@open-mercato/core 0.7.1-develop.7195.1.b5efd1d51a → 0.7.1-develop.7200.1.8ba2d93d3f

package/dist/modules/auth/lib/setup-app.js

@@ -331,6 +331,7 @@ async function setupInitialTenant(em, options) {
       await mod.setup.onTenantCreated({ em, tenantId, organizationId });
     }
   }
+  await ensureCustomRoleAcls(em, tenantId, resolvedModules);
   return {
     tenantId,
     organizationId,

package/dist/modules/auth/lib/setup-app.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/setup-app.ts"],
-  "sourcesContent": ["import { hash } from 'bcryptjs'\nimport { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { normalizeTenantId } from './tenantAccess'\nimport { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'setup' })\n\nconst DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const\nconst DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'\nconst DEFAULT_DERIVED_EMAIL_DOMAIN = DEMO_SUPERADMIN_EMAIL.split('@')[1] ?? 'acme.com'\n\nexport type EnsureRolesOptions = {\n  roleNames?: string[]\n  tenantId?: string\n}\n\nasync function ensureRolesInContext(\n  em: EntityManager,\n  roleNames: string[],\n  tenantId: string,\n) {\n  for (const name of roleNames) {\n    const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })\n    if (existing) continue\n    em.persist(em.create(Role, { name, tenantId, minActiveHolders: name === 'admin' ? 1 : 0, createdAt: new Date() }))\n  }\n}\n\nexport async function ensureRoles(em: EntityManager, options: EnsureRolesOptions = {}) {\n  const roleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const tenantId = normalizeTenantId(options.tenantId ?? null)\n  if (!tenantId) {\n    throw new Error('ensureRoles requires a tenantId \u2014 global roles are not supported')\n  }\n  await em.transactional(async (tem) => {\n    await ensureRolesInContext(tem, roleNames, tenantId)\n    await tem.flush()\n  })\n}\n\nasync function findRoleByName(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const normalizedTenant = normalizeTenantId(tenantId ?? null) ?? null\n  return findOneWithDecryption(em, Role, { name, tenantId: normalizedTenant }, {}, { tenantId: normalizedTenant, organizationId: null })\n}\n\nasync function findRoleByNameOrFail(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role> {\n  const role = await findRoleByName(em, name, tenantId)\n  if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`)\n  return role\n}\n\ntype PrimaryUserInput = {\n  email: string\n  password?: string\n  hashedPassword?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  displayName?: string | null\n  confirm?: boolean\n}\n\nconst DERIVED_EMAIL_ENV = {\n  admin: 'OM_INIT_ADMIN_EMAIL',\n  employee: 'OM_INIT_EMPLOYEE_EMAIL',\n} as const\n\nexport type DemoUserRole = 'superadmin' | 'admin' | 'employee'\nexport type DemoUserEmail = { role: DemoUserRole; email: string }\n\n/**\n * Returns the canonical list of demo user emails the setup path may have\n * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the\n * same way the derived-user seeding branch does, so the deactivation loop\n * never drifts from the seeding loop.\n *\n * Pure function \u2014 no side effects, safe to unit-test in isolation.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport function resolveDemoUserEmails(): DemoUserEmail[] {\n  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  return [\n    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },\n    { role: 'admin', email: adminEmail },\n    { role: 'employee', email: employeeEmail },\n  ]\n}\n\nexport type SetupInitialTenantOptions = {\n  orgName: string\n  primaryUser: PrimaryUserInput\n  roleNames?: string[]\n  includeDerivedUsers?: boolean\n  failIfUserExists?: boolean\n  primaryUserRoles?: string[]\n  includeSuperadminRole?: boolean\n  /** Optional list of enabled modules. When provided, module setup hooks are called. */\n  modules?: Module[]\n  /**\n   * Optional global slug to persist on the new Organization. When set, a\n   * pre-flight uniqueness check across all tenants throws OrgSlugExistsError\n   * on collision so scriptable callers can fail loudly instead of silently\n   * reusing or clobbering an existing organization.\n   */\n  orgSlug?: string\n  /**\n   * Opt-in flag that allows seeding the derived admin/employee accounts when\n   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.\n   *\n   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are\n   *   seeded with the well-known `'secret'` password so local dev workflows\n   *   (e.g. `mercato init`) stay predictable for developers.\n   * - In production: the fallback uses a randomly generated 96-bit password\n   *   (printed once by the CLI) so an operator who deliberately opts in still\n   *   avoids the historical hardcoded credential. When this flag is false/unset\n   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`\n   *   is thrown instead of silently seeding any account.\n   */\n  allowDemoDerivedPasswords?: boolean\n}\n\nexport class OrgSlugExistsError extends Error {\n  constructor(public readonly slug: string) {\n    super(`ORG_SLUG_EXISTS: an organization with slug \"${slug}\" already exists`)\n    this.name = 'OrgSlugExistsError'\n  }\n}\n\nexport class DerivedUserPasswordRequiredError extends Error {\n  constructor(public readonly missing: string[]) {\n    super(\n      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,\n    )\n    this.name = 'DerivedUserPasswordRequiredError'\n  }\n}\n\nexport type SetupInitialTenantResult = {\n  tenantId: string\n  organizationId: string\n  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>\n  reusedExistingUser: boolean\n}\n\nexport async function setupInitialTenant(\n  em: EntityManager,\n  options: SetupInitialTenantOptions,\n): Promise<SetupInitialTenantResult> {\n  const {\n    primaryUser,\n    includeDerivedUsers = true,\n    failIfUserExists = false,\n    primaryUserRoles,\n    includeSuperadminRole = true,\n  } = options\n  const primaryRolesInput = primaryUserRoles && primaryUserRoles.length ? primaryUserRoles : ['superadmin']\n  const primaryRoles = includeSuperadminRole\n    ? primaryRolesInput\n    : primaryRolesInput.filter((role) => role !== 'superadmin')\n  if (primaryRoles.length === 0) {\n    throw new Error('PRIMARY_ROLES_REQUIRED')\n  }\n  const defaultRoleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const resolvedRoleNames = includeSuperadminRole\n    ? defaultRoleNames\n    : defaultRoleNames.filter((role) => role !== 'superadmin')\n  const roleNames = Array.from(new Set([...resolvedRoleNames, ...primaryRoles]))\n  const resolvedModules = options.modules ?? tryGetModules()\n  const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)\n\n  const mainEmail = primaryUser.email\n  const existingUserByHash = await findOneWithDecryption(\n    em,\n    User,\n    { emailHash: { $in: emailHashLookupValues(mainEmail) }, deletedAt: null },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  const existingUser = existingUserByHash ?? await findOneWithDecryption(\n    em,\n    User,\n    { email: mainEmail, deletedAt: null },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  if (existingUser && failIfUserExists) {\n    throw new Error('USER_EXISTS')\n  }\n\n  if (options.orgSlug) {\n    const slugConflict = await findOneWithDecryption(\n      em,\n      Organization,\n      { slug: options.orgSlug },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    if (slugConflict) {\n      throw new OrgSlugExistsError(options.orgSlug)\n    }\n  }\n\n  let tenantId: string | undefined\n  let organizationId: string | undefined\n  let reusedExistingUser = false\n  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []\n\n  await em.transactional(async (tem) => {\n    if (!existingUser) return\n    reusedExistingUser = true\n    tenantId = existingUser.tenantId ? String(existingUser.tenantId) : undefined\n    organizationId = existingUser.organizationId ? String(existingUser.organizationId) : undefined\n    const roleTenantId = normalizeTenantId(existingUser.tenantId ?? null) ?? null\n    if (!roleTenantId) {\n      throw new Error('Cannot reuse a user without a tenantId \u2014 global roles are not supported')\n    }\n\n    await ensureRolesInContext(tem, roleNames, roleTenantId)\n    await tem.flush()\n\n    const requiredRoleSet = new Set([...roleNames, ...primaryRoles])\n    const links = await findWithDecryption(\n      tem,\n      UserRole,\n      { user: existingUser },\n      { populate: ['role'] },\n      { tenantId: roleTenantId, organizationId: null },\n    )\n    const currentRoles = new Set(links.map((link) => link.role.name))\n    for (const roleName of requiredRoleSet) {\n      if (!currentRoles.has(roleName)) {\n        const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n        tem.persist(tem.create(UserRole, { user: existingUser, role, createdAt: new Date() }))\n      }\n    }\n    await tem.flush()\n    const roles = Array.from(new Set([...currentRoles, ...roleNames]))\n    userSnapshots.push({ user: existingUser, roles, created: false })\n  })\n\n  if (!existingUser) {\n    const baseUsers: Array<{\n      email: string\n      roles: string[]\n      name?: string | null\n      passwordHash?: string | null\n      generatedPassword?: string | null\n    }> = [\n      { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },\n    ]\n    if (includeDerivedUsers) {\n      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)\n      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)\n      const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')\n      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')\n      const isProduction = process.env.NODE_ENV === 'production'\n      const allowDemo = options.allowDemoDerivedPasswords === true\n      if (isProduction && !allowDemo) {\n        const missing: string[] = []\n        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')\n        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')\n        if (missing.length) {\n          throw new DerivedUserPasswordRequiredError(missing)\n        }\n      }\n      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so\n      // local dev workflows stay predictable (admin@/employee@ login with the\n      // documented demo password). In production we either have env-supplied\n      // values, or \u2014 for opt-in --include-demo-users flows \u2014 we generate a\n      // random one-time password and surface it via `generatedPassword` so the\n      // operator can capture it. Production callers without env vars and\n      // without the opt-in already threw above.\n      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd\n      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd\n      const adminPasswordHash = await hash(adminPasswordPlain, 10)\n      const employeePasswordHash = await hash(employeePasswordPlain, 10)\n      addUniqueBaseUser(baseUsers, {\n        email: adminEmail,\n        roles: ['admin'],\n        passwordHash: adminPasswordHash,\n        generatedPassword: envAdminPwd ? null : adminPasswordPlain,\n      })\n      addUniqueBaseUser(baseUsers, {\n        email: employeeEmail,\n        roles: ['employee'],\n        passwordHash: employeePasswordHash,\n        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,\n      })\n    }\n    const passwordHash = await resolvePasswordHash(primaryUser)\n\n    await em.transactional(async (tem) => {\n      const tenant = tem.create(Tenant, {\n        name: options.orgName,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(tenant)\n      await tem.flush()\n\n      const organization = tem.create(Organization, {\n        name: options.orgName,\n        slug: options.orgSlug ?? null,\n        tenant,\n        isActive: true,\n        depth: 0,\n        ancestorIds: [],\n        childIds: [],\n        descendantIds: [],\n        logoPreserveAspectRatio: false,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(organization)\n      await tem.flush()\n\n      tenantId = String(tenant.id)\n      organizationId = String(organization.id)\n      const roleTenantId = tenantId\n\n      if (isTenantDataEncryptionEnabled()) {\n        try {\n          const kms = createKmsService()\n          if (kms.isHealthy()) {\n            if (isEncryptionDebugEnabled()) {\n              logger.info('Provisioning tenant DEK', { tenantId: String(tenant.id) })\n            }\n            await kms.createTenantDek(String(tenant.id))\n            if (isEncryptionDebugEnabled()) {\n              logger.info('Created tenant DEK during setup', { tenantId: String(tenant.id) })\n            }\n          } else {\n            if (isEncryptionDebugEnabled()) {\n              logger.warn('KMS not healthy, skipping tenant DEK creation', { tenantId: String(tenant.id) })\n            }\n          }\n        } catch (err) {\n          if (isEncryptionDebugEnabled()) {\n            logger.warn('Failed to create tenant DEK', { err })\n          }\n        }\n      }\n\n      await ensureRolesInContext(tem, roleNames, roleTenantId)\n      await tem.flush()\n\n      if (isTenantDataEncryptionEnabled()) {\n        // System-scoped maps are resolved from module code, never from a tenant row.\n        // Persisting one here would make the tenant-scoped encryption CLIs believe they\n        // own that entity and re-wrap its `system:<entityId>` ciphertext under the tenant\n        // DEK, which runtime decryption can no longer read.\n        for (const spec of defaultEncryptionMaps) {\n          if (spec.keyScope === 'system') continue\n          const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })\n          if (!existing) {\n            tem.persist(tem.create(EncryptionMap, {\n              entityId: spec.entityId,\n              tenantId: tenant.id,\n              organizationId: organization.id,\n              fieldsJson: spec.fields,\n              isActive: true,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            }))\n          } else {\n            existing.fieldsJson = spec.fields\n            existing.isActive = true\n          }\n        }\n        await tem.flush()\n      }\n    })\n\n    await em.transactional(async (tem) => {\n      if (!tenantId || !organizationId) return\n      const roleTenantId = tenantId\n      const encryptionService = isTenantDataEncryptionEnabled()\n        ? new TenantDataEncryptionService(tem as any, { kms: createKmsService() })\n        : null\n      if (encryptionService) {\n        await encryptionService.invalidateMap('auth:user', String(tenantId), String(organizationId))\n        await encryptionService.invalidateMap('auth:user', String(tenantId), null)\n      }\n\n      for (const base of baseUsers) {\n        const resolvedPasswordHash = base.passwordHash ?? passwordHash\n        let user = await findOneWithDecryption(tem, User, { email: base.email }, {}, { tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n        const confirm = primaryUser.confirm ?? true\n        const encryptedPayload = encryptionService\n          ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)\n          : { email: base.email, emailHash: computeEmailHash(base.email) }\n        if (user) {\n          user.passwordHash = resolvedPasswordHash\n          user.organizationId = organizationId\n          user.tenantId = tenantId\n          if (isTenantDataEncryptionEnabled()) {\n            user.email = encryptedPayload.email as any\n            user.emailHash = (encryptedPayload as any).emailHash ?? computeEmailHash(base.email)\n          }\n          if (base.name) user.name = base.name\n          if (confirm) user.isConfirmed = true\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })\n        } else {\n          user = tem.create(User, {\n            email: (encryptedPayload as any).email ?? base.email,\n            emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,\n            passwordHash: resolvedPasswordHash,\n            organizationId,\n            tenantId,\n            name: base.name ?? undefined,\n            isConfirmed: confirm,\n            createdAt: new Date(),\n          })\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })\n        }\n        await tem.flush()\n        for (const roleName of base.roles) {\n          const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })\n          if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))\n        }\n        await tem.flush()\n      }\n    })\n  }\n\n  if (!tenantId || !organizationId) {\n    throw new Error('SETUP_FAILED')\n  }\n\n  if (!reusedExistingUser) {\n    await rebuildHierarchyForTenant(em, tenantId)\n  }\n\n  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })\n  await deactivateDemoUsersIfSelfOnboardingEnabled(em)\n\n  // Call module onTenantCreated hooks\n  for (const mod of resolvedModules) {\n    if (mod.setup?.onTenantCreated) {\n      await mod.setup.onTenantCreated({ em, tenantId, organizationId })\n    }\n  }\n\n  return {\n    tenantId,\n    organizationId,\n    users: userSnapshots,\n    reusedExistingUser,\n  }\n}\n\nfunction resolvePrimaryName(input: PrimaryUserInput): string | null {\n  if (input.displayName && input.displayName.trim()) return input.displayName.trim()\n  const parts = [input.firstName, input.lastName].map((value) => value?.trim()).filter(Boolean)\n  if (parts.length) return parts.join(' ')\n  return null\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  const value = process.env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction addUniqueBaseUser(\n  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,\n  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },\n) {\n  if (!entry.email) return\n  const normalized = entry.email.toLowerCase()\n  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return\n  baseUsers.push(entry)\n}\n\n/**\n * Well-known demo password seeded for derived admin@/employee@ accounts in\n * non-production (`NODE_ENV !== 'production'`) when no env override is set.\n * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used\n * in production: the production branch either consumes env-supplied values or\n * falls back to `generateDerivedPassword()` so credentials remain non-guessable.\n */\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\n/**\n * Generate a 16-character base64url password (96 bits of entropy) for a derived\n * demo user in production when no env override is provided AND the caller\n * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the\n * `users[].generatedPassword` snapshot so CLI callers can print it to the\n * operator \u2014 there is no other recovery path for these credentials.\n */\nfunction generateDerivedPassword(): string {\n  return randomBytes(12).toString('base64url')\n}\n\nfunction isDemoModeEnabled(): boolean {\n  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  return parsed === false ? false : true\n}\n\nfunction shouldKeepDemoSuperadminDuringInit(): boolean {\n  if (process.env.OM_INIT_FLOW !== 'true') return false\n  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false\n  return isDemoModeEnabled()\n}\n\nasync function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {\n  if (typeof input.hashedPassword === 'string') return input.hashedPassword\n  if (input.password) return hash(input.password, 10)\n  return null\n}\n\nexport async function ensureDefaultRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n  options: { includeSuperadminRole?: boolean } = {},\n) {\n  const includeSuperadminRole = options.includeSuperadminRole ?? true\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const superadminRole = includeSuperadminRole ? await findRoleByName(em, 'superadmin', roleTenantId) : null\n  const adminRole = await findRoleByName(em, 'admin', roleTenantId)\n  const employeeRole = await findRoleByName(em, 'employee', roleTenantId)\n\n  // Merge features from all enabled modules' setup configs\n  const builtInRoles = ['superadmin', 'admin', 'employee'] as const\n  const superadminFeatures: string[] = []\n  const adminFeatures: string[] = []\n  const employeeFeatures: string[] = []\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of modules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)\n    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)\n    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)\n\n    // Collect features for custom roles (any key not in builtInRoles)\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if ((builtInRoles as readonly string[]).includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  logger.info('Seeded default role features', {\n    superadmin: superadminFeatures,\n    admin: adminFeatures,\n    employee: employeeFeatures,\n    ...(customRoleFeatures.size > 0\n      ? Object.fromEntries(customRoleFeatures)\n      : {}),\n  })\n\n  if (includeSuperadminRole && superadminRole) {\n    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })\n  }\n  if (adminRole) {\n    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)\n  }\n  if (employeeRole) {\n    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)\n  }\n\n  // Seed ACLs for custom roles defined by app modules.\n  // NOTE: Custom roles may not exist yet if they are created in seedDefaults\n  // (which runs after this function). In that case, use ensureCustomRoleAcls()\n  // after seedDefaults to pick them up.\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n    }\n  }\n}\n\n/**\n * Seed ACLs for custom roles defined in module defaultRoleFeatures.\n * Call this AFTER seedDefaults to pick up roles created by app modules.\n * Safe to call multiple times \u2014 ensureRoleAclFor merges features idempotently.\n */\nexport async function ensureCustomRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules?: Module[],\n): Promise<void> {\n  const resolvedModules = modules ?? tryGetModules()\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const builtInRoles = ['superadmin', 'admin', 'employee']\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of resolvedModules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if (builtInRoles.includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  if (customRoleFeatures.size === 0) return\n\n  let seeded = 0\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n      seeded++\n    }\n  }\n  if (seeded > 0) {\n    logger.info('Seeded custom role ACLs', { seeded })\n  }\n}\n\nasync function ensureRoleAclFor(\n  em: EntityManager,\n  role: Role,\n  tenantId: string,\n  features: string[],\n  options: { isSuperAdmin?: boolean } = {},\n) {\n  // Deduplicated on the create path too, not only on merge. `ensureDefaultRoleAcls` concatenates\n  // every enabled module's declared features, and two modules legitimately declare the same\n  // grant (the example module asks for `payment_gateways.view`, and so does that module itself),\n  // so a first init used to store the string twice while the second run silently collapsed it.\n  // Same list, two shapes, depending only on how many times setup had run.\n  const uniqueFeatures = Array.from(new Set(features))\n  const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })\n  if (!existing) {\n    const acl = em.create(RoleAcl, {\n      role,\n      tenantId,\n      featuresJson: uniqueFeatures,\n      isSuperAdmin: !!options.isSuperAdmin,\n      createdAt: new Date(),\n    })\n    await em.persist(acl).flush()\n    return\n  }\n  const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []\n  const merged = Array.from(new Set([...currentFeatures, ...uniqueFeatures]))\n  const changed =\n    merged.length !== currentFeatures.length ||\n    merged.some((value, index) => value !== currentFeatures[index])\n  if (changed) existing.featuresJson = merged\n  if (options.isSuperAdmin && !existing.isSuperAdmin) {\n    existing.isSuperAdmin = true\n  }\n  if (changed || options.isSuperAdmin) {\n    await em.persist(existing).flush()\n  }\n}\n\n/**\n * Neutralizes every demo account the setup path may have seeded\n * (superadmin, admin, employee \u2014 honoring OM_INIT_*_EMAIL overrides)\n * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not\n * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.\n *\n * Each user is processed in its own try/catch so a single failure (e.g.\n * decryption error on a legacy row) does not skip the remaining accounts.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {\n  if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return\n  if (shouldKeepDemoSuperadminDuringInit()) return\n  for (const { role, email } of resolveDemoUserEmails()) {\n    try {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { email },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!user) continue\n      let dirty = false\n      if (user.passwordHash) {\n        user.passwordHash = null\n        dirty = true\n      }\n      if (user.isConfirmed !== false) {\n        user.isConfirmed = false\n        dirty = true\n      }\n      if (dirty) {\n        await em.persist(user).flush()\n      }\n    } catch (error) {\n      logger.error('Failed to deactivate demo user', { role, email, err: error })\n    }\n  }\n}\n\n/**\n * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}\n * because the helper now neutralizes admin/employee demo accounts in addition\n * to superadmin (security tracker finding #5). Kept as an internal alias to\n * avoid breaking any out-of-tree caller that imported the old name; will be\n * removed in a future major.\n */\nconst deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled\n\n/** Try to get modules from runtime registry; returns empty array if not yet registered. */\nfunction tryGetModules(): Module[] {\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,gCAA6C;AACtD,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEhE,MAAM,qBAAqB,CAAC,YAAY,SAAS,YAAY;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B,sBAAsB,MAAM,GAAG,EAAE,CAAC,KAAK;AAO5E,eAAe,qBACb,IACA,WACA,UACA;AACA,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACjH,QAAI,SAAU;AACd,OAAG,QAAQ,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,kBAAkB,SAAS,UAAU,IAAI,GAAG,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACnH;AACF;AAEA,eAAsB,YAAY,IAAmB,UAA8B,CAAC,GAAG;AACrF,QAAM,YAAY,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AAC7D,QAAM,WAAW,kBAAkB,QAAQ,YAAY,IAAI;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,uEAAkE;AAAA,EACpF;AACA,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,qBAAqB,KAAK,WAAW,QAAQ;AACnD,UAAM,IAAI,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,eACb,IACA,MACA,UACsB;AACtB,QAAM,mBAAmB,kBAAkB,YAAY,IAAI,KAAK;AAChE,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,UAAU,iBAAiB,GAAG,CAAC,GAAG,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,CAAC;AACvI;AAEA,eAAe,qBACb,IACA,MACA,UACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,MAAM,QAAQ;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACnD,SAAO;AACT;AAYA,MAAM,oBAAoB;AAAA,EACxB,OAAO;AAAA,EACP,UAAU;AACZ;AAeO,SAAS,wBAAyC;AACvD,QAAM,aAAa,aAAa,kBAAkB,KAAK,KAAK,SAAS,4BAA4B;AACjG,QAAM,gBAAgB,aAAa,kBAAkB,QAAQ,KAAK,YAAY,4BAA4B;AAC1G,SAAO;AAAA,IACL,EAAE,MAAM,cAAc,OAAO,sBAAsB;AAAA,IACnD,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,IACnC,EAAE,MAAM,YAAY,OAAO,cAAc;AAAA,EAC3C;AACF;AAmCO,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAA4B,MAAc;AACxC,UAAM,+CAA+C,IAAI,kBAAkB;AADjD;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,yCAAyC,MAAM;AAAA,EAC1D,YAA4B,SAAmB;AAC7C;AAAA,MACE,2CAA2C,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/D;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,mBACpB,IACA,SACmC;AACnC,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA,wBAAwB;AAAA,EAC1B,IAAI;AACJ,QAAM,oBAAoB,oBAAoB,iBAAiB,SAAS,mBAAmB,CAAC,YAAY;AACxG,QAAM,eAAe,wBACjB,oBACA,kBAAkB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC5D,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,mBAAmB,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AACpE,QAAM,oBAAoB,wBACtB,mBACA,iBAAiB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC3D,QAAM,YAAY,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,mBAAmB,GAAG,YAAY,CAAC,CAAC;AAC7E,QAAM,kBAAkB,QAAQ,WAAW,cAAc;AACzD,QAAM,wBAAwB,yBAAyB,eAAe;AAEtE,QAAM,YAAY,YAAY;AAC9B,QAAM,qBAAqB,MAAM;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,EAAE,WAAW,EAAE,KAAK,sBAAsB,SAAS,EAAE,GAAG,WAAW,KAAK;AAAA,IACxE,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,eAAe,sBAAsB,MAAM;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,EAAE,OAAO,WAAW,WAAW,KAAK;AAAA,IACpC,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,QAAI,cAAc;AAChB,YAAM,IAAI,mBAAmB,QAAQ,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,qBAAqB;AACzB,QAAM,gBAA6G,CAAC;AAEpH,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,QAAI,CAAC,aAAc;AACnB,yBAAqB;AACrB,eAAW,aAAa,WAAW,OAAO,aAAa,QAAQ,IAAI;AACnE,qBAAiB,aAAa,iBAAiB,OAAO,aAAa,cAAc,IAAI;AACrF,UAAM,eAAe,kBAAkB,aAAa,YAAY,IAAI,KAAK;AACzE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,8EAAyE;AAAA,IAC3F;AAEA,UAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,UAAM,IAAI,MAAM;AAEhB,UAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAC/D,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,aAAa;AAAA,MACrB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,IACjD;AACA,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AAChE,eAAW,YAAY,iBAAiB;AACtC,UAAI,CAAC,aAAa,IAAI,QAAQ,GAAG;AAC/B,cAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,YAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,cAAc,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AACjE,kBAAc,KAAK,EAAE,MAAM,cAAc,OAAO,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,CAAC,cAAc;AACjB,UAAM,YAMD;AAAA,MACH,EAAE,OAAO,YAAY,OAAO,OAAO,cAAc,MAAM,mBAAmB,WAAW,EAAE;AAAA,IACzF;AACA,QAAI,qBAAqB;AACvB,YAAM,gBAAgB,aAAa,kBAAkB,KAAK;AAC1D,YAAM,mBAAmB,aAAa,kBAAkB,QAAQ;AAChE,YAAM,aAAa,iBAAiB,SAAS,4BAA4B;AACzE,YAAM,gBAAgB,oBAAoB,YAAY,4BAA4B;AAClF,YAAM,cAAc,aAAa,wBAAwB;AACzD,YAAM,iBAAiB,aAAa,2BAA2B;AAC/D,YAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,YAAM,YAAY,QAAQ,8BAA8B;AACxD,UAAI,gBAAgB,CAAC,WAAW;AAC9B,cAAM,UAAoB,CAAC;AAC3B,YAAI,CAAC,YAAa,SAAQ,KAAK,wBAAwB;AACvD,YAAI,CAAC,eAAgB,SAAQ,KAAK,2BAA2B;AAC7D,YAAI,QAAQ,QAAQ;AAClB,gBAAM,IAAI,iCAAiC,OAAO;AAAA,QACpD;AAAA,MACF;AAQA,YAAM,mBAAmB,eAAe,wBAAwB,IAAI;AACpE,YAAM,sBAAsB,eAAe,wBAAwB,IAAI;AACvE,YAAM,qBAAqB,eAAe;AAC1C,YAAM,wBAAwB,kBAAkB;AAChD,YAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE;AAC3D,YAAM,uBAAuB,MAAM,KAAK,uBAAuB,EAAE;AACjE,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,OAAO;AAAA,QACf,cAAc;AAAA,QACd,mBAAmB,cAAc,OAAO;AAAA,MAC1C,CAAC;AACD,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,UAAU;AAAA,QAClB,cAAc;AAAA,QACd,mBAAmB,iBAAiB,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,UAAM,eAAe,MAAM,oBAAoB,WAAW;AAE1D,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,QAChC,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,MAAM;AAClB,YAAM,IAAI,MAAM;AAEhB,YAAM,eAAe,IAAI,OAAO,cAAc;AAAA,QAC5C,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ,WAAW;AAAA,QACzB;AAAA,QACA,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,CAAC;AAAA,QACd,UAAU,CAAC;AAAA,QACX,eAAe,CAAC;AAAA,QAChB,yBAAyB;AAAA,QACzB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,YAAY;AACxB,YAAM,IAAI,MAAM;AAEhB,iBAAW,OAAO,OAAO,EAAE;AAC3B,uBAAiB,OAAO,aAAa,EAAE;AACvC,YAAM,eAAe;AAErB,UAAI,8BAA8B,GAAG;AACnC,YAAI;AACF,gBAAM,MAAM,iBAAiB;AAC7B,cAAI,IAAI,UAAU,GAAG;AACnB,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,2BAA2B,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACxE;AACA,kBAAM,IAAI,gBAAgB,OAAO,OAAO,EAAE,CAAC;AAC3C,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,mCAAmC,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAChF;AAAA,UACF,OAAO;AACL,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,iDAAiD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAC9F;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,yBAAyB,GAAG;AAC9B,mBAAO,KAAK,+BAA+B,EAAE,IAAI,CAAC;AAAA,UACpD;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,YAAM,IAAI,MAAM;AAEhB,UAAI,8BAA8B,GAAG;AAKnC,mBAAW,QAAQ,uBAAuB;AACxC,cAAI,KAAK,aAAa,SAAU;AAChC,gBAAM,WAAW,MAAM,sBAAsB,KAAK,eAAe,EAAE,UAAU,KAAK,UAAU,UAAU,OAAO,IAAI,gBAAgB,aAAa,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,gBAAgB,OAAO,aAAa,EAAE,EAAE,CAAC;AACjP,cAAI,CAAC,UAAU;AACb,gBAAI,QAAQ,IAAI,OAAO,eAAe;AAAA,cACpC,UAAU,KAAK;AAAA,cACf,UAAU,OAAO;AAAA,cACjB,gBAAgB,aAAa;AAAA,cAC7B,YAAY,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC,CAAC;AAAA,UACJ,OAAO;AACL,qBAAS,aAAa,KAAK;AAC3B,qBAAS,WAAW;AAAA,UACtB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,eAAe;AACrB,YAAM,oBAAoB,8BAA8B,IACpD,IAAI,4BAA4B,KAAY,EAAE,KAAK,iBAAiB,EAAE,CAAC,IACvE;AACJ,UAAI,mBAAmB;AACrB,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3F,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,IAAI;AAAA,MAC3E;AAEA,iBAAW,QAAQ,WAAW;AAC5B,cAAM,uBAAuB,KAAK,gBAAgB;AAClD,YAAI,OAAO,MAAM,sBAAsB,KAAK,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AACnJ,cAAM,UAAU,YAAY,WAAW;AACvC,cAAM,mBAAmB,oBACrB,MAAM,kBAAkB,qBAAqB,aAAa,EAAE,OAAO,KAAK,MAAM,GAAG,UAAU,cAAc,IACzG,EAAE,OAAO,KAAK,OAAO,WAAW,iBAAiB,KAAK,KAAK,EAAE;AACjE,YAAI,MAAM;AACR,eAAK,eAAe;AACpB,eAAK,iBAAiB;AACtB,eAAK,WAAW;AAChB,cAAI,8BAA8B,GAAG;AACnC,iBAAK,QAAQ,iBAAiB;AAC9B,iBAAK,YAAa,iBAAyB,aAAa,iBAAiB,KAAK,KAAK;AAAA,UACrF;AACA,cAAI,KAAK,KAAM,MAAK,OAAO,KAAK;AAChC,cAAI,QAAS,MAAK,cAAc;AAChC,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QACnH,OAAO;AACL,iBAAO,IAAI,OAAO,MAAM;AAAA,YACtB,OAAQ,iBAAyB,SAAS,KAAK;AAAA,YAC/C,WAAW,8BAA8B,IAAK,iBAAyB,aAAa,iBAAiB,KAAK,KAAK,IAAI;AAAA,YACnH,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA,MAAM,KAAK,QAAQ;AAAA,YACnB,aAAa;AAAA,YACb,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QAClH;AACA,cAAM,IAAI,MAAM;AAChB,mBAAW,YAAY,KAAK,OAAO;AACjC,gBAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,gBAAM,eAAe,MAAM,sBAAsB,KAAK,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,KAAK,CAAC;AACxI,cAAI,CAAC,aAAc,KAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,QAC5F;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,cAAc;AAAA,EAChC;AAEA,MAAI,CAAC,oBAAoB;AACvB,UAAM,0BAA0B,IAAI,QAAQ;AAAA,EAC9C;AAEA,QAAM,sBAAsB,IAAI,UAAU,iBAAiB,EAAE,sBAAsB,CAAC;AACpF,QAAM,2CAA2C,EAAE;AAGnD,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,OAAO,iBAAiB;AAC9B,YAAM,IAAI,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,MAAM,eAAe,MAAM,YAAY,KAAK,EAAG,QAAO,MAAM,YAAY,KAAK;AACjF,QAAM,QAAQ,CAAC,MAAM,WAAW,MAAM,QAAQ,EAAE,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F,MAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AACvC,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,kBACP,WACA,OACA;AACA,MAAI,CAAC,MAAM,MAAO;AAClB,QAAM,aAAa,MAAM,MAAM,YAAY;AAC3C,MAAI,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,YAAY,MAAM,UAAU,EAAG;AACvE,YAAU,KAAK,KAAK;AACtB;AASA,MAAM,wBAAwB;AAS9B,SAAS,0BAAkC;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AAC5D,SAAO,WAAW,QAAQ,QAAQ;AACpC;AAEA,SAAS,qCAA8C;AACrD,MAAI,QAAQ,IAAI,iBAAiB,OAAQ,QAAO;AAChD,MAAI,CAAC,aAAa,0BAA0B,EAAG,QAAO;AACtD,SAAO,kBAAkB;AAC3B;AAEA,eAAe,oBAAoB,OAAiD;AAClF,MAAI,OAAO,MAAM,mBAAmB,SAAU,QAAO,MAAM;AAC3D,MAAI,MAAM,SAAU,QAAO,KAAK,MAAM,UAAU,EAAE;AAClD,SAAO;AACT;AAEA,eAAsB,sBACpB,IACA,UACA,SACA,UAA+C,CAAC,GAChD;AACA,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,iBAAiB,wBAAwB,MAAM,eAAe,IAAI,cAAc,YAAY,IAAI;AACtG,QAAM,YAAY,MAAM,eAAe,IAAI,SAAS,YAAY;AAChE,QAAM,eAAe,MAAM,eAAe,IAAI,YAAY,YAAY;AAGtE,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAA+B,CAAC;AACtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,SAAS;AACzB,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,QAAI,aAAa,WAAY,oBAAmB,KAAK,GAAG,aAAa,UAAU;AAC/E,QAAI,aAAa,MAAO,eAAc,KAAK,GAAG,aAAa,KAAK;AAChE,QAAI,aAAa,SAAU,kBAAiB,KAAK,GAAG,aAAa,QAAQ;AAGzE,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAK,aAAmC,SAAS,QAAQ,EAAG;AAC5D,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,SAAO,KAAK,gCAAgC;AAAA,IAC1C,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,GAAI,mBAAmB,OAAO,IAC1B,OAAO,YAAY,kBAAkB,IACrC,CAAC;AAAA,EACP,CAAC;AAED,MAAI,yBAAyB,gBAAgB;AAC3C,UAAM,iBAAiB,IAAI,gBAAgB,UAAU,oBAAoB,EAAE,cAAc,KAAK,CAAC;AAAA,EACjG;AACA,MAAI,WAAW;AACb,UAAM,iBAAiB,IAAI,WAAW,UAAU,aAAa;AAAA,EAC/D;AACA,MAAI,cAAc;AAChB,UAAM,iBAAiB,IAAI,cAAc,UAAU,gBAAgB;AAAA,EACrE;AAMA,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AAAA,IACrD;AAAA,EACF;AACF;AAOA,eAAsB,qBACpB,IACA,UACA,SACe;AACf,QAAM,kBAAkB,WAAW,cAAc;AACjD,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,iBAAiB;AACjC,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAI,aAAa,SAAS,QAAQ,EAAG;AACrC,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,mBAAmB,SAAS,EAAG;AAEnC,MAAI,SAAS;AACb,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,GAAG;AACd,WAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACnD;AACF;AAEA,eAAe,iBACb,IACA,MACA,UACA,UACA,UAAsC,CAAC,GACvC;AAMA,QAAM,iBAAiB,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;AACnD,QAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACpH,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,GAAG,OAAO,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc,CAAC,CAAC,QAAQ;AAAA,MACxB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,QAAQ,SAAS,YAAY,IAAI,SAAS,eAAe,CAAC;AACxF,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,cAAc,CAAC,CAAC;AAC1E,QAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,MAAI,QAAS,UAAS,eAAe;AACrC,MAAI,QAAQ,gBAAgB,CAAC,SAAS,cAAc;AAClD,aAAS,eAAe;AAAA,EAC1B;AACA,MAAI,WAAW,QAAQ,cAAc;AACnC,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC;AACF;AAaA,eAAsB,2CAA2C,IAAmB;AAClF,MAAI,QAAQ,IAAI,oCAAoC,OAAQ;AAC5D,MAAI,mCAAmC,EAAG;AAC1C,aAAW,EAAE,MAAM,MAAM,KAAK,sBAAsB,GAAG;AACrD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,MAAM;AAAA,QACR,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,KAAM;AACX,UAAI,QAAQ;AACZ,UAAI,KAAK,cAAc;AACrB,aAAK,eAAe;AACpB,gBAAQ;AAAA,MACV;AACA,UAAI,KAAK,gBAAgB,OAAO;AAC9B,aAAK,cAAc;AACnB,gBAAQ;AAAA,MACV;AACA,UAAI,OAAO;AACT,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,aAAO,MAAM,kCAAkC,EAAE,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,IAC5E;AAAA,EACF;AACF;AASA,MAAM,kDAAkD;AAGxD,SAAS,gBAA0B;AACjC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { hash } from 'bcryptjs'\nimport { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { normalizeTenantId } from './tenantAccess'\nimport { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { createKmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'setup' })\n\nconst DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const\nconst DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'\nconst DEFAULT_DERIVED_EMAIL_DOMAIN = DEMO_SUPERADMIN_EMAIL.split('@')[1] ?? 'acme.com'\n\nexport type EnsureRolesOptions = {\n  roleNames?: string[]\n  tenantId?: string\n}\n\nasync function ensureRolesInContext(\n  em: EntityManager,\n  roleNames: string[],\n  tenantId: string,\n) {\n  for (const name of roleNames) {\n    const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })\n    if (existing) continue\n    em.persist(em.create(Role, { name, tenantId, minActiveHolders: name === 'admin' ? 