n      await onRunMutation(async () => {\n        const call = await apiCall<{ ok: boolean; error?: string }>(\n          '/api/customer_accounts/admin/users',\n          {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({\n              email: email.trim(),\n              displayName: displayName.trim(),\n              password,\n              roleIds: selectedRoleIds.length > 0 ? selectedRoleIds : undefined,\n            }),\n          },\n        )\n        if (!call.ok) {\n          flash(call.result?.error || t('customer_accounts.admin.createUser.error.save', 'Failed to create user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.createUser.flash.created', 'User created'), 'success')\n        resetForm()\n        onOpenChange(false)\n        onCreated()\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.createUser.error.save', 'Failed to create user')\n      flash(message, 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }, [displayName, email, onCreated, onOpenChange, onRunMutation, password, resetForm, selectedRoleIds, t])\n\n  const handleKeyDown = React.useCallback((event: React.KeyboardEvent) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      const form = (event.target as HTMLElement).closest('form')\n      if (form) form.requestSubmit()\n    }\n  }, [])\n\n  return (\n    <Dialog open={open} onOpenChange={(next) => { if (!next) resetForm(); onOpenChange(next) }}>\n      <DialogContent className=\"sm:max-w-lg\">\n        <DialogHeader>\n          <DialogTitle>{t('customer_accounts.admin.createUser.title', 'Create Customer User')}</DialogTitle>\n        </DialogHeader>\n        <form onSubmit={(event) => { void handleSubmit(event) }} onKeyDown={handleKeyDown} className=\"space-y-4\">\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-email\">\n              {t('customer_accounts.admin.createUser.fields.email', 'Email')}\n            </label>\n            <EmailInput\n              id=\"create-email\"\n              required\n              value={email}\n              onChange={(event) => setEmail(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.emailPlaceholder', 'user@example.com')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-name\">\n              {t('customer_accounts.admin.createUser.fields.displayName', 'Display Name')}\n            </label>\n            <Input\n              id=\"create-name\"\n              type=\"text\"\n              required\n              value={displayName}\n              onChange={(event) => setDisplayName(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.displayNamePlaceholder', 'John Doe')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-password\">\n              {t('customer_accounts.admin.createUser.fields.password', 'Password')}\n            </label>\n            <PasswordInput\n              id=\"create-password\"\n              required\n              minLength={8}\n              value={password}\n              onChange={(event) => setPassword(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.passwordPlaceholder', 'Min. 8 characters')}\n              autoComplete=\"new-password\"\n            />\n          </div>\n          {roleOptions.length > 0 && (\n            <div className=\"space-y-2\">\n              <p className=\"text-sm font-medium\">{t('customer_accounts.admin.createUser.fields.roles', 'Roles')}</p>\n              <div className=\"flex flex-wrap gap-2\">\n                {roleOptions.map((role) => {\n                  const isSelected = selectedRoleIds.includes(role.id)\n                  return (\n                    <Button\n                      key={role.id}\n                      type=\"button\"\n                      size=\"2xs\"\n                      variant={isSelected ? 'secondary' : 'outline'}\n                      aria-pressed={isSelected}\n                      onClick={() => setSelectedRoleIds((prev) =>\n                        prev.includes(role.id) ? prev.filter((rid) => rid !== role.id) : [...prev, role.id],\n                      )}\n                      className=\"rounded-full\"\n                    >\n                      {role.label}\n                    </Button>\n                  )\n                })}\n              </div>\n            </div>\n          )}\n          <div className=\"flex justify-end gap-2 pt-2\">\n            <Button type=\"button\" variant=\"outline\" onClick={() => { resetForm(); onOpenChange(false) }}>\n              {t('customer_accounts.admin.createUser.actions.cancel', 'Cancel')}\n            </Button>\n            <Button type=\"submit\" disabled={isSubmitting}>\n              {isSubmitting\n                ? t('customer_accounts.admin.createUser.actions.creating', 'Creating...')\n                : t('customer_accounts.admin.createUser.actions.create', 'Create User')}\n            </Button>\n          </div>\n        </form>\n      </DialogContent>\n    </Dialog>\n  )\n}\n\nexport type PortalUsersPageClientProps = {\n  portalOrigin: string\n}\n\nexport function PortalUsersPageClient({ portalOrigin }: PortalUsersPageClientProps) {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const t = useT()\n  const router = useRouter()\n  const [rows, setRows] = React.useState<UserRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [totalIsCapped, setTotalIsCapped] = React.useState(false)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [roleOptions, setRoleOptions] = React.useState<Array<{ value: string; label: string; id: string }>>([])\n  const [createDialogOpen, setCreateDialogOpen] = React.useState(false)\n\n  const { runMutation, retryLastMutation } = useGuardedMutation<{\n    entityType: string\n    entityId?: string\n  }>({\n    contextId: 'customer_accounts:users-list',\n  })\n\n  const runMutationWithContext = React.useCallback(\n    async <T,>(operation: () => Promise<T>, mutationPayload?: Record<string, unknown>): Promise<T> => {\n      return runMutation({\n        operation,\n        mutationPayload,\n        context: { entityType: 'customer_accounts:user' },\n      })\n    },\n    [runMutation],\n  )\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchRoleFilterOptions().then((opts) => {\n      if (!cancelled) setRoleOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'status',\n      label: t('customer_accounts.admin.filters.status', 'Status'),\n      type: 'select',\n      options: [\n        { value: 'active', label: t('customer_accounts.admin.filters.active', 'Active') },\n        { value: 'inactive', label: t('customer_accounts.admin.filters.inactive', 'Inactive') },\n      ],\n    },\n    {\n      id: 'roleId',\n      label: t('customer_accounts.admin.filters.role', 'Role'),\n      type: 'select',\n      options: roleOptions,\n    },\n  ], [roleOptions, t])\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (search.trim()) params.set('search', search.trim())\n    const status = filterValues.status\n    if (typeof status === 'string' && status.trim()) params.set('status', status)\n    const roleId = filterValues.roleId\n    if (typeof roleId === 'string' && roleId.trim()) params.set('roleId', roleId)\n    return params.toString()\n  }, [filterValues, page, pageSize, search])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const fallback: UsersResponse = { items: [], total: 0, totalPages: 1 }\n        const payload = await readApiResultOrThrow<UsersResponse>(\n          `/api/customer_accounts/admin/users?${queryParams}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users'), fallback },\n        )\n        if (cancelled) return\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        setRows(items)\n        setTotal(typeof payload?.total === 'number' ? payload.total : items.length)\n        setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)\n        setTotalIsCapped(payload?.totalIsCapped === true)\n      } catch (err) {\n        if (!cancelled) {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [queryParams, reloadToken, t])\n\n  const handleToggleActive = React.useCallback(async (user: UserRow) => {\n    const nextActive = !user.isActive\n    const actionLabel = nextActive\n      ? t('customer_accounts.admin.actions.activate', 'Activate')\n      : t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.toggleActive', '{{action}} user \"{{name}}\"?', {\n        action: actionLabel,\n        name: user.displayName || user.email,\n      }),\n      variant: nextActive ? 'default' : 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(user.updatedAt),\n          () => apiCall(\n            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n            {\n              method: 'PUT',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({ isActive: nextActive }),\n            },\n          ),\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.toggleActive', 'Failed to update user status'), 'error')\n          return\n        }\n        flash(\n          nextActive\n            ? t('customer_accounts.admin.flash.activated', 'User activated')\n            : t('customer_accounts.admin.flash.deactivated', 'User deactivated'),\n          'success',\n        )\n        setReloadToken((token) => token + 1)\n      }, { userId: user.id, isActive: nextActive })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.toggleActive', 'Failed to update user status')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleDelete = React.useCallback(async (user: UserRow) => {\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.delete', 'Delete user \"{{name}}\"?', {\n        name: user.displayName || user.email,\n      }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(user.updatedAt),\n          () => apiCall(\n            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n            { method: 'DELETE' },\n          ),\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.flash.deleted', 'User deleted'), 'success')\n        setReloadToken((token) => token + 1)\n      }, { id: user.id })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.delete', 'Failed to delete user')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    setFilterValues(values)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const columns = React.useMemo<ColumnDef<UserRow>[]>(() => {\n    const noValue = <span className=\"text-muted-foreground text-sm\">-</span>\n    return [\n      {\n        accessorKey: 'displayName',\n        header: t('customer_accounts.admin.columns.displayName', 'Name'),\n        cell: ({ row }) => (\n          <Link\n            href={`/backend/customer_accounts/users/${row.original.id}`}\n            className=\"font-medium hover:underline\"\n          >\n            {row.original.displayName || row.original.email}\n          </Link>\n        ),\n      },\n      {\n        accessorKey: 'email',\n        header: t('customer_accounts.admin.columns.email', 'Email'),\n      },\n      {\n        accessorKey: 'emailVerified',\n        header: t('customer_accounts.admin.columns.emailVerified', 'Verified'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.emailVerified\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-warning-bg text-status-warning-text'\n          }`}>\n            {row.original.emailVerified\n              ? t('customer_accounts.admin.verified', 'Yes')\n              : t('customer_accounts.admin.unverified', 'No')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'isActive',\n        header: t('customer_accounts.admin.columns.status', 'Status'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.isActive\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-error-bg text-status-error-text'\n          }`}>\n            {row.original.isActive\n              ? t('customer_accounts.admin.active', 'Active')\n              : t('customer_accounts.admin.inactive', 'Inactive')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'lastLoginAt',\n        header: t('customer_accounts.admin.columns.lastLogin', 'Last Login'),\n        cell: ({ row }) => formatDate(row.original.lastLoginAt, '-') || noValue,\n      },\n      {\n        accessorKey: 'roles',\n        header: t('customer_accounts.admin.columns.roles', 'Roles'),\n        cell: ({ row }) => {\n          const roles = row.original.roles\n          if (!roles || !roles.length) return noValue\n          return <span className=\"text-sm\">{roles.map((r) => r.name).join(', ')}</span>\n        },\n      },\n      {\n        accessorKey: 'createdAt',\n        header: t('customer_accounts.admin.columns.createdAt', 'Created'),\n        cell: ({ row }) => formatDate(row.original.createdAt, '-'),\n      },\n    ]\n  }, [t])\n\n  return (\n    <>\n      <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n        <div className=\"flex items-start justify-between gap-4\">\n          <div>\n            <h3 className=\"text-sm font-medium text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.title', 'Customer Portal')}\n            </h3>\n            <p className=\"mt-1 text-sm text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.description', 'Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.')}\n            </p>\n            <p className=\"mt-1.5 text-xs text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.url', 'Portal URL: {url}', {\n                url: buildPortalUrlPattern(portalOrigin),\n              })}\n            </p>\n            <p className=\"mt-0.5 text-xs text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.credentials', 'Demo credentials: alice.johnson@example.com / Password123!')}\n            </p>\n          </div>\n          <div className=\"flex shrink-0 flex-col gap-2\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              asChild\n            >\n              <Link href=\"/backend/customer_accounts/settings\">\n                <Settings className=\"size-4\" />\n                {t('customer_accounts.admin.portalInfo.openConfiguration', 'Open Configuration')}\n              </Link>\n            </Button>\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              asChild\n            >\n              <a href={buildPortalRootUrl(portalOrigin)} target=\"_blank\" rel=\"noopener noreferrer\">\n                <Globe className=\"size-4\" />\n                {t('customer_accounts.admin.portalInfo.open', 'Open Portal')}\n              </a>\n            </Button>\n          </div>\n        </div>\n      </div>\n      <DataTable<UserRow>\n        stickyActionsColumn\n        title={t('customer_accounts.admin.title', 'Users')}\n        actions={(\n          <Button onClick={() => setCreateDialogOpen(true)}>\n            {t('customer_accounts.admin.actions.createUser', 'Create User')}\n          </Button>\n        )}\n        columns={columns}\n        data={rows}\n        searchValue={search}\n        onSearchChange={(value) => { setSearch(value); setPage(1) }}\n        searchPlaceholder={t('customer_accounts.admin.searchPlaceholder', 'Search by name or email...')