1 : 0, createdAt: new Date() }))\n  }\n}\n\nexport async function ensureRoles(em: EntityManager, options: EnsureRolesOptions = {}) {\n  const roleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const tenantId = normalizeTenantId(options.tenantId ?? null)\n  if (!tenantId) {\n    throw new Error('ensureRoles requires a tenantId \u2014 global roles are not supported')\n  }\n  await em.transactional(async (tem) => {\n    await ensureRolesInContext(tem, roleNames, tenantId)\n    await tem.flush()\n  })\n}\n\nasync function findRoleByName(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const normalizedTenant = normalizeTenantId(tenantId ?? null) ?? null\n  return findOneWithDecryption(em, Role, { name, tenantId: normalizedTenant }, {}, { tenantId: normalizedTenant, organizationId: null })\n}\n\nasync function findRoleByNameOrFail(\n  em: EntityManager,\n  name: string,\n  tenantId: string | null,\n): Promise<Role> {\n  const role = await findRoleByName(em, name, tenantId)\n  if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`)\n  return role\n}\n\ntype PrimaryUserInput = {\n  email: string\n  password?: string\n  hashedPassword?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  displayName?: string | null\n  confirm?: boolean\n}\n\nconst DERIVED_EMAIL_ENV = {\n  admin: 'OM_INIT_ADMIN_EMAIL',\n  employee: 'OM_INIT_EMPLOYEE_EMAIL',\n} as const\n\nexport type DemoUserRole = 'superadmin' | 'admin' | 'employee'\nexport type DemoUserEmail = { role: DemoUserRole; email: string }\n\n/**\n * Returns the canonical list of demo user emails the setup path may have\n * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the\n * same way the derived-user seeding branch does, so the deactivation loop\n * never drifts from the seeding loop.\n *\n * Pure function \u2014 no side effects, safe to unit-test in isolation.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport function resolveDemoUserEmails(): DemoUserEmail[] {\n  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n  return [\n    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },\n    { role: 'admin', email: adminEmail },\n    { role: 'employee', email: employeeEmail },\n  ]\n}\n\nexport type SetupInitialTenantOptions = {\n  orgName: string\n  primaryUser: PrimaryUserInput\n  roleNames?: string[]\n  includeDerivedUsers?: boolean\n  failIfUserExists?: boolean\n  primaryUserRoles?: string[]\n  includeSuperadminRole?: boolean\n  /** Optional list of enabled modules. When provided, module setup hooks are called. */\n  modules?: Module[]\n  /**\n   * Optional global slug to persist on the new Organization. When set, a\n   * pre-flight uniqueness check across all tenants throws OrgSlugExistsError\n   * on collision so scriptable callers can fail loudly instead of silently\n   * reusing or clobbering an existing organization.\n   */\n  orgSlug?: string\n  /**\n   * Opt-in flag that allows seeding the derived admin/employee accounts when\n   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.\n   *\n   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are\n   *   seeded with the well-known `'secret'` password so local dev workflows\n   *   (e.g. `mercato init`) stay predictable for developers.\n   * - In production: the fallback uses a randomly generated 96-bit password\n   *   (printed once by the CLI) so an operator who deliberately opts in still\n   *   avoids the historical hardcoded credential. When this flag is false/unset\n   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`\n   *   is thrown instead of silently seeding any account.\n   */\n  allowDemoDerivedPasswords?: boolean\n}\n\nexport class OrgSlugExistsError extends Error {\n  constructor(public readonly slug: string) {\n    super(`ORG_SLUG_EXISTS: an organization with slug \"${slug}\" already exists`)\n    this.name = 'OrgSlugExistsError'\n  }\n}\n\nexport class DerivedUserPasswordRequiredError extends Error {\n  constructor(public readonly missing: string[]) {\n    super(\n      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,\n    )\n    this.name = 'DerivedUserPasswordRequiredError'\n  }\n}\n\nexport type SetupInitialTenantResult = {\n  tenantId: string\n  organizationId: string\n  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>\n  reusedExistingUser: boolean\n}\n\nexport async function setupInitialTenant(\n  em: EntityManager,\n  options: SetupInitialTenantOptions,\n): Promise<SetupInitialTenantResult> {\n  const {\n    primaryUser,\n    includeDerivedUsers = true,\n    failIfUserExists = false,\n    primaryUserRoles,\n    includeSuperadminRole = true,\n  } = options\n  const primaryRolesInput = primaryUserRoles && primaryUserRoles.length ? primaryUserRoles : ['superadmin']\n  const primaryRoles = includeSuperadminRole\n    ? primaryRolesInput\n    : primaryRolesInput.filter((role) => role !== 'superadmin')\n  if (primaryRoles.length === 0) {\n    throw new Error('PRIMARY_ROLES_REQUIRED')\n  }\n  const defaultRoleNames = options.roleNames ?? [...DEFAULT_ROLE_NAMES]\n  const resolvedRoleNames = includeSuperadminRole\n    ? defaultRoleNames\n    : defaultRoleNames.filter((role) => role !== 'superadmin')\n  const roleNames = Array.from(new Set([...resolvedRoleNames, ...primaryRoles]))\n  const resolvedModules = options.modules ?? tryGetModules()\n  const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)\n\n  const mainEmail = primaryUser.email\n  const existingUserByHash = await findOneWithDecryption(\n    em,\n    User,\n    { emailHash: { $in: emailHashLookupValues(mainEmail) }, deletedAt: null },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  const existingUser = existingUserByHash ?? await findOneWithDecryption(\n    em,\n    User,\n    { email: mainEmail, deletedAt: null },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  if (existingUser && failIfUserExists) {\n    throw new Error('USER_EXISTS')\n  }\n\n  if (options.orgSlug) {\n    const slugConflict = await findOneWithDecryption(\n      em,\n      Organization,\n      { slug: options.orgSlug },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    if (slugConflict) {\n      throw new OrgSlugExistsError(options.orgSlug)\n    }\n  }\n\n  let tenantId: string | undefined\n  let organizationId: string | undefined\n  let reusedExistingUser = false\n  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []\n\n  await em.transactional(async (tem) => {\n    if (!existingUser) return\n    reusedExistingUser = true\n    tenantId = existingUser.tenantId ? String(existingUser.tenantId) : undefined\n    organizationId = existingUser.organizationId ? String(existingUser.organizationId) : undefined\n    const roleTenantId = normalizeTenantId(existingUser.tenantId ?? null) ?? null\n    if (!roleTenantId) {\n      throw new Error('Cannot reuse a user without a tenantId \u2014 global roles are not supported')\n    }\n\n    await ensureRolesInContext(tem, roleNames, roleTenantId)\n    await tem.flush()\n\n    const requiredRoleSet = new Set([...roleNames, ...primaryRoles])\n    const links = await findWithDecryption(\n      tem,\n      UserRole,\n      { user: existingUser },\n      { populate: ['role'] },\n      { tenantId: roleTenantId, organizationId: null },\n    )\n    const currentRoles = new Set(links.map((link) => link.role.name))\n    for (const roleName of requiredRoleSet) {\n      if (!currentRoles.has(roleName)) {\n        const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n        tem.persist(tem.create(UserRole, { user: existingUser, role, createdAt: new Date() }))\n      }\n    }\n    await tem.flush()\n    const roles = Array.from(new Set([...currentRoles, ...roleNames]))\n    userSnapshots.push({ user: existingUser, roles, created: false })\n  })\n\n  if (!existingUser) {\n    const baseUsers: Array<{\n      email: string\n      roles: string[]\n      name?: string | null\n      passwordHash?: string | null\n      generatedPassword?: string | null\n    }> = [\n      { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },\n    ]\n    if (includeDerivedUsers) {\n      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)\n      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)\n      const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`\n      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')\n      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')\n      const isProduction = process.env.NODE_ENV === 'production'\n      const allowDemo = options.allowDemoDerivedPasswords === true\n      if (isProduction && !allowDemo) {\n        const missing: string[] = []\n        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')\n        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')\n        if (missing.length) {\n          throw new DerivedUserPasswordRequiredError(missing)\n        }\n      }\n      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so\n      // local dev workflows stay predictable (admin@/employee@ login with the\n      // documented demo password). In production we either have env-supplied\n      // values, or \u2014 for opt-in --include-demo-users flows \u2014 we generate a\n      // random one-time password and surface it via `generatedPassword` so the\n      // operator can capture it. Production callers without env vars and\n      // without the opt-in already threw above.\n      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD\n      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd\n      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd\n      const adminPasswordHash = await hash(adminPasswordPlain, 10)\n      const employeePasswordHash = await hash(employeePasswordPlain, 10)\n      addUniqueBaseUser(baseUsers, {\n        email: adminEmail,\n        roles: ['admin'],\n        passwordHash: adminPasswordHash,\n        generatedPassword: envAdminPwd ? null : adminPasswordPlain,\n      })\n      addUniqueBaseUser(baseUsers, {\n        email: employeeEmail,\n        roles: ['employee'],\n        passwordHash: employeePasswordHash,\n        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,\n      })\n    }\n    const passwordHash = await resolvePasswordHash(primaryUser)\n\n    await em.transactional(async (tem) => {\n      const tenant = tem.create(Tenant, {\n        name: options.orgName,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(tenant)\n      await tem.flush()\n\n      const organization = tem.create(Organization, {\n        name: options.orgName,\n        slug: options.orgSlug ?? null,\n        tenant,\n        isActive: true,\n        depth: 0,\n        ancestorIds: [],\n        childIds: [],\n        descendantIds: [],\n        logoPreserveAspectRatio: false,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      tem.persist(organization)\n      await tem.flush()\n\n      tenantId = String(tenant.id)\n      organizationId = String(organization.id)\n      const roleTenantId = tenantId\n\n      if (isTenantDataEncryptionEnabled()) {\n        try {\n          const kms = createKmsService()\n          if (kms.isHealthy()) {\n            if (isEncryptionDebugEnabled()) {\n              logger.info('Provisioning tenant DEK', { tenantId: String(tenant.id) })\n            }\n            await kms.createTenantDek(String(tenant.id))\n            if (isEncryptionDebugEnabled()) {\n              logger.info('Created tenant DEK during setup', { tenantId: String(tenant.id) })\n            }\n          } else {\n            if (isEncryptionDebugEnabled()) {\n              logger.warn('KMS not healthy, skipping tenant DEK creation', { tenantId: String(tenant.id) })\n            }\n          }\n        } catch (err) {\n          if (isEncryptionDebugEnabled()) {\n            logger.warn('Failed to create tenant DEK', { err })\n          }\n        }\n      }\n\n      await ensureRolesInContext(tem, roleNames, roleTenantId)\n      await tem.flush()\n\n      if (isTenantDataEncryptionEnabled()) {\n        // System-scoped maps are resolved from module code, never from a tenant row.\n        // Persisting one here would make the tenant-scoped encryption CLIs believe they\n        // own that entity and re-wrap its `system:<entityId>` ciphertext under the tenant\n        // DEK, which runtime decryption can no longer read.\n        for (const spec of defaultEncryptionMaps) {\n          if (spec.keyScope === 'system') continue\n          const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })\n          if (!existing) {\n            tem.persist(tem.create(EncryptionMap, {\n              entityId: spec.entityId,\n              tenantId: tenant.id,\n              organizationId: organization.id,\n              fieldsJson: spec.fields,\n              isActive: true,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            }))\n          } else {\n            existing.fieldsJson = spec.fields\n            existing.isActive = true\n          }\n        }\n        await tem.flush()\n      }\n    })\n\n    await em.transactional(async (tem) => {\n      if (!tenantId || !organizationId) return\n      const roleTenantId = tenantId\n      const encryptionService = isTenantDataEncryptionEnabled()\n        ? new TenantDataEncryptionService(tem as any, { kms: createKmsService() })\n        : null\n      if (encryptionService) {\n        await encryptionService.invalidateMap('auth:user', String(tenantId), String(organizationId))\n        await encryptionService.invalidateMap('auth:user', String(tenantId), null)\n      }\n\n      for (const base of baseUsers) {\n        const resolvedPasswordHash = base.passwordHash ?? passwordHash\n        let user = await findOneWithDecryption(tem, User, { email: base.email }, {}, { tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n        const confirm = primaryUser.confirm ?? true\n        const encryptedPayload = encryptionService\n          ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)\n          : { email: base.email, emailHash: computeEmailHash(base.email) }\n        if (user) {\n          user.passwordHash = resolvedPasswordHash\n          user.organizationId = organizationId\n          user.tenantId = tenantId\n          if (isTenantDataEncryptionEnabled()) {\n            user.email = encryptedPayload.email as any\n            user.emailHash = (encryptedPayload as any).emailHash ?? computeEmailHash(base.email)\n          }\n          if (base.name) user.name = base.name\n          if (confirm) user.isConfirmed = true\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })\n        } else {\n          user = tem.create(User, {\n            email: (encryptedPayload as any).email ?? base.email,\n            emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,\n            passwordHash: resolvedPasswordHash,\n            organizationId,\n            tenantId,\n            name: base.name ?? undefined,\n            isConfirmed: confirm,\n            createdAt: new Date(),\n          })\n          tem.persist(user)\n          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })\n        }\n        await tem.flush()\n        for (const roleName of base.roles) {\n          const role = await findRoleByNameOrFail(tem, roleName, roleTenantId)\n          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })\n          if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))\n        }\n        await tem.flush()\n      }\n    })\n  }\n\n  if (!tenantId || !organizationId) {\n    throw new Error('SETUP_FAILED')\n  }\n\n  if (!reusedExistingUser) {\n    await rebuildHierarchyForTenant(em, tenantId)\n  }\n\n  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })\n  await deactivateDemoUsersIfSelfOnboardingEnabled(em)\n\n  // Call module onTenantCreated hooks\n  for (const mod of resolvedModules) {\n    if (mod.setup?.onTenantCreated) {\n      await mod.setup.onTenantCreated({ em, tenantId, organizationId })\n    }\n  }\n\n  // Custom roles are often created inside onTenantCreated hooks, so they did not\n  // exist yet when ensureDefaultRoleAcls ran above and were skipped there. Sync\n  // again now that the hooks have had a chance to create them \u2014 idempotent, same\n  // pattern as the `mercato auth sync-role-acls` CLI command.\n  await ensureCustomRoleAcls(em, tenantId, resolvedModules)\n\n  return {\n    tenantId,\n    organizationId,\n    users: userSnapshots,\n    reusedExistingUser,\n  }\n}\n\nfunction resolvePrimaryName(input: PrimaryUserInput): string | null {\n  if (input.displayName && input.displayName.trim()) return input.displayName.trim()\n  const parts = [input.firstName, input.lastName].map((value) => value?.trim()).filter(Boolean)\n  if (parts.length) return parts.join(' ')\n  return null\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  const value = process.env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction addUniqueBaseUser(\n  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,\n  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },\n) {\n  if (!entry.email) return\n  const normalized = entry.email.toLowerCase()\n  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return\n  baseUsers.push(entry)\n}\n\n/**\n * Well-known demo password seeded for derived admin@/employee@ accounts in\n * non-production (`NODE_ENV !== 'production'`) when no env override is set.\n * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used\n * in production: the production branch either consumes env-supplied values or\n * falls back to `generateDerivedPassword()` so credentials remain non-guessable.\n */\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\n/**\n * Generate a 16-character base64url password (96 bits of entropy) for a derived\n * demo user in production when no env override is provided AND the caller\n * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the\n * `users[].generatedPassword` snapshot so CLI callers can print it to the\n * operator \u2014 there is no other recovery path for these credentials.\n */\nfunction generateDerivedPassword(): string {\n  return randomBytes(12).toString('base64url')\n}\n\nfunction isDemoModeEnabled(): boolean {\n  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  return parsed === false ? false : true\n}\n\nfunction shouldKeepDemoSuperadminDuringInit(): boolean {\n  if (process.env.OM_INIT_FLOW !== 'true') return false\n  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false\n  return isDemoModeEnabled()\n}\n\nasync function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {\n  if (typeof input.hashedPassword === 'string') return input.hashedPassword\n  if (input.password) return hash(input.password, 10)\n  return null\n}\n\nexport async function ensureDefaultRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n  options: { includeSuperadminRole?: boolean } = {},\n) {\n  const includeSuperadminRole = options.includeSuperadminRole ?? true\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const superadminRole = includeSuperadminRole ? await findRoleByName(em, 'superadmin', roleTenantId) : null\n  const adminRole = await findRoleByName(em, 'admin', roleTenantId)\n  const employeeRole = await findRoleByName(em, 'employee', roleTenantId)\n\n  // Merge features from all enabled modules' setup configs\n  const builtInRoles = ['superadmin', 'admin', 'employee'] as const\n  const superadminFeatures: string[] = []\n  const adminFeatures: string[] = []\n  const employeeFeatures: string[] = []\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of modules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin)\n    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin)\n    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee)\n\n    // Collect features for custom roles (any key not in builtInRoles)\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if ((builtInRoles as readonly string[]).includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  logger.info('Seeded default role features', {\n    superadmin: superadminFeatures,\n    admin: adminFeatures,\n    employee: employeeFeatures,\n    ...(customRoleFeatures.size > 0\n      ? Object.fromEntries(customRoleFeatures)\n      : {}),\n  })\n\n  if (includeSuperadminRole && superadminRole) {\n    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true })\n  }\n  if (adminRole) {\n    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures)\n  }\n  if (employeeRole) {\n    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures)\n  }\n\n  // Seed ACLs for custom roles defined by app modules.\n  // NOTE: Custom roles may not exist yet if they are created in seedDefaults\n  // (which runs after this function). In that case, use ensureCustomRoleAcls()\n  // after seedDefaults to pick them up.\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n    }\n  }\n}\n\n/**\n * Seed ACLs for custom roles defined in module defaultRoleFeatures.\n * Call this AFTER seedDefaults to pick up roles created by app modules.\n * Safe to call multiple times \u2014 ensureRoleAclFor merges features idempotently.\n */\nexport async function ensureCustomRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules?: Module[],\n): Promise<void> {\n  const resolvedModules = modules ?? tryGetModules()\n  const roleTenantId = normalizeTenantId(tenantId) ?? null\n  const builtInRoles = ['superadmin', 'admin', 'employee']\n  const customRoleFeatures = new Map<string, string[]>()\n\n  for (const mod of resolvedModules) {\n    const roleFeatures = mod.setup?.defaultRoleFeatures\n    if (!roleFeatures) continue\n    for (const [roleName, features] of Object.entries(roleFeatures)) {\n      if (builtInRoles.includes(roleName)) continue\n      if (!Array.isArray(features)) continue\n      const existing = customRoleFeatures.get(roleName) ?? []\n      existing.push(...features)\n      customRoleFeatures.set(roleName, existing)\n    }\n  }\n\n  if (customRoleFeatures.size === 0) return\n\n  let seeded = 0\n  for (const [roleName, features] of customRoleFeatures) {\n    const role = await findRoleByName(em, roleName, roleTenantId)\n    if (role) {\n      await ensureRoleAclFor(em, role, tenantId, features)\n      seeded++\n    }\n  }\n  if (seeded > 0) {\n    logger.info('Seeded custom role ACLs', { seeded })\n  }\n}\n\nasync function ensureRoleAclFor(\n  em: EntityManager,\n  role: Role,\n  tenantId: string,\n  features: string[],\n  options: { isSuperAdmin?: boolean } = {},\n) {\n  // Deduplicated on the create path too, not only on merge. `ensureDefaultRoleAcls` concatenates\n  // every enabled module's declared features, and two modules legitimately declare the same\n  // grant (the example module asks for `payment_gateways.view`, and so does that module itself),\n  // so a first init used to store the string twice while the second run silently collapsed it.\n  // Same list, two shapes, depending only on how many times setup had run.\n  const uniqueFeatures = Array.from(new Set(features))\n  const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })\n  if (!existing) {\n    const acl = em.create(RoleAcl, {\n      role,\n      tenantId,\n      featuresJson: uniqueFeatures,\n      isSuperAdmin: !!options.isSuperAdmin,\n      createdAt: new Date(),\n    })\n    await em.persist(acl).flush()\n    return\n  }\n  const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : []\n  const merged = Array.from(new Set([...currentFeatures, ...uniqueFeatures]))\n  const changed =\n    merged.length !== currentFeatures.length ||\n    merged.some((value, index) => value !== currentFeatures[index])\n  if (changed) existing.featuresJson = merged\n  if (options.isSuperAdmin && !existing.isSuperAdmin) {\n    existing.isSuperAdmin = true\n  }\n  if (changed || options.isSuperAdmin) {\n    await em.persist(existing).flush()\n  }\n}\n\n/**\n * Neutralizes every demo account the setup path may have seeded\n * (superadmin, admin, employee \u2014 honoring OM_INIT_*_EMAIL overrides)\n * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not\n * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.\n *\n * Each user is processed in its own try/catch so a single failure (e.g.\n * decryption error on a legacy row) does not skip the remaining accounts.\n *\n * @internal Exported for tests; not part of the public auth API.\n */\nexport async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {\n  if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return\n  if (shouldKeepDemoSuperadminDuringInit()) return\n  for (const { role, email } of resolveDemoUserEmails()) {\n    try {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { email },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!user) continue\n      let dirty = false\n      if (user.passwordHash) {\n        user.passwordHash = null\n        dirty = true\n      }\n      if (user.isConfirmed !== false) {\n        user.isConfirmed = false\n        dirty = true\n      }\n      if (dirty) {\n        await em.persist(user).flush()\n      }\n    } catch (error) {\n      logger.error('Failed to deactivate demo user', { role, email, err: error })\n    }\n  }\n}\n\n/**\n * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}\n * because the helper now neutralizes admin/employee demo accounts in addition\n * to superadmin (security tracker finding #5). Kept as an internal alias to\n * avoid breaking any out-of-tree caller that imported the old name; will be\n * removed in a future major.\n */\nconst deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled\n\n/** Try to get modules from runtime registry; returns empty array if not yet registered. */\nfunction tryGetModules(): Module[] {\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,MAAM,SAAS,MAAM,gBAAgB;AAC9C,SAAS,QAAQ,oBAAoB;AACrC,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,gCAA6C;AACtD,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEhE,MAAM,qBAAqB,CAAC,YAAY,SAAS,YAAY;AAC7D,MAAM,wBAAwB;AAC9B,MAAM,+BAA+B,sBAAsB,MAAM,GAAG,EAAE,CAAC,KAAK;AAO5E,eAAe,qBACb,IACA,WACA,UACA;AACA,aAAW,QAAQ,WAAW;AAC5B,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACjH,QAAI,SAAU;AACd,OAAG,QAAQ,GAAG,OAAO,MAAM,EAAE,MAAM,UAAU,kBAAkB,SAAS,UAAU,IAAI,GAAG,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACnH;AACF;AAEA,eAAsB,YAAY,IAAmB,UAA8B,CAAC,GAAG;AACrF,QAAM,YAAY,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AAC7D,QAAM,WAAW,kBAAkB,QAAQ,YAAY,IAAI;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,uEAAkE;AAAA,EACpF;AACA,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,qBAAqB,KAAK,WAAW,QAAQ;AACnD,UAAM,IAAI,MAAM;AAAA,EAClB,CAAC;AACH;AAEA,eAAe,eACb,IACA,MACA,UACsB;AACtB,QAAM,mBAAmB,kBAAkB,YAAY,IAAI,KAAK;AAChE,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,UAAU,iBAAiB,GAAG,CAAC,GAAG,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,CAAC;AACvI;AAEA,eAAe,qBACb,IACA,MACA,UACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,MAAM,QAAQ;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACnD,SAAO;AACT;AAYA,MAAM,oBAAoB;AAAA,EACxB,OAAO;AAAA,EACP,UAAU;AACZ;AAeO,SAAS,wBAAyC;AACvD,QAAM,aAAa,aAAa,kBAAkB,KAAK,KAAK,SAAS,4BAA4B;AACjG,QAAM,gBAAgB,aAAa,kBAAkB,QAAQ,KAAK,YAAY,4BAA4B;AAC1G,SAAO;AAAA,IACL,EAAE,MAAM,cAAc,OAAO,sBAAsB;AAAA,IACnD,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,IACnC,EAAE,MAAM,YAAY,OAAO,cAAc;AAAA,EAC3C;AACF;AAmCO,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAA4B,MAAc;AACxC,UAAM,+CAA+C,IAAI,kBAAkB;AADjD;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,yCAAyC,MAAM;AAAA,EAC1D,YAA4B,SAAmB;AAC7C;AAAA,MACE,2CAA2C,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/D;AAH0B;AAI1B,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,mBACpB,IACA,SACmC;AACnC,QAAM;AAAA,IACJ;AAAA,IACA,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB;AAAA,IACA,wBAAwB;AAAA,EAC1B,IAAI;AACJ,QAAM,oBAAoB,oBAAoB,iBAAiB,SAAS,mBAAmB,CAAC,YAAY;AACxG,QAAM,eAAe,wBACjB,oBACA,kBAAkB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC5D,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,mBAAmB,QAAQ,aAAa,CAAC,GAAG,kBAAkB;AACpE,QAAM,oBAAoB,wBACtB,mBACA,iBAAiB,OAAO,CAAC,SAAS,SAAS,YAAY;AAC3D,QAAM,YAAY,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,mBAAmB,GAAG,YAAY,CAAC,CAAC;AAC7E,QAAM,kBAAkB,QAAQ,WAAW,cAAc;AACzD,QAAM,wBAAwB,yBAAyB,eAAe;AAEtE,QAAM,YAAY,YAAY;AAC9B,QAAM,qBAAqB,MAAM;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,EAAE,WAAW,EAAE,KAAK,sBAAsB,SAAS,EAAE,GAAG,WAAW,KAAK;AAAA,IACxE,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,eAAe,sBAAsB,MAAM;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,EAAE,OAAO,WAAW,WAAW,KAAK;AAAA,IACpC,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,aAAa;AAAA,EAC/B;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,QAAI,cAAc;AAChB,YAAM,IAAI,mBAAmB,QAAQ,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,qBAAqB;AACzB,QAAM,gBAA6G,CAAC;AAEpH,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,QAAI,CAAC,aAAc;AACnB,yBAAqB;AACrB,eAAW,aAAa,WAAW,OAAO,aAAa,QAAQ,IAAI;AACnE,qBAAiB,aAAa,iBAAiB,OAAO,aAAa,cAAc,IAAI;AACrF,UAAM,eAAe,kBAAkB,aAAa,YAAY,IAAI,KAAK;AACzE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,8EAAyE;AAAA,IAC3F;AAEA,UAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,UAAM,IAAI,MAAM;AAEhB,UAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAC/D,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,aAAa;AAAA,MACrB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,IACjD;AACA,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AAChE,eAAW,YAAY,iBAAiB;AACtC,UAAI,CAAC,aAAa,IAAI,QAAQ,GAAG;AAC/B,cAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,YAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,cAAc,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,MACvF;AAAA,IACF;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,QAAQ,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AACjE,kBAAc,KAAK,EAAE,MAAM,cAAc,OAAO,SAAS,MAAM,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,CAAC,cAAc;AACjB,UAAM,YAMD;AAAA,MACH,EAAE,OAAO,YAAY,OAAO,OAAO,cAAc,MAAM,mBAAmB,WAAW,EAAE;AAAA,IACzF;AACA,QAAI,qBAAqB;AACvB,YAAM,gBAAgB,aAAa,kBAAkB,KAAK;AAC1D,YAAM,mBAAmB,aAAa,kBAAkB,QAAQ;AAChE,YAAM,aAAa,iBAAiB,SAAS,4BAA4B;AACzE,YAAM,gBAAgB,oBAAoB,YAAY,4BAA4B;AAClF,YAAM,cAAc,aAAa,wBAAwB;AACzD,YAAM,iBAAiB,aAAa,2BAA2B;AAC/D,YAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,YAAM,YAAY,QAAQ,8BAA8B;AACxD,UAAI,gBAAgB,CAAC,WAAW;AAC9B,cAAM,UAAoB,CAAC;AAC3B,YAAI,CAAC,YAAa,SAAQ,KAAK,wBAAwB;AACvD,YAAI,CAAC,eAAgB,SAAQ,KAAK,2BAA2B;AAC7D,YAAI,QAAQ,QAAQ;AAClB,gBAAM,IAAI,iCAAiC,OAAO;AAAA,QACpD;AAAA,MACF;AAQA,YAAM,mBAAmB,eAAe,wBAAwB,IAAI;AACpE,YAAM,sBAAsB,eAAe,wBAAwB,IAAI;AACvE,YAAM,qBAAqB,eAAe;AAC1C,YAAM,wBAAwB,kBAAkB;AAChD,YAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE;AAC3D,YAAM,uBAAuB,MAAM,KAAK,uBAAuB,EAAE;AACjE,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,OAAO;AAAA,QACf,cAAc;AAAA,QACd,mBAAmB,cAAc,OAAO;AAAA,MAC1C,CAAC;AACD,wBAAkB,WAAW;AAAA,QAC3B,OAAO;AAAA,QACP,OAAO,CAAC,UAAU;AAAA,QAClB,cAAc;AAAA,QACd,mBAAmB,iBAAiB,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,UAAM,eAAe,MAAM,oBAAoB,WAAW;AAE1D,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,QAChC,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,MAAM;AAClB,YAAM,IAAI,MAAM;AAEhB,YAAM,eAAe,IAAI,OAAO,cAAc;AAAA,QAC5C,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ,WAAW;AAAA,QACzB;AAAA,QACA,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,CAAC;AAAA,QACd,UAAU,CAAC;AAAA,QACX,eAAe,CAAC;AAAA,QAChB,yBAAyB;AAAA,QACzB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAI,QAAQ,YAAY;AACxB,YAAM,IAAI,MAAM;AAEhB,iBAAW,OAAO,OAAO,EAAE;AAC3B,uBAAiB,OAAO,aAAa,EAAE;AACvC,YAAM,eAAe;AAErB,UAAI,8BAA8B,GAAG;AACnC,YAAI;AACF,gBAAM,MAAM,iBAAiB;AAC7B,cAAI,IAAI,UAAU,GAAG;AACnB,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,2BAA2B,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YACxE;AACA,kBAAM,IAAI,gBAAgB,OAAO,OAAO,EAAE,CAAC;AAC3C,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,mCAAmC,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAChF;AAAA,UACF,OAAO;AACL,gBAAI,yBAAyB,GAAG;AAC9B,qBAAO,KAAK,iDAAiD,EAAE,UAAU,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,YAC9F;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,yBAAyB,GAAG;AAC9B,mBAAO,KAAK,+BAA+B,EAAE,IAAI,CAAC;AAAA,UACpD;AAAA,QACF;AAAA,MACF;AAEA,YAAM,qBAAqB,KAAK,WAAW,YAAY;AACvD,YAAM,IAAI,MAAM;AAEhB,UAAI,8BAA8B,GAAG;AAKnC,mBAAW,QAAQ,uBAAuB;AACxC,cAAI,KAAK,aAAa,SAAU;AAChC,gBAAM,WAAW,MAAM,sBAAsB,KAAK,eAAe,EAAE,UAAU,KAAK,UAAU,UAAU,OAAO,IAAI,gBAAgB,aAAa,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,OAAO,EAAE,GAAG,gBAAgB,OAAO,aAAa,EAAE,EAAE,CAAC;AACjP,cAAI,CAAC,UAAU;AACb,gBAAI,QAAQ,IAAI,OAAO,eAAe;AAAA,cACpC,UAAU,KAAK;AAAA,cACf,UAAU,OAAO;AAAA,cACjB,gBAAgB,aAAa;AAAA,cAC7B,YAAY,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC,CAAC;AAAA,UACJ,OAAO;AACL,qBAAS,aAAa,KAAK;AAC3B,qBAAS,WAAW;AAAA,UACtB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,eAAe;AACrB,YAAM,oBAAoB,8BAA8B,IACpD,IAAI,4BAA4B,KAAY,EAAE,KAAK,iBAAiB,EAAE,CAAC,IACvE;AACJ,UAAI,mBAAmB;AACrB,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,OAAO,cAAc,CAAC;AAC3F,cAAM,kBAAkB,cAAc,aAAa,OAAO,QAAQ,GAAG,IAAI;AAAA,MAC3E;AAEA,iBAAW,QAAQ,WAAW;AAC5B,cAAM,uBAAuB,KAAK,gBAAgB;AAClD,YAAI,OAAO,MAAM,sBAAsB,KAAK,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AACnJ,cAAM,UAAU,YAAY,WAAW;AACvC,cAAM,mBAAmB,oBACrB,MAAM,kBAAkB,qBAAqB,aAAa,EAAE,OAAO,KAAK,MAAM,GAAG,UAAU,cAAc,IACzG,EAAE,OAAO,KAAK,OAAO,WAAW,iBAAiB,KAAK,KAAK,EAAE;AACjE,YAAI,MAAM;AACR,eAAK,eAAe;AACpB,eAAK,iBAAiB;AACtB,eAAK,WAAW;AAChB,cAAI,8BAA8B,GAAG;AACnC,iBAAK,QAAQ,iBAAiB;AAC9B,iBAAK,YAAa,iBAAyB,aAAa,iBAAiB,KAAK,KAAK;AAAA,UACrF;AACA,cAAI,KAAK,KAAM,MAAK,OAAO,KAAK;AAChC,cAAI,QAAS,MAAK,cAAc;AAChC,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QACnH,OAAO;AACL,iBAAO,IAAI,OAAO,MAAM;AAAA,YACtB,OAAQ,iBAAyB,SAAS,KAAK;AAAA,YAC/C,WAAW,8BAA8B,IAAK,iBAAyB,aAAa,iBAAiB,KAAK,KAAK,IAAI;AAAA,YACnH,cAAc;AAAA,YACd;AAAA,YACA;AAAA,YACA,MAAM,KAAK,QAAQ;AAAA,YACnB,aAAa;AAAA,YACb,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,cAAI,QAAQ,IAAI;AAChB,wBAAc,KAAK,EAAE,MAAM,OAAO,KAAK,OAAO,SAAS,MAAM,mBAAmB,KAAK,qBAAqB,KAAK,CAAC;AAAA,QAClH;AACA,cAAM,IAAI,MAAM;AAChB,mBAAW,YAAY,KAAK,OAAO;AACjC,gBAAM,OAAO,MAAM,qBAAqB,KAAK,UAAU,YAAY;AACnE,gBAAM,eAAe,MAAM,sBAAsB,KAAK,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,gBAAgB,KAAK,CAAC;AACxI,cAAI,CAAC,aAAc,KAAI,QAAQ,IAAI,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,QAC5F;AACA,cAAM,IAAI,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,MAAM,cAAc;AAAA,EAChC;AAEA,MAAI,CAAC,oBAAoB;AACvB,UAAM,0BAA0B,IAAI,QAAQ;AAAA,EAC9C;AAEA,QAAM,sBAAsB,IAAI,UAAU,iBAAiB,EAAE,sBAAsB,CAAC;AACpF,QAAM,2CAA2C,EAAE;AAGnD,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,OAAO,iBAAiB;AAC9B,YAAM,IAAI,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,CAAC;AAAA,IAClE;AAAA,EACF;AAMA,QAAM,qBAAqB,IAAI,UAAU,eAAe;AAExD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAwC;AAClE,MAAI,MAAM,eAAe,MAAM,YAAY,KAAK,EAAG,QAAO,MAAM,YAAY,KAAK;AACjF,QAAM,QAAQ,CAAC,MAAM,WAAW,MAAM,QAAQ,EAAE,IAAI,CAAC,UAAU,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F,MAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AACvC,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,kBACP,WACA,OACA;AACA,MAAI,CAAC,MAAM,MAAO;AAClB,QAAM,aAAa,MAAM,MAAM,YAAY;AAC3C,MAAI,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,YAAY,MAAM,UAAU,EAAG;AACvE,YAAU,KAAK,KAAK;AACtB;AASA,MAAM,wBAAwB;AAS9B,SAAS,0BAAkC;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AAC5D,SAAO,WAAW,QAAQ,QAAQ;AACpC;AAEA,SAAS,qCAA8C;AACrD,MAAI,QAAQ,IAAI,iBAAiB,OAAQ,QAAO;AAChD,MAAI,CAAC,aAAa,0BAA0B,EAAG,QAAO;AACtD,SAAO,kBAAkB;AAC3B;AAEA,eAAe,oBAAoB,OAAiD;AAClF,MAAI,OAAO,MAAM,mBAAmB,SAAU,QAAO,MAAM;AAC3D,MAAI,MAAM,SAAU,QAAO,KAAK,MAAM,UAAU,EAAE;AAClD,SAAO;AACT;AAEA,eAAsB,sBACpB,IACA,UACA,SACA,UAA+C,CAAC,GAChD;AACA,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,iBAAiB,wBAAwB,MAAM,eAAe,IAAI,cAAc,YAAY,IAAI;AACtG,QAAM,YAAY,MAAM,eAAe,IAAI,SAAS,YAAY;AAChE,QAAM,eAAe,MAAM,eAAe,IAAI,YAAY,YAAY;AAGtE,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAA+B,CAAC;AACtC,QAAM,gBAA0B,CAAC;AACjC,QAAM,mBAA6B,CAAC;AACpC,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,SAAS;AACzB,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,QAAI,aAAa,WAAY,oBAAmB,KAAK,GAAG,aAAa,UAAU;AAC/E,QAAI,aAAa,MAAO,eAAc,KAAK,GAAG,aAAa,KAAK;AAChE,QAAI,aAAa,SAAU,kBAAiB,KAAK,GAAG,aAAa,QAAQ;AAGzE,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAK,aAAmC,SAAS,QAAQ,EAAG;AAC5D,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,SAAO,KAAK,gCAAgC;AAAA,IAC1C,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,IACV,GAAI,mBAAmB,OAAO,IAC1B,OAAO,YAAY,kBAAkB,IACrC,CAAC;AAAA,EACP,CAAC;AAED,MAAI,yBAAyB,gBAAgB;AAC3C,UAAM,iBAAiB,IAAI,gBAAgB,UAAU,oBAAoB,EAAE,cAAc,KAAK,CAAC;AAAA,EACjG;AACA,MAAI,WAAW;AACb,UAAM,iBAAiB,IAAI,WAAW,UAAU,aAAa;AAAA,EAC/D;AACA,MAAI,cAAc;AAChB,UAAM,iBAAiB,IAAI,cAAc,UAAU,gBAAgB;AAAA,EACrE;AAMA,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AAAA,IACrD;AAAA,EACF;AACF;AAOA,eAAsB,qBACpB,IACA,UACA,SACe;AACf,QAAM,kBAAkB,WAAW,cAAc;AACjD,QAAM,eAAe,kBAAkB,QAAQ,KAAK;AACpD,QAAM,eAAe,CAAC,cAAc,SAAS,UAAU;AACvD,QAAM,qBAAqB,oBAAI,IAAsB;AAErD,aAAW,OAAO,iBAAiB;AACjC,UAAM,eAAe,IAAI,OAAO;AAChC,QAAI,CAAC,aAAc;AACnB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC/D,UAAI,aAAa,SAAS,QAAQ,EAAG;AACrC,UAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,YAAM,WAAW,mBAAmB,IAAI,QAAQ,KAAK,CAAC;AACtD,eAAS,KAAK,GAAG,QAAQ;AACzB,yBAAmB,IAAI,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,mBAAmB,SAAS,EAAG;AAEnC,MAAI,SAAS;AACb,aAAW,CAAC,UAAU,QAAQ,KAAK,oBAAoB;AACrD,UAAM,OAAO,MAAM,eAAe,IAAI,UAAU,YAAY;AAC5D,QAAI,MAAM;AACR,YAAM,iBAAiB,IAAI,MAAM,UAAU,QAAQ;AACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,GAAG;AACd,WAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACnD;AACF;AAEA,eAAe,iBACb,IACA,MACA,UACA,UACA,UAAsC,CAAC,GACvC;AAMA,QAAM,iBAAiB,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;AACnD,QAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,EAAE,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,UAAU,gBAAgB,KAAK,CAAC;AACpH,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,GAAG,OAAO,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc,CAAC,CAAC,QAAQ;AAAA,MACxB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM,QAAQ,SAAS,YAAY,IAAI,SAAS,eAAe,CAAC;AACxF,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,cAAc,CAAC,CAAC;AAC1E,QAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,MAAI,QAAS,UAAS,eAAe;AACrC,MAAI,QAAQ,gBAAgB,CAAC,SAAS,cAAc;AAClD,aAAS,eAAe;AAAA,EAC1B;AACA,MAAI,WAAW,QAAQ,cAAc;AACnC,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC;AACF;AAaA,eAAsB,2CAA2C,IAAmB;AAClF,MAAI,QAAQ,IAAI,oCAAoC,OAAQ;AAC5D,MAAI,mCAAmC,EAAG;AAC1C,aAAW,EAAE,MAAM,MAAM,KAAK,sBAAsB,GAAG;AACrD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,MAAM;AAAA,QACR,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,KAAM;AACX,UAAI,QAAQ;AACZ,UAAI,KAAK,cAAc;AACrB,aAAK,eAAe;AACpB,gBAAQ;AAAA,MACV;AACA,UAAI,KAAK,gBAAgB,OAAO;AAC9B,aAAK,cAAc;AACnB,gBAAQ;AAAA,MACV;AACA,UAAI,OAAO;AACT,cAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAAA,MAC/B;AAAA,IACF,SAAS,OAAO;AACd,aAAO,MAAM,kCAAkC,EAAE,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,IAC5E;AAAA,EACF;AACF;AASA,MAAM,kDAAkD;AAGxD,SAAS,gBAA0B;AACjC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/entities/lib/field-definitions.js

@@ -14,6 +14,7 @@ const CONFIG_PASSTHROUGH_KEYS = [
   "formEditable",
   "listVisible",
   "indexed",
+  "encrypted",
   "priority",
   "editor",
   "input",
@@ -38,6 +39,11 @@ function normalizeValue(value) {
 function configEquals(a, b) {
   return JSON.stringify(normalizeValue(a ?? null)) === JSON.stringify(normalizeValue(b ?? null));
 }
+function hasEncryptionEnabled(definition) {
+  const config = definition?.configJson;
+  if (!config || typeof config !== "object") return false;
+  return config.encrypted === true;
+}
 async function ensureCustomFieldDefinitions(em, sets, scope) {
   let created = 0;
   let updated = 0;
@@ -65,6 +71,9 @@ async function ensureCustomFieldDefinitions(em, sets, scope) {
         const value = field[key];
         if (value !== void 0) configJson[key] = value;
       }
+      if (configJson.encrypted === void 0 && hasEncryptionEnabled(existing)) {
+        configJson.encrypted = true;
+      }
       if (!existing) {
         if (!scope.dryRun) {
           const createdDef = em.create(CustomFieldDef, {

package/dist/modules/entities/lib/field-definitions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/lib/field-definitions.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomFieldDef } from '../data/entities'\nimport type { CustomFieldDefinition } from '@open-mercato/shared/modules/entities'\n\nexport type FieldSetInput = {\n  entity: string\n  fields: CustomFieldDefinition[]\n  source?: string\n}\n\nexport type EnsureFieldDefinitionsOptions = {\n  organizationId: string | null\n  tenantId: string | null\n  dryRun?: boolean\n  createOnly?: boolean\n}\n\nexport type EnsureFieldDefinitionsResult = {\n  created: number\n  updated: number\n  unchanged: number\n}\n\nconst CONFIG_PASSTHROUGH_KEYS: Array<keyof CustomFieldDefinition> = [\n  'label',\n  'description',\n  'fieldset',\n  'fieldsets',\n  'group',\n  'options',\n  'optionsUrl',\n  'defaultValue',\n  'required',\n  'multi',\n  'filterable',\n  'formEditable',\n  'listVisible',\n  'indexed',\n  'priority',\n  'editor',\n  'input',\n  'relatedEntityId',\n  'dictionaryId',\n  'dictionaryInlineCreate',\n  'validation',\n  'maxAttachmentSizeMb',\n  'acceptExtensions',\n  'sourceMetadata',\n]\n\nfunction normalizeValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map((item) => normalizeValue(item))\n  if (value && typeof value === 'object') {\n    return Object.keys(value as Record<string, unknown>)\n      .sort((a, b) => a.localeCompare(b))\n      .reduce<Record<string, unknown>>((acc, key) => {\n        acc[key] = normalizeValue((value as Record<string, unknown>)[key])\n        return acc\n      }, {})\n  }\n  return value\n}\n\nfunction configEquals(a: unknown, b: unknown): boolean {\n  return JSON.stringify(normalizeValue(a ?? null)) === JSON.stringify(normalizeValue(b ?? null))\n}\n\nexport async function ensureCustomFieldDefinitions(\n  em: EntityManager,\n  sets: FieldSetInput[],\n  scope: EnsureFieldDefinitionsOptions\n): Promise<EnsureFieldDefinitionsResult> {\n  let created = 0\n  let updated = 0\n  let unchanged = 0\n\n  // Prefetch every existing definition the batch could touch in a single query,\n  // then index by composite key so the nested loop never issues per-field lookups.\n  const entityIds = Array.from(new Set(sets.map((set) => set.entity)))\n  const fieldKeys = Array.from(new Set(sets.flatMap((set) => set.fields.map((field) => field.key))))\n  const existingByKey = new Map<string, CustomFieldDef>()\n  if (entityIds.length > 0 && fieldKeys.length > 0) {\n    const existingDefs = await em.find(CustomFieldDef, {\n      entityId: { $in: entityIds },\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      key: { $in: fieldKeys },\n    })\n    for (const def of existingDefs) {\n      existingByKey.set(`${def.entityId}|${def.key}`, def)\n    }\n  }\n\n  let dirty = false\n\n  for (const set of sets) {\n    for (const field of set.fields) {\n      const existing = existingByKey.get(`${set.entity}|${field.key}`) ?? null\n      const configJson: Record<string, unknown> = {}\n\n      for (const key of CONFIG_PASSTHROUGH_KEYS) {\n        const value = field[key]\n        if (value !== undefined) configJson[key] = value as unknown\n      }\n\n      if (!existing) {\n        if (!scope.dryRun) {\n          const createdDef = em.create(CustomFieldDef, {\n            entityId: set.entity,\n            organizationId: scope.organizationId,\n            tenantId: scope.tenantId,\n            key: field.key,\n            kind: field.kind,\n            configJson,\n            isActive: true,\n            createdAt: new Date(),\n            updatedAt: new Date(),\n          })\n          em.persist(createdDef)\n          // Track so duplicate (entity, key) pairs within the batch update in memory instead of double-inserting.\n          existingByKey.set(`${set.entity}|${field.key}`, createdDef)\n          dirty = true\n        }\n        created++\n        continue\n      }\n\n      const kindChanged = existing.kind !== field.kind\n      const configChanged = !configEquals(existing.configJson ?? null, configJson)\n      const needsActivation = existing.isActive !== true || existing.deletedAt != null\n      if (scope.createOnly) {\n        unchanged++\n        continue\n      }\n      if (!kindChanged && !configChanged && !needsActivation) {\n        unchanged++\n        continue\n      }\n\n      if (!scope.dryRun) {\n        existing.kind = field.kind\n        ;(existing as any).configJson = configJson\n        existing.isActive = true\n        existing.updatedAt = new Date()\n        if (existing.deletedAt) existing.deletedAt = null\n        em.persist(existing)\n        dirty = true\n      }\n      updated++\n    }\n  }\n\n  if (dirty) {\n    // Single flush for the whole batch instead of one round trip per field.\n    await em.flush()\n  }\n\n  return { created, updated, unchanged }\n}\n"],
-  "mappings": "AACA,SAAS,sBAAsB;AAsB/B,MAAM,0BAA8D;AAAA,EAClE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,OAAyB;AAC/C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC;AACzE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,KAAK,KAAgC,EAChD,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,EACjC,OAAgC,CAAC,KAAK,QAAQ;AAC7C,UAAI,GAAG,IAAI,eAAgB,MAAkC,GAAG,CAAC;AACjE,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,aAAa,GAAY,GAAqB;AACrD,SAAO,KAAK,UAAU,eAAe,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,eAAe,KAAK,IAAI,CAAC;AAC/F;AAEA,eAAsB,6BACpB,IACA,MACA,OACuC;AACvC,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,YAAY;AAIhB,QAAM,YAAY,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;AACnE,QAAM,YAAY,MAAM,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC;AACjG,QAAM,gBAAgB,oBAAI,IAA4B;AACtD,MAAI,UAAU,SAAS,KAAK,UAAU,SAAS,GAAG;AAChD,UAAM,eAAe,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACjD,UAAU,EAAE,KAAK,UAAU;AAAA,MAC3B,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,KAAK,EAAE,KAAK,UAAU;AAAA,IACxB,CAAC;AACD,eAAW,OAAO,cAAc;AAC9B,oBAAc,IAAI,GAAG,IAAI,QAAQ,IAAI,IAAI,GAAG,IAAI,GAAG;AAAA,IACrD;AAAA,EACF;AAEA,MAAI,QAAQ;AAEZ,aAAW,OAAO,MAAM;AACtB,eAAW,SAAS,IAAI,QAAQ;AAC9B,YAAM,WAAW,cAAc,IAAI,GAAG,IAAI,MAAM,IAAI,MAAM,GAAG,EAAE,KAAK;AACpE,YAAM,aAAsC,CAAC;AAE7C,iBAAW,OAAO,yBAAyB;AACzC,cAAM,QAAQ,MAAM,GAAG;AACvB,YAAI,UAAU,OAAW,YAAW,GAAG,IAAI;AAAA,MAC7C;AAEA,UAAI,CAAC,UAAU;AACb,YAAI,CAAC,MAAM,QAAQ;AACjB,gBAAM,aAAa,GAAG,OAAO,gBAAgB;AAAA,YAC3C,UAAU,IAAI;AAAA,YACd,gBAAgB,MAAM;AAAA,YACtB,UAAU,MAAM;AAAA,YAChB,KAAK,MAAM;AAAA,YACX,MAAM,MAAM;AAAA,YACZ;AAAA,YACA,UAAU;AAAA,YACV,WAAW,oBAAI,KAAK;AAAA,YACpB,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,aAAG,QAAQ,UAAU;AAErB,wBAAc,IAAI,GAAG,IAAI,MAAM,IAAI,MAAM,GAAG,IAAI,UAAU;AAC1D,kBAAQ;AAAA,QACV;AACA;AACA;AAAA,MACF;AAEA,YAAM,cAAc,SAAS,SAAS,MAAM;AAC5C,YAAM,gBAAgB,CAAC,aAAa,SAAS,cAAc,MAAM,UAAU;AAC3E,YAAM,kBAAkB,SAAS,aAAa,QAAQ,SAAS,aAAa;AAC5E,UAAI,MAAM,YAAY;AACpB;AACA;AAAA,MACF;AACA,UAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,iBAAiB;AACtD;AACA;AAAA,MACF;AAEA,UAAI,CAAC,MAAM,QAAQ;AACjB,iBAAS,OAAO,MAAM;AACrB,QAAC,SAAiB,aAAa;AAChC,iBAAS,WAAW;AACpB,iBAAS,YAAY,oBAAI,KAAK;AAC9B,YAAI,SAAS,UAAW,UAAS,YAAY;AAC7C,WAAG,QAAQ,QAAQ;AACnB,gBAAQ;AAAA,MACV;AACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO;AAET,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,SAAO,EAAE,SAAS,SAAS,UAAU;AACvC;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomFieldDef } from '../data/entities'\nimport type { CustomFieldDefinition } from '@open-mercato/shared/modules/entities'\n\nexport type FieldSetInput = {\n  entity: string\n  fields: CustomFieldDefinition[]\n  source?: string\n}\n\nexport type EnsureFieldDefinitionsOptions = {\n  organizationId: string | null\n  tenantId: string | null\n  dryRun?: boolean\n  createOnly?: boolean\n}\n\nexport type EnsureFieldDefinitionsResult = {\n  created: number\n  updated: number\n  unchanged: number\n}\n\nconst CONFIG_PASSTHROUGH_KEYS: Array<keyof CustomFieldDefinition> = [\n  'label',\n  'description',\n  'fieldset',\n  'fieldsets',\n  'group',\n  'options',\n  'optionsUrl',\n  'defaultValue',\n  'required',\n  'multi',\n  'filterable',\n  'formEditable',\n  'listVisible',\n  'indexed',\n  'encrypted',\n  'priority',\n  'editor',\n  'input',\n  'relatedEntityId',\n  'dictionaryId',\n  'dictionaryInlineCreate',\n  'validation',\n  'maxAttachmentSizeMb',\n  'acceptExtensions',\n  'sourceMetadata',\n]\n\nfunction normalizeValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map((item) => normalizeValue(item))\n  if (value && typeof value === 'object') {\n    return Object.keys(value as Record<string, unknown>)\n      .sort((a, b) => a.localeCompare(b))\n      .reduce<Record<string, unknown>>((acc, key) => {\n        acc[key] = normalizeValue((value as Record<string, unknown>)[key])\n        return acc\n      }, {})\n  }\n  return value\n}\n\nfunction configEquals(a: unknown, b: unknown): boolean {\n  return JSON.stringify(normalizeValue(a ?? null)) === JSON.stringify(normalizeValue(b ?? null))\n}\n\nfunction hasEncryptionEnabled(definition: CustomFieldDef | null): boolean {\n  const config = definition?.configJson\n  if (!config || typeof config !== 'object') return false\n  return (config as Record<string, unknown>).encrypted === true\n}\n\nexport async function ensureCustomFieldDefinitions(\n  em: EntityManager,\n  sets: FieldSetInput[],\n  scope: EnsureFieldDefinitionsOptions\n): Promise<EnsureFieldDefinitionsResult> {\n  let created = 0\n  let updated = 0\n  let unchanged = 0\n\n  // Prefetch every existing definition the batch could touch in a single query,\n  // then index by composite key so the nested loop never issues per-field lookups.\n  const entityIds = Array.from(new Set(sets.map((set) => set.entity)))\n  const fieldKeys = Array.from(new Set(sets.flatMap((set) => set.fields.map((field) => field.key))))\n  const existingByKey = new Map<string, CustomFieldDef>()\n  if (entityIds.length > 0 && fieldKeys.length > 0) {\n    const existingDefs = await em.find(CustomFieldDef, {\n      entityId: { $in: entityIds },\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      key: { $in: fieldKeys },\n    })\n    for (const def of existingDefs) {\n      existingByKey.set(`${def.entityId}|${def.key}`, def)\n    }\n  }\n\n  let dirty = false\n\n  for (const set of sets) {\n    for (const field of set.fields) {\n      const existing = existingByKey.get(`${set.entity}|${field.key}`) ?? null\n      const configJson: Record<string, unknown> = {}\n\n      for (const key of CONFIG_PASSTHROUGH_KEYS) {\n        const value = field[key]\n        if (value !== undefined) configJson[key] = value as unknown\n      }\n\n      // configJson is rebuilt from the declaration, so a field encrypted through the\n      // definitions API would lose the flag on the next install while its stored\n      // values stay ciphertext the read path no longer decrypts. Keep an enabled flag\n      // unless the declaration turns it off with an explicit `encrypted: false`.\n      if (configJson.encrypted === undefined && hasEncryptionEnabled(existing)) {\n        configJson.encrypted = true\n      }\n\n      if (!existing) {\n        if (!scope.dryRun) {\n          const createdDef = em.create(CustomFieldDef, {\n            entityId: set.entity,\n            organizationId: scope.organizationId,\n            tenantId: scope.tenantId,\n            key: field.key,\n            kind: field.kind,\n            configJson,\n            isActive: true,\n            createdAt: new Date(),\n            updatedAt: new Date(),\n          })\n          em.persist(createdDef)\n          // Track so duplicate (entity, key) pairs within the batch update in memory instead of double-inserting.\n          existingByKey.set(`${set.entity}|${field.key}`, createdDef)\n          dirty = true\n        }\n        created++\n        continue\n      }\n\n      const kindChanged = existing.kind !== field.kind\n      const configChanged = !configEquals(existing.configJson ?? null, configJson)\n      const needsActivation = existing.isActive !== true || existing.deletedAt != null\n      if (scope.createOnly) {\n        unchanged++\n        continue\n      }\n      if (!kindChanged && !configChanged && !needsActivation) {\n        unchanged++\n        continue\n      }\n\n      if (!scope.dryRun) {\n        existing.kind = field.kind\n        ;(existing as any).configJson = configJson\n        existing.isActive = true\n        existing.updatedAt = new Date()\n        if (existing.deletedAt) existing.deletedAt = null\n        em.persist(existing)\n        dirty = true\n      }\n      updated++\n    }\n  }\n\n  if (dirty) {\n    // Single flush for the whole batch instead of one round trip per field.\n    await em.flush()\n  }\n\n  return { created, updated, unchanged }\n}\n"],
+  "mappings": "AACA,SAAS,sBAAsB;AAsB/B,MAAM,0BAA8D;AAAA,EAClE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,OAAyB;AAC/C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC;AACzE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,KAAK,KAAgC,EAChD,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,EACjC,OAAgC,CAAC,KAAK,QAAQ;AAC7C,UAAI,GAAG,IAAI,eAAgB,MAAkC,GAAG,CAAC;AACjE,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,aAAa,GAAY,GAAqB;AACrD,SAAO,KAAK,UAAU,eAAe,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,eAAe,KAAK,IAAI,CAAC;AAC/F;AAEA,SAAS,qBAAqB,YAA4C;AACxE,QAAM,SAAS,YAAY;AAC3B,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,SAAQ,OAAmC,cAAc;AAC3D;AAEA,eAAsB,6BACpB,IACA,MACA,OACuC;AACvC,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,YAAY;AAIhB,QAAM,YAAY,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;AACnE,QAAM,YAAY,MAAM,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC;AACjG,QAAM,gBAAgB,oBAAI,IAA4B;AACtD,MAAI,UAAU,SAAS,KAAK,UAAU,SAAS,GAAG;AAChD,UAAM,eAAe,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACjD,UAAU,EAAE,KAAK,UAAU;AAAA,MAC3B,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,KAAK,EAAE,KAAK,UAAU;AAAA,IACxB,CAAC;AACD,eAAW,OAAO,cAAc;AAC9B,oBAAc,IAAI,GAAG,IAAI,QAAQ,IAAI,IAAI,GAAG,IAAI,GAAG;AAAA,IACrD;AAAA,EACF;AAEA,MAAI,QAAQ;AAEZ,aAAW,OAAO,MAAM;AACtB,eAAW,SAAS,IAAI,QAAQ;AAC9B,YAAM,WAAW,cAAc,IAAI,GAAG,IAAI,MAAM,IAAI,MAAM,GAAG,EAAE,KAAK;AACpE,YAAM,aAAsC,CAAC;AAE7C,iBAAW,OAAO,yBAAyB;AACzC,cAAM,QAAQ,MAAM,GAAG;AACvB,YAAI,UAAU,OAAW,YAAW,GAAG,IAAI;AAAA,MAC7C;AAMA,UAAI,WAAW,cAAc,UAAa,qBAAqB,QAAQ,GAAG;AACxE,mBAAW,YAAY;AAAA,MACzB;AAEA,UAAI,CAAC,UAAU;AACb,YAAI,CAAC,MAAM,QAAQ;AACjB,gBAAM,aAAa,GAAG,OAAO,gBAAgB;AAAA,YAC3C,UAAU,IAAI;AAAA,YACd,gBAAgB,MAAM;AAAA,YACtB,UAAU,MAAM;AAAA,YAChB,KAAK,MAAM;AAAA,YACX,MAAM,MAAM;AAAA,YACZ;AAAA,YACA,UAAU;AAAA,YACV,WAAW,oBAAI,KAAK;AAAA,YACpB,WAAW,oBAAI,KAAK;AAAA,UACtB,CAAC;AACD,aAAG,QAAQ,UAAU;AAErB,wBAAc,IAAI,GAAG,IAAI,MAAM,IAAI,MAAM,GAAG,IAAI,UAAU;AAC1D,kBAAQ;AAAA,QACV;AACA;AACA;AAAA,MACF;AAEA,YAAM,cAAc,SAAS,SAAS,MAAM;AAC5C,YAAM,gBAAgB,CAAC,aAAa,SAAS,cAAc,MAAM,UAAU;AAC3E,YAAM,kBAAkB,SAAS,aAAa,QAAQ,SAAS,aAAa;AAC5E,UAAI,MAAM,YAAY;AACpB;AACA;AAAA,MACF;AACA,UAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,iBAAiB;AACtD;AACA;AAAA,MACF;AAEA,UAAI,CAAC,MAAM,QAAQ;AACjB,iBAAS,OAAO,MAAM;AACrB,QAAC,SAAiB,aAAa;AAChC,iBAAS,WAAW;AACpB,iBAAS,YAAY,oBAAI,KAAK;AAC9B,YAAI,SAAS,UAAW,UAAS,YAAY;AAC7C,WAAG,QAAQ,QAAQ;AACnB,gBAAQ;AAAA,MACV;AACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO;AAET,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,SAAO,EAAE,SAAS,SAAS,UAAU;AACvC;",
   "names": []
 }