}\n        filters={filters}\n        filterValues={filterValues}\n        onFiltersApply={handleFiltersApply}\n        onFiltersClear={handleFiltersClear}\n        perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}\n        emptyState={(\n          <ListEmptyState\n            entityName={t('customer_accounts.admin.title', 'Users')}\n            onCreate={() => setCreateDialogOpen(true)}\n            createLabel={t('customer_accounts.admin.actions.createUser', 'Create User')}\n          />\n        )}\n        onRowClick={(row) => router.push(`/backend/customer_accounts/users/${row.id}`)}\n        rowActions={(row) => (\n          <RowActions\n            items={[\n              {\n                id: 'view',\n                label: t('customer_accounts.admin.actions.view', 'View'),\n                onSelect: () => { router.push(`/backend/customer_accounts/users/${row.id}`) },\n              },\n              {\n                id: 'toggle-active',\n                label: row.isActive\n                  ? t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n                  : t('customer_accounts.admin.actions.activate', 'Activate'),\n                onSelect: () => { void handleToggleActive(row) },\n              },\n              {\n                id: 'delete',\n                label: t('customer_accounts.admin.actions.delete', 'Delete'),\n                destructive: true,\n                onSelect: () => { void handleDelete(row) },\n              },\n            ]}\n          />\n        )}\n        pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}\n        isLoading={isLoading}\n      />\n      <CreateUserDialog\n        open={createDialogOpen}\n        onOpenChange={setCreateDialogOpen}\n        roleOptions={roleOptions}\n        onCreated={() => setReloadToken((token) => token + 1)}\n        onRunMutation={runMutationWithContext}\n      />\n      {ConfirmDialogElement}\n    </>\n  )\n}\n"],
-  "mappings": ";AAkJU,SA0VN,UA1VM,KAGA,YAHA;AAhJV,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,OAAO,gBAAgB;AAChC,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,eAAe,cAAc,mBAAmB;AACjE,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB,6BAA6B;AAuB1D,SAAS,WAAW,OAAkC,UAA0B;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO;AACzC,SAAO,KAAK,mBAAmB;AACjC;AAEA,eAAe,yBAAuF;AACpG,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,WAAO,MACJ,OAAO,CAAC,SAAS,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,SAAS,QAAQ,EAC/E,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG,EAAE;AAAA,EACtE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,YAAY,MAAM,YAAY,MAAM;AACxC,aAAS,EAAE;AACX,mBAAe,EAAE;AACjB,gBAAY,EAAE;AACd,uBAAmB,CAAC,CAAC;AAAA,EACvB,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,YAAY,OAAO,UAA2B;AACvE,UAAM,eAAe;AACrB,QAAI,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,KAAK,GAAG;AAC5D,YAAM,EAAE,qDAAqD,wCAAwC,GAAG,OAAO;AAC/G;AAAA,IACF;AACA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,cAAc,YAAY;AAC9B,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU;AAAA,cACnB,OAAO,MAAM,KAAK;AAAA,cAClB,aAAa,YAAY,KAAK;AAAA,cAC9B;AAAA,cACA,SAAS,gBAAgB,SAAS,IAAI,kBAAkB;AAAA,YAC1D,CAAC;AAAA,UACH;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,KAAK,QAAQ,SAAS,EAAE,iDAAiD,uBAAuB,GAAG,OAAO;AAChH;AAAA,QACF;AACA,cAAM,EAAE,oDAAoD,cAAc,GAAG,SAAS;AACtF,kBAAU;AACV,qBAAa,KAAK;AAClB,kBAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,uBAAuB;AAC/H,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,aAAa,OAAO,WAAW,cAAc,eAAe,UAAU,WAAW,iBAAiB,CAAC,CAAC;AAExG,QAAM,gBAAgB,MAAM,YAAY,CAAC,UAA+B;AACtE,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,YAAM,OAAQ,MAAM,OAAuB,QAAQ,MAAM;AACzD,UAAI,KAAM,MAAK,cAAc;AAAA,IAC/B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,UAAO,MAAY,cAAc,CAAC,SAAS;AAAE,QAAI,CAAC,KAAM,WAAU;AAAG,iBAAa,IAAI;AAAA,EAAE,GACvF,+BAAC,iBAAc,WAAU,eACvB;AAAA,wBAAC,gBACC,8BAAC,eAAa,YAAE,4CAA4C,sBAAsB,GAAE,GACtF;AAAA,IACA,qBAAC,UAAK,UAAU,CAAC,UAAU;AAAE,WAAK,aAAa,KAAK;AAAA,IAAE,GAAG,WAAW,eAAe,WAAU,aAC3F;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,gBAC5C,YAAE,mDAAmD,OAAO,GAC/D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,YAChD,aAAa,EAAE,8DAA8D,kBAAkB;AAAA;AAAA,QACjG;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,eAC5C,YAAE,yDAAyD,cAAc,GAC5E;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,YACtD,aAAa,EAAE,oEAAoE,UAAU;AAAA;AAAA,QAC/F;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,mBAC5C,YAAE,sDAAsD,UAAU,GACrE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,WAAW;AAAA,YACX,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,YAAY,MAAM,OAAO,KAAK;AAAA,YACnD,aAAa,EAAE,iEAAiE,mBAAmB;AAAA,YACnG,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACC,YAAY,SAAS,KACpB,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,OAAE,WAAU,uBAAuB,YAAE,mDAAmD,OAAO,GAAE;AAAA,QAClG,oBAAC,SAAI,WAAU,wBACZ,sBAAY,IAAI,CAAC,SAAS;AACzB,gBAAM,aAAa,gBAAgB,SAAS,KAAK,EAAE;AACnD,iBACE;AAAA,YAAC;AAAA;AAAA,cAEC,MAAK;AAAA,cACL,MAAK;AAAA,cACL,SAAS,aAAa,cAAc;AAAA,cACpC,gBAAc;AAAA,cACd,SAAS,MAAM;AAAA,gBAAmB,CAAC,SACjC,KAAK,SAAS,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE;AAAA,cACpF;AAAA,cACA,WAAU;AAAA,cAET,eAAK;AAAA;AAAA,YAVD,KAAK;AAAA,UAWZ;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEF,qBAAC,SAAI,WAAU,+BACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAS,MAAM;AAAE,oBAAU;AAAG,uBAAa,KAAK;AAAA,QAAE,GACvF,YAAE,qDAAqD,QAAQ,GAClE;AAAA,QACA,oBAAC,UAAO,MAAK,UAAS,UAAU,cAC7B,yBACG,EAAE,uDAAuD,aAAa,IACtE,EAAE,qDAAqD,aAAa,GAC1E;AAAA,SACF;AAAA,OACF;AAAA,KACF,GACF;AAEJ;AAMO,SAAS,sBAAsB,EAAE,aAAa,GAA+B;AAClF,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAoB,CAAC,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAA8D,CAAC,CAAC;AAC5G,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,KAAK;AAEpE,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAGxC;AAAA,IACD,WAAW;AAAA,EACb,CAAC;AAED,QAAM,yBAAyB,MAAM;AAAA,IACnC,OAAW,WAA6B,oBAA0D;AAChG,aAAO,YAAY;AAAA,QACjB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,CAAC,WAAW;AAAA,EACd;AAEA,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,2BAAuB,EAAE,KAAK,CAAC,SAAS;AACtC,UAAI,CAAC,UAAW,gBAAe,IAAI;AAAA,IACrC,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,MAC3D,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,UAAU,OAAO,EAAE,0CAA0C,QAAQ,EAAE;AAAA,QAChF,EAAE,OAAO,YAAY,OAAO,EAAE,4CAA4C,UAAU,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,MACvD,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,aAAa,CAAC,CAAC;AAEnB,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,cAAc,MAAM,UAAU,MAAM,CAAC;AAEzC,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,WAA0B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AACrE,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,WAAW;AAAA,UACjD;AAAA,UACA,EAAE,cAAc,EAAE,2CAA2C,+BAA+B,GAAG,SAAS;AAAA,QAC1G;AACA,YAAI,UAAW;AACf,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,gBAAQ,KAAK;AACb,iBAAS,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ,MAAM,MAAM;AAC1E,sBAAc,OAAO,SAAS,eAAe,WAAW,QAAQ,aAAa,CAAC;AAC9E,yBAAiB,SAAS,kBAAkB,IAAI;AAAA,MAClD,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,2CAA2C,+BAA+B;AACjI,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;AAEhC,QAAM,qBAAqB,MAAM,YAAY,OAAO,SAAkB;AACpE,UAAM,aAAa,CAAC,KAAK;AACzB,UAAM,cAAc,aAChB,EAAE,4CAA4C,UAAU,IACxD,EAAE,8CAA8C,YAAY;AAChE,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,gDAAgD,+BAA+B;AAAA,QACtF,QAAQ;AAAA,QACR,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS,aAAa,YAAY;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,0BAA0B,KAAK,SAAS;AAAA,UACxC,MAAM;AAAA,YACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,YACjE;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,WAAW,CAAC;AAAA,YAC/C;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,8CAA8C,8BAA8B,GAAG,OAAO;AAC9F;AAAA,QACF;AACA;AAAA,UACE,aACI,EAAE,2CAA2C,gBAAgB,IAC7D,EAAE,6CAA6C,kBAAkB;AAAA,UACrE;AAAA,QACF;AACA,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,QAAQ,KAAK,IAAI,UAAU,WAAW,CAAC;AAAA,IAC9C,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,8CAA8C,8BAA8B;AACnI,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,eAAe,MAAM,YAAY,OAAO,SAAkB;AAC9D,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,0CAA0C,2BAA2B;AAAA,QAC5E,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,0BAA0B,KAAK,SAAS;AAAA,UACxC,MAAM;AAAA,YACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,YACjE,EAAE,QAAQ,SAAS;AAAA,UACrB;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,wCAAwC,uBAAuB,GAAG,OAAO;AACjF;AAAA,QACF;AACA,cAAM,EAAE,yCAAyC,cAAc,GAAG,SAAS;AAC3E,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC;AAAA,IACpB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,wCAAwC,uBAAuB;AACtH,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,oBAAgB,MAAM;AACtB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAA8B,MAAM;AACxD,UAAM,UAAU,oBAAC,UAAK,WAAU,iCAAgC,eAAC;AACjE,WAAO;AAAA,MACL;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,+CAA+C,MAAM;AAAA,QAC/D,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,oCAAoC,IAAI,SAAS,EAAE;AAAA,YACzD,WAAU;AAAA,YAET,cAAI,SAAS,eAAe,IAAI,SAAS;AAAA;AAAA,QAC5C;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,MAC5D;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,iDAAiD,UAAU;AAAA,QACrE,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,gBACT,kDACA,+CACN,IACG,cAAI,SAAS,gBACV,EAAE,oCAAoC,KAAK,IAC3C,EAAE,sCAAsC,IAAI,GAClD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,0CAA0C,QAAQ;AAAA,QAC5D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,WACT,kDACA,2CACN,IACG,cAAI,SAAS,WACV,EAAE,kCAAkC,QAAQ,IAC5C,EAAE,oCAAoC,UAAU,GACtD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,YAAY;AAAA,QACnE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,aAAa,GAAG,KAAK;AAAA,MAClE;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,QAC1D,MAAM,CAAC,EAAE,IAAI,MAAM;AACjB,gBAAM,QAAQ,IAAI,SAAS;AAC3B,cAAI,CAAC,SAAS,CAAC,MAAM,OAAQ,QAAO;AACpC,iBAAO,oBAAC,UAAK,WAAU,WAAW,gBAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,GAAE;AAAA,QACxE;AAAA,MACF;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,SAAS;AAAA,QAChE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,WAAW,GAAG;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,iCACE;AAAA,wBAAC,SAAI,WAAU,qEACb,+BAAC,SAAI,WAAU,0CACb;AAAA,2BAAC,SACC;AAAA,4BAAC,QAAG,WAAU,6CACX,YAAE,4CAA4C,iBAAiB,GAClE;AAAA,QACA,oBAAC,OAAE,WAAU,sCACV,YAAE,kDAAkD,mIAAmI,GAC1L;AAAA,QACA,oBAAC,OAAE,WAAU,wCACV,YAAE,0CAA0C,qBAAqB;AAAA,UAChE,KAAK,sBAAsB,YAAY;AAAA,QACzC,CAAC,GACH;AAAA,QACA,oBAAC,OAAE,WAAU,wCACV,YAAE,kDAAkD,4DAA4D,GACnH;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,gCACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,SAAO;AAAA,YAEP,+BAAC,QAAK,MAAK,uCACT;AAAA,kCAAC,YAAS,WAAU,UAAS;AAAA,cAC5B,EAAE,wDAAwD,oBAAoB;AAAA,eACjF;AAAA;AAAA,QACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,SAAO;AAAA,YAEP,+BAAC,OAAE,MAAM,mBAAmB,YAAY,GAAG,QAAO,UAAS,KAAI,uBAC7D;AAAA,kCAAC,SAAM,WAAU,UAAS;AAAA,cACzB,EAAE,2CAA2C,aAAa;AAAA,eAC7D;AAAA;AAAA,QACF;AAAA,SACF;AAAA,OACF,GACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,qBAAmB;AAAA,QACnB,OAAO,EAAE,iCAAiC,OAAO;AAAA,QACjD,SACE,oBAAC,UAAO,SAAS,MAAM,oBAAoB,IAAI,GAC5C,YAAE,8CAA8C,aAAa,GAChE;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,mBAAmB,EAAE,6CAA6C,4BAA4B;AAAA,QAC9F;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,aAAa,EAAE,SAAS,gBAAgB,MAAM,WAAW,QAAQ;AAAA,QACjE,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,iCAAiC,OAAO;AAAA,YACtD,UAAU,MAAM,oBAAoB,IAAI;AAAA,YACxC,aAAa,EAAE,8CAA8C,aAAa;AAAA;AAAA,QAC5E;AAAA,QAEF,YAAY,CAAC,QAAQ,OAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,QAC7E,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,gBACvD,UAAU,MAAM;AAAE,yBAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,gBAAE;AAAA,cAC9E;AAAA,cACA;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,IAAI,WACP,EAAE,8CAA8C,YAAY,IAC5D,EAAE,4CAA4C,UAAU;AAAA,gBAC5D,UAAU,MAAM;AAAE,uBAAK,mBAAmB,GAAG;AAAA,gBAAE;AAAA,cACjD;AAAA,cACA;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,gBAC3D,aAAa;AAAA,gBACb,UAAU,MAAM;AAAE,uBAAK,aAAa,GAAG;AAAA,gBAAE;AAAA,cAC3C;AAAA,YACF;AAAA;AAAA,QACF;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA,QACtF;AAAA;AAAA,IACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,MAAM;AAAA,QACN,cAAc;AAAA,QACd;AAAA,QACA,WAAW,MAAM,eAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,QACpD,eAAe;AAAA;AAAA,IACjB;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/customer_accounts/extension-points'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Globe, Settings } from 'lucide-react'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\nimport { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'\n\ntype UserRow = {\n  id: string\n  displayName: string\n  email: string\n  emailVerified: boolean\n  isActive: boolean\n  lastLoginAt: string | null\n  roles: Array<{ id: string; name: string; slug: string }>\n  createdAt: string\n  updatedAt?: string | null\n  personEntityId: string | null\n  customerEntityId: string | null\n}\n\ntype UsersResponse = {\n  items?: UserRow[]\n  total?: number\n  totalPages?: number\n  totalIsCapped?: boolean\n}\n\nfunction formatDate(value: string | null | undefined, fallback: string): string {\n  if (!value) return fallback\n  const date = new Date(value)\n  if (Number.isNaN(date.getTime())) return fallback\n  return date.toLocaleDateString()\n}\n\nasync function fetchRoleFilterOptions(): Promise<Array<{ value: string; label: string; id: string }>> {\n  try {\n    const call = await apiCall<{ items?: Array<{ id: string; name: string }> }>(\n      '/api/customer_accounts/admin/roles?pageSize=100',\n    )\n    if (!call.ok) return []\n    const items = Array.isArray(call.result?.items) ? call.result!.items : []\n    return items\n      .filter((item) => typeof item?.id === 'string' && typeof