package/dist/modules/entities/lib/install-from-ce.js

@@ -17,6 +17,7 @@ const FIELD_DETAIL_KEYS = [
   "formEditable",
   "listVisible",
   "indexed",
+  "encrypted",
   "priority",
   "editor",
   "input",

package/dist/modules/entities/lib/install-from-ce.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/lib/install-from-ce.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache/types'\nimport type { CustomFieldDefinition, CustomFieldSet, CustomEntitySpec } from '@open-mercato/shared/modules/entities'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { ensureCustomFieldDefinitions } from './field-definitions'\nimport { upsertCustomEntity, type UpsertCustomEntityResult } from './register'\nimport { invalidateDefinitionsCache } from '../api/definitions.cache'\n\ntype InstallScope = {\n  tenantId: string | null\n}\n\nexport type InstallEntitiesOptions = {\n  tenantIds?: string[]\n  entityIds?: string[]\n  includeGlobal?: boolean\n  dryRun?: boolean\n  createOnly?: boolean\n  force?: boolean\n  logger?: (message: string) => void\n}\n\nexport type InstallEntitiesResult = {\n  processed: number\n  synchronized: number\n  skipped: number\n  fieldChanges: number\n}\n\nexport type AggregatedEntityConfig = {\n  entityId: string\n  moduleIds: Set<string>\n  spec?: CustomEntitySpec\n  fieldSets: CustomFieldSet[]\n}\n\nconst FIELD_DETAIL_KEYS: Array<keyof CustomFieldDefinition> = [\n  'label',\n  'description',\n  'options',\n  'optionsUrl',\n  'defaultValue',\n  'required',\n  'multi',\n  'filterable',\n  'formEditable',\n  'listVisible',\n  'indexed',\n  'priority',\n  'editor',\n  'input',\n  'relatedEntityId',\n  'validation',\n  'maxAttachmentSizeMb',\n  'acceptExtensions',\n]\n\nfunction normalizeValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map((item) => normalizeValue(item))\n  if (value && typeof value === 'object') {\n    return Object.keys(value as Record<string, unknown>)\n      .sort((a, b) => a.localeCompare(b))\n      .reduce<Record<string, unknown>>((acc, key) => {\n        acc[key] = normalizeValue((value as Record<string, unknown>)[key])\n        return acc\n      }, {})\n  }\n  return value\n}\n\nfunction computeChecksum(payload: unknown): string {\n  return crypto.createHash('md5').update(JSON.stringify(normalizeValue(payload))).digest('hex')\n}\n\nfunction systemEntityIds(): Set<string> {\n  const ids = new Set<string>()\n  const GeneratedEntities = getEntityIds()\n  for (const moduleEntities of Object.values(GeneratedEntities)) {\n    for (const id of Object.values(moduleEntities as Record<string, string>)) {\n      ids.add(id)\n    }\n  }\n  return ids\n}\n\nfunction buildAggregatedConfigs(): AggregatedEntityConfig[] {\n  const map = new Map<string, AggregatedEntityConfig>()\n  const modules = getModules()\n  for (const mod of modules) {\n    const moduleId = mod.id\n    const entitySpecs = ((mod as any).customEntities as CustomEntitySpec[] | undefined) ?? []\n    for (const spec of entitySpecs) {\n      const existing = map.get(spec.id) ?? { entityId: spec.id, moduleIds: new Set<string>(), spec: undefined, fieldSets: [] }\n      existing.moduleIds.add(moduleId)\n      if (!existing.spec) existing.spec = spec\n      map.set(spec.id, existing)\n    }\n    const fieldSets = ((mod as any).customFieldSets as CustomFieldSet[] | undefined) ?? []\n    for (const set of fieldSets) {\n      const existing = map.get(set.entity) ?? { entityId: set.entity, moduleIds: new Set<string>(), spec: undefined, fieldSets: [] }\n      existing.moduleIds.add(moduleId)\n      existing.fieldSets.push(set)\n      map.set(set.entity, existing)\n    }\n  }\n  return Array.from(map.values())\n}\n\nexport function resolveFields(fieldSets: CustomFieldSet[]): CustomFieldDefinition[] {\n  const byKey = new Map<string, CustomFieldDefinition>()\n  const declarationOrder = new Map<string, number>()\n  for (const set of fieldSets) {\n    for (const field of set.fields ?? []) {\n      if (!declarationOrder.has(field.key)) declarationOrder.set(field.key, declarationOrder.size)\n      byKey.set(field.key, { ...field })\n    }\n  }\n  // Declaration order is the author's intent, so it drives `priority` (and the\n  // resulting render order) unless a field states its own. Sorting alphabetically\n  // by key here would silently discard that intent (#4378).\n  const resolved = Array.from(byKey.values()).map((field) => (\n    typeof field.priority === 'number'\n      ? field\n      : { ...field, priority: declarationOrder.get(field.key) ?? 0 }\n  ))\n  return resolved.sort((a, b) => {\n    const byPriority = (a.priority ?? 0) - (b.priority ?? 0)\n    if (byPriority !== 0) return byPriority\n    return (declarationOrder.get(a.key) ?? 0) - (declarationOrder.get(b.key) ?? 0)\n  })\n}\n\nfunction normalizeField(field: CustomFieldDefinition) {\n  const payload: Record<string, unknown> = {\n    key: field.key,\n    kind: field.kind,\n  }\n  for (const key of FIELD_DETAIL_KEYS) {\n    const value = field[key]\n    if (value !== undefined) payload[key] = value as unknown\n  }\n  if (field.id) payload.id = field.id\n  return payload\n}\n\nfunction buildChecksumPayload(params: {\n  entityId: string\n  scope: InstallScope\n  spec: CustomEntitySpec | undefined\n  global: boolean\n  fields: CustomFieldDefinition[]\n}) {\n  const { entityId, scope, spec, global, fields } = params\n  return {\n    entityId,\n    scope,\n    global,\n    label: spec?.label ?? null,\n    description: spec?.description ?? null,\n    labelField: spec?.labelField ?? null,\n    defaultEditor: spec?.defaultEditor ?? null,\n    showInSidebar: spec?.showInSidebar ?? false,\n    accessRestricted: spec?.accessRestricted ?? false,\n    fields: fields.map((f) => normalizeField(f)),\n  }\n}\n\nexport async function installCustomEntitiesFromModules(\n  em: EntityManager,\n  cache: CacheStrategy | null | undefined,\n  options: InstallEntitiesOptions = {}\n): Promise<InstallEntitiesResult> {\n  const requestedEntityIds = options.entityIds\n    ? new Set(options.entityIds.filter((id): id is string => typeof id === 'string' && id.length > 0))\n    : null\n  const aggregated = buildAggregatedConfigs().filter((entry) => {\n    if (!requestedEntityIds) return true\n    return requestedEntityIds.has(entry.entityId)\n  })\n  const systemIds = systemEntityIds()\n  const includeGlobal = options.includeGlobal !== false\n  const dryRun = options.dryRun === true\n  const createOnly = options.createOnly === true\n  const force = options.force === true\n  const logger = options.logger\n\n  let tenantIds: string[] | undefined\n  if (options.tenantIds !== undefined) {\n    tenantIds = Array.from(new Set(options.tenantIds.filter((id): id is string => typeof id === 'string' && id.length > 0)))\n  }\n\n  const ensureTenantIds = async (): Promise<string[]> => {\n    if (tenantIds !== undefined) return tenantIds\n    const rows = await em.find(Tenant, { deletedAt: null } as any, { fields: ['id'] as any })\n    tenantIds = rows.map((row) => row.id)\n    return tenantIds ?? []\n  }\n\n  let processed = 0\n  let synchronized = 0\n  let skipped = 0\n  let fieldChanges = 0\n\n  for (const entry of aggregated) {\n    const { entityId } = entry\n    const spec = entry.spec\n    const fields = resolveFields(entry.fieldSets)\n    const isSystem = systemIds.has(entityId)\n    const registerEntity = !isSystem && !!spec\n    const isGlobal = spec?.global === true\n\n    const scopes: InstallScope[] = []\n    if (isGlobal) {\n      if (includeGlobal) scopes.push({ tenantId: null })\n    } else {\n      const ids = await ensureTenantIds()\n      if (!ids.length) {\n        skipped++\n        continue\n      }\n      for (const tenantId of ids) scopes.push({ tenantId })\n    }\n\n    if (!scopes.length && fields.length === 0 && !registerEntity) {\n      skipped++\n      continue\n    }\n\n    for (const scope of scopes) {\n      processed++\n      const scopeKey = scope.tenantId ? `tenant:${scope.tenantId}` : 'global'\n      const checksumPayload = buildChecksumPayload({\n        entityId,\n        scope,\n        spec,\n        global: isGlobal,\n        fields,\n      })\n      const checksum = computeChecksum(checksumPayload)\n      const cacheKey = `custom-entities:v1:${scopeKey}:${entityId}`\n\n      if (!dryRun && !force && cache) {\n        try {\n          const cached = await cache.get(cacheKey)\n          if (typeof cached === 'string' && cached === checksum) {\n            skipped++\n            continue\n          }\n        } catch {}\n      }\n\n      let entityResult: UpsertCustomEntityResult = 'unchanged'\n      if (registerEntity) {\n        entityResult = await upsertCustomEntity(em, entityId, {\n          label: spec?.label ?? entityId,\n          description: spec?.description ?? null,\n          organizationId: null,\n          tenantId: scope.tenantId,\n          showInSidebar: spec?.showInSidebar ?? false,\n          accessRestricted: spec?.accessRestricted ?? false,\n          labelField: spec?.labelField ?? null,\n          defaultEditor: spec?.defaultEditor ?? null,\n          isActive: true,\n          dryRun,\n          createOnly,\n        })\n      }\n\n      let fieldResult = { created: 0, updated: 0, unchanged: 0 }\n      if (fields.length) {\n        fieldResult = await ensureCustomFieldDefinitions(\n          em,\n          [{ entity: entityId, fields }],\n          { organizationId: null, tenantId: scope.tenantId, dryRun, createOnly }\n        )\n      }\n\n      const changed = (entityResult !== 'unchanged') || fieldResult.created > 0 || fieldResult.updated > 0\n      const shouldInvalidateDefinitions = !dryRun && (changed || force)\n      if (shouldInvalidateDefinitions) {\n        await invalidateDefinitionsCache(cache ?? undefined, {\n          tenantId: scope.tenantId,\n          organizationId: null,\n          entityIds: [entityId],\n        })\n      }\n\n      if (changed) {\n        synchronized++\n        fieldChanges += fieldResult.created + fieldResult.updated\n        if (!dryRun && cache) {\n          try {\n            await cache.set(cacheKey, checksum, { tags: [`custom-entity:${entityId}`, `custom-entity-scope:${scopeKey}`] })\n          } catch {}\n        }\n        if (logger) {\n          const parts: string[] = []\n          if (entityResult !== 'unchanged') parts.push(`entity ${entityResult}`)\n          if (fieldResult.created || fieldResult.updated) {\n            parts.push(`fields +${fieldResult.created} / ~${fieldResult.updated}`)\n          }\n          logger(`Synced ${entityId} for ${scopeKey}${parts.length ? ` (${parts.join(', ')})` : ''}`)\n        }\n      } else {\n        skipped++\n        if (!dryRun && cache) {\n          try {\n            await cache.set(cacheKey, checksum, { tags: [`custom-entity:${entityId}`, `custom-entity-scope:${scopeKey}`] })\n          } catch {}\n        }\n      }\n    }\n  }\n\n  return { processed, synchronized, skipped, fieldChanges }\n}\n\nexport function listCustomEntityIds(): string[] {\n  return buildAggregatedConfigs().map((entry) => entry.entityId)\n}\n\nexport function getAggregatedCustomEntityConfigs(): AggregatedEntityConfig[] {\n  return buildAggregatedConfigs()\n}\n"],
-  "mappings": "AAAA,OAAO,YAAY;AAInB,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,oCAAoC;AAC7C,SAAS,0BAAyD;AAClE,SAAS,kCAAkC;AA8B3C,MAAM,oBAAwD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,OAAyB;AAC/C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC;AACzE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,KAAK,KAAgC,EAChD,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,EACjC,OAAgC,CAAC,KAAK,QAAQ;AAC7C,UAAI,GAAG,IAAI,eAAgB,MAAkC,GAAG,CAAC;AACjE,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA0B;AACjD,SAAO,OAAO,WAAW,KAAK,EAAE,OAAO,KAAK,UAAU,eAAe,OAAO,CAAC,CAAC,EAAE,OAAO,KAAK;AAC9F;AAEA,SAAS,kBAA+B;AACtC,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,oBAAoB,aAAa;AACvC,aAAW,kBAAkB,OAAO,OAAO,iBAAiB,GAAG;AAC7D,eAAW,MAAM,OAAO,OAAO,cAAwC,GAAG;AACxE,UAAI,IAAI,EAAE;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAmD;AAC1D,QAAM,MAAM,oBAAI,IAAoC;AACpD,QAAM,UAAU,WAAW;AAC3B,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,UAAM,cAAgB,IAAY,kBAAqD,CAAC;AACxF,eAAW,QAAQ,aAAa;AAC9B,YAAM,WAAW,IAAI,IAAI,KAAK,EAAE,KAAK,EAAE,UAAU,KAAK,IAAI,WAAW,oBAAI,IAAY,GAAG,MAAM,QAAW,WAAW,CAAC,EAAE;AACvH,eAAS,UAAU,IAAI,QAAQ;AAC/B,UAAI,CAAC,SAAS,KAAM,UAAS,OAAO;AACpC,UAAI,IAAI,KAAK,IAAI,QAAQ;AAAA,IAC3B;AACA,UAAM,YAAc,IAAY,mBAAoD,CAAC;AACrF,eAAW,OAAO,WAAW;AAC3B,YAAM,WAAW,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,UAAU,IAAI,QAAQ,WAAW,oBAAI,IAAY,GAAG,MAAM,QAAW,WAAW,CAAC,EAAE;AAC7H,eAAS,UAAU,IAAI,QAAQ;AAC/B,eAAS,UAAU,KAAK,GAAG;AAC3B,UAAI,IAAI,IAAI,QAAQ,QAAQ;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,OAAO,CAAC;AAChC;AAEO,SAAS,cAAc,WAAsD;AAClF,QAAM,QAAQ,oBAAI,IAAmC;AACrD,QAAM,mBAAmB,oBAAI,IAAoB;AACjD,aAAW,OAAO,WAAW;AAC3B,eAAW,SAAS,IAAI,UAAU,CAAC,GAAG;AACpC,UAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG,EAAG,kBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI;AAC3F,YAAM,IAAI,MAAM,KAAK,EAAE,GAAG,MAAM,CAAC;AAAA,IACnC;AAAA,EACF;AAIA,QAAM,WAAW,MAAM,KAAK,MAAM,OAAO,CAAC,EAAE,IAAI,CAAC,UAC/C,OAAO,MAAM,aAAa,WACtB,QACA,EAAE,GAAG,OAAO,UAAU,iBAAiB,IAAI,MAAM,GAAG,KAAK,EAAE,CAChE;AACD,SAAO,SAAS,KAAK,CAAC,GAAG,MAAM;AAC7B,UAAM,cAAc,EAAE,YAAY,MAAM,EAAE,YAAY;AACtD,QAAI,eAAe,EAAG,QAAO;AAC7B,YAAQ,iBAAiB,IAAI,EAAE,GAAG,KAAK,MAAM,iBAAiB,IAAI,EAAE,GAAG,KAAK;AAAA,EAC9E,CAAC;AACH;AAEA,SAAS,eAAe,OAA8B;AACpD,QAAM,UAAmC;AAAA,IACvC,KAAK,MAAM;AAAA,IACX,MAAM,MAAM;AAAA,EACd;AACA,aAAW,OAAO,mBAAmB;AACnC,UAAM,QAAQ,MAAM,GAAG;AACvB,QAAI,UAAU,OAAW,SAAQ,GAAG,IAAI;AAAA,EAC1C;AACA,MAAI,MAAM,GAAI,SAAQ,KAAK,MAAM;AACjC,SAAO;AACT;AAEA,SAAS,qBAAqB,QAM3B;AACD,QAAM,EAAE,UAAU,OAAO,MAAM,QAAQ,OAAO,IAAI;AAClD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM,SAAS;AAAA,IACtB,aAAa,MAAM,eAAe;AAAA,IAClC,YAAY,MAAM,cAAc;AAAA,IAChC,eAAe,MAAM,iBAAiB;AAAA,IACtC,eAAe,MAAM,iBAAiB;AAAA,IACtC,kBAAkB,MAAM,oBAAoB;AAAA,IAC5C,QAAQ,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC;AAAA,EAC7C;AACF;AAEA,eAAsB,iCACpB,IACA,OACA,UAAkC,CAAC,GACH;AAChC,QAAM,qBAAqB,QAAQ,YAC/B,IAAI,IAAI,QAAQ,UAAU,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,IAC/F;AACJ,QAAM,aAAa,uBAAuB,EAAE,OAAO,CAAC,UAAU;AAC5D,QAAI,CAAC,mBAAoB,QAAO;AAChC,WAAO,mBAAmB,IAAI,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACD,QAAM,YAAY,gBAAgB;AAClC,QAAM,gBAAgB,QAAQ,kBAAkB;AAChD,QAAM,SAAS,QAAQ,WAAW;AAClC,QAAM,aAAa,QAAQ,eAAe;AAC1C,QAAM,QAAQ,QAAQ,UAAU;AAChC,QAAM,SAAS,QAAQ;AAEvB,MAAI;AACJ,MAAI,QAAQ,cAAc,QAAW;AACnC,gBAAY,MAAM,KAAK,IAAI,IAAI,QAAQ,UAAU,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AAAA,EACzH;AAEA,QAAM,kBAAkB,YAA+B;AACrD,QAAI,cAAc,OAAW,QAAO;AACpC,UAAM,OAAO,MAAM,GAAG,KAAK,QAAQ,EAAE,WAAW,KAAK,GAAU,EAAE,QAAQ,CAAC,IAAI,EAAS,CAAC;AACxF,gBAAY,KAAK,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpC,WAAO,aAAa,CAAC;AAAA,EACvB;AAEA,MAAI,YAAY;AAChB,MAAI,eAAe;AACnB,MAAI,UAAU;AACd,MAAI,eAAe;AAEnB,aAAW,SAAS,YAAY;AAC9B,UAAM,EAAE,SAAS,IAAI;AACrB,UAAM,OAAO,MAAM;AACnB,UAAM,SAAS,cAAc,MAAM,SAAS;AAC5C,UAAM,WAAW,UAAU,IAAI,QAAQ;AACvC,UAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC;AACtC,UAAM,WAAW,MAAM,WAAW;AAElC,UAAM,SAAyB,CAAC;AAChC,QAAI,UAAU;AACZ,UAAI,cAAe,QAAO,KAAK,EAAE,UAAU,KAAK,CAAC;AAAA,IACnD,OAAO;AACL,YAAM,MAAM,MAAM,gBAAgB;AAClC,UAAI,CAAC,IAAI,QAAQ;AACf;AACA;AAAA,MACF;AACA,iBAAW,YAAY,IAAK,QAAO,KAAK,EAAE,SAAS,CAAC;AAAA,IACtD;AAEA,QAAI,CAAC,OAAO,UAAU,OAAO,WAAW,KAAK,CAAC,gBAAgB;AAC5D;AACA;AAAA,IACF;AAEA,eAAW,SAAS,QAAQ;AAC1B;AACA,YAAM,WAAW,MAAM,WAAW,UAAU,MAAM,QAAQ,KAAK;AAC/D,YAAM,kBAAkB,qBAAqB;AAAA,QAC3C;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,YAAM,WAAW,gBAAgB,eAAe;AAChD,YAAM,WAAW,sBAAsB,QAAQ,IAAI,QAAQ;AAE3D,UAAI,CAAC,UAAU,CAAC,SAAS,OAAO;AAC9B,YAAI;AACF,gBAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,cAAI,OAAO,WAAW,YAAY,WAAW,UAAU;AACrD;AACA;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AAEA,UAAI,eAAyC;AAC7C,UAAI,gBAAgB;AAClB,uBAAe,MAAM,mBAAmB,IAAI,UAAU;AAAA,UACpD,OAAO,MAAM,SAAS;AAAA,UACtB,aAAa,MAAM,eAAe;AAAA,UAClC,gBAAgB;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,eAAe,MAAM,iBAAiB;AAAA,UACtC,kBAAkB,MAAM,oBAAoB;AAAA,UAC5C,YAAY,MAAM,cAAc;AAAA,UAChC,eAAe,MAAM,iBAAiB;AAAA,UACtC,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAEA,UAAI,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAAE;AACzD,UAAI,OAAO,QAAQ;AACjB,sBAAc,MAAM;AAAA,UAClB;AAAA,UACA,CAAC,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,UAC7B,EAAE,gBAAgB,MAAM,UAAU,MAAM,UAAU,QAAQ,WAAW;AAAA,QACvE;AAAA,MACF;AAEA,YAAM,UAAW,iBAAiB,eAAgB,YAAY,UAAU,KAAK,YAAY,UAAU;AACnG,YAAM,8BAA8B,CAAC,WAAW,WAAW;AAC3D,UAAI,6BAA6B;AAC/B,cAAM,2BAA2B,SAAS,QAAW;AAAA,UACnD,UAAU,MAAM;AAAA,UAChB,gBAAgB;AAAA,UAChB,WAAW,CAAC,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH;AAEA,UAAI,SAAS;AACX;AACA,wBAAgB,YAAY,UAAU,YAAY;AAClD,YAAI,CAAC,UAAU,OAAO;AACpB,cAAI;AACF,kBAAM,MAAM,IAAI,UAAU,UAAU,EAAE,MAAM,CAAC,iBAAiB,QAAQ,IAAI,uBAAuB,QAAQ,EAAE,EAAE,CAAC;AAAA,UAChH,QAAQ;AAAA,UAAC;AAAA,QACX;AACA,YAAI,QAAQ;AACV,gBAAM,QAAkB,CAAC;AACzB,cAAI,iBAAiB,YAAa,OAAM,KAAK,UAAU,YAAY,EAAE;AACrE,cAAI,YAAY,WAAW,YAAY,SAAS;AAC9C,kBAAM,KAAK,WAAW,YAAY,OAAO,OAAO,YAAY,OAAO,EAAE;AAAA,UACvE;AACA,iBAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,MAAM,SAAS,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,QAC5F;AAAA,MACF,OAAO;AACL;AACA,YAAI,CAAC,UAAU,OAAO;AACpB,cAAI;AACF,kBAAM,MAAM,IAAI,UAAU,UAAU,EAAE,MAAM,CAAC,iBAAiB,QAAQ,IAAI,uBAAuB,QAAQ,EAAE,EAAE,CAAC;AAAA,UAChH,QAAQ;AAAA,UAAC;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,cAAc,SAAS,aAAa;AAC1D;AAEO,SAAS,sBAAgC;AAC9C,SAAO,uBAAuB,EAAE,IAAI,CAAC,UAAU,MAAM,QAAQ;AAC/D;AAEO,SAAS,mCAA6D;AAC3E,SAAO,uBAAuB;AAChC;",
+  "sourcesContent": ["import crypto from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache/types'\nimport type { CustomFieldDefinition, CustomFieldSet, CustomEntitySpec } from '@open-mercato/shared/modules/entities'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { ensureCustomFieldDefinitions } from './field-definitions'\nimport { upsertCustomEntity, type UpsertCustomEntityResult } from './register'\nimport { invalidateDefinitionsCache } from '../api/definitions.cache'\n\ntype InstallScope = {\n  tenantId: string | null\n}\n\nexport type InstallEntitiesOptions = {\n  tenantIds?: string[]\n  entityIds?: string[]\n  includeGlobal?: boolean\n  dryRun?: boolean\n  createOnly?: boolean\n  force?: boolean\n  logger?: (message: string) => void\n}\n\nexport type InstallEntitiesResult = {\n  processed: number\n  synchronized: number\n  skipped: number\n  fieldChanges: number\n}\n\nexport type AggregatedEntityConfig = {\n  entityId: string\n  moduleIds: Set<string>\n  spec?: CustomEntitySpec\n  fieldSets: CustomFieldSet[]\n}\n\nconst FIELD_DETAIL_KEYS: Array<keyof CustomFieldDefinition> = [\n  'label',\n  'description',\n  'options',\n  'optionsUrl',\n  'defaultValue',\n  'required',\n  'multi',\n  'filterable',\n  'formEditable',\n  'listVisible',\n  'indexed',\n  'encrypted',\n  'priority',\n  'editor',\n  'input',\n  'relatedEntityId',\n  'validation',\n  'maxAttachmentSizeMb',\n  'acceptExtensions',\n]\n\nfunction normalizeValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map((item) => normalizeValue(item))\n  if (value && typeof value === 'object') {\n    return Object.keys(value as Record<string, unknown>)\n      .sort((a, b) => a.localeCompare(b))\n      .reduce<Record<string, unknown>>((acc, key) => {\n        acc[key] = normalizeValue((value as Record<string, unknown>)[key])\n        return acc\n      }, {})\n  }\n  return value\n}\n\nfunction computeChecksum(payload: unknown): string {\n  return crypto.createHash('md5').update(JSON.stringify(normalizeValue(payload))).digest('hex')\n}\n\nfunction systemEntityIds(): Set<string> {\n  const ids = new Set<string>()\n  const GeneratedEntities = getEntityIds()\n  for (const moduleEntities of Object.values(GeneratedEntities)) {\n    for (const id of Object.values(moduleEntities as Record<string, string>)) {\n      ids.add(id)\n    }\n  }\n  return ids\n}\n\nfunction buildAggregatedConfigs(): AggregatedEntityConfig[] {\n  const map = new Map<string, AggregatedEntityConfig>()\n  const modules = getModules()\n  for (const mod of modules) {\n    const moduleId = mod.id\n    const entitySpecs = ((mod as any).customEntities as CustomEntitySpec[] | undefined) ?? []\n    for (const spec of entitySpecs) {\n      const existing = map.get(spec.id) ?? { entityId: spec.id, moduleIds: new Set<string>(), spec: undefined, fieldSets: [] }\n      existing.moduleIds.add(moduleId)\n      if (!existing.spec) existing.spec = spec\n      map.set(spec.id, existing)\n    }\n    const fieldSets = ((mod as any).customFieldSets as CustomFieldSet[] | undefined) ?? []\n    for (const set of fieldSets) {\n      const existing = map.get(set.entity) ?? { entityId: set.entity, moduleIds: new Set<string>(), spec: undefined, fieldSets: [] }\n      existing.moduleIds.add(moduleId)\n      existing.fieldSets.push(set)\n      map.set(set.entity, existing)\n    }\n  }\n  return Array.from(map.values())\n}\n\nexport function resolveFields(fieldSets: CustomFieldSet[]): CustomFieldDefinition[] {\n  const byKey = new Map<string, CustomFieldDefinition>()\n  const declarationOrder = new Map<string, number>()\n  for (const set of fieldSets) {\n    for (const field of set.fields ?? []) {\n      if (!declarationOrder.has(field.key)) declarationOrder.set(field.key, declarationOrder.size)\n      byKey.set(field.key, { ...field })\n    }\n  }\n  // Declaration order is the author's intent, so it drives `priority` (and the\n  // resulting render order) unless a field states its own. Sorting alphabetically\n  // by key here would silently discard that intent (#4378).\n  const resolved = Array.from(byKey.values()).map((field) => (\n    typeof field.priority === 'number'\n      ? field\n      : { ...field, priority: declarationOrder.get(field.key) ?? 0 }\n  ))\n  return resolved.sort((a, b) => {\n    const byPriority = (a.priority ?? 0) - (b.priority ?? 0)\n    if (byPriority !== 0) return byPriority\n    return (declarationOrder.get(a.key) ?? 0) - (declarationOrder.get(b.key) ?? 0)\n  })\n}\n\nfunction normalizeField(field: CustomFieldDefinition) {\n  const payload: Record<string, unknown> = {\n    key: field.key,\n    kind: field.kind,\n  }\n  for (const key of FIELD_DETAIL_KEYS) {\n    const value = field[key]\n    if (value !== undefined) payload[key] = value as unknown\n  }\n  if (field.id) payload.id = field.id\n  return payload\n}\n\nfunction buildChecksumPayload(params: {\n  entityId: string\n  scope: InstallScope\n  spec: CustomEntitySpec | undefined\n  global: boolean\n  fields: CustomFieldDefinition[]\n}) {\n  const { entityId, scope, spec, global, fields } = params\n  return {\n    entityId,\n    scope,\n    global,\n    label: spec?.label ?? null,\n    description: spec?.description ?? null,\n    labelField: spec?.labelField ?? null,\n    defaultEditor: spec?.defaultEditor ?? null,\n    showInSidebar: spec?.showInSidebar ?? false,\n    accessRestricted: spec?.accessRestricted ?? false,\n    fields: fields.map((f) => normalizeField(f)),\n  }\n}\n\nexport async function installCustomEntitiesFromModules(\n  em: EntityManager,\n  cache: CacheStrategy | null | undefined,\n  options: InstallEntitiesOptions = {}\n): Promise<InstallEntitiesResult> {\n  const requestedEntityIds = options.entityIds\n    ? new Set(options.entityIds.filter((id): id is string => typeof id === 'string' && id.length > 0))\n    : null\n  const aggregated = buildAggregatedConfigs().filter((entry) => {\n    if (!requestedEntityIds) return true\n    return requestedEntityIds.has(entry.entityId)\n  })\n  const systemIds = systemEntityIds()\n  const includeGlobal = options.includeGlobal !== false\n  const dryRun = options.dryRun === true\n  const createOnly = options.createOnly === true\n  const force = options.force === true\n  const logger = options.logger\n\n  let tenantIds: string[] | undefined\n  if (options.tenantIds !== undefined) {\n    tenantIds = Array.from(new Set(options.tenantIds.filter((id): id is string => typeof id === 'string' && id.length > 0)))\n  }\n\n  const ensureTenantIds = async (): Promise<string[]> => {\n    if (tenantIds !== undefined) return tenantIds\n    const rows = await em.find(Tenant, { deletedAt: null } as any, { fields: ['id'] as any })\n    tenantIds = rows.map((row) => row.id)\n    return tenantIds ?? []\n  }\n\n  let processed = 0\n  let synchronized = 0\n  let skipped = 0\n  let fieldChanges = 0\n\n  for (const entry of aggregated) {\n    const { entityId } = entry\n    const spec = entry.spec\n    const fields = resolveFields(entry.fieldSets)\n    const isSystem = systemIds.has(entityId)\n    const registerEntity = !isSystem && !!spec\n    const isGlobal = spec?.global === true\n\n    const scopes: InstallScope[] = []\n    if (isGlobal) {\n      if (includeGlobal) scopes.push({ tenantId: null })\n    } else {\n      const ids = await ensureTenantIds()\n      if (!ids.length) {\n        skipped++\n        continue\n      }\n      for (const tenantId of ids) scopes.push({ tenantId })\n    }\n\n    if (!scopes.length && fields.length === 0 && !registerEntity) {\n      skipped++\n      continue\n    }\n\n    for (const scope of scopes) {\n      processed++\n      const scopeKey = scope.tenantId ? `tenant:${scope.tenantId}` : 'global'\n      const checksumPayload = buildChecksumPayload({\n        entityId,\n        scope,\n        spec,\n        global: isGlobal,\n        fields,\n      })\n      const checksum = computeChecksum(checksumPayload)\n      const cacheKey = `custom-entities:v1:${scopeKey}:${entityId}`\n\n      if (!dryRun && !force && cache) {\n        try {\n          const cached = await cache.get(cacheKey)\n          if (typeof cached === 'string' && cached === checksum) {\n            skipped++\n            continue\n          }\n        } catch {}\n      }\n\n      let entityResult: UpsertCustomEntityResult = 'unchanged'\n      if (registerEntity) {\n        entityResult = await upsertCustomEntity(em, entityId, {\n          label: spec?.label ?? entityId,\n          description: spec?.description ?? null,\n          organizationId: null,\n          tenantId: scope.tenantId,\n          showInSidebar: spec?.showInSidebar ?? false,\n          accessRestricted: spec?.accessRestricted ?? false,\n          labelField: spec?.labelField ?? null,\n          defaultEditor: spec?.defaultEditor ?? null,\n          isActive: true,\n          dryRun,\n          createOnly,\n        })\n      }\n\n      let fieldResult = { created: 0, updated: 0, unchanged: 0 }\n      if (fields.length) {\n        fieldResult = await ensureCustomFieldDefinitions(\n          em,\n          [{ entity: entityId, fields }],\n          { organizationId: null, tenantId: scope.tenantId, dryRun, createOnly }\n        )\n      }\n\n      const changed = (entityResult !== 'unchanged') || fieldResult.created > 0 || fieldResult.updated > 0\n      const shouldInvalidateDefinitions = !dryRun && (changed || force)\n      if (shouldInvalidateDefinitions) {\n        await invalidateDefinitionsCache(cache ?? undefined, {\n          tenantId: scope.tenantId,\n          organizationId: null,\n          entityIds: [entityId],\n        })\n      }\n\n      if (changed) {\n        synchronized++\n        fieldChanges += fieldResult.created + fieldResult.updated\n        if (!dryRun && cache) {\n          try {\n            await cache.set(cacheKey, checksum, { tags: [`custom-entity:${entityId}`, `custom-entity-scope:${scopeKey}`] })\n          } catch {}\n        }\n        if (logger) {\n          const parts: string[] = []\n          if (entityResult !== 'unchanged') parts.push(`entity ${entityResult}`)\n          if (fieldResult.created || fieldResult.updated) {\n            parts.push(`fields +${fieldResult.created} / ~${fieldResult.updated}`)\n          }\n          logger(`Synced ${entityId} for ${scopeKey}${parts.length ? ` (${parts.join(', ')})` : ''}`)\n        }\n      } else {\n        skipped++\n        if (!dryRun && cache) {\n          try {\n            await cache.set(cacheKey, checksum, { tags: [`custom-entity:${entityId}`, `custom-entity-scope:${scopeKey}`] })\n          } catch {}\n        }\n      }\n    }\n  }\n\n  return { processed, synchronized, skipped, fieldChanges }\n}\n\nexport function listCustomEntityIds(): string[] {\n  return buildAggregatedConfigs().map((entry) => entry.entityId)\n}\n\nexport function getAggregatedCustomEntityConfigs(): AggregatedEntityConfig[] {\n  return buildAggregatedConfigs()\n}\n"],
+  "mappings": "AAAA,OAAO,YAAY;AAInB,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,oCAAoC;AAC7C,SAAS,0BAAyD;AAClE,SAAS,kCAAkC;AA8B3C,MAAM,oBAAwD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,OAAyB;AAC/C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC;AACzE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,KAAK,KAAgC,EAChD,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,EACjC,OAAgC,CAAC,KAAK,QAAQ;AAC7C,UAAI,GAAG,IAAI,eAAgB,MAAkC,GAAG,CAAC;AACjE,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA0B;AACjD,SAAO,OAAO,WAAW,KAAK,EAAE,OAAO,KAAK,UAAU,eAAe,OAAO,CAAC,CAAC,EAAE,OAAO,KAAK;AAC9F;AAEA,SAAS,kBAA+B;AACtC,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,oBAAoB,aAAa;AACvC,aAAW,kBAAkB,OAAO,OAAO,iBAAiB,GAAG;AAC7D,eAAW,MAAM,OAAO,OAAO,cAAwC,GAAG;AACxE,UAAI,IAAI,EAAE;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAmD;AAC1D,QAAM,MAAM,oBAAI,IAAoC;AACpD,QAAM,UAAU,WAAW;AAC3B,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,UAAM,cAAgB,IAAY,kBAAqD,CAAC;AACxF,eAAW,QAAQ,aAAa;AAC9B,YAAM,WAAW,IAAI,IAAI,KAAK,EAAE,KAAK,EAAE,UAAU,KAAK,IAAI,WAAW,oBAAI,IAAY,GAAG,MAAM,QAAW,WAAW,CAAC,EAAE;AACvH,eAAS,UAAU,IAAI,QAAQ;AAC/B,UAAI,CAAC,SAAS,KAAM,UAAS,OAAO;AACpC,UAAI,IAAI,KAAK,IAAI,QAAQ;AAAA,IAC3B;AACA,UAAM,YAAc,IAAY,mBAAoD,CAAC;AACrF,eAAW,OAAO,WAAW;AAC3B,YAAM,WAAW,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,UAAU,IAAI,QAAQ,WAAW,oBAAI,IAAY,GAAG,MAAM,QAAW,WAAW,CAAC,EAAE;AAC7H,eAAS,UAAU,IAAI,QAAQ;AAC/B,eAAS,UAAU,KAAK,GAAG;AAC3B,UAAI,IAAI,IAAI,QAAQ,QAAQ;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,OAAO,CAAC;AAChC;AAEO,SAAS,cAAc,WAAsD;AAClF,QAAM,QAAQ,oBAAI,IAAmC;AACrD,QAAM,mBAAmB,oBAAI,IAAoB;AACjD,aAAW,OAAO,WAAW;AAC3B,eAAW,SAAS,IAAI,UAAU,CAAC,GAAG;AACpC,UAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG,EAAG,kBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI;AAC3F,YAAM,IAAI,MAAM,KAAK,EAAE,GAAG,MAAM,CAAC;AAAA,IACnC;AAAA,EACF;AAIA,QAAM,WAAW,MAAM,KAAK,MAAM,OAAO,CAAC,EAAE,IAAI,CAAC,UAC/C,OAAO,MAAM,aAAa,WACtB,QACA,EAAE,GAAG,OAAO,UAAU,iBAAiB,IAAI,MAAM,GAAG,KAAK,EAAE,CAChE;AACD,SAAO,SAAS,KAAK,CAAC,GAAG,MAAM;AAC7B,UAAM,cAAc,EAAE,YAAY,MAAM,EAAE,YAAY;AACtD,QAAI,eAAe,EAAG,QAAO;AAC7B,YAAQ,iBAAiB,IAAI,EAAE,GAAG,KAAK,MAAM,iBAAiB,IAAI,EAAE,GAAG,KAAK;AAAA,EAC9E,CAAC;AACH;AAEA,SAAS,eAAe,OAA8B;AACpD,QAAM,UAAmC;AAAA,IACvC,KAAK,MAAM;AAAA,IACX,MAAM,MAAM;AAAA,EACd;AACA,aAAW,OAAO,mBAAmB;AACnC,UAAM,QAAQ,MAAM,GAAG;AACvB,QAAI,UAAU,OAAW,SAAQ,GAAG,IAAI;AAAA,EAC1C;AACA,MAAI,MAAM,GAAI,SAAQ,KAAK,MAAM;AACjC,SAAO;AACT;AAEA,SAAS,qBAAqB,QAM3B;AACD,QAAM,EAAE,UAAU,OAAO,MAAM,QAAQ,OAAO,IAAI;AAClD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM,SAAS;AAAA,IACtB,aAAa,MAAM,eAAe;AAAA,IAClC,YAAY,MAAM,cAAc;AAAA,IAChC,eAAe,MAAM,iBAAiB;AAAA,IACtC,eAAe,MAAM,iBAAiB;AAAA,IACtC,kBAAkB,MAAM,oBAAoB;AAAA,IAC5C,QAAQ,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC;AAAA,EAC7C;AACF;AAEA,eAAsB,iCACpB,IACA,OACA,UAAkC,CAAC,GACH;AAChC,QAAM,qBAAqB,QAAQ,YAC/B,IAAI,IAAI,QAAQ,UAAU,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,IAC/F;AACJ,QAAM,aAAa,uBAAuB,EAAE,OAAO,CAAC,UAAU;AAC5D,QAAI,CAAC,mBAAoB,QAAO;AAChC,WAAO,mBAAmB,IAAI,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACD,QAAM,YAAY,gBAAgB;AAClC,QAAM,gBAAgB,QAAQ,kBAAkB;AAChD,QAAM,SAAS,QAAQ,WAAW;AAClC,QAAM,aAAa,QAAQ,eAAe;AAC1C,QAAM,QAAQ,QAAQ,UAAU;AAChC,QAAM,SAAS,QAAQ;AAEvB,MAAI;AACJ,MAAI,QAAQ,cAAc,QAAW;AACnC,gBAAY,MAAM,KAAK,IAAI,IAAI,QAAQ,UAAU,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AAAA,EACzH;AAEA,QAAM,kBAAkB,YAA+B;AACrD,QAAI,cAAc,OAAW,QAAO;AACpC,UAAM,OAAO,MAAM,GAAG,KAAK,QAAQ,EAAE,WAAW,KAAK,GAAU,EAAE,QAAQ,CAAC,IAAI,EAAS,CAAC;AACxF,gBAAY,KAAK,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpC,WAAO,aAAa,CAAC;AAAA,EACvB;AAEA,MAAI,YAAY;AAChB,MAAI,eAAe;AACnB,MAAI,UAAU;AACd,MAAI,eAAe;AAEnB,aAAW,SAAS,YAAY;AAC9B,UAAM,EAAE,SAAS,IAAI;AACrB,UAAM,OAAO,MAAM;AACnB,UAAM,SAAS,cAAc,MAAM,SAAS;AAC5C,UAAM,WAAW,UAAU,IAAI,QAAQ;AACvC,UAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC;AACtC,UAAM,WAAW,MAAM,WAAW;AAElC,UAAM,SAAyB,CAAC;AAChC,QAAI,UAAU;AACZ,UAAI,cAAe,QAAO,KAAK,EAAE,UAAU,KAAK,CAAC;AAAA,IACnD,OAAO;AACL,YAAM,MAAM,MAAM,gBAAgB;AAClC,UAAI,CAAC,IAAI,QAAQ;AACf;AACA;AAAA,MACF;AACA,iBAAW,YAAY,IAAK,QAAO,KAAK,EAAE,SAAS,CAAC;AAAA,IACtD;AAEA,QAAI,CAAC,OAAO,UAAU,OAAO,WAAW,KAAK,CAAC,gBAAgB;AAC5D;AACA;AAAA,IACF;AAEA,eAAW,SAAS,QAAQ;AAC1B;AACA,YAAM,WAAW,MAAM,WAAW,UAAU,MAAM,QAAQ,KAAK;AAC/D,YAAM,kBAAkB,qBAAqB;AAAA,QAC3C;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AACD,YAAM,WAAW,gBAAgB,eAAe;AAChD,YAAM,WAAW,sBAAsB,QAAQ,IAAI,QAAQ;AAE3D,UAAI,CAAC,UAAU,CAAC,SAAS,OAAO;AAC9B,YAAI;AACF,gBAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,cAAI,OAAO,WAAW,YAAY,WAAW,UAAU;AACrD;AACA;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AAEA,UAAI,eAAyC;AAC7C,UAAI,gBAAgB;AAClB,uBAAe,MAAM,mBAAmB,IAAI,UAAU;AAAA,UACpD,OAAO,MAAM,SAAS;AAAA,UACtB,aAAa,MAAM,eAAe;AAAA,UAClC,gBAAgB;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,eAAe,MAAM,iBAAiB;AAAA,UACtC,kBAAkB,MAAM,oBAAoB;AAAA,UAC5C,YAAY,MAAM,cAAc;AAAA,UAChC,eAAe,MAAM,iBAAiB;AAAA,UACtC,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAEA,UAAI,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAAE;AACzD,UAAI,OAAO,QAAQ;AACjB,sBAAc,MAAM;AAAA,UAClB;AAAA,UACA,CAAC,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,UAC7B,EAAE,gBAAgB,MAAM,UAAU,MAAM,UAAU,QAAQ,WAAW;AAAA,QACvE;AAAA,MACF;AAEA,YAAM,UAAW,iBAAiB,eAAgB,YAAY,UAAU,KAAK,YAAY,UAAU;AACnG,YAAM,8BAA8B,CAAC,WAAW,WAAW;AAC3D,UAAI,6BAA6B;AAC/B,cAAM,2BAA2B,SAAS,QAAW;AAAA,UACnD,UAAU,MAAM;AAAA,UAChB,gBAAgB;AAAA,UAChB,WAAW,CAAC,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH;AAEA,UAAI,SAAS;AACX;AACA,wBAAgB,YAAY,UAAU,YAAY;AAClD,YAAI,CAAC,UAAU,OAAO;AACpB,cAAI;AACF,kBAAM,MAAM,IAAI,UAAU,UAAU,EAAE,MAAM,CAAC,iBAAiB,QAAQ,IAAI,uBAAuB,QAAQ,EAAE,EAAE,CAAC;AAAA,UAChH,QAAQ;AAAA,UAAC;AAAA,QACX;AACA,YAAI,QAAQ;AACV,gBAAM,QAAkB,CAAC;AACzB,cAAI,iBAAiB,YAAa,OAAM,KAAK,UAAU,YAAY,EAAE;AACrE,cAAI,YAAY,WAAW,YAAY,SAAS;AAC9C,kBAAM,KAAK,WAAW,YAAY,OAAO,OAAO,YAAY,OAAO,EAAE;AAAA,UACvE;AACA,iBAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,MAAM,SAAS,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,QAC5F;AAAA,MACF,OAAO;AACL;AACA,YAAI,CAAC,UAAU,OAAO;AACpB,cAAI;AACF,kBAAM,MAAM,IAAI,UAAU,UAAU,EAAE,MAAM,CAAC,iBAAiB,QAAQ,IAAI,uBAAuB,QAAQ,EAAE,EAAE,CAAC;AAAA,UAChH,QAAQ;AAAA,UAAC;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,cAAc,SAAS,aAAa;AAC1D;AAEO,SAAS,sBAAgC;AAC9C,SAAO,uBAAuB,EAAE,IAAI,CAAC,UAAU,MAAM,QAAQ;AAC/D;AAEO,SAAS,mCAA6D;AAC3E,SAAO,uBAAuB;AAChC;",
   "names": []
 }