item?.name === 'string')\n      .map((item) => ({ value: item.id, label: item.name, id: item.id }))\n  } catch {\n    return []\n  }\n}\n\nfunction CreateUserDialog({\n  open,\n  onOpenChange,\n  roleOptions,\n  onCreated,\n  onRunMutation,\n}: {\n  open: boolean\n  onOpenChange: (next: boolean) => void\n  roleOptions: Array<{ id: string; label: string }>\n  onCreated: () => void\n  onRunMutation: <T>(operation: () => Promise<T>) => Promise<T>\n}) {\n  const t = useT()\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [password, setPassword] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const resetForm = React.useCallback(() => {\n    setEmail('')\n    setDisplayName('')\n    setPassword('')\n    setSelectedRoleIds([])\n  }, [])\n\n  const handleSubmit = React.useCallback(async (event: React.FormEvent) => {\n    event.preventDefault()\n    if (!email.trim() || !displayName.trim() || !password.trim()) {\n      flash(t('customer_accounts.admin.createUser.error.required', 'Email, name, and password are required'), 'error')\n      return\n    }\n    setIsSubmitting(true)\n    try {\n      await onRunMutation(async () => {\n        const call = await apiCall<{ ok: boolean; error?: string }>(\n          '/api/customer_accounts/admin/users',\n          {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({\n              email: email.trim(),\n              displayName: displayName.trim(),\n              password,\n              roleIds: selectedRoleIds.length > 0 ? selectedRoleIds : undefined,\n            }),\n          },\n        )\n        if (!call.ok) {\n          flash(call.result?.error || t('customer_accounts.admin.createUser.error.save', 'Failed to create user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.createUser.flash.created', 'User created'), 'success')\n        resetForm()\n        onOpenChange(false)\n        onCreated()\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.createUser.error.save', 'Failed to create user')\n      flash(message, 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }, [displayName, email, onCreated, onOpenChange, onRunMutation, password, resetForm, selectedRoleIds, t])\n\n  const handleKeyDown = React.useCallback((event: React.KeyboardEvent) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      const form = (event.target as HTMLElement).closest('form')\n      if (form) form.requestSubmit()\n    }\n  }, [])\n\n  return (\n    <Dialog open={open} onOpenChange={(next) => { if (!next) resetForm(); onOpenChange(next) }}>\n      <DialogContent className=\"sm:max-w-lg\">\n        <DialogHeader>\n          <DialogTitle>{t('customer_accounts.admin.createUser.title', 'Create Customer User')}</DialogTitle>\n        </DialogHeader>\n        <form onSubmit={(event) => { void handleSubmit(event) }} onKeyDown={handleKeyDown} className=\"space-y-4\">\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-email\">\n              {t('customer_accounts.admin.createUser.fields.email', 'Email')}\n            </label>\n            <EmailInput\n              id=\"create-email\"\n              required\n              value={email}\n              onChange={(event) => setEmail(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.emailPlaceholder', 'user@example.com')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-name\">\n              {t('customer_accounts.admin.createUser.fields.displayName', 'Display Name')}\n            </label>\n            <Input\n              id=\"create-name\"\n              type=\"text\"\n              required\n              value={displayName}\n              onChange={(event) => setDisplayName(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.displayNamePlaceholder', 'John Doe')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-password\">\n              {t('customer_accounts.admin.createUser.fields.password', 'Password')}\n            </label>\n            <PasswordInput\n              id=\"create-password\"\n              required\n              minLength={8}\n              value={password}\n              onChange={(event) => setPassword(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.passwordPlaceholder', 'Min. 8 characters')}\n              autoComplete=\"new-password\"\n            />\n          </div>\n          {roleOptions.length > 0 && (\n            <div className=\"space-y-2\">\n              <p className=\"text-sm font-medium\">{t('customer_accounts.admin.createUser.fields.roles', 'Roles')}</p>\n              <div className=\"flex flex-wrap gap-2\">\n                {roleOptions.map((role) => {\n                  const isSelected = selectedRoleIds.includes(role.id)\n                  return (\n                    <Button\n                      key={role.id}\n                      type=\"button\"\n                      size=\"2xs\"\n                      variant={isSelected ? 'secondary' : 'outline'}\n                      aria-pressed={isSelected}\n                      onClick={() => setSelectedRoleIds((prev) =>\n                        prev.includes(role.id) ? prev.filter((rid) => rid !== role.id) : [...prev, role.id],\n                      )}\n                      className=\"rounded-full\"\n                    >\n                      {role.label}\n                    </Button>\n                  )\n                })}\n              </div>\n            </div>\n          )}\n          <div className=\"flex justify-end gap-2 pt-2\">\n            <Button type=\"button\" variant=\"outline\" onClick={() => { resetForm(); onOpenChange(false) }}>\n              {t('customer_accounts.admin.createUser.actions.cancel', 'Cancel')}\n            </Button>\n            <Button type=\"submit\" disabled={isSubmitting}>\n              {isSubmitting\n                ? t('customer_accounts.admin.createUser.actions.creating', 'Creating...')\n                : t('customer_accounts.admin.createUser.actions.create', 'Create User')}\n            </Button>\n          </div>\n        </form>\n      </DialogContent>\n    </Dialog>\n  )\n}\n\nexport type PortalUsersPageClientProps = {\n  portalOrigin: string\n  portalOrgSlug?: string | null\n}\n\nexport function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: PortalUsersPageClientProps) {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const t = useT()\n  const router = useRouter()\n  const [rows, setRows] = React.useState<UserRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [totalIsCapped, setTotalIsCapped] = React.useState(false)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [roleOptions, setRoleOptions] = React.useState<Array<{ value: string; label: string; id: string }>>([])\n  const [createDialogOpen, setCreateDialogOpen] = React.useState(false)\n\n  const { runMutation, retryLastMutation } = useGuardedMutation<{\n    entityType: string\n    entityId?: string\n  }>({\n    contextId: 'customer_accounts:users-list',\n  })\n\n  const runMutationWithContext = React.useCallback(\n    async <T,>(operation: () => Promise<T>, mutationPayload?: Record<string, unknown>): Promise<T> => {\n      return runMutation({\n        operation,\n        mutationPayload,\n        context: { entityType: 'customer_accounts:user' },\n      })\n    },\n    [runMutation],\n  )\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchRoleFilterOptions().then((opts) => {\n      if (!cancelled) setRoleOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'status',\n      label: t('customer_accounts.admin.filters.status', 'Status'),\n      type: 'select',\n      options: [\n        { value: 'active', label: t('customer_accounts.admin.filters.active', 'Active') },\n        { value: 'inactive', label: t('customer_accounts.admin.filters.inactive', 'Inactive') },\n      ],\n    },\n    {\n      id: 'roleId',\n      label: t('customer_accounts.admin.filters.role', 'Role'),\n      type: 'select',\n      options: roleOptions,\n    },\n  ], [roleOptions, t])\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (search.trim()) params.set('search', search.trim())\n    const status = filterValues.status\n    if (typeof status === 'string' && status.trim()) params.set('status', status)\n    const roleId = filterValues.roleId\n    if (typeof roleId === 'string' && roleId.trim()) params.set('roleId', roleId)\n    return params.toString()\n  }, [filterValues, page, pageSize, search])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const fallback: UsersResponse = { items: [], total: 0, totalPages: 1 }\n        const payload = await readApiResultOrThrow<UsersResponse>(\n          `/api/customer_accounts/admin/users?${queryParams}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users'), fallback },\n        )\n        if (cancelled) return\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        setRows(items)\n        setTotal(typeof payload?.total === 'number' ? payload.total : items.length)\n        setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)\n        setTotalIsCapped(payload?.totalIsCapped === true)\n      } catch (err) {\n        if (!cancelled) {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [queryParams, reloadToken, t])\n\n  const handleToggleActive = React.useCallback(async (user: UserRow) => {\n    const nextActive = !user.isActive\n    const actionLabel = nextActive\n      ? t('customer_accounts.admin.actions.activate', 'Activate')\n      : t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.toggleActive', '{{action}} user \"{{name}}\"?', {\n        action: actionLabel,\n        name: user.displayName || user.email,\n      }),\n      variant: nextActive ? 'default' : 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(user.updatedAt),\n          () => apiCall(\n            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n            {\n              method: 'PUT',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({ isActive: nextActive }),\n            },\n          ),\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.toggleActive', 'Failed to update user status'), 'error')\n          return\n        }\n        flash(\n          nextActive\n            ? t('customer_accounts.admin.flash.activated', 'User activated')\n            : t('customer_accounts.admin.flash.deactivated', 'User deactivated'),\n          'success',\n        )\n        setReloadToken((token) => token + 1)\n      }, { userId: user.id, isActive: nextActive })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.toggleActive', 'Failed to update user status')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleDelete = React.useCallback(async (user: UserRow) => {\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.delete', 'Delete user \"{{name}}\"?', {\n        name: user.displayName || user.email,\n      }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(user.updatedAt),\n          () => apiCall(\n            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n            { method: 'DELETE' },\n          ),\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.flash.deleted', 'User deleted'), 'success')\n        setReloadToken((token) => token + 1)\n      }, { id: user.id })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.delete', 'Failed to delete user')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    setFilterValues(values)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const columns = React.useMemo<ColumnDef<UserRow>[]>(() => {\n    const noValue = <span className=\"text-muted-foreground text-sm\">-</span>\n    return [\n      {\n        accessorKey: 'displayName',\n        header: t('customer_accounts.admin.columns.displayName', 'Name'),\n        cell: ({ row }) => (\n          <Link\n            href={`/backend/customer_accounts/users/${row.original.id}`}\n            className=\"font-medium hover:underline\"\n          >\n            {row.original.displayName || row.original.email}\n          </Link>\n        ),\n      },\n      {\n        accessorKey: 'email',\n        header: t('customer_accounts.admin.columns.email', 'Email'),\n      },\n      {\n        accessorKey: 'emailVerified',\n        header: t('customer_accounts.admin.columns.emailVerified', 'Verified'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.emailVerified\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-warning-bg text-status-warning-text'\n          }`}>\n            {row.original.emailVerified\n              ? t('customer_accounts.admin.verified', 'Yes')\n              : t('customer_accounts.admin.unverified', 'No')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'isActive',\n        header: t('customer_accounts.admin.columns.status', 'Status'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.isActive\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-error-bg text-status-error-text'\n          }`}>\n            {row.original.isActive\n              ? t('customer_accounts.admin.active', 'Active')\n              : t('customer_accounts.admin.inactive', 'Inactive')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'lastLoginAt',\n        header: t('customer_accounts.admin.columns.lastLogin', 'Last Login'),\n        cell: ({ row }) => formatDate(row.original.lastLoginAt, '-') || noValue,\n      },\n      {\n        accessorKey: 'roles',\n        header: t('customer_accounts.admin.columns.roles', 'Roles'),\n        cell: ({ row }) => {\n          const roles = row.original.roles\n          if (!roles || !roles.length) return noValue\n          return <span className=\"text-sm\">{roles.map((r) => r.name).join(', ')}</span>\n        },\n      },\n      {\n        accessorKey: 'createdAt',\n        header: t('customer_accounts.admin.columns.createdAt', 'Created'),\n        cell: ({ row }) => formatDate(row.original.createdAt, '-'),\n      },\n    ]\n  }, [t])\n\n  return (\n    <>\n      <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n        <div className=\"flex items-start justify-between gap-4\">\n          <div>\n            <h3 className=\"text-sm font-medium text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.title', 'Customer Portal')}\n            </h3>\n            <p className=\"mt-1 text-sm text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.description', 'Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.')