package/dist/modules/eudr/search.js

@@ -69,22 +69,20 @@ function resolveSupplierName(record) {
   return readObjectText(snapshot, "display_name", "displayName", "name");
 }
 function buildStatementPresenter(translate, record) {
-  const label = translate("eudr.search.badge.statement", "DDS statement");
   const title = readRecordText(record, "title") ?? translate("eudr.common.recordUnavailable");
   const subtitle = formatSubtitle(
     readRecordText(record, "reference_number", "referenceNumber"),
     translateToken(translate, "eudr.commodity", readRecordText(record, "commodity"))
   );
-  return { title, subtitle, icon: "file-check", badge: label };
+  return { title, subtitle, icon: "file-check" };
 }
 function buildPlotPresenter(translate, record) {
-  const label = translate("eudr.search.badge.plot", "Plot");
   const title = readRecordText(record, "name") ?? translate("eudr.common.recordUnavailable");
   const subtitle = formatSubtitle(
     readRecordText(record, "origin_country", "originCountry"),
     translateToken(translate, "eudr.plotType", readRecordText(record, "plot_type", "plotType"))
   );
-  return { title, subtitle, icon: "map-pin", badge: label };
+  return { title, subtitle, icon: "map-pin" };
 }
 function buildSubmissionPresenter(translate, record) {
   const label = translate("eudr.search.badge.submission", "Evidence submission");
@@ -95,7 +93,7 @@ function buildSubmissionPresenter(translate, record) {
     supplierName,
     translateToken(translate, "eudr.submissionStatus", readRecordText(record, "status"))
   );
-  return { title, subtitle, icon: "package", badge: label };
+  return { title, subtitle, icon: "package" };
 }
 const searchConfig = {
   entities: [