}\n            </p>\n            <p className=\"mt-1.5 text-xs text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.url', 'Portal URL: {url}', {\n                url: buildPortalUrlPattern(portalOrigin),\n              })}\n            </p>\n            <p className=\"mt-0.5 text-xs text-status-info-text\">\n              {t('customer_accounts.admin.portalInfo.credentials', 'Demo credentials: alice.johnson@example.com / Password123!')}\n            </p>\n          </div>\n          <div className=\"flex shrink-0 flex-col gap-2\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              asChild\n            >\n              <Link href=\"/backend/customer_accounts/settings\">\n                <Settings className=\"size-4\" />\n                {t('customer_accounts.admin.portalInfo.openConfiguration', 'Open Configuration')}\n              </Link>\n            </Button>\n            {portalOrgSlug ? (\n              <Button\n                type=\"button\"\n                variant=\"outline\"\n                size=\"sm\"\n                asChild\n              >\n                <a href={buildPortalRootUrl(portalOrigin, portalOrgSlug)} target=\"_blank\" rel=\"noopener noreferrer\">\n                  <Globe className=\"size-4\" />\n                  {t('customer_accounts.admin.portalInfo.open', 'Open Portal')}\n                </a>\n              </Button>\n            ) : null}\n          </div>\n        </div>\n      </div>\n      <DataTable<UserRow>\n        stickyActionsColumn\n        title={t('customer_accounts.admin.title', 'Users')}\n        actions={(\n          <Button onClick={() => setCreateDialogOpen(true)}>\n            {t('customer_accounts.admin.actions.createUser', 'Create User')}\n          </Button>\n        )}\n        columns={columns}\n        data={rows}\n        searchValue={search}\n        onSearchChange={(value) => { setSearch(value); setPage(1) }}\n        searchPlaceholder={t('customer_accounts.admin.searchPlaceholder', 'Search by name or email...')}\n        filters={filters}\n        filterValues={filterValues}\n        onFiltersApply={handleFiltersApply}\n        onFiltersClear={handleFiltersClear}\n        perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}\n        emptyState={(\n          <ListEmptyState\n            entityName={t('customer_accounts.admin.title', 'Users')}\n            onCreate={() => setCreateDialogOpen(true)}\n            createLabel={t('customer_accounts.admin.actions.createUser', 'Create User')}\n          />\n        )}\n        onRowClick={(row) => router.push(`/backend/customer_accounts/users/${row.id}`)}\n        rowActions={(row) => (\n          <RowActions\n            items={[\n              {\n                id: 'view',\n                label: t('customer_accounts.admin.actions.view', 'View'),\n                onSelect: () => { router.push(`/backend/customer_accounts/users/${row.id}`) },\n              },\n              {\n                id: 'toggle-active',\n                label: row.isActive\n                  ? t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n                  : t('customer_accounts.admin.actions.activate', 'Activate'),\n                onSelect: () => { void handleToggleActive(row) },\n              },\n              {\n                id: 'delete',\n                label: t('customer_accounts.admin.actions.delete', 'Delete'),\n                destructive: true,\n                onSelect: () => { void handleDelete(row) },\n              },\n            ]}\n          />\n        )}\n        pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}\n        isLoading={isLoading}\n      />\n      <CreateUserDialog\n        open={createDialogOpen}\n        onOpenChange={setCreateDialogOpen}\n        roleOptions={roleOptions}\n        onCreated={() => setReloadToken((token) => token + 1)}\n        onRunMutation={runMutationWithContext}\n      />\n      {ConfirmDialogElement}\n    </>\n  )\n}\n"],
+  "mappings": ";AAkJU,SA2VN,UA3VM,KAGA,YAHA;AAhJV,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,OAAO,gBAAgB;AAChC,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,eAAe,cAAc,mBAAmB;AACjE,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB,6BAA6B;AAuB1D,SAAS,WAAW,OAAkC,UAA0B;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO;AACzC,SAAO,KAAK,mBAAmB;AACjC;AAEA,eAAe,yBAAuF;AACpG,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,WAAO,MACJ,OAAO,CAAC,SAAS,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,SAAS,QAAQ,EAC/E,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG,EAAE;AAAA,EACtE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,YAAY,MAAM,YAAY,MAAM;AACxC,aAAS,EAAE;AACX,mBAAe,EAAE;AACjB,gBAAY,EAAE;AACd,uBAAmB,CAAC,CAAC;AAAA,EACvB,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,YAAY,OAAO,UAA2B;AACvE,UAAM,eAAe;AACrB,QAAI,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,KAAK,GAAG;AAC5D,YAAM,EAAE,qDAAqD,wCAAwC,GAAG,OAAO;AAC/G;AAAA,IACF;AACA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,cAAc,YAAY;AAC9B,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU;AAAA,cACnB,OAAO,MAAM,KAAK;AAAA,cAClB,aAAa,YAAY,KAAK;AAAA,cAC9B;AAAA,cACA,SAAS,gBAAgB,SAAS,IAAI,kBAAkB;AAAA,YAC1D,CAAC;AAAA,UACH;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,KAAK,QAAQ,SAAS,EAAE,iDAAiD,uBAAuB,GAAG,OAAO;AAChH;AAAA,QACF;AACA,cAAM,EAAE,oDAAoD,cAAc,GAAG,SAAS;AACtF,kBAAU;AACV,qBAAa,KAAK;AAClB,kBAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,uBAAuB;AAC/H,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,aAAa,OAAO,WAAW,cAAc,eAAe,UAAU,WAAW,iBAAiB,CAAC,CAAC;AAExG,QAAM,gBAAgB,MAAM,YAAY,CAAC,UAA+B;AACtE,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,YAAM,OAAQ,MAAM,OAAuB,QAAQ,MAAM;AACzD,UAAI,KAAM,MAAK,cAAc;AAAA,IAC/B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,UAAO,MAAY,cAAc,CAAC,SAAS;AAAE,QAAI,CAAC,KAAM,WAAU;AAAG,iBAAa,IAAI;AAAA,EAAE,GACvF,+BAAC,iBAAc,WAAU,eACvB;AAAA,wBAAC,gBACC,8BAAC,eAAa,YAAE,4CAA4C,sBAAsB,GAAE,GACtF;AAAA,IACA,qBAAC,UAAK,UAAU,CAAC,UAAU;AAAE,WAAK,aAAa,KAAK;AAAA,IAAE,GAAG,WAAW,eAAe,WAAU,aAC3F;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,gBAC5C,YAAE,mDAAmD,OAAO,GAC/D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,YAChD,aAAa,EAAE,8DAA8D,kBAAkB;AAAA;AAAA,QACjG;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,eAC5C,YAAE,yDAAyD,cAAc,GAC5E;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,YACtD,aAAa,EAAE,oEAAoE,UAAU;AAAA;AAAA,QAC/F;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,mBAC5C,YAAE,sDAAsD,UAAU,GACrE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,WAAW;AAAA,YACX,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,YAAY,MAAM,OAAO,KAAK;AAAA,YACnD,aAAa,EAAE,iEAAiE,mBAAmB;AAAA,YACnG,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACC,YAAY,SAAS,KACpB,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,OAAE,WAAU,uBAAuB,YAAE,mDAAmD,OAAO,GAAE;AAAA,QAClG,oBAAC,SAAI,WAAU,wBACZ,sBAAY,IAAI,CAAC,SAAS;AACzB,gBAAM,aAAa,gBAAgB,SAAS,KAAK,EAAE;AACnD,iBACE;AAAA,YAAC;AAAA;AAAA,cAEC,MAAK;AAAA,cACL,MAAK;AAAA,cACL,SAAS,aAAa,cAAc;AAAA,cACpC,gBAAc;AAAA,cACd,SAAS,MAAM;AAAA,gBAAmB,CAAC,SACjC,KAAK,SAAS,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE;AAAA,cACpF;AAAA,cACA,WAAU;AAAA,cAET,eAAK;AAAA;AAAA,YAVD,KAAK;AAAA,UAWZ;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEF,qBAAC,SAAI,WAAU,+BACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAS,MAAM;AAAE,oBAAU;AAAG,uBAAa,KAAK;AAAA,QAAE,GACvF,YAAE,qDAAqD,QAAQ,GAClE;AAAA,QACA,oBAAC,UAAO,MAAK,UAAS,UAAU,cAC7B,yBACG,EAAE,uDAAuD,aAAa,IACtE,EAAE,qDAAqD,aAAa,GAC1E;AAAA,SACF;AAAA,OACF;AAAA,KACF,GACF;AAEJ;AAOO,SAAS,sBAAsB,EAAE,cAAc,gBAAgB,KAAK,GAA+B;AACxG,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAoB,CAAC,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAA8D,CAAC,CAAC;AAC5G,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,KAAK;AAEpE,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAGxC;AAAA,IACD,WAAW;AAAA,EACb,CAAC;AAED,QAAM,yBAAyB,MAAM;AAAA,IACnC,OAAW,WAA6B,oBAA0D;AAChG,aAAO,YAAY;AAAA,QACjB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,CAAC,WAAW;AAAA,EACd;AAEA,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,2BAAuB,EAAE,KAAK,CAAC,SAAS;AACtC,UAAI,CAAC,UAAW,gBAAe,IAAI;AAAA,IACrC,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,MAC3D,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,UAAU,OAAO,EAAE,0CAA0C,QAAQ,EAAE;AAAA,QAChF,EAAE,OAAO,YAAY,OAAO,EAAE,4CAA4C,UAAU,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,MACvD,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,aAAa,CAAC,CAAC;AAEnB,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,cAAc,MAAM,UAAU,MAAM,CAAC;AAEzC,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,WAA0B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AACrE,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,WAAW;AAAA,UACjD;AAAA,UACA,EAAE,cAAc,EAAE,2CAA2C,+BAA+B,GAAG,SAAS;AAAA,QAC1G;AACA,YAAI,UAAW;AACf,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,gBAAQ,KAAK;AACb,iBAAS,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ,MAAM,MAAM;AAC1E,sBAAc,OAAO,SAAS,eAAe,WAAW,QAAQ,aAAa,CAAC;AAC9E,yBAAiB,SAAS,kBAAkB,IAAI;AAAA,MAClD,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,2CAA2C,+BAA+B;AACjI,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;AAEhC,QAAM,qBAAqB,MAAM,YAAY,OAAO,SAAkB;AACpE,UAAM,aAAa,CAAC,KAAK;AACzB,UAAM,cAAc,aAChB,EAAE,4CAA4C,UAAU,IACxD,EAAE,8CAA8C,YAAY;AAChE,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,gDAAgD,+BAA+B;AAAA,QACtF,QAAQ;AAAA,QACR,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS,aAAa,YAAY;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,0BAA0B,KAAK,SAAS;AAAA,UACxC,MAAM;AAAA,YACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,YACjE;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,WAAW,CAAC;AAAA,YAC/C;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,8CAA8C,8BAA8B,GAAG,OAAO;AAC9F;AAAA,QACF;AACA;AAAA,UACE,aACI,EAAE,2CAA2C,gBAAgB,IAC7D,EAAE,6CAA6C,kBAAkB;AAAA,UACrE;AAAA,QACF;AACA,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,QAAQ,KAAK,IAAI,UAAU,WAAW,CAAC;AAAA,IAC9C,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,8CAA8C,8BAA8B;AACnI,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,eAAe,MAAM,YAAY,OAAO,SAAkB;AAC9D,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,0CAA0C,2BAA2B;AAAA,QAC5E,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,0BAA0B,KAAK,SAAS;AAAA,UACxC,MAAM;AAAA,YACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,YACjE,EAAE,QAAQ,SAAS;AAAA,UACrB;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,wCAAwC,uBAAuB,GAAG,OAAO;AACjF;AAAA,QACF;AACA,cAAM,EAAE,yCAAyC,cAAc,GAAG,SAAS;AAC3E,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC;AAAA,IACpB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,wCAAwC,uBAAuB;AACtH,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,oBAAgB,MAAM;AACtB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAA8B,MAAM;AACxD,UAAM,UAAU,oBAAC,UAAK,WAAU,iCAAgC,eAAC;AACjE,WAAO;AAAA,MACL;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,+CAA+C,MAAM;AAAA,QAC/D,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,oCAAoC,IAAI,SAAS,EAAE;AAAA,YACzD,WAAU;AAAA,YAET,cAAI,SAAS,eAAe,IAAI,SAAS;AAAA;AAAA,QAC5C;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,MAC5D;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,iDAAiD,UAAU;AAAA,QACrE,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,gBACT,kDACA,+CACN,IACG,cAAI,SAAS,gBACV,EAAE,oCAAoC,KAAK,IAC3C,EAAE,sCAAsC,IAAI,GAClD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,0CAA0C,QAAQ;AAAA,QAC5D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,WACT,kDACA,2CACN,IACG,cAAI,SAAS,WACV,EAAE,kCAAkC,QAAQ,IAC5C,EAAE,oCAAoC,UAAU,GACtD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,YAAY;AAAA,QACnE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,aAAa,GAAG,KAAK;AAAA,MAClE;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,QAC1D,MAAM,CAAC,EAAE,IAAI,MAAM;AACjB,gBAAM,QAAQ,IAAI,SAAS;AAC3B,cAAI,CAAC,SAAS,CAAC,MAAM,OAAQ,QAAO;AACpC,iBAAO,oBAAC,UAAK,WAAU,WAAW,gBAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,GAAE;AAAA,QACxE;AAAA,MACF;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,SAAS;AAAA,QAChE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,WAAW,GAAG;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,iCACE;AAAA,wBAAC,SAAI,WAAU,qEACb,+BAAC,SAAI,WAAU,0CACb;AAAA,2BAAC,SACC;AAAA,4BAAC,QAAG,WAAU,6CACX,YAAE,4CAA4C,iBAAiB,GAClE;AAAA,QACA,oBAAC,OAAE,WAAU,sCACV,YAAE,kDAAkD,mIAAmI,GAC1L;AAAA,QACA,oBAAC,OAAE,WAAU,wCACV,YAAE,0CAA0C,qBAAqB;AAAA,UAChE,KAAK,sBAAsB,YAAY;AAAA,QACzC,CAAC,GACH;AAAA,QACA,oBAAC,OAAE,WAAU,wCACV,YAAE,kDAAkD,4DAA4D,GACnH;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,gCACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,SAAO;AAAA,YAEP,+BAAC,QAAK,MAAK,uCACT;AAAA,kCAAC,YAAS,WAAU,UAAS;AAAA,cAC5B,EAAE,wDAAwD,oBAAoB;AAAA,eACjF;AAAA;AAAA,QACF;AAAA,QACC,gBACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,SAAO;AAAA,YAEP,+BAAC,OAAE,MAAM,mBAAmB,cAAc,aAAa,GAAG,QAAO,UAAS,KAAI,uBAC5E;AAAA,kCAAC,SAAM,WAAU,UAAS;AAAA,cACzB,EAAE,2CAA2C,aAAa;AAAA,eAC7D;AAAA;AAAA,QACF,IACE;AAAA,SACN;AAAA,OACF,GACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,qBAAmB;AAAA,QACnB,OAAO,EAAE,iCAAiC,OAAO;AAAA,QACjD,SACE,oBAAC,UAAO,SAAS,MAAM,oBAAoB,IAAI,GAC5C,YAAE,8CAA8C,aAAa,GAChE;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,mBAAmB,EAAE,6CAA6C,4BAA4B;AAAA,QAC9F;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,aAAa,EAAE,SAAS,gBAAgB,MAAM,WAAW,QAAQ;AAAA,QACjE,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,iCAAiC,OAAO;AAAA,YACtD,UAAU,MAAM,oBAAoB,IAAI;AAAA,YACxC,aAAa,EAAE,8CAA8C,aAAa;AAAA;AAAA,QAC5E;AAAA,QAEF,YAAY,CAAC,QAAQ,OAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,QAC7E,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,gBACvD,UAAU,MAAM;AAAE,yBAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,gBAAE;AAAA,cAC9E;AAAA,cACA;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,IAAI,WACP,EAAE,8CAA8C,YAAY,IAC5D,EAAE,4CAA4C,UAAU;AAAA,gBAC5D,UAAU,MAAM;AAAE,uBAAK,mBAAmB,GAAG;AAAA,gBAAE;AAAA,cACjD;AAAA,cACA;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,gBAC3D,aAAa;AAAA,gBACb,UAAU,MAAM;AAAE,uBAAK,aAAa,GAAG;AAAA,gBAAE;AAAA,cAC3C;AAAA,YACF;AAAA;AAAA,QACF;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA,QACtF;AAAA;AAAA,IACF;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,MAAM;AAAA,QACN,cAAc;AAAA,QACd;AAAA,QACA,WAAW,MAAM,eAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,QACpD,eAAe;AAAA;AAAA,IACjB;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/users/page.js