package/dist/modules/eudr/search.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/eudr/search.ts"],
-  "sourcesContent": ["import type { SearchBuildContext, SearchIndexSource, SearchModuleConfig, SearchResultPresenter } from '@open-mercato/shared/modules/search'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nconst EUDR_STATEMENTS_URL = '/backend/eudr/statements'\nconst EUDR_PLOTS_URL = '/backend/eudr/plots'\nconst EUDR_EVIDENCE_SUBMISSIONS_URL = '/backend/eudr/evidence-submissions'\n\nfunction assertTenantContext(ctx: SearchBuildContext): void {\n  if (typeof ctx.tenantId !== 'string' || ctx.tenantId.length === 0) {\n    throw new Error('[internal] [search.eudr] Missing tenantId in search build context')\n  }\n}\n\nfunction normalizeText(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n  if (value instanceof Date) return value.toISOString()\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  return null\n}\n\nfunction readRecordText(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const text = normalizeText(record[key])\n    if (text) return text\n  }\n  return null\n}\n\nfunction readObjectText(source: unknown, ...keys: string[]): string | null {\n  if (!source || typeof source !== 'object') return null\n  return readRecordText(source as Record<string, unknown>, ...keys)\n}\n\nfunction formatSubtitle(...parts: Array<unknown>): string | undefined {\n  const text = parts\n    .map((part) => normalizeText(part))\n    .filter((value): value is string => Boolean(value))\n  if (!text.length) return undefined\n  return text.join(' \u00B7 ')\n}\n\nfunction appendLine(lines: string[], label: string, value: unknown) {\n  const text = normalizeText(value)\n  if (!text) return\n  lines.push(`${label}: ${text}`)\n}\n\nfunction friendlyLabel(input: string): string {\n  return input\n    .replace(/^cf:/, '')\n    .replace(/_/g, ' ')\n    .replace(/([a-z])([A-Z])/g, (_match, firstChar, secondChar) => `${firstChar} ${secondChar}`)\n    .replace(/\\b\\w/g, (character) => character.toUpperCase())\n}\n\nfunction appendCustomFieldLines(lines: string[], customFields: Record<string, unknown>) {\n  for (const [key, value] of Object.entries(customFields)) {\n    if (value === null || value === undefined) continue\n    appendLine(lines, friendlyLabel(key), value)\n  }\n}\n\nfunction buildIndexSource(\n  ctx: SearchBuildContext,\n  presenter: SearchResultPresenter,\n  lines: string[],\n): SearchIndexSource | null {\n  appendCustomFieldLines(lines, ctx.customFields)\n  if (!lines.length) return null\n  return {\n    text: lines,\n    presenter,\n    checksumSource: { record: ctx.record, customFields: ctx.customFields },\n  }\n}\n\nfunction buildRecordUrl(baseUrl: string, record: Record<string, unknown>): string | null {\n  const recordId = readRecordText(record, 'id')\n  return recordId ? `${baseUrl}/${encodeURIComponent(recordId)}` : null\n}\n\nfunction translateToken(translate: TranslateFn, prefix: string, value: string | null): string | null {\n  if (!value) return null\n  return translate(`${prefix}.${value}`, value)\n}\n\nfunction resolveSupplierName(record: Record<string, unknown>): string | null {\n  const snapshot = record.supplier_snapshot ?? record.supplierSnapshot\n  return readObjectText(snapshot, 'display_name', 'displayName', 'name')\n}\n\nfunction buildStatementPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const label = translate('eudr.search.badge.statement', 'DDS statement')\n  const title = readRecordText(record, 'title') ?? translate('eudr.common.recordUnavailable')\n  const subtitle = formatSubtitle(\n    readRecordText(record, 'reference_number', 'referenceNumber'),\n    translateToken(translate, 'eudr.commodity', readRecordText(record, 'commodity')),\n  )\n  return { title, subtitle, icon: 'file-check', badge: label }\n}\n\nfunction buildPlotPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const label = translate('eudr.search.badge.plot', 'Plot')\n  const title = readRecordText(record, 'name') ?? translate('eudr.common.recordUnavailable')\n  const subtitle = formatSubtitle(\n    readRecordText(record, 'origin_country', 'originCountry'),\n    translateToken(translate, 'eudr.plotType', readRecordText(record, 'plot_type', 'plotType')),\n  )\n  return { title, subtitle, icon: 'map-pin', badge: label }\n}\n\nfunction buildSubmissionPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const label = translate('eudr.search.badge.submission', 'Evidence submission')\n  const batchNumber = readRecordText(record, 'batch_number', 'batchNumber')\n  const supplierName = resolveSupplierName(record)\n  const title = batchNumber\n    ? `${label} ${batchNumber}`\n    : supplierName ?? translate('eudr.common.recordUnavailable')\n  const subtitle = formatSubtitle(\n    supplierName,\n    translateToken(translate, 'eudr.submissionStatus', readRecordText(record, 'status')),\n  )\n  return { title, subtitle, icon: 'package', badge: label }\n}\n\nexport const searchConfig: SearchModuleConfig = {\n  entities: [\n    {\n      entityId: 'eudr:eudr_due_diligence_statement',\n      enabled: true,\n      priority: 8,\n      fieldPolicy: {\n        searchable: ['title', 'reference_number', 'commodity'],\n        excluded: ['notes'],\n      },\n      buildSource: async (ctx) => {\n        assertTenantContext(ctx)\n        const { t: translate } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Title', record.title)\n        appendLine(lines, 'Reference number', record.reference_number ?? record.referenceNumber)\n        appendLine(lines, 'Commodity', record.commodity)\n        return buildIndexSource(ctx, buildStatementPresenter(translate, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t: translate } = await resolveTranslations()\n        return buildStatementPresenter(translate, ctx.record)\n      },\n      resolveUrl: async (ctx) => buildRecordUrl(EUDR_STATEMENTS_URL, ctx.record),\n      aclFeatures: ['eudr.statements.view'],\n    },\n    {\n      entityId: 'eudr:eudr_plot',\n      enabled: true,\n      priority: 7,\n      fieldPolicy: {\n        searchable: ['name', 'external_id', 'origin_country'],\n        excluded: ['producer_name'],\n      },\n      buildSource: async (ctx) => {\n        assertTenantContext(ctx)\n        const { t: translate } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Name', record.name)\n        appendLine(lines, 'External ID', record.external_id ?? record.externalId)\n        appendLine(lines, 'Origin country', record.origin_country ?? record.originCountry)\n        return buildIndexSource(ctx, buildPlotPresenter(translate, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t: translate } = await resolveTranslations()\n        return buildPlotPresenter(translate, ctx.record)\n      },\n      resolveUrl: async (ctx) => buildRecordUrl(EUDR_PLOTS_URL, ctx.record),\n      aclFeatures: ['eudr.plots.view'],\n    },\n    {\n      entityId: 'eudr:eudr_evidence_submission',\n      enabled: true,\n      priority: 6,\n      fieldPolicy: {\n        searchable: ['batch_number', 'commodity'],\n        excluded: ['producer_name', 'notes'],\n      },\n      buildSource: async (ctx) => {\n        assertTenantContext(ctx)\n        const { t: translate } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Batch number', record.batch_number ?? record.batchNumber)\n        appendLine(lines, 'Commodity', record.commodity)\n        appendLine(lines, 'Supplier', resolveSupplierName(record))\n        return buildIndexSource(ctx, buildSubmissionPresenter(translate, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t: translate } = await resolveTranslations()\n        return buildSubmissionPresenter(translate, ctx.record)\n      },\n      resolveUrl: async (ctx) => buildRecordUrl(EUDR_EVIDENCE_SUBMISSIONS_URL, ctx.record),\n      aclFeatures: ['eudr.submissions.view'],\n    },\n  ],\n}\n\nexport default searchConfig\nexport const config = searchConfig\n"],
-  "mappings": "AAEA,SAAS,2BAA2B;AAEpC,MAAM,sBAAsB;AAC5B,MAAM,iBAAiB;AACvB,MAAM,gCAAgC;AAEtC,SAAS,oBAAoB,KAA+B;AAC1D,MAAI,OAAO,IAAI,aAAa,YAAY,IAAI,SAAS,WAAW,GAAG;AACjE,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACF;AAEA,SAAS,cAAc,OAA+B;AACpD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AACA,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEA,SAAS,eAAe,WAAoC,MAA+B;AACzF,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,cAAc,OAAO,GAAG,CAAC;AACtC,QAAI,KAAM,QAAO;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,eAAe,WAAoB,MAA+B;AACzE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,SAAO,eAAe,QAAmC,GAAG,IAAI;AAClE;AAEA,SAAS,kBAAkB,OAA2C;AACpE,QAAM,OAAO,MACV,IAAI,CAAC,SAAS,cAAc,IAAI,CAAC,EACjC,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC;AACpD,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,SAAO,KAAK,KAAK,QAAK;AACxB;AAEA,SAAS,WAAW,OAAiB,OAAe,OAAgB;AAClE,QAAM,OAAO,cAAc,KAAK;AAChC,MAAI,CAAC,KAAM;AACX,QAAM,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE;AAChC;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MACJ,QAAQ,QAAQ,EAAE,EAClB,QAAQ,MAAM,GAAG,EACjB,QAAQ,mBAAmB,CAAC,QAAQ,WAAW,eAAe,GAAG,SAAS,IAAI,UAAU,EAAE,EAC1F,QAAQ,SAAS,CAAC,cAAc,UAAU,YAAY,CAAC;AAC5D;AAEA,SAAS,uBAAuB,OAAiB,cAAuC;AACtF,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACvD,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,eAAW,OAAO,cAAc,GAAG,GAAG,KAAK;AAAA,EAC7C;AACF;AAEA,SAAS,iBACP,KACA,WACA,OAC0B;AAC1B,yBAAuB,OAAO,IAAI,YAAY;AAC9C,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,gBAAgB,EAAE,QAAQ,IAAI,QAAQ,cAAc,IAAI,aAAa;AAAA,EACvE;AACF;AAEA,SAAS,eAAe,SAAiB,QAAgD;AACvF,QAAM,WAAW,eAAe,QAAQ,IAAI;AAC5C,SAAO,WAAW,GAAG,OAAO,IAAI,mBAAmB,QAAQ,CAAC,KAAK;AACnE;AAEA,SAAS,eAAe,WAAwB,QAAgB,OAAqC;AACnG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,UAAU,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK;AAC9C;AAEA,SAAS,oBAAoB,QAAgD;AAC3E,QAAM,WAAW,OAAO,qBAAqB,OAAO;AACpD,SAAO,eAAe,UAAU,gBAAgB,eAAe,MAAM;AACvE;AAEA,SAAS,wBAAwB,WAAwB,QAAwD;AAC/G,QAAM,QAAQ,UAAU,+BAA+B,eAAe;AACtE,QAAM,QAAQ,eAAe,QAAQ,OAAO,KAAK,UAAU,+BAA+B;AAC1F,QAAM,WAAW;AAAA,IACf,eAAe,QAAQ,oBAAoB,iBAAiB;AAAA,IAC5D,eAAe,WAAW,kBAAkB,eAAe,QAAQ,WAAW,CAAC;AAAA,EACjF;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,cAAc,OAAO,MAAM;AAC7D;AAEA,SAAS,mBAAmB,WAAwB,QAAwD;AAC1G,QAAM,QAAQ,UAAU,0BAA0B,MAAM;AACxD,QAAM,QAAQ,eAAe,QAAQ,MAAM,KAAK,UAAU,+BAA+B;AACzF,QAAM,WAAW;AAAA,IACf,eAAe,QAAQ,kBAAkB,eAAe;AAAA,IACxD,eAAe,WAAW,iBAAiB,eAAe,QAAQ,aAAa,UAAU,CAAC;AAAA,EAC5F;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,WAAW,OAAO,MAAM;AAC1D;AAEA,SAAS,yBAAyB,WAAwB,QAAwD;AAChH,QAAM,QAAQ,UAAU,gCAAgC,qBAAqB;AAC7E,QAAM,cAAc,eAAe,QAAQ,gBAAgB,aAAa;AACxE,QAAM,eAAe,oBAAoB,MAAM;AAC/C,QAAM,QAAQ,cACV,GAAG,KAAK,IAAI,WAAW,KACvB,gBAAgB,UAAU,+BAA+B;AAC7D,QAAM,WAAW;AAAA,IACf;AAAA,IACA,eAAe,WAAW,yBAAyB,eAAe,QAAQ,QAAQ,CAAC;AAAA,EACrF;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,WAAW,OAAO,MAAM;AAC1D;AAEO,MAAM,eAAmC;AAAA,EAC9C,UAAU;AAAA,IACR;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,QACX,YAAY,CAAC,SAAS,oBAAoB,WAAW;AAAA,QACrD,UAAU,CAAC,OAAO;AAAA,MACpB;AAAA,MACA,aAAa,OAAO,QAAQ;AAC1B,4BAAoB,GAAG;AACvB,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,SAAS,OAAO,KAAK;AACvC,mBAAW,OAAO,oBAAoB,OAAO,oBAAoB,OAAO,eAAe;AACvF,mBAAW,OAAO,aAAa,OAAO,SAAS;AAC/C,eAAO,iBAAiB,KAAK,wBAAwB,WAAW,MAAM,GAAG,KAAK;AAAA,MAChF;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,eAAO,wBAAwB,WAAW,IAAI,MAAM;AAAA,MACtD;AAAA,MACA,YAAY,OAAO,QAAQ,eAAe,qBAAqB,IAAI,MAAM;AAAA,MACzE,aAAa,CAAC,sBAAsB;AAAA,IACtC;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,QACX,YAAY,CAAC,QAAQ,eAAe,gBAAgB;AAAA,QACpD,UAAU,CAAC,eAAe;AAAA,MAC5B;AAAA,MACA,aAAa,OAAO,QAAQ;AAC1B,4BAAoB,GAAG;AACvB,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,eAAe,OAAO,eAAe,OAAO,UAAU;AACxE,mBAAW,OAAO,kBAAkB,OAAO,kBAAkB,OAAO,aAAa;AACjF,eAAO,iBAAiB,KAAK,mBAAmB,WAAW,MAAM,GAAG,KAAK;AAAA,MAC3E;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,eAAO,mBAAmB,WAAW,IAAI,MAAM;AAAA,MACjD;AAAA,MACA,YAAY,OAAO,QAAQ,eAAe,gBAAgB,IAAI,MAAM;AAAA,MACpE,aAAa,CAAC,iBAAiB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,QACX,YAAY,CAAC,gBAAgB,WAAW;AAAA,QACxC,UAAU,CAAC,iBAAiB,OAAO;AAAA,MACrC;AAAA,MACA,aAAa,OAAO,QAAQ;AAC1B,4BAAoB,GAAG;AACvB,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,aAAa,OAAO,SAAS;AAC/C,mBAAW,OAAO,YAAY,oBAAoB,MAAM,CAAC;AACzD,eAAO,iBAAiB,KAAK,yBAAyB,WAAW,MAAM,GAAG,KAAK;AAAA,MACjF;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,eAAO,yBAAyB,WAAW,IAAI,MAAM;AAAA,MACvD;AAAA,MACA,YAAY,OAAO,QAAQ,eAAe,+BAA+B,IAAI,MAAM;AAAA,MACnF,aAAa,CAAC,uBAAuB;AAAA,IACvC;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;AACR,MAAM,SAAS;",
+  "sourcesContent": ["import type { SearchBuildContext, SearchIndexSource, SearchModuleConfig, SearchResultPresenter } from '@open-mercato/shared/modules/search'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nconst EUDR_STATEMENTS_URL = '/backend/eudr/statements'\nconst EUDR_PLOTS_URL = '/backend/eudr/plots'\nconst EUDR_EVIDENCE_SUBMISSIONS_URL = '/backend/eudr/evidence-submissions'\n\nfunction assertTenantContext(ctx: SearchBuildContext): void {\n  if (typeof ctx.tenantId !== 'string' || ctx.tenantId.length === 0) {\n    throw new Error('[internal] [search.eudr] Missing tenantId in search build context')\n  }\n}\n\nfunction normalizeText(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n  if (value instanceof Date) return value.toISOString()\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  return null\n}\n\nfunction readRecordText(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const text = normalizeText(record[key])\n    if (text) return text\n  }\n  return null\n}\n\nfunction readObjectText(source: unknown, ...keys: string[]): string | null {\n  if (!source || typeof source !== 'object') return null\n  return readRecordText(source as Record<string, unknown>, ...keys)\n}\n\nfunction formatSubtitle(...parts: Array<unknown>): string | undefined {\n  const text = parts\n    .map((part) => normalizeText(part))\n    .filter((value): value is string => Boolean(value))\n  if (!text.length) return undefined\n  return text.join(' \u00B7 ')\n}\n\nfunction appendLine(lines: string[], label: string, value: unknown) {\n  const text = normalizeText(value)\n  if (!text) return\n  lines.push(`${label}: ${text}`)\n}\n\nfunction friendlyLabel(input: string): string {\n  return input\n    .replace(/^cf:/, '')\n    .replace(/_/g, ' ')\n    .replace(/([a-z])([A-Z])/g, (_match, firstChar, secondChar) => `${firstChar} ${secondChar}`)\n    .replace(/\\b\\w/g, (character) => character.toUpperCase())\n}\n\nfunction appendCustomFieldLines(lines: string[], customFields: Record<string, unknown>) {\n  for (const [key, value] of Object.entries(customFields)) {\n    if (value === null || value === undefined) continue\n    appendLine(lines, friendlyLabel(key), value)\n  }\n}\n\nfunction buildIndexSource(\n  ctx: SearchBuildContext,\n  presenter: SearchResultPresenter,\n  lines: string[],\n): SearchIndexSource | null {\n  appendCustomFieldLines(lines, ctx.customFields)\n  if (!lines.length) return null\n  return {\n    text: lines,\n    presenter,\n    checksumSource: { record: ctx.record, customFields: ctx.customFields },\n  }\n}\n\nfunction buildRecordUrl(baseUrl: string, record: Record<string, unknown>): string | null {\n  const recordId = readRecordText(record, 'id')\n  return recordId ? `${baseUrl}/${encodeURIComponent(recordId)}` : null\n}\n\nfunction translateToken(translate: TranslateFn, prefix: string, value: string | null): string | null {\n  if (!value) return null\n  return translate(`${prefix}.${value}`, value)\n}\n\nfunction resolveSupplierName(record: Record<string, unknown>): string | null {\n  const snapshot = record.supplier_snapshot ?? record.supplierSnapshot\n  return readObjectText(snapshot, 'display_name', 'displayName', 'name')\n}\n\nfunction buildStatementPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const title = readRecordText(record, 'title') ?? translate('eudr.common.recordUnavailable')\n  const subtitle = formatSubtitle(\n    readRecordText(record, 'reference_number', 'referenceNumber'),\n    translateToken(translate, 'eudr.commodity', readRecordText(record, 'commodity')),\n  )\n  return { title, subtitle, icon: 'file-check' }\n}\n\nfunction buildPlotPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const title = readRecordText(record, 'name') ?? translate('eudr.common.recordUnavailable')\n  const subtitle = formatSubtitle(\n    readRecordText(record, 'origin_country', 'originCountry'),\n    translateToken(translate, 'eudr.plotType', readRecordText(record, 'plot_type', 'plotType')),\n  )\n  return { title, subtitle, icon: 'map-pin' }\n}\n\nfunction buildSubmissionPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const label = translate('eudr.search.badge.submission', 'Evidence submission')\n  const batchNumber = readRecordText(record, 'batch_number', 'batchNumber')\n  const supplierName = resolveSupplierName(record)\n  const title = batchNumber\n    ? `${label} ${batchNumber}`\n    : supplierName ?? translate('eudr.common.recordUnavailable')\n  const subtitle = formatSubtitle(\n    supplierName,\n    translateToken(translate, 'eudr.submissionStatus', readRecordText(record, 'status')),\n  )\n  return { title, subtitle, icon: 'package' }\n}\n\nexport const searchConfig: SearchModuleConfig = {\n  entities: [\n    {\n      entityId: 'eudr:eudr_due_diligence_statement',\n      enabled: true,\n      priority: 8,\n      fieldPolicy: {\n        searchable: ['title', 'reference_number', 'commodity'],\n        excluded: ['notes'],\n      },\n      buildSource: async (ctx) => {\n        assertTenantContext(ctx)\n        const { t: translate } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Title', record.title)\n        appendLine(lines, 'Reference number', record.reference_number ?? record.referenceNumber)\n        appendLine(lines, 'Commodity', record.commodity)\n        return buildIndexSource(ctx, buildStatementPresenter(translate, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t: translate } = await resolveTranslations()\n        return buildStatementPresenter(translate, ctx.record)\n      },\n      resolveUrl: async (ctx) => buildRecordUrl(EUDR_STATEMENTS_URL, ctx.record),\n      aclFeatures: ['eudr.statements.view'],\n    },\n    {\n      entityId: 'eudr:eudr_plot',\n      enabled: true,\n      priority: 7,\n      fieldPolicy: {\n        searchable: ['name', 'external_id', 'origin_country'],\n        excluded: ['producer_name'],\n      },\n      buildSource: async (ctx) => {\n        assertTenantContext(ctx)\n        const { t: translate } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Name', record.name)\n        appendLine(lines, 'External ID', record.external_id ?? record.externalId)\n        appendLine(lines, 'Origin country', record.origin_country ?? record.originCountry)\n        return buildIndexSource(ctx, buildPlotPresenter(translate, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t: translate } = await resolveTranslations()\n        return buildPlotPresenter(translate, ctx.record)\n      },\n      resolveUrl: async (ctx) => buildRecordUrl(EUDR_PLOTS_URL, ctx.record),\n      aclFeatures: ['eudr.plots.view'],\n    },\n    {\n      entityId: 'eudr:eudr_evidence_submission',\n      enabled: true,\n      priority: 6,\n      fieldPolicy: {\n        searchable: ['batch_number', 'commodity'],\n        excluded: ['producer_name', 'notes'],\n      },\n      buildSource: async (ctx) => {\n        assertTenantContext(ctx)\n        const { t: translate } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Batch number', record.batch_number ?? record.batchNumber)\n        appendLine(lines, 'Commodity', record.commodity)\n        appendLine(lines, 'Supplier', resolveSupplierName(record))\n        return buildIndexSource(ctx, buildSubmissionPresenter(translate, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t: translate } = await resolveTranslations()\n        return buildSubmissionPresenter(translate, ctx.record)\n      },\n      resolveUrl: async (ctx) => buildRecordUrl(EUDR_EVIDENCE_SUBMISSIONS_URL, ctx.record),\n      aclFeatures: ['eudr.submissions.view'],\n    },\n  ],\n}\n\nexport default searchConfig\nexport const config = searchConfig\n"],
+  "mappings": "AAEA,SAAS,2BAA2B;AAEpC,MAAM,sBAAsB;AAC5B,MAAM,iBAAiB;AACvB,MAAM,gCAAgC;AAEtC,SAAS,oBAAoB,KAA+B;AAC1D,MAAI,OAAO,IAAI,aAAa,YAAY,IAAI,SAAS,WAAW,GAAG;AACjE,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACF;AAEA,SAAS,cAAc,OAA+B;AACpD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AACA,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEA,SAAS,eAAe,WAAoC,MAA+B;AACzF,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,cAAc,OAAO,GAAG,CAAC;AACtC,QAAI,KAAM,QAAO;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,eAAe,WAAoB,MAA+B;AACzE,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,SAAO,eAAe,QAAmC,GAAG,IAAI;AAClE;AAEA,SAAS,kBAAkB,OAA2C;AACpE,QAAM,OAAO,MACV,IAAI,CAAC,SAAS,cAAc,IAAI,CAAC,EACjC,OAAO,CAAC,UAA2B,QAAQ,KAAK,CAAC;AACpD,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,SAAO,KAAK,KAAK,QAAK;AACxB;AAEA,SAAS,WAAW,OAAiB,OAAe,OAAgB;AAClE,QAAM,OAAO,cAAc,KAAK;AAChC,MAAI,CAAC,KAAM;AACX,QAAM,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE;AAChC;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MACJ,QAAQ,QAAQ,EAAE,EAClB,QAAQ,MAAM,GAAG,EACjB,QAAQ,mBAAmB,CAAC,QAAQ,WAAW,eAAe,GAAG,SAAS,IAAI,UAAU,EAAE,EAC1F,QAAQ,SAAS,CAAC,cAAc,UAAU,YAAY,CAAC;AAC5D;AAEA,SAAS,uBAAuB,OAAiB,cAAuC;AACtF,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACvD,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,eAAW,OAAO,cAAc,GAAG,GAAG,KAAK;AAAA,EAC7C;AACF;AAEA,SAAS,iBACP,KACA,WACA,OAC0B;AAC1B,yBAAuB,OAAO,IAAI,YAAY;AAC9C,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,gBAAgB,EAAE,QAAQ,IAAI,QAAQ,cAAc,IAAI,aAAa;AAAA,EACvE;AACF;AAEA,SAAS,eAAe,SAAiB,QAAgD;AACvF,QAAM,WAAW,eAAe,QAAQ,IAAI;AAC5C,SAAO,WAAW,GAAG,OAAO,IAAI,mBAAmB,QAAQ,CAAC,KAAK;AACnE;AAEA,SAAS,eAAe,WAAwB,QAAgB,OAAqC;AACnG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,UAAU,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK;AAC9C;AAEA,SAAS,oBAAoB,QAAgD;AAC3E,QAAM,WAAW,OAAO,qBAAqB,OAAO;AACpD,SAAO,eAAe,UAAU,gBAAgB,eAAe,MAAM;AACvE;AAEA,SAAS,wBAAwB,WAAwB,QAAwD;AAC/G,QAAM,QAAQ,eAAe,QAAQ,OAAO,KAAK,UAAU,+BAA+B;AAC1F,QAAM,WAAW;AAAA,IACf,eAAe,QAAQ,oBAAoB,iBAAiB;AAAA,IAC5D,eAAe,WAAW,kBAAkB,eAAe,QAAQ,WAAW,CAAC;AAAA,EACjF;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,aAAa;AAC/C;AAEA,SAAS,mBAAmB,WAAwB,QAAwD;AAC1G,QAAM,QAAQ,eAAe,QAAQ,MAAM,KAAK,UAAU,+BAA+B;AACzF,QAAM,WAAW;AAAA,IACf,eAAe,QAAQ,kBAAkB,eAAe;AAAA,IACxD,eAAe,WAAW,iBAAiB,eAAe,QAAQ,aAAa,UAAU,CAAC;AAAA,EAC5F;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,UAAU;AAC5C;AAEA,SAAS,yBAAyB,WAAwB,QAAwD;AAChH,QAAM,QAAQ,UAAU,gCAAgC,qBAAqB;AAC7E,QAAM,cAAc,eAAe,QAAQ,gBAAgB,aAAa;AACxE,QAAM,eAAe,oBAAoB,MAAM;AAC/C,QAAM,QAAQ,cACV,GAAG,KAAK,IAAI,WAAW,KACvB,gBAAgB,UAAU,+BAA+B;AAC7D,QAAM,WAAW;AAAA,IACf;AAAA,IACA,eAAe,WAAW,yBAAyB,eAAe,QAAQ,QAAQ,CAAC;AAAA,EACrF;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,UAAU;AAC5C;AAEO,MAAM,eAAmC;AAAA,EAC9C,UAAU;AAAA,IACR;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,QACX,YAAY,CAAC,SAAS,oBAAoB,WAAW;AAAA,QACrD,UAAU,CAAC,OAAO;AAAA,MACpB;AAAA,MACA,aAAa,OAAO,QAAQ;AAC1B,4BAAoB,GAAG;AACvB,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,SAAS,OAAO,KAAK;AACvC,mBAAW,OAAO,oBAAoB,OAAO,oBAAoB,OAAO,eAAe;AACvF,mBAAW,OAAO,aAAa,OAAO,SAAS;AAC/C,eAAO,iBAAiB,KAAK,wBAAwB,WAAW,MAAM,GAAG,KAAK;AAAA,MAChF;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,eAAO,wBAAwB,WAAW,IAAI,MAAM;AAAA,MACtD;AAAA,MACA,YAAY,OAAO,QAAQ,eAAe,qBAAqB,IAAI,MAAM;AAAA,MACzE,aAAa,CAAC,sBAAsB;AAAA,IACtC;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,QACX,YAAY,CAAC,QAAQ,eAAe,gBAAgB;AAAA,QACpD,UAAU,CAAC,eAAe;AAAA,MAC5B;AAAA,MACA,aAAa,OAAO,QAAQ;AAC1B,4BAAoB,GAAG;AACvB,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,eAAe,OAAO,eAAe,OAAO,UAAU;AACxE,mBAAW,OAAO,kBAAkB,OAAO,kBAAkB,OAAO,aAAa;AACjF,eAAO,iBAAiB,KAAK,mBAAmB,WAAW,MAAM,GAAG,KAAK;AAAA,MAC3E;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,eAAO,mBAAmB,WAAW,IAAI,MAAM;AAAA,MACjD;AAAA,MACA,YAAY,OAAO,QAAQ,eAAe,gBAAgB,IAAI,MAAM;AAAA,MACpE,aAAa,CAAC,iBAAiB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,QACX,YAAY,CAAC,gBAAgB,WAAW;AAAA,QACxC,UAAU,CAAC,iBAAiB,OAAO;AAAA,MACrC;AAAA,MACA,aAAa,OAAO,QAAQ;AAC1B,4BAAoB,GAAG;AACvB,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,aAAa,OAAO,SAAS;AAC/C,mBAAW,OAAO,YAAY,oBAAoB,MAAM,CAAC;AACzD,eAAO,iBAAiB,KAAK,yBAAyB,WAAW,MAAM,GAAG,KAAK;AAAA,MACjF;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,GAAG,UAAU,IAAI,MAAM,oBAAoB;AACnD,eAAO,yBAAyB,WAAW,IAAI,MAAM;AAAA,MACvD;AAAA,MACA,YAAY,OAAO,QAAQ,eAAe,+BAA+B,IAAI,MAAM;AAAA,MACnF,aAAa,CAAC,uBAAuB;AAAA,IACvC;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;AACR,MAAM,SAAS;",
   "names": []
 }

package/dist/modules/sales/lib/lineSnapshots.js

@@ -10,6 +10,9 @@ function toNumeric(value) {
 function mapPersistedLine(line) {
   return {
     id: line.id,
+    statusEntryId: line.statusEntryId ?? null,
+    catalogSnapshot: line.catalogSnapshot ? cloneJson(line.catalogSnapshot) : null,
+    promotionSnapshot: line.promotionSnapshot ? cloneJson(line.promotionSnapshot) : null,
     lineNumber: line.lineNumber,
     kind: line.kind,
     productId: line.productId ?? null,