@@ -2,10 +2,12 @@ import { jsx } from "react/jsx-runtime";
 import { headers } from "next/headers";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { resolvePortalRequestOrigin } from "../../../lib/portalUrl.js";
+import { resolveCurrentOrgPortalSlug } from "../../../lib/portalOrgSlug.js";
 import { PortalUsersPageClient } from "./PortalUsersPageClient.js";
 async function CustomerAccountsPage() {
   const portalOrigin = resolvePortalRequestOrigin(await headers());
-  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { className: "space-y-4", children: /* @__PURE__ */ jsx(PortalUsersPageClient, { portalOrigin }) }) });
+  const portalOrgSlug = await resolveCurrentOrgPortalSlug();
+  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { className: "space-y-4", children: /* @__PURE__ */ jsx(PortalUsersPageClient, { portalOrigin, portalOrgSlug }) }) });
 }
 export {
   CustomerAccountsPage as default

package/dist/modules/customer_accounts/backend/customer_accounts/users/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/backend/customer_accounts/users/page.tsx"],
-  "sourcesContent": ["import { headers } from 'next/headers'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { resolvePortalRequestOrigin } from '../../../lib/portalUrl'\nimport { PortalUsersPageClient } from './PortalUsersPageClient'\n\nexport default async function CustomerAccountsPage() {\n  const portalOrigin = resolvePortalRequestOrigin(await headers())\n  return (\n    <Page>\n      <PageBody className=\"space-y-4\">\n        <PortalUsersPageClient portalOrigin={portalOrigin} />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": "AAUQ;AAVR,SAAS,eAAe;AACxB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AAEtC,eAAO,uBAA8C;AACnD,QAAM,eAAe,2BAA2B,MAAM,QAAQ,CAAC;AAC/D,SACE,oBAAC,QACC,8BAAC,YAAS,WAAU,aAClB,8BAAC,yBAAsB,cAA4B,GACrD,GACF;AAEJ;",
+  "sourcesContent": ["import { headers } from 'next/headers'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { resolvePortalRequestOrigin } from '../../../lib/portalUrl'\nimport { resolveCurrentOrgPortalSlug } from '../../../lib/portalOrgSlug'\nimport { PortalUsersPageClient } from './PortalUsersPageClient'\n\nexport default async function CustomerAccountsPage() {\n  const portalOrigin = resolvePortalRequestOrigin(await headers())\n  const portalOrgSlug = await resolveCurrentOrgPortalSlug()\n  return (\n    <Page>\n      <PageBody className=\"space-y-4\">\n        <PortalUsersPageClient portalOrigin={portalOrigin} portalOrgSlug={portalOrgSlug} />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": "AAYQ;AAZR,SAAS,eAAe;AACxB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,kCAAkC;AAC3C,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAEtC,eAAO,uBAA8C;AACnD,QAAM,eAAe,2BAA2B,MAAM,QAAQ,CAAC;AAC/D,QAAM,gBAAgB,MAAM,4BAA4B;AACxD,SACE,oBAAC,QACC,8BAAC,YAAS,WAAU,aAClB,8BAAC,yBAAsB,cAA4B,eAA8B,GACnF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/portalOrgSlug.js