package/dist/modules/sales/lib/lineSnapshots.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/sales/lib/lineSnapshots.ts"],
-  "sourcesContent": ["import type { SalesOrderLine, SalesQuoteLine } from '../data/entities'\nimport { cloneJson } from './json'\nimport type { SalesLineDiscountBasis, SalesLineSnapshot } from './types'\n\nfunction toNumeric(value: unknown): number {\n  if (typeof value === 'number' && Number.isFinite(value)) return value\n  if (typeof value === 'string' && value.trim().length) {\n    const parsed = Number(value)\n    if (Number.isFinite(parsed)) return parsed\n  }\n  return 0\n}\n\nfunction mapPersistedLine(line: SalesOrderLine | SalesQuoteLine): SalesLineSnapshot {\n  return {\n    id: line.id,\n    lineNumber: line.lineNumber,\n    kind: line.kind,\n    productId: line.productId ?? null,\n    productVariantId: line.productVariantId ?? null,\n    name: line.name ?? null,\n    description: line.description ?? null,\n    comment: line.comment ?? null,\n    quantity: toNumeric(line.quantity),\n    quantityUnit: line.quantityUnit ?? null,\n    normalizedQuantity: toNumeric(line.normalizedQuantity ?? line.quantity),\n    normalizedUnit: line.normalizedUnit ?? line.quantityUnit ?? null,\n    uomSnapshot: line.uomSnapshot ? cloneJson(line.uomSnapshot) : null,\n    currencyCode: line.currencyCode,\n    unitPriceNet: toNumeric(line.unitPriceNet),\n    unitPriceGross: toNumeric(line.unitPriceGross),\n    discountAmount: toNumeric(line.discountAmount),\n    // The persisted column holds the discount for the whole line, so the\n    // calculation engine must not multiply it out by quantity again. This flag\n    // is the only thing standing between a round trip and a compounding\n    // re-inflation, and it is why mappers must never set `discountAmountBasis`\n    // instead \u2014 that one means \"a caller asserted this\".\n    discountAmountFromStoredRow: true,\n    discountPercent: toNumeric(line.discountPercent),\n    taxRate: toNumeric(line.taxRate),\n    taxAmount: toNumeric(line.taxAmount),\n    // The totals below are the engine's own previous output read back off the\n    // row, not something a caller asserted, so they are not reconciled against\n    // the recomputed net (#5644) \u2014 on a legacy row that divergence is the\n    // discount contract healing itself, not a caller mistake.\n    totalsFromStoredRow: true,\n    totalNetAmount: toNumeric(line.totalNetAmount),\n    totalGrossAmount: toNumeric(line.totalGrossAmount),\n    configuration: line.configuration ? cloneJson(line.configuration) : null,\n    promotionCode: line.promotionCode ?? null,\n    metadata: line.metadata ? cloneJson(line.metadata) : null,\n    customFieldSetId: line.customFieldSetId ?? null,\n  }\n}\n\n/**\n * Rebuild a calculation snapshot from a persisted order line.\n *\n * Shared by `commands/documents.ts` and `commands/returns.ts` on purpose: the\n * two files used to carry byte-identical copies, and that duplication is why\n * the return flows kept the discount defect after the order flows were fixed.\n */\nexport function mapOrderLineEntityToSnapshot(line: SalesOrderLine): SalesLineSnapshot {\n  return mapPersistedLine(line)\n}\n\nexport function mapQuoteLineEntityToSnapshot(line: SalesQuoteLine): SalesLineSnapshot {\n  return mapPersistedLine(line)\n}\n\ntype UpsertDiscountFields = Pick<\n  SalesLineSnapshot,\n  'discountAmount' | 'discountAmountBasis' | 'discountAmountFromStoredRow'\n>\n\n/**\n * Decide the discount fields of an upsert payload one operand at a time.\n *\n * A line upsert can source its amount from two places with opposite meanings: a\n * caller value, which is per unit unless the caller says otherwise, and the\n * stored row, which is always a line total. Collapsing them into a single\n * `caller ?? stored` expression means whichever origin the merged result is\n * tagged with is wrong half the time \u2014 and the half that breaks is the\n * upsert-existing path, which then re-inflates by a further factor of quantity\n * while looking perfectly correct.\n *\n * Keeping `null` rather than `0` for \"nothing supplied\" is deliberate too: the\n * column cannot represent that distinction, but the payload can, and the\n * calculation engine needs it to tell a suppressing zero from an absent value.\n */\nexport function resolveUpsertDiscountFields(\n  callerAmount: number | null | undefined,\n  callerBasis: SalesLineDiscountBasis | null | undefined,\n  existingSnapshot: Pick<SalesLineSnapshot, 'discountAmount'> | null | undefined,\n): UpsertDiscountFields {\n  if (callerAmount !== null && callerAmount !== undefined) {\n    return { discountAmount: callerAmount, discountAmountBasis: callerBasis ?? 'unit' }\n  }\n  return {\n    discountAmount: existingSnapshot?.discountAmount ?? null,\n    discountAmountFromStoredRow: existingSnapshot != null,\n  }\n}\n\n/**\n * Decide whether the `totalNetAmount` an upsert payload ends up carrying is a\n * caller assertion or a value that came back off the stored row.\n *\n * The upsert merges caller input over the existing snapshot, so the merged\n * total has two possible origins and only the caller one is worth reconciling\n * against the recomputed net (#5644): a value read back off the row is what the\n * engine itself wrote last time, and on a legacy row it is exactly what\n * recalculation is supposed to heal.\n */\nexport function resolveUpsertTotalsOrigin(\n  callerTotalNetAmount: number | null | undefined,\n  existingSnapshot: Pick<SalesLineSnapshot, 'totalNetAmount'> | null | undefined,\n): Pick<SalesLineSnapshot, 'totalsFromStoredRow'> {\n  if (callerTotalNetAmount !== null && callerTotalNetAmount !== undefined) return {}\n  return existingSnapshot != null ? { totalsFromStoredRow: true } : {}\n}\n"],
-  "mappings": "AACA,SAAS,iBAAiB;AAG1B,SAAS,UAAU,OAAwB;AACzC,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO;AAChE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,QAAQ;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,QAAI,OAAO,SAAS,MAAM,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAA0D;AAClF,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,YAAY,KAAK;AAAA,IACjB,MAAM,KAAK;AAAA,IACX,WAAW,KAAK,aAAa;AAAA,IAC7B,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,MAAM,KAAK,QAAQ;AAAA,IACnB,aAAa,KAAK,eAAe;AAAA,IACjC,SAAS,KAAK,WAAW;AAAA,IACzB,UAAU,UAAU,KAAK,QAAQ;AAAA,IACjC,cAAc,KAAK,gBAAgB;AAAA,IACnC,oBAAoB,UAAU,KAAK,sBAAsB,KAAK,QAAQ;AAAA,IACtE,gBAAgB,KAAK,kBAAkB,KAAK,gBAAgB;AAAA,IAC5D,aAAa,KAAK,cAAc,UAAU,KAAK,WAAW,IAAI;AAAA,IAC9D,cAAc,KAAK;AAAA,IACnB,cAAc,UAAU,KAAK,YAAY;AAAA,IACzC,gBAAgB,UAAU,KAAK,cAAc;AAAA,IAC7C,gBAAgB,UAAU,KAAK,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM7C,6BAA6B;AAAA,IAC7B,iBAAiB,UAAU,KAAK,eAAe;AAAA,IAC/C,SAAS,UAAU,KAAK,OAAO;AAAA,IAC/B,WAAW,UAAU,KAAK,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAKnC,qBAAqB;AAAA,IACrB,gBAAgB,UAAU,KAAK,cAAc;AAAA,IAC7C,kBAAkB,UAAU,KAAK,gBAAgB;AAAA,IACjD,eAAe,KAAK,gBAAgB,UAAU,KAAK,aAAa,IAAI;AAAA,IACpE,eAAe,KAAK,iBAAiB;AAAA,IACrC,UAAU,KAAK,WAAW,UAAU,KAAK,QAAQ,IAAI;AAAA,IACrD,kBAAkB,KAAK,oBAAoB;AAAA,EAC7C;AACF;AASO,SAAS,6BAA6B,MAAyC;AACpF,SAAO,iBAAiB,IAAI;AAC9B;AAEO,SAAS,6BAA6B,MAAyC;AACpF,SAAO,iBAAiB,IAAI;AAC9B;AAsBO,SAAS,4BACd,cACA,aACA,kBACsB;AACtB,MAAI,iBAAiB,QAAQ,iBAAiB,QAAW;AACvD,WAAO,EAAE,gBAAgB,cAAc,qBAAqB,eAAe,OAAO;AAAA,EACpF;AACA,SAAO;AAAA,IACL,gBAAgB,kBAAkB,kBAAkB;AAAA,IACpD,6BAA6B,oBAAoB;AAAA,EACnD;AACF;AAYO,SAAS,0BACd,sBACA,kBACgD;AAChD,MAAI,yBAAyB,QAAQ,yBAAyB,OAAW,QAAO,CAAC;AACjF,SAAO,oBAAoB,OAAO,EAAE,qBAAqB,KAAK,IAAI,CAAC;AACrE;",
+  "sourcesContent": ["import type { SalesOrderLine, SalesQuoteLine } from '../data/entities'\nimport { cloneJson } from './json'\nimport type { SalesLineDiscountBasis, SalesLineSnapshot } from './types'\n\nfunction toNumeric(value: unknown): number {\n  if (typeof value === 'number' && Number.isFinite(value)) return value\n  if (typeof value === 'string' && value.trim().length) {\n    const parsed = Number(value)\n    if (Number.isFinite(parsed)) return parsed\n  }\n  return 0\n}\n\n/**\n * A snapshot rebuilt from a persisted row, plus the columns the calculation\n * engine never reads but the write paths must carry back to the row.\n *\n * The line upsert, line delete and adjustment write paths all rebuild *every*\n * line of the document from these snapshots and then `Object.assign` the result\n * onto the existing entities. Anything the mapper drops is therefore not merely\n * absent from the calculation \u2014 it is written back as `null` over the stored\n * value of lines the caller never touched (#5911).\n */\nexport type SalesPersistedLineSnapshot = SalesLineSnapshot & {\n  statusEntryId: string | null\n  catalogSnapshot: Record<string, unknown> | null\n  promotionSnapshot: Record<string, unknown> | null\n}\n\nfunction mapPersistedLine(line: SalesOrderLine | SalesQuoteLine): SalesPersistedLineSnapshot {\n  return {\n    id: line.id,\n    statusEntryId: line.statusEntryId ?? null,\n    catalogSnapshot: line.catalogSnapshot ? cloneJson(line.catalogSnapshot) : null,\n    promotionSnapshot: line.promotionSnapshot ? cloneJson(line.promotionSnapshot) : null,\n    lineNumber: line.lineNumber,\n    kind: line.kind,\n    productId: line.productId ?? null,\n    productVariantId: line.productVariantId ?? null,\n    name: line.name ?? null,\n    description: line.description ?? null,\n    comment: line.comment ?? null,\n    quantity: toNumeric(line.quantity),\n    quantityUnit: line.quantityUnit ?? null,\n    normalizedQuantity: toNumeric(line.normalizedQuantity ?? line.quantity),\n    normalizedUnit: line.normalizedUnit ?? line.quantityUnit ?? null,\n    uomSnapshot: line.uomSnapshot ? cloneJson(line.uomSnapshot) : null,\n    currencyCode: line.currencyCode,\n    unitPriceNet: toNumeric(line.unitPriceNet),\n    unitPriceGross: toNumeric(line.unitPriceGross),\n    discountAmount: toNumeric(line.discountAmount),\n    // The persisted column holds the discount for the whole line, so the\n    // calculation engine must not multiply it out by quantity again. This flag\n    // is the only thing standing between a round trip and a compounding\n    // re-inflation, and it is why mappers must never set `discountAmountBasis`\n    // instead \u2014 that one means \"a caller asserted this\".\n    discountAmountFromStoredRow: true,\n    discountPercent: toNumeric(line.discountPercent),\n    taxRate: toNumeric(line.taxRate),\n    taxAmount: toNumeric(line.taxAmount),\n    // The totals below are the engine's own previous output read back off the\n    // row, not something a caller asserted, so they are not reconciled against\n    // the recomputed net (#5644) \u2014 on a legacy row that divergence is the\n    // discount contract healing itself, not a caller mistake.\n    totalsFromStoredRow: true,\n    totalNetAmount: toNumeric(line.totalNetAmount),\n    totalGrossAmount: toNumeric(line.totalGrossAmount),\n    configuration: line.configuration ? cloneJson(line.configuration) : null,\n    promotionCode: line.promotionCode ?? null,\n    metadata: line.metadata ? cloneJson(line.metadata) : null,\n    customFieldSetId: line.customFieldSetId ?? null,\n  }\n}\n\n/**\n * Rebuild a calculation snapshot from a persisted order line.\n *\n * Shared by `commands/documents.ts` and `commands/returns.ts` on purpose: the\n * two files used to carry byte-identical copies, and that duplication is why\n * the return flows kept the discount defect after the order flows were fixed.\n */\nexport function mapOrderLineEntityToSnapshot(line: SalesOrderLine): SalesPersistedLineSnapshot {\n  return mapPersistedLine(line)\n}\n\nexport function mapQuoteLineEntityToSnapshot(line: SalesQuoteLine): SalesPersistedLineSnapshot {\n  return mapPersistedLine(line)\n}\n\ntype UpsertDiscountFields = Pick<\n  SalesLineSnapshot,\n  'discountAmount' | 'discountAmountBasis' | 'discountAmountFromStoredRow'\n>\n\n/**\n * Decide the discount fields of an upsert payload one operand at a time.\n *\n * A line upsert can source its amount from two places with opposite meanings: a\n * caller value, which is per unit unless the caller says otherwise, and the\n * stored row, which is always a line total. Collapsing them into a single\n * `caller ?? stored` expression means whichever origin the merged result is\n * tagged with is wrong half the time \u2014 and the half that breaks is the\n * upsert-existing path, which then re-inflates by a further factor of quantity\n * while looking perfectly correct.\n *\n * Keeping `null` rather than `0` for \"nothing supplied\" is deliberate too: the\n * column cannot represent that distinction, but the payload can, and the\n * calculation engine needs it to tell a suppressing zero from an absent value.\n */\nexport function resolveUpsertDiscountFields(\n  callerAmount: number | null | undefined,\n  callerBasis: SalesLineDiscountBasis | null | undefined,\n  existingSnapshot: Pick<SalesLineSnapshot, 'discountAmount'> | null | undefined,\n): UpsertDiscountFields {\n  if (callerAmount !== null && callerAmount !== undefined) {\n    return { discountAmount: callerAmount, discountAmountBasis: callerBasis ?? 'unit' }\n  }\n  return {\n    discountAmount: existingSnapshot?.discountAmount ?? null,\n    discountAmountFromStoredRow: existingSnapshot != null,\n  }\n}\n\n/**\n * Decide whether the `totalNetAmount` an upsert payload ends up carrying is a\n * caller assertion or a value that came back off the stored row.\n *\n * The upsert merges caller input over the existing snapshot, so the merged\n * total has two possible origins and only the caller one is worth reconciling\n * against the recomputed net (#5644): a value read back off the row is what the\n * engine itself wrote last time, and on a legacy row it is exactly what\n * recalculation is supposed to heal.\n */\nexport function resolveUpsertTotalsOrigin(\n  callerTotalNetAmount: number | null | undefined,\n  existingSnapshot: Pick<SalesLineSnapshot, 'totalNetAmount'> | null | undefined,\n): Pick<SalesLineSnapshot, 'totalsFromStoredRow'> {\n  if (callerTotalNetAmount !== null && callerTotalNetAmount !== undefined) return {}\n  return existingSnapshot != null ? { totalsFromStoredRow: true } : {}\n}\n"],
+  "mappings": "AACA,SAAS,iBAAiB;AAG1B,SAAS,UAAU,OAAwB;AACzC,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO;AAChE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,QAAQ;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,QAAI,OAAO,SAAS,MAAM,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAkBA,SAAS,iBAAiB,MAAmE;AAC3F,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,eAAe,KAAK,iBAAiB;AAAA,IACrC,iBAAiB,KAAK,kBAAkB,UAAU,KAAK,eAAe,IAAI;AAAA,IAC1E,mBAAmB,KAAK,oBAAoB,UAAU,KAAK,iBAAiB,IAAI;AAAA,IAChF,YAAY,KAAK;AAAA,IACjB,MAAM,KAAK;AAAA,IACX,WAAW,KAAK,aAAa;AAAA,IAC7B,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,MAAM,KAAK,QAAQ;AAAA,IACnB,aAAa,KAAK,eAAe;AAAA,IACjC,SAAS,KAAK,WAAW;AAAA,IACzB,UAAU,UAAU,KAAK,QAAQ;AAAA,IACjC,cAAc,KAAK,gBAAgB;AAAA,IACnC,oBAAoB,UAAU,KAAK,sBAAsB,KAAK,QAAQ;AAAA,IACtE,gBAAgB,KAAK,kBAAkB,KAAK,gBAAgB;AAAA,IAC5D,aAAa,KAAK,cAAc,UAAU,KAAK,WAAW,IAAI;AAAA,IAC9D,cAAc,KAAK;AAAA,IACnB,cAAc,UAAU,KAAK,YAAY;AAAA,IACzC,gBAAgB,UAAU,KAAK,cAAc;AAAA,IAC7C,gBAAgB,UAAU,KAAK,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM7C,6BAA6B;AAAA,IAC7B,iBAAiB,UAAU,KAAK,eAAe;AAAA,IAC/C,SAAS,UAAU,KAAK,OAAO;AAAA,IAC/B,WAAW,UAAU,KAAK,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAKnC,qBAAqB;AAAA,IACrB,gBAAgB,UAAU,KAAK,cAAc;AAAA,IAC7C,kBAAkB,UAAU,KAAK,gBAAgB;AAAA,IACjD,eAAe,KAAK,gBAAgB,UAAU,KAAK,aAAa,IAAI;AAAA,IACpE,eAAe,KAAK,iBAAiB;AAAA,IACrC,UAAU,KAAK,WAAW,UAAU,KAAK,QAAQ,IAAI;AAAA,IACrD,kBAAkB,KAAK,oBAAoB;AAAA,EAC7C;AACF;AASO,SAAS,6BAA6B,MAAkD;AAC7F,SAAO,iBAAiB,IAAI;AAC9B;AAEO,SAAS,6BAA6B,MAAkD;AAC7F,SAAO,iBAAiB,IAAI;AAC9B;AAsBO,SAAS,4BACd,cACA,aACA,kBACsB;AACtB,MAAI,iBAAiB,QAAQ,iBAAiB,QAAW;AACvD,WAAO,EAAE,gBAAgB,cAAc,qBAAqB,eAAe,OAAO;AAAA,EACpF;AACA,SAAO;AAAA,IACL,gBAAgB,kBAAkB,kBAAkB;AAAA,IACpD,6BAA6B,oBAAoB;AAAA,EACnD;AACF;AAYO,SAAS,0BACd,sBACA,kBACgD;AAChD,MAAI,yBAAyB,QAAQ,yBAAyB,OAAW,QAAO,CAAC;AACjF,SAAO,oBAAoB,OAAO,EAAE,qBAAqB,KAAK,IAAI,CAAC;AACrE;",
   "names": []
 }

package/dist/modules/wms/search.js

@@ -37,13 +37,13 @@ function buildWarehousePresenter(t, record) {
   const label = t("wms.search.badge.warehouse", "Warehouse");
   const title = pickString(record.name, record.code, record.id) ?? label;
   const subtitle = formatSubtitle(record.code, record.city, record.country);
-  return { title, subtitle, icon: "warehouse", badge: label };
+  return { title, subtitle, icon: "warehouse" };
 }
 function buildLocationPresenter(t, record) {
   const label = t("wms.search.badge.location", "Location");
   const title = pickString(record.code, record.id) ?? label;
   const subtitle = formatSubtitle(record.type, record.warehouse_id ?? record.warehouseId);
-  return { title, subtitle, icon: "map-pinned", badge: label };
+  return { title, subtitle, icon: "map-pinned" };
 }
 function buildInventoryProfilePresenter(t, record) {
   const label = t("wms.search.badge.inventoryProfile", "Inventory profile");
@@ -55,13 +55,13 @@ function buildInventoryProfilePresenter(t, record) {
     record.default_uom ?? record.defaultUom,
     variantId ? t("wms.search.profile.variantScoped", "Variant-scoped") : t("wms.search.profile.productScoped", "Product-scoped")
   );
-  return { title, subtitle, icon: "boxes", badge: label };
+  return { title, subtitle, icon: "boxes" };
 }
 function buildLotPresenter(t, record) {
   const label = t("wms.search.badge.lot", "Inventory lot");
   const title = pickString(record.lot_number, record.lotNumber, record.batch_number, record.batchNumber, record.id) ?? label;
   const subtitle = formatSubtitle(record.catalog_variant_id ?? record.catalogVariantId, record.status, record.expires_at ?? record.expiresAt);
-  return { title, subtitle, icon: "package-search", badge: label };
+  return { title, subtitle, icon: "package-search" };
 }
 const searchConfig = {
   entities: [

package/dist/modules/wms/search.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/wms/search.ts"],
-  "sourcesContent": ["import type {\n  SearchBuildContext,\n  SearchIndexSource,\n  SearchModuleConfig,\n  SearchResultPresenter,\n} from '@open-mercato/shared/modules/search'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { E } from '#generated/entities.ids.generated'\n\nconst WMS_ROOT_URL = '/backend/wms'\nconst WMS_INVENTORY_URL = '/backend/wms/inventory'\nconst WMS_CONFIG_URL = '/backend/config/wms'\n\nfunction pickString(...candidates: Array<unknown>): string | null {\n  for (const candidate of candidates) {\n    if (typeof candidate !== 'string') continue\n    const trimmed = candidate.trim()\n    if (trimmed.length > 0) return trimmed\n  }\n  return null\n}\n\nfunction appendLine(lines: string[], label: string, value: unknown) {\n  if (value === null || value === undefined) return\n  const text = Array.isArray(value)\n    ? value.map((item) => (item == null ? '' : String(item))).filter(Boolean).join(', ')\n    : typeof value === 'object'\n      ? JSON.stringify(value)\n      : String(value)\n  if (!text.trim()) return\n  lines.push(`${label}: ${text}`)\n}\n\nfunction formatSubtitle(...parts: Array<unknown>): string | undefined {\n  const values = parts\n    .map((part) => (part == null ? '' : String(part)).trim())\n    .filter(Boolean)\n  if (!values.length) return undefined\n  return values.join(' \u00B7 ')\n}\n\nfunction buildIndexSource(\n  ctx: SearchBuildContext,\n  presenter: SearchResultPresenter,\n  lines: string[],\n): SearchIndexSource | null {\n  for (const [key, value] of Object.entries(ctx.customFields)) {\n    appendLine(lines, key.replace(/^cf:/, ''), value)\n  }\n  if (!lines.length) return null\n  return {\n    text: lines,\n    presenter,\n    checksumSource: { record: ctx.record, customFields: ctx.customFields },\n  }\n}\n\nfunction buildWarehousePresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.warehouse', 'Warehouse')\n  const title = pickString(record.name, record.code, record.id) ?? label\n  const subtitle = formatSubtitle(record.code, record.city, record.country)\n  return { title, subtitle, icon: 'warehouse', badge: label }\n}\n\nfunction buildLocationPresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.location', 'Location')\n  const title = pickString(record.code, record.id) ?? label\n  const subtitle = formatSubtitle(record.type, record.warehouse_id ?? record.warehouseId)\n  return { title, subtitle, icon: 'map-pinned', badge: label }\n}\n\nfunction buildInventoryProfilePresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.inventoryProfile', 'Inventory profile')\n  const productId = pickString(record.catalog_product_id, record.catalogProductId)\n  const variantId = pickString(record.catalog_variant_id, record.catalogVariantId)\n  const title = variantId || productId || pickString(record.id) || label\n  const subtitle = formatSubtitle(\n    record.default_strategy ?? record.defaultStrategy,\n    record.default_uom ?? record.defaultUom,\n    variantId ? t('wms.search.profile.variantScoped', 'Variant-scoped') : t('wms.search.profile.productScoped', 'Product-scoped'),\n  )\n  return { title, subtitle, icon: 'boxes', badge: label }\n}\n\nfunction buildLotPresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.lot', 'Inventory lot')\n  const title = pickString(record.lot_number, record.lotNumber, record.batch_number, record.batchNumber, record.id) ?? label\n  const subtitle = formatSubtitle(record.catalog_variant_id ?? record.catalogVariantId, record.status, record.expires_at ?? record.expiresAt)\n  return { title, subtitle, icon: 'package-search', badge: label }\n}\n\nexport const searchConfig: SearchModuleConfig = {\n  entities: [\n    {\n      entityId: E.wms.warehouse,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 8,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Name', record.name)\n        appendLine(lines, 'Code', record.code)\n        appendLine(lines, 'City', record.city)\n        appendLine(lines, 'Country', record.country)\n        appendLine(lines, 'Timezone', record.timezone)\n        return buildIndexSource(ctx, buildWarehousePresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildWarehousePresenter(t, ctx.record)\n      },\n      resolveUrl: async () => WMS_CONFIG_URL,\n      fieldPolicy: {\n        searchable: ['name', 'code', 'city', 'country', 'timezone'],\n      },\n    },\n    {\n      entityId: E.wms.warehouse_location,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 7,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Code', record.code)\n        appendLine(lines, 'Type', record.type)\n        appendLine(lines, 'Warehouse', record.warehouse_id ?? record.warehouseId)\n        appendLine(lines, 'Parent', record.parent_id ?? record.parentId)\n        appendLine(lines, 'Capacity units', record.capacity_units ?? record.capacityUnits)\n        appendLine(lines, 'Capacity weight', record.capacity_weight ?? record.capacityWeight)\n        return buildIndexSource(ctx, buildLocationPresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildLocationPresenter(t, ctx.record)\n      },\n      resolveUrl: async () => WMS_CONFIG_URL,\n      fieldPolicy: {\n        searchable: ['code', 'type', 'warehouse_id', 'parent_id', 'capacity_units', 'capacity_weight'],\n      },\n    },\n    {\n      entityId: E.wms.product_inventory_profile,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 8,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Product', record.catalog_product_id ?? record.catalogProductId)\n        appendLine(lines, 'Variant', record.catalog_variant_id ?? record.catalogVariantId)\n        appendLine(lines, 'Default UOM', record.default_uom ?? record.defaultUom)\n        appendLine(lines, 'Strategy', record.default_strategy ?? record.defaultStrategy)\n        appendLine(lines, 'Reorder point', record.reorder_point ?? record.reorderPoint)\n        appendLine(lines, 'Safety stock', record.safety_stock ?? record.safetyStock)\n        appendLine(lines, 'Track lot', record.track_lot ?? record.trackLot)\n        appendLine(lines, 'Track serial', record.track_serial ?? record.trackSerial)\n        appendLine(lines, 'Track expiration', record.track_expiration ?? record.trackExpiration)\n        return buildIndexSource(ctx, buildInventoryProfilePresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildInventoryProfilePresenter(t, ctx.record)\n      },\n      resolveUrl: async (ctx) => {\n        const variantId = pickString(ctx.record.catalog_variant_id, ctx.record.catalogVariantId)\n        if (variantId) return `${WMS_ROOT_URL}/sku/${variantId}`\n        return WMS_CONFIG_URL\n      },\n      resolveLinks: async () => [{ href: WMS_INVENTORY_URL, label: 'Inventory console', kind: 'secondary' }],\n      fieldPolicy: {\n        searchable: [\n          'catalog_product_id',\n          'catalog_variant_id',\n          'default_uom',\n          'default_strategy',\n          'reorder_point',\n          'safety_stock',\n        ],\n      },\n    },\n    {\n      entityId: E.wms.inventory_lot,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 6,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Lot number', record.lot_number ?? record.lotNumber)\n        appendLine(lines, 'Batch number', record.batch_number ?? record.batchNumber)\n        appendLine(lines, 'SKU', record.sku)\n        appendLine(lines, 'Variant', record.catalog_variant_id ?? record.catalogVariantId)\n        appendLine(lines, 'Status', record.status)\n        appendLine(lines, 'Expires at', record.expires_at ?? record.expiresAt)\n        return buildIndexSource(ctx, buildLotPresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildLotPresenter(t, ctx.record)\n      },\n      resolveUrl: async (ctx) => {\n        const id = pickString(ctx.record.id)\n        if (id) return `${WMS_ROOT_URL}/lot/${id}`\n        return WMS_ROOT_URL\n      },\n      resolveLinks: async () => [{ href: WMS_CONFIG_URL, label: 'WMS configuration', kind: 'secondary' }],\n      fieldPolicy: {\n        searchable: ['lot_number', 'batch_number', 'sku', 'catalog_variant_id', 'status', 'expires_at'],\n      },\n    },\n  ],\n}\n\nexport default searchConfig\nexport const config = searchConfig\n"],
-  "mappings": "AAOA,SAAS,2BAA2B;AACpC,SAAS,SAAS;AAElB,MAAM,eAAe;AACrB,MAAM,oBAAoB;AAC1B,MAAM,iBAAiB;AAEvB,SAAS,cAAc,YAA2C;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,SAAU;AACnC,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAiB,OAAe,OAAgB;AAClE,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAC5B,MAAM,IAAI,CAAC,SAAU,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAE,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,IACjF,OAAO,UAAU,WACf,KAAK,UAAU,KAAK,IACpB,OAAO,KAAK;AAClB,MAAI,CAAC,KAAK,KAAK,EAAG;AAClB,QAAM,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE;AAChC;AAEA,SAAS,kBAAkB,OAA2C;AACpE,QAAM,SAAS,MACZ,IAAI,CAAC,UAAU,QAAQ,OAAO,KAAK,OAAO,IAAI,GAAG,KAAK,CAAC,EACvD,OAAO,OAAO;AACjB,MAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,SAAO,OAAO,KAAK,QAAK;AAC1B;AAEA,SAAS,iBACP,KACA,WACA,OAC0B;AAC1B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,YAAY,GAAG;AAC3D,eAAW,OAAO,IAAI,QAAQ,QAAQ,EAAE,GAAG,KAAK;AAAA,EAClD;AACA,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,gBAAgB,EAAE,QAAQ,IAAI,QAAQ,cAAc,IAAI,aAAa;AAAA,EACvE;AACF;AAEA,SAAS,wBACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,8BAA8B,WAAW;AACzD,QAAM,QAAQ,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,EAAE,KAAK;AACjE,QAAM,WAAW,eAAe,OAAO,MAAM,OAAO,MAAM,OAAO,OAAO;AACxE,SAAO,EAAE,OAAO,UAAU,MAAM,aAAa,OAAO,MAAM;AAC5D;AAEA,SAAS,uBACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,6BAA6B,UAAU;AACvD,QAAM,QAAQ,WAAW,OAAO,MAAM,OAAO,EAAE,KAAK;AACpD,QAAM,WAAW,eAAe,OAAO,MAAM,OAAO,gBAAgB,OAAO,WAAW;AACtF,SAAO,EAAE,OAAO,UAAU,MAAM,cAAc,OAAO,MAAM;AAC7D;AAEA,SAAS,+BACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,qCAAqC,mBAAmB;AACxE,QAAM,YAAY,WAAW,OAAO,oBAAoB,OAAO,gBAAgB;AAC/E,QAAM,YAAY,WAAW,OAAO,oBAAoB,OAAO,gBAAgB;AAC/E,QAAM,QAAQ,aAAa,aAAa,WAAW,OAAO,EAAE,KAAK;AACjE,QAAM,WAAW;AAAA,IACf,OAAO,oBAAoB,OAAO;AAAA,IAClC,OAAO,eAAe,OAAO;AAAA,IAC7B,YAAY,EAAE,oCAAoC,gBAAgB,IAAI,EAAE,oCAAoC,gBAAgB;AAAA,EAC9H;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,SAAS,OAAO,MAAM;AACxD;AAEA,SAAS,kBACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,wBAAwB,eAAe;AACvD,QAAM,QAAQ,WAAW,OAAO,YAAY,OAAO,WAAW,OAAO,cAAc,OAAO,aAAa,OAAO,EAAE,KAAK;AACrH,QAAM,WAAW,eAAe,OAAO,sBAAsB,OAAO,kBAAkB,OAAO,QAAQ,OAAO,cAAc,OAAO,SAAS;AAC1I,SAAO,EAAE,OAAO,UAAU,MAAM,kBAAkB,OAAO,MAAM;AACjE;AAEO,MAAM,eAAmC;AAAA,EAC9C,UAAU;AAAA,IACR;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,WAAW,OAAO,OAAO;AAC3C,mBAAW,OAAO,YAAY,OAAO,QAAQ;AAC7C,eAAO,iBAAiB,KAAK,wBAAwB,GAAG,MAAM,GAAG,KAAK;AAAA,MACxE;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,wBAAwB,GAAG,IAAI,MAAM;AAAA,MAC9C;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,aAAa;AAAA,QACX,YAAY,CAAC,QAAQ,QAAQ,QAAQ,WAAW,UAAU;AAAA,MAC5D;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,aAAa,OAAO,gBAAgB,OAAO,WAAW;AACxE,mBAAW,OAAO,UAAU,OAAO,aAAa,OAAO,QAAQ;AAC/D,mBAAW,OAAO,kBAAkB,OAAO,kBAAkB,OAAO,aAAa;AACjF,mBAAW,OAAO,mBAAmB,OAAO,mBAAmB,OAAO,cAAc;AACpF,eAAO,iBAAiB,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK;AAAA,MACvE;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,uBAAuB,GAAG,IAAI,MAAM;AAAA,MAC7C;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,aAAa;AAAA,QACX,YAAY,CAAC,QAAQ,QAAQ,gBAAgB,aAAa,kBAAkB,iBAAiB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,WAAW,OAAO,sBAAsB,OAAO,gBAAgB;AACjF,mBAAW,OAAO,WAAW,OAAO,sBAAsB,OAAO,gBAAgB;AACjF,mBAAW,OAAO,eAAe,OAAO,eAAe,OAAO,UAAU;AACxE,mBAAW,OAAO,YAAY,OAAO,oBAAoB,OAAO,eAAe;AAC/E,mBAAW,OAAO,iBAAiB,OAAO,iBAAiB,OAAO,YAAY;AAC9E,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,aAAa,OAAO,aAAa,OAAO,QAAQ;AAClE,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,oBAAoB,OAAO,oBAAoB,OAAO,eAAe;AACvF,eAAO,iBAAiB,KAAK,+BAA+B,GAAG,MAAM,GAAG,KAAK;AAAA,MAC/E;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,+BAA+B,GAAG,IAAI,MAAM;AAAA,MACrD;AAAA,MACA,YAAY,OAAO,QAAQ;AACzB,cAAM,YAAY,WAAW,IAAI,OAAO,oBAAoB,IAAI,OAAO,gBAAgB;AACvF,YAAI,UAAW,QAAO,GAAG,YAAY,QAAQ,SAAS;AACtD,eAAO;AAAA,MACT;AAAA,MACA,cAAc,YAAY,CAAC,EAAE,MAAM,mBAAmB,OAAO,qBAAqB,MAAM,YAAY,CAAC;AAAA,MACrG,aAAa;AAAA,QACX,YAAY;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,cAAc,OAAO,cAAc,OAAO,SAAS;AACrE,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,OAAO,OAAO,GAAG;AACnC,mBAAW,OAAO,WAAW,OAAO,sBAAsB,OAAO,gBAAgB;AACjF,mBAAW,OAAO,UAAU,OAAO,MAAM;AACzC,mBAAW,OAAO,cAAc,OAAO,cAAc,OAAO,SAAS;AACrE,eAAO,iBAAiB,KAAK,kBAAkB,GAAG,MAAM,GAAG,KAAK;AAAA,MAClE;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,kBAAkB,GAAG,IAAI,MAAM;AAAA,MACxC;AAAA,MACA,YAAY,OAAO,QAAQ;AACzB,cAAM,KAAK,WAAW,IAAI,OAAO,EAAE;AACnC,YAAI,GAAI,QAAO,GAAG,YAAY,QAAQ,EAAE;AACxC,eAAO;AAAA,MACT;AAAA,MACA,cAAc,YAAY,CAAC,EAAE,MAAM,gBAAgB,OAAO,qBAAqB,MAAM,YAAY,CAAC;AAAA,MAClG,aAAa;AAAA,QACX,YAAY,CAAC,cAAc,gBAAgB,OAAO,sBAAsB,UAAU,YAAY;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;AACR,MAAM,SAAS;",
+  "sourcesContent": ["import type {\n  SearchBuildContext,\n  SearchIndexSource,\n  SearchModuleConfig,\n  SearchResultPresenter,\n} from '@open-mercato/shared/modules/search'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { E } from '#generated/entities.ids.generated'\n\nconst WMS_ROOT_URL = '/backend/wms'\nconst WMS_INVENTORY_URL = '/backend/wms/inventory'\nconst WMS_CONFIG_URL = '/backend/config/wms'\n\nfunction pickString(...candidates: Array<unknown>): string | null {\n  for (const candidate of candidates) {\n    if (typeof candidate !== 'string') continue\n    const trimmed = candidate.trim()\n    if (trimmed.length > 0) return trimmed\n  }\n  return null\n}\n\nfunction appendLine(lines: string[], label: string, value: unknown) {\n  if (value === null || value === undefined) return\n  const text = Array.isArray(value)\n    ? value.map((item) => (item == null ? '' : String(item))).filter(Boolean).join(', ')\n    : typeof value === 'object'\n      ? JSON.stringify(value)\n      : String(value)\n  if (!text.trim()) return\n  lines.push(`${label}: ${text}`)\n}\n\nfunction formatSubtitle(...parts: Array<unknown>): string | undefined {\n  const values = parts\n    .map((part) => (part == null ? '' : String(part)).trim())\n    .filter(Boolean)\n  if (!values.length) return undefined\n  return values.join(' \u00B7 ')\n}\n\nfunction buildIndexSource(\n  ctx: SearchBuildContext,\n  presenter: SearchResultPresenter,\n  lines: string[],\n): SearchIndexSource | null {\n  for (const [key, value] of Object.entries(ctx.customFields)) {\n    appendLine(lines, key.replace(/^cf:/, ''), value)\n  }\n  if (!lines.length) return null\n  return {\n    text: lines,\n    presenter,\n    checksumSource: { record: ctx.record, customFields: ctx.customFields },\n  }\n}\n\nfunction buildWarehousePresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.warehouse', 'Warehouse')\n  const title = pickString(record.name, record.code, record.id) ?? label\n  const subtitle = formatSubtitle(record.code, record.city, record.country)\n  return { title, subtitle, icon: 'warehouse' }\n}\n\nfunction buildLocationPresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.location', 'Location')\n  const title = pickString(record.code, record.id) ?? label\n  const subtitle = formatSubtitle(record.type, record.warehouse_id ?? record.warehouseId)\n  return { title, subtitle, icon: 'map-pinned' }\n}\n\nfunction buildInventoryProfilePresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.inventoryProfile', 'Inventory profile')\n  const productId = pickString(record.catalog_product_id, record.catalogProductId)\n  const variantId = pickString(record.catalog_variant_id, record.catalogVariantId)\n  const title = variantId || productId || pickString(record.id) || label\n  const subtitle = formatSubtitle(\n    record.default_strategy ?? record.defaultStrategy,\n    record.default_uom ?? record.defaultUom,\n    variantId ? t('wms.search.profile.variantScoped', 'Variant-scoped') : t('wms.search.profile.productScoped', 'Product-scoped'),\n  )\n  return { title, subtitle, icon: 'boxes' }\n}\n\nfunction buildLotPresenter(\n  t: TranslateFn,\n  record: Record<string, unknown>,\n): SearchResultPresenter {\n  const label = t('wms.search.badge.lot', 'Inventory lot')\n  const title = pickString(record.lot_number, record.lotNumber, record.batch_number, record.batchNumber, record.id) ?? label\n  const subtitle = formatSubtitle(record.catalog_variant_id ?? record.catalogVariantId, record.status, record.expires_at ?? record.expiresAt)\n  return { title, subtitle, icon: 'package-search' }\n}\n\nexport const searchConfig: SearchModuleConfig = {\n  entities: [\n    {\n      entityId: E.wms.warehouse,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 8,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Name', record.name)\n        appendLine(lines, 'Code', record.code)\n        appendLine(lines, 'City', record.city)\n        appendLine(lines, 'Country', record.country)\n        appendLine(lines, 'Timezone', record.timezone)\n        return buildIndexSource(ctx, buildWarehousePresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildWarehousePresenter(t, ctx.record)\n      },\n      resolveUrl: async () => WMS_CONFIG_URL,\n      fieldPolicy: {\n        searchable: ['name', 'code', 'city', 'country', 'timezone'],\n      },\n    },\n    {\n      entityId: E.wms.warehouse_location,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 7,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Code', record.code)\n        appendLine(lines, 'Type', record.type)\n        appendLine(lines, 'Warehouse', record.warehouse_id ?? record.warehouseId)\n        appendLine(lines, 'Parent', record.parent_id ?? record.parentId)\n        appendLine(lines, 'Capacity units', record.capacity_units ?? record.capacityUnits)\n        appendLine(lines, 'Capacity weight', record.capacity_weight ?? record.capacityWeight)\n        return buildIndexSource(ctx, buildLocationPresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildLocationPresenter(t, ctx.record)\n      },\n      resolveUrl: async () => WMS_CONFIG_URL,\n      fieldPolicy: {\n        searchable: ['code', 'type', 'warehouse_id', 'parent_id', 'capacity_units', 'capacity_weight'],\n      },\n    },\n    {\n      entityId: E.wms.product_inventory_profile,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 8,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Product', record.catalog_product_id ?? record.catalogProductId)\n        appendLine(lines, 'Variant', record.catalog_variant_id ?? record.catalogVariantId)\n        appendLine(lines, 'Default UOM', record.default_uom ?? record.defaultUom)\n        appendLine(lines, 'Strategy', record.default_strategy ?? record.defaultStrategy)\n        appendLine(lines, 'Reorder point', record.reorder_point ?? record.reorderPoint)\n        appendLine(lines, 'Safety stock', record.safety_stock ?? record.safetyStock)\n        appendLine(lines, 'Track lot', record.track_lot ?? record.trackLot)\n        appendLine(lines, 'Track serial', record.track_serial ?? record.trackSerial)\n        appendLine(lines, 'Track expiration', record.track_expiration ?? record.trackExpiration)\n        return buildIndexSource(ctx, buildInventoryProfilePresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildInventoryProfilePresenter(t, ctx.record)\n      },\n      resolveUrl: async (ctx) => {\n        const variantId = pickString(ctx.record.catalog_variant_id, ctx.record.catalogVariantId)\n        if (variantId) return `${WMS_ROOT_URL}/sku/${variantId}`\n        return WMS_CONFIG_URL\n      },\n      resolveLinks: async () => [{ href: WMS_INVENTORY_URL, label: 'Inventory console', kind: 'secondary' }],\n      fieldPolicy: {\n        searchable: [\n          'catalog_product_id',\n          'catalog_variant_id',\n          'default_uom',\n          'default_strategy',\n          'reorder_point',\n          'safety_stock',\n        ],\n      },\n    },\n    {\n      entityId: E.wms.inventory_lot,\n      aclFeatures: ['wms.view'],\n      enabled: true,\n      priority: 6,\n      buildSource: async (ctx) => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Lot number', record.lot_number ?? record.lotNumber)\n        appendLine(lines, 'Batch number', record.batch_number ?? record.batchNumber)\n        appendLine(lines, 'SKU', record.sku)\n        appendLine(lines, 'Variant', record.catalog_variant_id ?? record.catalogVariantId)\n        appendLine(lines, 'Status', record.status)\n        appendLine(lines, 'Expires at', record.expires_at ?? record.expiresAt)\n        return buildIndexSource(ctx, buildLotPresenter(t, record), lines)\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildLotPresenter(t, ctx.record)\n      },\n      resolveUrl: async (ctx) => {\n        const id = pickString(ctx.record.id)\n        if (id) return `${WMS_ROOT_URL}/lot/${id}`\n        return WMS_ROOT_URL\n      },\n      resolveLinks: async () => [{ href: WMS_CONFIG_URL, label: 'WMS configuration', kind: 'secondary' }],\n      fieldPolicy: {\n        searchable: ['lot_number', 'batch_number', 'sku', 'catalog_variant_id', 'status', 'expires_at'],\n      },\n    },\n  ],\n}\n\nexport default searchConfig\nexport const config = searchConfig\n"],
+  "mappings": "AAOA,SAAS,2BAA2B;AACpC,SAAS,SAAS;AAElB,MAAM,eAAe;AACrB,MAAM,oBAAoB;AAC1B,MAAM,iBAAiB;AAEvB,SAAS,cAAc,YAA2C;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,SAAU;AACnC,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAiB,OAAe,OAAgB;AAClE,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAC5B,MAAM,IAAI,CAAC,SAAU,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAE,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,IACjF,OAAO,UAAU,WACf,KAAK,UAAU,KAAK,IACpB,OAAO,KAAK;AAClB,MAAI,CAAC,KAAK,KAAK,EAAG;AAClB,QAAM,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE;AAChC;AAEA,SAAS,kBAAkB,OAA2C;AACpE,QAAM,SAAS,MACZ,IAAI,CAAC,UAAU,QAAQ,OAAO,KAAK,OAAO,IAAI,GAAG,KAAK,CAAC,EACvD,OAAO,OAAO;AACjB,MAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,SAAO,OAAO,KAAK,QAAK;AAC1B;AAEA,SAAS,iBACP,KACA,WACA,OAC0B;AAC1B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,YAAY,GAAG;AAC3D,eAAW,OAAO,IAAI,QAAQ,QAAQ,EAAE,GAAG,KAAK;AAAA,EAClD;AACA,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,gBAAgB,EAAE,QAAQ,IAAI,QAAQ,cAAc,IAAI,aAAa;AAAA,EACvE;AACF;AAEA,SAAS,wBACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,8BAA8B,WAAW;AACzD,QAAM,QAAQ,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,EAAE,KAAK;AACjE,QAAM,WAAW,eAAe,OAAO,MAAM,OAAO,MAAM,OAAO,OAAO;AACxE,SAAO,EAAE,OAAO,UAAU,MAAM,YAAY;AAC9C;AAEA,SAAS,uBACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,6BAA6B,UAAU;AACvD,QAAM,QAAQ,WAAW,OAAO,MAAM,OAAO,EAAE,KAAK;AACpD,QAAM,WAAW,eAAe,OAAO,MAAM,OAAO,gBAAgB,OAAO,WAAW;AACtF,SAAO,EAAE,OAAO,UAAU,MAAM,aAAa;AAC/C;AAEA,SAAS,+BACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,qCAAqC,mBAAmB;AACxE,QAAM,YAAY,WAAW,OAAO,oBAAoB,OAAO,gBAAgB;AAC/E,QAAM,YAAY,WAAW,OAAO,oBAAoB,OAAO,gBAAgB;AAC/E,QAAM,QAAQ,aAAa,aAAa,WAAW,OAAO,EAAE,KAAK;AACjE,QAAM,WAAW;AAAA,IACf,OAAO,oBAAoB,OAAO;AAAA,IAClC,OAAO,eAAe,OAAO;AAAA,IAC7B,YAAY,EAAE,oCAAoC,gBAAgB,IAAI,EAAE,oCAAoC,gBAAgB;AAAA,EAC9H;AACA,SAAO,EAAE,OAAO,UAAU,MAAM,QAAQ;AAC1C;AAEA,SAAS,kBACP,GACA,QACuB;AACvB,QAAM,QAAQ,EAAE,wBAAwB,eAAe;AACvD,QAAM,QAAQ,WAAW,OAAO,YAAY,OAAO,WAAW,OAAO,cAAc,OAAO,aAAa,OAAO,EAAE,KAAK;AACrH,QAAM,WAAW,eAAe,OAAO,sBAAsB,OAAO,kBAAkB,OAAO,QAAQ,OAAO,cAAc,OAAO,SAAS;AAC1I,SAAO,EAAE,OAAO,UAAU,MAAM,iBAAiB;AACnD;AAEO,MAAM,eAAmC;AAAA,EAC9C,UAAU;AAAA,IACR;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,WAAW,OAAO,OAAO;AAC3C,mBAAW,OAAO,YAAY,OAAO,QAAQ;AAC7C,eAAO,iBAAiB,KAAK,wBAAwB,GAAG,MAAM,GAAG,KAAK;AAAA,MACxE;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,wBAAwB,GAAG,IAAI,MAAM;AAAA,MAC9C;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,aAAa;AAAA,QACX,YAAY,CAAC,QAAQ,QAAQ,QAAQ,WAAW,UAAU;AAAA,MAC5D;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,aAAa,OAAO,gBAAgB,OAAO,WAAW;AACxE,mBAAW,OAAO,UAAU,OAAO,aAAa,OAAO,QAAQ;AAC/D,mBAAW,OAAO,kBAAkB,OAAO,kBAAkB,OAAO,aAAa;AACjF,mBAAW,OAAO,mBAAmB,OAAO,mBAAmB,OAAO,cAAc;AACpF,eAAO,iBAAiB,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK;AAAA,MACvE;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,uBAAuB,GAAG,IAAI,MAAM;AAAA,MAC7C;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,aAAa;AAAA,QACX,YAAY,CAAC,QAAQ,QAAQ,gBAAgB,aAAa,kBAAkB,iBAAiB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,WAAW,OAAO,sBAAsB,OAAO,gBAAgB;AACjF,mBAAW,OAAO,WAAW,OAAO,sBAAsB,OAAO,gBAAgB;AACjF,mBAAW,OAAO,eAAe,OAAO,eAAe,OAAO,UAAU;AACxE,mBAAW,OAAO,YAAY,OAAO,oBAAoB,OAAO,eAAe;AAC/E,mBAAW,OAAO,iBAAiB,OAAO,iBAAiB,OAAO,YAAY;AAC9E,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,aAAa,OAAO,aAAa,OAAO,QAAQ;AAClE,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,oBAAoB,OAAO,oBAAoB,OAAO,eAAe;AACvF,eAAO,iBAAiB,KAAK,+BAA+B,GAAG,MAAM,GAAG,KAAK;AAAA,MAC/E;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,+BAA+B,GAAG,IAAI,MAAM;AAAA,MACrD;AAAA,MACA,YAAY,OAAO,QAAQ;AACzB,cAAM,YAAY,WAAW,IAAI,OAAO,oBAAoB,IAAI,OAAO,gBAAgB;AACvF,YAAI,UAAW,QAAO,GAAG,YAAY,QAAQ,SAAS;AACtD,eAAO;AAAA,MACT;AAAA,MACA,cAAc,YAAY,CAAC,EAAE,MAAM,mBAAmB,OAAO,qBAAqB,MAAM,YAAY,CAAC;AAAA,MACrG,aAAa;AAAA,QACX,YAAY;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU,EAAE,IAAI;AAAA,MAChB,aAAa,CAAC,UAAU;AAAA,MACxB,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAAQ;AAC1B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,cAAc,OAAO,cAAc,OAAO,SAAS;AACrE,mBAAW,OAAO,gBAAgB,OAAO,gBAAgB,OAAO,WAAW;AAC3E,mBAAW,OAAO,OAAO,OAAO,GAAG;AACnC,mBAAW,OAAO,WAAW,OAAO,sBAAsB,OAAO,gBAAgB;AACjF,mBAAW,OAAO,UAAU,OAAO,MAAM;AACzC,mBAAW,OAAO,cAAc,OAAO,cAAc,OAAO,SAAS;AACrE,eAAO,iBAAiB,KAAK,kBAAkB,GAAG,MAAM,GAAG,KAAK;AAAA,MAClE;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,kBAAkB,GAAG,IAAI,MAAM;AAAA,MACxC;AAAA,MACA,YAAY,OAAO,QAAQ;AACzB,cAAM,KAAK,WAAW,IAAI,OAAO,EAAE;AACnC,YAAI,GAAI,QAAO,GAAG,YAAY,QAAQ,EAAE;AACxC,eAAO;AAAA,MACT;AAAA,MACA,cAAc,YAAY,CAAC,EAAE,MAAM,gBAAgB,OAAO,qBAAqB,MAAM,YAAY,CAAC;AAAA,MAClG,aAAa;AAAA,QACX,YAAY,CAAC,cAAc,gBAAgB,OAAO,sBAAsB,UAAU,YAAY;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;AACR,MAAM,SAAS;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.7.1-develop.7195.1.b5efd1d51a",
+  "version": "0.7.1-develop.7200.1.8ba2d93d3f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7195.1.b5efd1d51a",
-    "@open-mercato/shared": "0.7.1-develop.7195.1.b5efd1d51a",
-    "@open-mercato/ui": "0.7.1-develop.7195.1.b5efd1d51a",
+    "@open-mercato/ai-assistant": "0.7.1-develop.7200.1.8ba2d93d3f",
+    "@open-mercato/shared": "0.7.1-develop.7200.1.8ba2d93d3f",
+    "@open-mercato/ui": "0.7.1-develop.7200.1.8ba2d93d3f",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7195.1.b5efd1d51a",
-    "@open-mercato/shared": "0.7.1-develop.7195.1.b5efd1d51a",
-    "@open-mercato/ui": "0.7.1-develop.7195.1.b5efd1d51a",
+    "@open-mercato/ai-assistant": "0.7.1-develop.7200.1.8ba2d93d3f",
+    "@open-mercato/shared": "0.7.1-develop.7200.1.8ba2d93d3f",
+    "@open-mercato/ui": "0.7.1-develop.7200.1.8ba2d93d3f",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/auth/lib/setup-app.ts