@@ -0,0 +1,22 @@
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromCookies } from "@open-mercato/shared/lib/auth/server";
+import { findOrganizationInTenant } from "./organizationLookup.js";
+async function resolveCurrentOrgPortalSlug() {
+  try {
+    const auth = await getAuthFromCookies();
+    const organizationId = auth?.orgId;
+    const tenantId = auth?.tenantId;
+    if (!organizationId || !tenantId) return null;
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const organization = await findOrganizationInTenant(em, organizationId, tenantId);
+    const slug = organization?.slug?.trim();
+    return slug && slug.length > 0 ? slug : null;
+  } catch {
+    return null;
+  }
+}
+export {
+  resolveCurrentOrgPortalSlug
+};
+//# sourceMappingURL=portalOrgSlug.js.map

package/dist/modules/customer_accounts/lib/portalOrgSlug.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/portalOrgSlug.ts"],
+  "sourcesContent": ["// Server-only resolution of the signed-in admin's organization slug, used to\n// build the \"Open Portal\" link on the customer-accounts admin pages.\n//\n// Deliberately kept out of `portalUrl.ts`: that module is imported by client\n// components, and pulling the ORM in there would drag MikroORM into the browser\n// bundle. Keep every EntityManager import on this side of the boundary.\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromCookies } from '@open-mercato/shared/lib/auth/server'\nimport { findOrganizationInTenant } from './organizationLookup'\n\ntype EntityManagerResolver = {\n  resolve(name: 'em'): EntityManager\n}\n\n/**\n * Resolve the slug of the organization the current admin session is scoped to,\n * or null when there is no session, no active organization, or the organization\n * has no slug yet. Callers render the portal link only for a non-null result \u2014\n * a slugless portal URL cannot resolve (#5668).\n */\nexport async function resolveCurrentOrgPortalSlug(): Promise<string | null> {\n  try {\n    const auth = await getAuthFromCookies()\n    const organizationId = auth?.orgId\n    const tenantId = auth?.tenantId\n    if (!organizationId || !tenantId) return null\n\n    const container = await createRequestContainer()\n    const em = (container as Awaited<ReturnType<typeof createRequestContainer>> & EntityManagerResolver).resolve('em')\n    const organization = await findOrganizationInTenant(em, organizationId, tenantId)\n    const slug = organization?.slug?.trim()\n    return slug && slug.length > 0 ? slug : null\n  } catch {\n    // The portal link is a convenience action \u2014 a lookup failure must not take\n    // the whole admin page down, so degrade to hiding the button.\n    return null\n  }\n}\n"],
+  "mappings": "AAQA,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,gCAAgC;AAYzC,eAAsB,8BAAsD;AAC1E,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB;AACtC,UAAM,iBAAiB,MAAM;AAC7B,UAAM,WAAW,MAAM;AACvB,QAAI,CAAC,kBAAkB,CAAC,SAAU,QAAO;AAEzC,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAyF,QAAQ,IAAI;AACjH,UAAM,eAAe,MAAM,yBAAyB,IAAI,gBAAgB,QAAQ;AAChF,UAAM,OAAO,cAAc,MAAM,KAAK;AACtC,WAAO,QAAQ,KAAK,SAAS,IAAI,OAAO;AAAA,EAC1C,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/portalUrl.js

@@ -57,8 +57,11 @@ function normalizeOrigin(origin) {
 function buildPortalUrlPattern(origin) {
   return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`;
 }
-function buildPortalRootUrl(origin) {
-  return `${normalizeOrigin(origin)}/portal`;
+function buildPortalRootUrl(origin, orgSlug) {
+  const base = normalizeOrigin(origin);
+  const slug = typeof orgSlug === "string" ? orgSlug.trim() : "";
+  if (!slug) return `${base}/portal`;
+  return `${base}/${encodeURIComponent(slug)}/portal`;
 }
 export {
   PORTAL_ORG_SLUG_PLACEHOLDER,

package/dist/modules/customer_accounts/lib/portalUrl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/portalUrl.ts"],
-  "sourcesContent": ["// Resolve the browser-visible origin on the server so the admin portal-address\n// hints are already correct in the first server-rendered paint. Deriving the\n// origin from `window.location.origin` during render made the server HTML and\n// the hydrated client output disagree, which React reported as a hydration\n// error and repaired with a visible flicker of the portal address (#5457).\n//\n// `resolvePortalRequestOrigin` is deliberately named apart from the shared\n// `resolveRequestOrigin` in `@open-mercato/shared/lib/url`: that one takes a\n// `Request` and reads the protocol off `req.url`, which a server component does\n// not have \u2014 it only has `headers()`. This one also validates the untrusted host\n// header before the value reaches rendered text or a link href, and infers the\n// protocol when the proxy stays quiet, so the two are not interchangeable.\n\nexport type RequestHeaderReader = {\n  get(name: string): string | null | undefined\n}\n\nconst FORWARDED_HOST_HEADER = 'x-forwarded-host'\nconst HOST_HEADER = 'host'\nconst FORWARDED_PROTO_HEADER = 'x-forwarded-proto'\n\n// Host headers are client-controlled, so only a plain `host[:port]` or bracketed\n// IPv6 literal is accepted before it reaches rendered text and link hrefs.\nconst HOST_PATTERN = /^(?:[a-z0-9.-]+|\\[[0-9a-f:.]+\\])(?::\\d{1,5})?$/i\nconst PROTOCOL_PATTERN = /^https?$/i\n// Bracketed, because HOST_PATTERN only accepts a colon-bearing host in that form.\nconst LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]'])\n\nexport const PORTAL_ORG_SLUG_PLACEHOLDER = '[org-slug]'\n\nfunction firstHeaderValue(raw: string | null | undefined): string | null {\n  if (typeof raw !== 'string') return null\n  // Proxy chains append values, so the client-facing hop is the first entry.\n  const value = raw.split(',')[0]?.trim() ?? ''\n  return value.length > 0 ? value : null\n}\n\nfunction readHost(headers: RequestHeaderReader): string | null {\n  const forwarded = firstHeaderValue(headers.get(FORWARDED_HOST_HEADER))\n  const host = forwarded ?? firstHeaderValue(headers.get(HOST_HEADER))\n  if (!host) return null\n  return HOST_PATTERN.test(host) ? host.toLowerCase() : null\n}\n\nfunction readProtocol(headers: RequestHeaderReader, host: string): string {\n  const forwarded = firstHeaderValue(headers.get(FORWARDED_PROTO_HEADER))\n  if (forwarded && PROTOCOL_PATTERN.test(forwarded)) return forwarded.toLowerCase()\n  // An operator who configured APP_URL has named the canonical origin explicitly;\n  // when it points at this very host, trust it over any inference below. Without\n  // this, a plain-HTTP deployment behind a proxy that omits x-forwarded-proto\n  // would render https:// links that do not work.\n  const configured = configuredOrigin()\n  if (configured) {\n    try {\n      const parsed = new URL(configured)\n      if (parsed.host.toLowerCase() === host) return parsed.protocol.replace(':', '')\n    } catch {\n      // configuredOrigin() already parsed this successfully; ignore defensively.\n    }\n  }\n  // Otherwise a terminating proxy that omits the header is serving a public\n  // hostname over TLS far more often than not; only loopback hosts default to http.\n  const hostname = host.replace(/:\\d{1,5}$/, '')\n  return LOOPBACK_HOSTS.has(hostname) ? 'http' : 'https'\n}\n\nfunction configuredOrigin(): string {\n  const candidates = [process.env.APP_URL, process.env.NEXT_PUBLIC_APP_URL]\n  for (const candidate of candidates) {\n    const value = candidate?.trim()\n    if (!value) continue\n    try {\n      const parsed = new URL(value)\n      if (PROTOCOL_PATTERN.test(parsed.protocol.replace(':', ''))) return parsed.origin\n    } catch {\n      // A malformed APP_URL must not break the page \u2014 fall through to the next candidate.\n    }\n  }\n  return ''\n}\n\n/**\n * Resolve the origin the current request was made to, mirroring the value\n * `window.location.origin` reports in the browser. Falls back to the configured\n * app URL, then to an empty string so callers render a root-relative path that\n * is identical on the server and the client.\n *\n * Named apart from `resolveRequestOrigin` in `@open-mercato/shared/lib/url` \u2014\n * see the note at the top of this file for why the two cannot be merged.\n */\nexport function resolvePortalRequestOrigin(headers: RequestHeaderReader | null | undefined): string {\n  if (headers && typeof headers.get === 'function') {\n    const host = readHost(headers)\n    if (host) return `${readProtocol(headers, host)}://${host}`\n  }\n  return configuredOrigin()\n}\n\nfunction normalizeOrigin(origin: string | null | undefined): string {\n  if (typeof origin !== 'string') return ''\n  return origin.trim().replace(/\\/+$/, '')\n}\n\n/** Display pattern for a tenant portal address, e.g. `https://app.example.com/[org-slug]/portal`. */\nexport function buildPortalUrlPattern(origin: string | null | undefined): string {\n  return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`\n}\n\n/** Portal entry point used by the \"Open Portal\" action on admin pages. */\nexport function buildPortalRootUrl(origin: string | null | undefined): string {\n  return `${normalizeOrigin(origin)}/portal`\n}\n"],
-  "mappings": "AAiBA,MAAM,wBAAwB;AAC9B,MAAM,cAAc;AACpB,MAAM,yBAAyB;AAI/B,MAAM,eAAe;AACrB,MAAM,mBAAmB;AAEzB,MAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAE3D,MAAM,8BAA8B;AAE3C,SAAS,iBAAiB,KAA+C;AACvE,MAAI,OAAO,QAAQ,SAAU,QAAO;AAEpC,QAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAC3C,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,SAAS,SAAS,SAA6C;AAC7D,QAAM,YAAY,iBAAiB,QAAQ,IAAI,qBAAqB,CAAC;AACrE,QAAM,OAAO,aAAa,iBAAiB,QAAQ,IAAI,WAAW,CAAC;AACnE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,aAAa,KAAK,IAAI,IAAI,KAAK,YAAY,IAAI;AACxD;AAEA,SAAS,aAAa,SAA8B,MAAsB;AACxE,QAAM,YAAY,iBAAiB,QAAQ,IAAI,sBAAsB,CAAC;AACtE,MAAI,aAAa,iBAAiB,KAAK,SAAS,EAAG,QAAO,UAAU,YAAY;AAKhF,QAAM,aAAa,iBAAiB;AACpC,MAAI,YAAY;AACd,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,UAAU;AACjC,UAAI,OAAO,KAAK,YAAY,MAAM,KAAM,QAAO,OAAO,SAAS,QAAQ,KAAK,EAAE;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,WAAW,KAAK,QAAQ,aAAa,EAAE;AAC7C,SAAO,eAAe,IAAI,QAAQ,IAAI,SAAS;AACjD;AAEA,SAAS,mBAA2B;AAClC,QAAM,aAAa,CAAC,QAAQ,IAAI,SAAS,QAAQ,IAAI,mBAAmB;AACxE,aAAW,aAAa,YAAY;AAClC,UAAM,QAAQ,WAAW,KAAK;AAC9B,QAAI,CAAC,MAAO;AACZ,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,UAAI,iBAAiB,KAAK,OAAO,SAAS,QAAQ,KAAK,EAAE,CAAC,EAAG,QAAO,OAAO;AAAA,IAC7E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAWO,SAAS,2BAA2B,SAAyD;AAClG,MAAI,WAAW,OAAO,QAAQ,QAAQ,YAAY;AAChD,UAAM,OAAO,SAAS,OAAO;AAC7B,QAAI,KAAM,QAAO,GAAG,aAAa,SAAS,IAAI,CAAC,MAAM,IAAI;AAAA,EAC3D;AACA,SAAO,iBAAiB;AAC1B;AAEA,SAAS,gBAAgB,QAA2C;AAClE,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACzC;AAGO,SAAS,sBAAsB,QAA2C;AAC/E,SAAO,GAAG,gBAAgB,MAAM,CAAC,IAAI,2BAA2B;AAClE;AAGO,SAAS,mBAAmB,QAA2C;AAC5E,SAAO,GAAG,gBAAgB,MAAM,CAAC;AACnC;",
+  "sourcesContent": ["// Resolve the browser-visible origin on the server so the admin portal-address\n// hints are already correct in the first server-rendered paint. Deriving the\n// origin from `window.location.origin` during render made the server HTML and\n// the hydrated client output disagree, which React reported as a hydration\n// error and repaired with a visible flicker of the portal address (#5457).\n//\n// `resolvePortalRequestOrigin` is deliberately named apart from the shared\n// `resolveRequestOrigin` in `@open-mercato/shared/lib/url`: that one takes a\n// `Request` and reads the protocol off `req.url`, which a server component does\n// not have \u2014 it only has `headers()`. This one also validates the untrusted host\n// header before the value reaches rendered text or a link href, and infers the\n// protocol when the proxy stays quiet, so the two are not interchangeable.\n\nexport type RequestHeaderReader = {\n  get(name: string): string | null | undefined\n}\n\nconst FORWARDED_HOST_HEADER = 'x-forwarded-host'\nconst HOST_HEADER = 'host'\nconst FORWARDED_PROTO_HEADER = 'x-forwarded-proto'\n\n// Host headers are client-controlled, so only a plain `host[:port]` or bracketed\n// IPv6 literal is accepted before it reaches rendered text and link hrefs.\nconst HOST_PATTERN = /^(?:[a-z0-9.-]+|\\[[0-9a-f:.]+\\])(?::\\d{1,5})?$/i\nconst PROTOCOL_PATTERN = /^https?$/i\n// Bracketed, because HOST_PATTERN only accepts a colon-bearing host in that form.\nconst LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]'])\n\nexport const PORTAL_ORG_SLUG_PLACEHOLDER = '[org-slug]'\n\nfunction firstHeaderValue(raw: string | null | undefined): string | null {\n  if (typeof raw !== 'string') return null\n  // Proxy chains append values, so the client-facing hop is the first entry.\n  const value = raw.split(',')[0]?.trim() ?? ''\n  return value.length > 0 ? value : null\n}\n\nfunction readHost(headers: RequestHeaderReader): string | null {\n  const forwarded = firstHeaderValue(headers.get(FORWARDED_HOST_HEADER))\n  const host = forwarded ?? firstHeaderValue(headers.get(HOST_HEADER))\n  if (!host) return null\n  return HOST_PATTERN.test(host) ? host.toLowerCase() : null\n}\n\nfunction readProtocol(headers: RequestHeaderReader, host: string): string {\n  const forwarded = firstHeaderValue(headers.get(FORWARDED_PROTO_HEADER))\n  if (forwarded && PROTOCOL_PATTERN.test(forwarded)) return forwarded.toLowerCase()\n  // An operator who configured APP_URL has named the canonical origin explicitly;\n  // when it points at this very host, trust it over any inference below. Without\n  // this, a plain-HTTP deployment behind a proxy that omits x-forwarded-proto\n  // would render https:// links that do not work.\n  const configured = configuredOrigin()\n  if (configured) {\n    try {\n      const parsed = new URL(configured)\n      if (parsed.host.toLowerCase() === host) return parsed.protocol.replace(':', '')\n    } catch {\n      // configuredOrigin() already parsed this successfully; ignore defensively.\n    }\n  }\n  // Otherwise a terminating proxy that omits the header is serving a public\n  // hostname over TLS far more often than not; only loopback hosts default to http.\n  const hostname = host.replace(/:\\d{1,5}$/, '')\n  return LOOPBACK_HOSTS.has(hostname) ? 'http' : 'https'\n}\n\nfunction configuredOrigin(): string {\n  const candidates = [process.env.APP_URL, process.env.NEXT_PUBLIC_APP_URL]\n  for (const candidate of candidates) {\n    const value = candidate?.trim()\n    if (!value) continue\n    try {\n      const parsed = new URL(value)\n      if (PROTOCOL_PATTERN.test(parsed.protocol.replace(':', ''))) return parsed.origin\n    } catch {\n      // A malformed APP_URL must not break the page \u2014 fall through to the next candidate.\n    }\n  }\n  return ''\n}\n\n/**\n * Resolve the origin the current request was made to, mirroring the value\n * `window.location.origin` reports in the browser. Falls back to the configured\n * app URL, then to an empty string so callers render a root-relative path that\n * is identical on the server and the client.\n *\n * Named apart from `resolveRequestOrigin` in `@open-mercato/shared/lib/url` \u2014\n * see the note at the top of this file for why the two cannot be merged.\n */\nexport function resolvePortalRequestOrigin(headers: RequestHeaderReader | null | undefined): string {\n  if (headers && typeof headers.get === 'function') {\n    const host = readHost(headers)\n    if (host) return `${readProtocol(headers, host)}://${host}`\n  }\n  return configuredOrigin()\n}\n\nfunction normalizeOrigin(origin: string | null | undefined): string {\n  if (typeof origin !== 'string') return ''\n  return origin.trim().replace(/\\/+$/, '')\n}\n\n/** Display pattern for a tenant portal address, e.g. `https://app.example.com/[org-slug]/portal`. */\nexport function buildPortalUrlPattern(origin: string | null | undefined): string {\n  return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`\n}\n\n/**\n * Portal entry point used by the \"Open Portal\" action on admin pages.\n *\n * Portal pages are only ever mounted at `frontend/[orgSlug]/portal/**`, so a URL\n * without the organization segment cannot resolve and renders a 404 (#5668).\n * The slug stays optional to keep this signature backward compatible; callers\n * that cannot resolve one should hide the action rather than link to the\n * slugless fallback.\n */\nexport function buildPortalRootUrl(origin: string | null | undefined, orgSlug?: string | null): string {\n  const base = normalizeOrigin(origin)\n  const slug = typeof orgSlug === 'string' ? orgSlug.trim() : ''\n  if (!slug) return `${base}/portal`\n  return `${base}/${encodeURIComponent(slug)}/portal`\n}\n"],
+  "mappings": "AAiBA,MAAM,wBAAwB;AAC9B,MAAM,cAAc;AACpB,MAAM,yBAAyB;AAI/B,MAAM,eAAe;AACrB,MAAM,mBAAmB;AAEzB,MAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAE3D,MAAM,8BAA8B;AAE3C,SAAS,iBAAiB,KAA+C;AACvE,MAAI,OAAO,QAAQ,SAAU,QAAO;AAEpC,QAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AAC3C,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,SAAS,SAAS,SAA6C;AAC7D,QAAM,YAAY,iBAAiB,QAAQ,IAAI,qBAAqB,CAAC;AACrE,QAAM,OAAO,aAAa,iBAAiB,QAAQ,IAAI,WAAW,CAAC;AACnE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,aAAa,KAAK,IAAI,IAAI,KAAK,YAAY,IAAI;AACxD;AAEA,SAAS,aAAa,SAA8B,MAAsB;AACxE,QAAM,YAAY,iBAAiB,QAAQ,IAAI,sBAAsB,CAAC;AACtE,MAAI,aAAa,iBAAiB,KAAK,SAAS,EAAG,QAAO,UAAU,YAAY;AAKhF,QAAM,aAAa,iBAAiB;AACpC,MAAI,YAAY;AACd,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,UAAU;AACjC,UAAI,OAAO,KAAK,YAAY,MAAM,KAAM,QAAO,OAAO,SAAS,QAAQ,KAAK,EAAE;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,WAAW,KAAK,QAAQ,aAAa,EAAE;AAC7C,SAAO,eAAe,IAAI,QAAQ,IAAI,SAAS;AACjD;AAEA,SAAS,mBAA2B;AAClC,QAAM,aAAa,CAAC,QAAQ,IAAI,SAAS,QAAQ,IAAI,mBAAmB;AACxE,aAAW,aAAa,YAAY;AAClC,UAAM,QAAQ,WAAW,KAAK;AAC9B,QAAI,CAAC,MAAO;AACZ,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,UAAI,iBAAiB,KAAK,OAAO,SAAS,QAAQ,KAAK,EAAE,CAAC,EAAG,QAAO,OAAO;AAAA,IAC7E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAWO,SAAS,2BAA2B,SAAyD;AAClG,MAAI,WAAW,OAAO,QAAQ,QAAQ,YAAY;AAChD,UAAM,OAAO,SAAS,OAAO;AAC7B,QAAI,KAAM,QAAO,GAAG,aAAa,SAAS,IAAI,CAAC,MAAM,IAAI;AAAA,EAC3D;AACA,SAAO,iBAAiB;AAC1B;AAEA,SAAS,gBAAgB,QAA2C;AAClE,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACzC;AAGO,SAAS,sBAAsB,QAA2C;AAC/E,SAAO,GAAG,gBAAgB,MAAM,CAAC,IAAI,2BAA2B;AAClE;AAWO,SAAS,mBAAmB,QAAmC,SAAiC;AACrG,QAAM,OAAO,gBAAgB,MAAM;AACnC,QAAM,OAAO,OAAO,YAAY,WAAW,QAAQ,KAAK,IAAI;AAC5D,MAAI,CAAC,KAAM,QAAO,GAAG,IAAI;AACzB,SAAO,GAAG,IAAI,IAAI,mBAAmB,IAAI,CAAC;AAC5C;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.7.1-develop.7104.1.1dd769bf1a",
+  "version": "0.7.1-develop.7106.1.53fe9dd1b1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -252,16 +252,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7104.1.1dd769bf1a",
-    "@open-mercato/shared": "0.7.1-develop.7104.1.1dd769bf1a",
-    "@open-mercato/ui": "0.7.1-develop.7104.1.1dd769bf1a",
+    "@open-mercato/ai-assistant": "0.7.1-develop.7106.1.53fe9dd1b1",
+    "@open-mercato/shared": "0.7.1-develop.7106.1.53fe9dd1b1",
+    "@open-mercato/ui": "0.7.1-develop.7106.1.53fe9dd1b1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7104.1.1dd769bf1a",
-    "@open-mercato/shared": "0.7.1-develop.7104.1.1dd769bf1a",
-    "@open-mercato/ui": "0.7.1-develop.7104.1.1dd769bf1a",
+    "@open-mercato/ai-assistant": "0.7.1-develop.7106.1.53fe9dd1b1",
+    "@open-mercato/shared": "0.7.1-develop.7106.1.53fe9dd1b1",
+    "@open-mercato/ui": "0.7.1-develop.7106.1.53fe9dd1b1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/auth/api/users/acl/route.ts