@@ -470,6 +470,12 @@ export async function setupInitialTenant(
     }
   }
 
+  // Custom roles are often created inside onTenantCreated hooks, so they did not
+  // exist yet when ensureDefaultRoleAcls ran above and were skipped there. Sync
+  // again now that the hooks have had a chance to create them — idempotent, same
+  // pattern as the `mercato auth sync-role-acls` CLI command.
+  await ensureCustomRoleAcls(em, tenantId, resolvedModules)
+
   return {
     tenantId,
     organizationId,

package/src/modules/entities/lib/field-definitions.ts

@@ -36,6 +36,7 @@ const CONFIG_PASSTHROUGH_KEYS: Array<keyof CustomFieldDefinition> = [
   'formEditable',
   'listVisible',
   'indexed',
+  'encrypted',
   'priority',
   'editor',
   'input',
@@ -65,6 +66,12 @@ function configEquals(a: unknown, b: unknown): boolean {
   return JSON.stringify(normalizeValue(a ?? null)) === JSON.stringify(normalizeValue(b ?? null))
 }
 
+function hasEncryptionEnabled(definition: CustomFieldDef | null): boolean {
+  const config = definition?.configJson
+  if (!config || typeof config !== 'object') return false
+  return (config as Record<string, unknown>).encrypted === true
+}
+
 export async function ensureCustomFieldDefinitions(
   em: EntityManager,
   sets: FieldSetInput[],
@@ -103,6 +110,14 @@ export async function ensureCustomFieldDefinitions(
         if (value !== undefined) configJson[key] = value as unknown
       }
 
+      // configJson is rebuilt from the declaration, so a field encrypted through the
+      // definitions API would lose the flag on the next install while its stored
+      // values stay ciphertext the read path no longer decrypts. Keep an enabled flag
+      // unless the declaration turns it off with an explicit `encrypted: false`.
+      if (configJson.encrypted === undefined && hasEncryptionEnabled(existing)) {
+        configJson.encrypted = true
+      }
+
       if (!existing) {
         if (!scope.dryRun) {
           const createdDef = em.create(CustomFieldDef, {

package/src/modules/entities/lib/install-from-ce.ts

@@ -49,6 +49,7 @@ const FIELD_DETAIL_KEYS: Array<keyof CustomFieldDefinition> = [
   'formEditable',
   'listVisible',
   'indexed',
+  'encrypted',
   'priority',
   'editor',
   'input',

package/src/modules/eudr/i18n/de.json

@@ -744,5 +744,8 @@
   "eudr.supplierPanel.viewSubmissions": "Einreichungen anzeigen",
   "eudr.supplierPanel.warnings": "Mit Warnungen",
   "eudr.warnings.harvestBeforeCutoff": "Ernte vor dem EUDR-Stichtag",
-  "eudr.warnings.speciesMissing": "Bei einer verknüpften Holz-Zuordnung fehlt der wissenschaftliche oder gebräuchliche Artname"
+  "eudr.warnings.speciesMissing": "Bei einer verknüpften Holz-Zuordnung fehlt der wissenschaftliche oder gebräuchliche Artname",
+  "search.entityType.eudr.eudr_due_diligence_statement": "DDS-Erklärung",
+  "search.entityType.eudr.eudr_evidence_submission": "Nachweiseinreichung",
+  "search.entityType.eudr.eudr_plot": "Parzelle"
 }

package/src/modules/eudr/i18n/en.json

@@ -744,5 +744,8 @@
   "eudr.supplierPanel.viewSubmissions": "View submissions",
   "eudr.supplierPanel.warnings": "With warnings",
   "eudr.warnings.harvestBeforeCutoff": "Harvest before EUDR cutoff",
-  "eudr.warnings.speciesMissing": "A linked wood mapping is missing a scientific or common species name"
+  "eudr.warnings.speciesMissing": "A linked wood mapping is missing a scientific or common species name",
+  "search.entityType.eudr.eudr_due_diligence_statement": "DDS statement",
+  "search.entityType.eudr.eudr_evidence_submission": "Evidence submission",
+  "search.entityType.eudr.eudr_plot": "Plot"
 }

package/src/modules/eudr/i18n/es.json

@@ -744,5 +744,8 @@
   "eudr.supplierPanel.viewSubmissions": "Ver presentaciones",
   "eudr.supplierPanel.warnings": "Con advertencias",
   "eudr.warnings.harvestBeforeCutoff": "Cosecha anterior a la fecha de corte EUDR",
-  "eudr.warnings.speciesMissing": "A una asignación de madera vinculada le falta el nombre científico o común de la especie"
+  "eudr.warnings.speciesMissing": "A una asignación de madera vinculada le falta el nombre científico o común de la especie",
+  "search.entityType.eudr.eudr_due_diligence_statement": "Declaración DDS",
+  "search.entityType.eudr.eudr_evidence_submission": "Envío de evidencia",
+  "search.entityType.eudr.eudr_plot": "Parcela"
 }

package/src/modules/eudr/i18n/ko.json

@@ -744,5 +744,8 @@
   "eudr.supplierPanel.viewSubmissions": "제출물 보기",
   "eudr.supplierPanel.warnings": "경고 있음",
   "eudr.warnings.harvestBeforeCutoff": "EUDR 기준일 이전 수확",
-  "eudr.warnings.speciesMissing": "연결된 목재 매핑에 학명 또는 일반명이 누락되었습니다"
+  "eudr.warnings.speciesMissing": "연결된 목재 매핑에 학명 또는 일반명이 누락되었습니다",
+  "search.entityType.eudr.eudr_due_diligence_statement": "DDS 진술서",
+  "search.entityType.eudr.eudr_evidence_submission": "증거 제출물",
+  "search.entityType.eudr.eudr_plot": "구획"
 }

package/src/modules/eudr/i18n/pl.json

@@ -744,5 +744,8 @@
   "eudr.supplierPanel.viewSubmissions": "Zobacz zgłoszenia",
   "eudr.supplierPanel.warnings": "Z ostrzeżeniami",
   "eudr.warnings.harvestBeforeCutoff": "Zbiory przed datą graniczną EUDR",
-  "eudr.warnings.speciesMissing": "W powiązanym mapowaniu drewna brakuje naukowej lub zwyczajowej nazwy gatunku"
+  "eudr.warnings.speciesMissing": "W powiązanym mapowaniu drewna brakuje naukowej lub zwyczajowej nazwy gatunku",
+  "search.entityType.eudr.eudr_due_diligence_statement": "Oświadczenie DDS",
+  "search.entityType.eudr.eudr_evidence_submission": "Zgłoszenie dowodów",
+  "search.entityType.eudr.eudr_plot": "Działka"
 }

package/src/modules/eudr/search.ts

@@ -95,23 +95,21 @@ function resolveSupplierName(record: Record<string, unknown>): string | null {
 }
 
 function buildStatementPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {
-  const label = translate('eudr.search.badge.statement', 'DDS statement')
   const title = readRecordText(record, 'title') ?? translate('eudr.common.recordUnavailable')
   const subtitle = formatSubtitle(
     readRecordText(record, 'reference_number', 'referenceNumber'),
     translateToken(translate, 'eudr.commodity', readRecordText(record, 'commodity')),
   )
-  return { title, subtitle, icon: 'file-check', badge: label }
+  return { title, subtitle, icon: 'file-check' }
 }
 
 function buildPlotPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {
-  const label = translate('eudr.search.badge.plot', 'Plot')
   const title = readRecordText(record, 'name') ?? translate('eudr.common.recordUnavailable')
   const subtitle = formatSubtitle(
     readRecordText(record, 'origin_country', 'originCountry'),
     translateToken(translate, 'eudr.plotType', readRecordText(record, 'plot_type', 'plotType')),
   )
-  return { title, subtitle, icon: 'map-pin', badge: label }
+  return { title, subtitle, icon: 'map-pin' }
 }
 
 function buildSubmissionPresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {
@@ -125,7 +123,7 @@ function buildSubmissionPresenter(translate: TranslateFn, record: Record<string,
     supplierName,
     translateToken(translate, 'eudr.submissionStatus', readRecordText(record, 'status')),
   )
-  return { title, subtitle, icon: 'package', badge: label }
+  return { title, subtitle, icon: 'package' }
 }
 
 export const searchConfig: SearchModuleConfig = {

package/src/modules/sales/lib/lineSnapshots.ts

@@ -11,9 +11,28 @@ function toNumeric(value: unknown): number {
   return 0
 }
 
-function mapPersistedLine(line: SalesOrderLine | SalesQuoteLine): SalesLineSnapshot {
+/**
+ * A snapshot rebuilt from a persisted row, plus the columns the calculation
+ * engine never reads but the write paths must carry back to the row.
+ *
+ * The line upsert, line delete and adjustment write paths all rebuild *every*
+ * line of the document from these snapshots and then `Object.assign` the result
+ * onto the existing entities. Anything the mapper drops is therefore not merely
+ * absent from the calculation — it is written back as `null` over the stored
+ * value of lines the caller never touched (#5911).
+ */
+export type SalesPersistedLineSnapshot = SalesLineSnapshot & {
+  statusEntryId: string | null
+  catalogSnapshot: Record<string, unknown> | null
+  promotionSnapshot: Record<string, unknown> | null
+}
+
+function mapPersistedLine(line: SalesOrderLine | SalesQuoteLine): SalesPersistedLineSnapshot {
   return {
     id: line.id,
+    statusEntryId: line.statusEntryId ?? null,
+    catalogSnapshot: line.catalogSnapshot ? cloneJson(line.catalogSnapshot) : null,
+    promotionSnapshot: line.promotionSnapshot ? cloneJson(line.promotionSnapshot) : null,
     lineNumber: line.lineNumber,
     kind: line.kind,
     productId: line.productId ?? null,
@@ -60,11 +79,11 @@ function mapPersistedLine(line: SalesOrderLine | SalesQuoteLine): SalesLineSnaps
  * two files used to carry byte-identical copies, and that duplication is why
  * the return flows kept the discount defect after the order flows were fixed.
  */
-export function mapOrderLineEntityToSnapshot(line: SalesOrderLine): SalesLineSnapshot {
+export function mapOrderLineEntityToSnapshot(line: SalesOrderLine): SalesPersistedLineSnapshot {
   return mapPersistedLine(line)
 }
 
-export function mapQuoteLineEntityToSnapshot(line: SalesQuoteLine): SalesLineSnapshot {
+export function mapQuoteLineEntityToSnapshot(line: SalesQuoteLine): SalesPersistedLineSnapshot {
   return mapPersistedLine(line)
 }
 

package/src/modules/wms/i18n/de.json

@@ -1,4 +1,8 @@
 {
+  "search.entityType.wms.inventory_lot": "Lagerbestand",
+  "search.entityType.wms.product_inventory_profile": "Bestandsprofil",
+  "search.entityType.wms.warehouse": "Lager",
+  "search.entityType.wms.warehouse_location": "Lagerort",
   "wms.audit.inventory.receive": "Wareneingang buchen",
   "wms.audit.salesOrder.assignWarehouse": "Lager dem Auftrag zuweisen",
   "wms.audit.salesOrder.reRunReservation": "Reservierung für Auftrag erneut ausführen",

package/src/modules/wms/i18n/en.json

@@ -1,4 +1,8 @@
 {
+  "search.entityType.wms.inventory_lot": "Inventory lot",
+  "search.entityType.wms.product_inventory_profile": "Inventory profile",
+  "search.entityType.wms.warehouse": "Warehouse",
+  "search.entityType.wms.warehouse_location": "Location",
   "wms.audit.inventory.receive": "Receive inventory",
   "wms.audit.salesOrder.assignWarehouse": "Assign warehouse to order",
   "wms.audit.salesOrder.reRunReservation": "Re-run reservation for order",

package/src/modules/wms/i18n/es.json

@@ -1,4 +1,8 @@
 {
+  "search.entityType.wms.inventory_lot": "Lote de inventario",
+  "search.entityType.wms.product_inventory_profile": "Perfil de inventario",
+  "search.entityType.wms.warehouse": "Almacén",
+  "search.entityType.wms.warehouse_location": "Ubicación",
   "wms.audit.inventory.receive": "Recibir inventario",
   "wms.audit.salesOrder.assignWarehouse": "Asignar almacén al pedido",
   "wms.audit.salesOrder.reRunReservation": "Volver a ejecutar la reserva del pedido",

package/src/modules/wms/i18n/ko.json

@@ -1,4 +1,8 @@
 {
+  "search.entityType.wms.inventory_lot": "재고 로트",
+  "search.entityType.wms.product_inventory_profile": "재고 프로필",
+  "search.entityType.wms.warehouse": "창고",
+  "search.entityType.wms.warehouse_location": "위치",
   "wms.audit.inventory.receive": "재고 수령",
   "wms.audit.salesOrder.assignWarehouse": "주문할 창고 지정",
   "wms.audit.salesOrder.reRunReservation": "주문 예약 재실행",

package/src/modules/wms/i18n/pl.json

@@ -1,4 +1,8 @@
 {
+  "search.entityType.wms.inventory_lot": "Partia zapasu",
+  "search.entityType.wms.product_inventory_profile": "Profil zapasu",
+  "search.entityType.wms.warehouse": "Magazyn",
+  "search.entityType.wms.warehouse_location": "Lokalizacja",
   "wms.audit.inventory.receive": "Przyjmij zapas",
   "wms.audit.salesOrder.assignWarehouse": "Przypisz magazyn do zamówienia",
   "wms.audit.salesOrder.reRunReservation": "Ponów rezerwację dla zamówienia",

package/src/modules/wms/search.ts

@@ -63,7 +63,7 @@ function buildWarehousePresenter(
   const label = t('wms.search.badge.warehouse', 'Warehouse')
   const title = pickString(record.name, record.code, record.id) ?? label
   const subtitle = formatSubtitle(record.code, record.city, record.country)
-  return { title, subtitle, icon: 'warehouse', badge: label }
+  return { title, subtitle, icon: 'warehouse' }
 }
 
 function buildLocationPresenter(
@@ -73,7 +73,7 @@ function buildLocationPresenter(
   const label = t('wms.search.badge.location', 'Location')
   const title = pickString(record.code, record.id) ?? label
   const subtitle = formatSubtitle(record.type, record.warehouse_id ?? record.warehouseId)
-  return { title, subtitle, icon: 'map-pinned', badge: label }
+  return { title, subtitle, icon: 'map-pinned' }
 }
 
 function buildInventoryProfilePresenter(
@@ -89,7 +89,7 @@ function buildInventoryProfilePresenter(
     record.default_uom ?? record.defaultUom,
     variantId ? t('wms.search.profile.variantScoped', 'Variant-scoped') : t('wms.search.profile.productScoped', 'Product-scoped'),
   )
-  return { title, subtitle, icon: 'boxes', badge: label }
+  return { title, subtitle, icon: 'boxes' }
 }
 
 function buildLotPresenter(
@@ -99,7 +99,7 @@ function buildLotPresenter(
   const label = t('wms.search.badge.lot', 'Inventory lot')
   const title = pickString(record.lot_number, record.lotNumber, record.batch_number, record.batchNumber, record.id) ?? label
   const subtitle = formatSubtitle(record.catalog_variant_id ?? record.catalogVariantId, record.status, record.expires_at ?? record.expiresAt)
-  return { title, subtitle, icon: 'package-search', badge: label }
+  return { title, subtitle, icon: 'package-search' }
 }
 
 export const searchConfig: SearchModuleConfig = {