@@ -347,7 +347,7 @@ export async function PUT(req: Request) {
     return NextResponse.json({
       error: translate(
         'auth.acl.organizationWarning',
-        'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.',
+        'Organization restrictions require at least one feature override. Add a feature or module wildcard, or clear the organization scope before saving.',
       ),
     }, { status: 400 })
   }
@@ -475,7 +475,7 @@ export const openApi: OpenApiRouteDoc = {
     },
     PUT: {
       summary: 'Update user ACL',
-      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.',
+      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. Authorization evaluates the merged ACL, so a partial request returns 403 when a preserved grant is outside the actor\'s grantable ACL. An organization-scoped non-super-admin override requires at least one feature grant.',
       requestBody: {
         contentType: 'application/json',
         schema: putSchema,

package/src/modules/auth/i18n/de.json

@@ -390,7 +390,7 @@
   "auth.acl.modules.webhooks": "Webhooks",
   "auth.acl.modules.wms": "Warehouse Management System",
   "auth.acl.modules.workflows": "Workflow Engine",
-  "auth.acl.organizationWarning": "Organisationseinschränkungen werden nur gespeichert, wenn mindestens eine Berechtigungsüberschreibung ausgewählt ist. Füge eine Berechtigung hinzu oder aktiviere einen Modul-Wildcard vor dem Speichern.",
+  "auth.acl.organizationWarning": "Organisationseinschränkungen erfordern mindestens eine Berechtigungsüberschreibung. Füge eine Berechtigung oder einen Modul-Platzhalter hinzu, oder lösche den Organisationsbereich vor dem Speichern.",
   "auth.acl.organizationsScope": "Organisationsbereich",
   "auth.acl.organizationsScopeHint": "Empty means all organizations. Select one or more to restrict access.",
   "auth.acl.restricted": "Eingeschränkt",

package/src/modules/auth/i18n/en.json

@@ -390,7 +390,7 @@
   "auth.acl.modules.webhooks": "Webhooks",
   "auth.acl.modules.wms": "Warehouse Management System",
   "auth.acl.modules.workflows": "Workflow Engine",
-  "auth.acl.organizationWarning": "Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.",
+  "auth.acl.organizationWarning": "Organization restrictions require at least one feature override. Add a feature or module wildcard, or clear the organization scope before saving.",
   "auth.acl.organizationsScope": "Organizations scope",
   "auth.acl.organizationsScopeHint": "Empty means all organizations. Select one or more to restrict access.",
   "auth.acl.restricted": "Restricted",

package/src/modules/auth/i18n/es.json

@@ -390,7 +390,7 @@
   "auth.acl.modules.webhooks": "Webhooks",
   "auth.acl.modules.wms": "Warehouse Management System",
   "auth.acl.modules.workflows": "Workflow Engine",
-  "auth.acl.organizationWarning": "Las restricciones de organización se guardan solo cuando se selecciona al menos una anulación de función. Agrega una función o habilita un comodín de módulo antes de guardar.",
+  "auth.acl.organizationWarning": "Las restricciones de organización requieren al menos una anulación de función. Agrega una función o un comodín de módulo, o borra el ámbito de organización antes de guardar.",
   "auth.acl.organizationsScope": "Alcance de organizaciones",
   "auth.acl.organizationsScopeHint": "Empty means all organizations. Select one or more to restrict access.",
   "auth.acl.restricted": "Restringido",

package/src/modules/auth/i18n/ko.json

@@ -390,7 +390,7 @@
   "auth.acl.modules.webhooks": "Webhooks",
   "auth.acl.modules.wms": "Warehouse Management System",
   "auth.acl.modules.workflows": "Workflow Engine",
-  "auth.acl.organizationWarning": "조직 제한은 최소 하나의 기능 재정의가 선택된 경우에만 저장됩니다. 저장하기 전에 기능을 추가하거나 모듈 와일드카드를 활성화하세요.",
+  "auth.acl.organizationWarning": "조직 제한에는 하나 이상의 기능 재정의가 필요합니다. 기능이나 모듈 와일드카드를 추가하거나 저장하기 전에 조직 범위를 지우세요.",
   "auth.acl.organizationsScope": "조직 범위",
   "auth.acl.organizationsScopeHint": "Empty means all organizations. Select one or more to restrict access.",
   "auth.acl.restricted": "제한됨",

package/src/modules/auth/i18n/pl.json

@@ -390,7 +390,7 @@
   "auth.acl.modules.webhooks": "Webhooki",
   "auth.acl.modules.wms": "System zarządzania magazynem",
   "auth.acl.modules.workflows": "Mechanizm przepływów pracy",
-  "auth.acl.organizationWarning": "Ograniczenia organizacyjne są zapisywane tylko wtedy, gdy wybrano co najmniej jedno nadpisanie uprawnień. Dodaj uprawnienie lub włącz symbol wieloznaczny modułu przed zapisaniem.",
+  "auth.acl.organizationWarning": "Ograniczenia organizacyjne wymagają co najmniej jednego nadpisania uprawnień. Dodaj uprawnienie lub wildcard modułu albo wyczyść zakres organizacji przed zapisaniem.",
   "auth.acl.organizationsScope": "Zakres organizacji",
   "auth.acl.organizationsScopeHint": "Brak wyboru oznacza wszystkie organizacje. Wybierz co najmniej jedną, aby ograniczyć dostęp.",
   "auth.acl.restricted": "Ograniczone",

package/src/modules/customer_accounts/backend/customer_accounts/settings/CustomerAccountsSettingsPageClient.tsx

@@ -15,13 +15,17 @@ const DEMO_CREDENTIALS = [
 
 export type CustomerAccountsSettingsPageClientProps = {
   portalOrigin: string
+  portalOrgSlug?: string | null
 }
 
-export function CustomerAccountsSettingsPageClient({ portalOrigin }: CustomerAccountsSettingsPageClientProps) {
+export function CustomerAccountsSettingsPageClient({ portalOrigin, portalOrgSlug = null }: CustomerAccountsSettingsPageClientProps) {
   const t = useT()
 
   const portalUrl = useMemo(() => buildPortalUrlPattern(portalOrigin), [portalOrigin])
-  const portalRootUrl = useMemo(() => buildPortalRootUrl(portalOrigin), [portalOrigin])
+  const portalRootUrl = useMemo(
+    () => (portalOrgSlug ? buildPortalRootUrl(portalOrigin, portalOrgSlug) : null),
+    [portalOrigin, portalOrgSlug],
+  )
 
   return (
     <>
@@ -47,13 +51,15 @@ export function CustomerAccountsSettingsPageClient({ portalOrigin }: CustomerAcc
               {portalUrl}
             </code>
           </div>
-          <div>
-            <Button type="button" variant="outline" size="sm" asChild>
-              <a href={portalRootUrl} target="_blank" rel="noopener noreferrer">
-                {t('customer_accounts.settings.portal_access.open_portal', 'Open Portal')}
-              </a>
-            </Button>
-          </div>
+          {portalRootUrl ? (
+            <div>
+              <Button type="button" variant="outline" size="sm" asChild>
+                <a href={portalRootUrl} target="_blank" rel="noopener noreferrer">
+                  {t('customer_accounts.settings.portal_access.open_portal', 'Open Portal')}
+                </a>
+              </Button>
+            </div>
+          ) : null}
           <p className="text-xs text-muted-foreground">
             {t(
               'customer_accounts.settings.portal_access.slug_note',

package/src/modules/customer_accounts/backend/customer_accounts/settings/page.tsx

@@ -1,15 +1,17 @@
 import { headers } from 'next/headers'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { resolvePortalRequestOrigin } from '../../../lib/portalUrl'
+import { resolveCurrentOrgPortalSlug } from '../../../lib/portalOrgSlug'
 import { CustomerAccountsSettingsPageClient } from './CustomerAccountsSettingsPageClient'
 
 export default async function CustomerAccountsSettingsPage() {
   const portalOrigin = resolvePortalRequestOrigin(await headers())
+  const portalOrgSlug = await resolveCurrentOrgPortalSlug()
   return (
     <Page>
       {/* space-y-6 preserves the gap the page header previously got as a direct <Page> child. */}
       <PageBody className="space-y-6">
-        <CustomerAccountsSettingsPageClient portalOrigin={portalOrigin} />
+        <CustomerAccountsSettingsPageClient portalOrigin={portalOrigin} portalOrgSlug={portalOrgSlug} />
       </PageBody>
     </Page>
   )

package/src/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.tsx

@@ -229,9 +229,10 @@ function CreateUserDialog({
 
 export type PortalUsersPageClientProps = {
   portalOrigin: string
+  portalOrgSlug?: string | null
 }
 
-export function PortalUsersPageClient({ portalOrigin }: PortalUsersPageClientProps) {
+export function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: PortalUsersPageClientProps) {
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const t = useT()
   const router = useRouter()
@@ -521,17 +522,19 @@ export function PortalUsersPageClient({ portalOrigin }: PortalUsersPageClientPro
                 {t('customer_accounts.admin.portalInfo.openConfiguration', 'Open Configuration')}
               </Link>
             </Button>
-            <Button
-              type="button"
-              variant="outline"
-              size="sm"
-              asChild
-            >
-              <a href={buildPortalRootUrl(portalOrigin)} target="_blank" rel="noopener noreferrer">
-                <Globe className="size-4" />
-                {t('customer_accounts.admin.portalInfo.open', 'Open Portal')}
-              </a>
-            </Button>
+            {portalOrgSlug ? (
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                asChild
+              >
+                <a href={buildPortalRootUrl(portalOrigin, portalOrgSlug)} target="_blank" rel="noopener noreferrer">
+                  <Globe className="size-4" />
+                  {t('customer_accounts.admin.portalInfo.open', 'Open Portal')}
+                </a>
+              </Button>
+            ) : null}
           </div>
         </div>
       </div>

package/src/modules/customer_accounts/backend/customer_accounts/users/page.tsx

@@ -1,14 +1,16 @@
 import { headers } from 'next/headers'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { resolvePortalRequestOrigin } from '../../../lib/portalUrl'
+import { resolveCurrentOrgPortalSlug } from '../../../lib/portalOrgSlug'
 import { PortalUsersPageClient } from './PortalUsersPageClient'
 
 export default async function CustomerAccountsPage() {
   const portalOrigin = resolvePortalRequestOrigin(await headers())
+  const portalOrgSlug = await resolveCurrentOrgPortalSlug()
   return (
     <Page>
       <PageBody className="space-y-4">
-        <PortalUsersPageClient portalOrigin={portalOrigin} />
+        <PortalUsersPageClient portalOrigin={portalOrigin} portalOrgSlug={portalOrgSlug} />
       </PageBody>
     </Page>
   )

package/src/modules/customer_accounts/lib/portalOrgSlug.ts

@@ -0,0 +1,40 @@
+// Server-only resolution of the signed-in admin's organization slug, used to
+// build the "Open Portal" link on the customer-accounts admin pages.
+//
+// Deliberately kept out of `portalUrl.ts`: that module is imported by client
+// components, and pulling the ORM in there would drag MikroORM into the browser
+// bundle. Keep every EntityManager import on this side of the boundary.
+
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromCookies } from '@open-mercato/shared/lib/auth/server'
+import { findOrganizationInTenant } from './organizationLookup'
+
+type EntityManagerResolver = {
+  resolve(name: 'em'): EntityManager
+}
+
+/**
+ * Resolve the slug of the organization the current admin session is scoped to,
+ * or null when there is no session, no active organization, or the organization
+ * has no slug yet. Callers render the portal link only for a non-null result —
+ * a slugless portal URL cannot resolve (#5668).
+ */
+export async function resolveCurrentOrgPortalSlug(): Promise<string | null> {
+  try {
+    const auth = await getAuthFromCookies()
+    const organizationId = auth?.orgId
+    const tenantId = auth?.tenantId
+    if (!organizationId || !tenantId) return null
+
+    const container = await createRequestContainer()
+    const em = (container as Awaited<ReturnType<typeof createRequestContainer>> & EntityManagerResolver).resolve('em')
+    const organization = await findOrganizationInTenant(em, organizationId, tenantId)
+    const slug = organization?.slug?.trim()
+    return slug && slug.length > 0 ? slug : null
+  } catch {
+    // The portal link is a convenience action — a lookup failure must not take
+    // the whole admin page down, so degrade to hiding the button.
+    return null
+  }
+}

package/src/modules/customer_accounts/lib/portalUrl.ts

@@ -106,7 +106,18 @@ export function buildPortalUrlPattern(origin: string | null | undefined): string
   return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`
 }
 
-/** Portal entry point used by the "Open Portal" action on admin pages. */
-export function buildPortalRootUrl(origin: string | null | undefined): string {
-  return `${normalizeOrigin(origin)}/portal`
+/**
+ * Portal entry point used by the "Open Portal" action on admin pages.
+ *
+ * Portal pages are only ever mounted at `frontend/[orgSlug]/portal/**`, so a URL
+ * without the organization segment cannot resolve and renders a 404 (#5668).
+ * The slug stays optional to keep this signature backward compatible; callers
+ * that cannot resolve one should hide the action rather than link to the
+ * slugless fallback.
+ */
+export function buildPortalRootUrl(origin: string | null | undefined, orgSlug?: string | null): string {
+  const base = normalizeOrigin(origin)
+  const slug = typeof orgSlug === 'string' ? orgSlug.trim() : ''
+  if (!slug) return `${base}/portal`
+  return `${base}/${encodeURIComponent(slug)}/portal`
 }