@open-mercato/core 0.8.1-develop.7275.1.f772b944d4 → 0.8.1-develop.7295.1.d0e0e33014

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 5016 entry points
+[build:core] found 5018 entry points
 [build:core] built successfully
 [build:core:generated] found 232 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/users/acl/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/api/users/acl/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminUserTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  AUTH_USER_ACL_UPDATE_COMMAND_ID,\n  type AclUpdateResult,\n  type UserAclUpdateInput,\n} from '@open-mercato/core/modules/auth/commands/acl'\n\nconst getSchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  userId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst userAclResponseSchema = z.object({\n  hasCustomAcl: z.boolean(),\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst userAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst userAclErrorSchema = z.object({ error: z.string() })\n\ntype TenantResolution = { tenantId: string | null } | { error: NextResponse }\n\n/**\n * The single tenant scope both handlers work in. GET and PUT MUST resolve it the\n * same way: the admin user form PUTs the ACL panel's state on every save, so a\n * GET that reads a narrower scope than the PUT writes hands the operator an\n * empty form and turns the next name-only edit into a silent revocation, with no\n * `updatedAt` to arm the optimistic lock against it.\n *\n * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a\n * global account legitimately signs in with `auth.tenantId === null` and the\n * scope has to come from the target user instead. That fallback is reserved for\n * a super admin: for anyone else it would let the target pick the scope its own\n * access is then checked against, and it decrypts a possibly foreign user ahead\n * of every guard. A tenant-less non-super-admin therefore resolves to `null`,\n * which reads as \"no override\" and refuses to write \u2014 the behaviour that held\n * before this route resolved a scope at all. The read is also skipped whenever a\n * tenant is already known.\n *\n * An explicit `tenantId` wins, mirroring the role ACL route (additive there and\n * here; no caller sends it yet) \u2014 but only for a super admin or for the actor's\n * own tenant, so it cannot widen anyone's reach. The result is that for a\n * non-super-admin the resolved scope is always the actor's own.\n */\nasync function resolveAclTenantId(args: {\n  em: EntityManager\n  auth: NonNullable<AuthContext>\n  actorIsSuperAdmin: boolean\n  userId: string\n  requestedTenantId?: string\n}): Promise<TenantResolution> {\n  const authTenantId = args.auth.tenantId ?? null\n  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {\n    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }\n  }\n  const known = args.requestedTenantId ?? authTenantId\n  if (known) return { tenantId: known }\n  if (!args.actorIsSuperAdmin) return { tenantId: null }\n  const targetUser = await findOneWithDecryption(\n    args.em,\n    User,\n    { id: args.userId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: args.auth.orgId ?? null },\n  )\n  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    userId: url.searchParams.get('userId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  // An unresolvable scope reads as \"no override\", which is what PUT then refuses\n  // to write (`Tenant required`) \u2014 so the pair still cannot destroy a row.\n  const tenantId = resolution.tenantId\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const acl = tenantId\n    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n    : null\n  const response = acl\n    ? {\n        hasCustomAcl: true,\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.userId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.user_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId,\n    query: { userId: parsed.data.userId, tenantId },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  // The scope the row is read and written in. `auth.tenantId` is `string | null`\n  // \u2014 never `undefined`, since every producer normalizes with `?? null` \u2014 so the\n  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched\n  // no row, leaving create/update to fail the NOT NULL constraint and clear to\n  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500\n  // into a working, correctly scoped write.\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  const tenantId = resolution.tenantId\n  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits\n  // cannot silently clobber each other (#2055). Strictly additive \u2014 a no-op when\n  // the client sends no expected-version header; skipped when no ACL row exists.\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.user_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false\n  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []\n  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null\n\n  // A per-user ACL is an absolute override, so an omitted dimension must keep\n  // its stored value. Normalizing an omitted `features` to `[]` or an omitted\n  // `organizations` to `null` turned a single-dimension edit into a silent\n  // clear, deleting the row and widening the user back to their full role.\n  const featuresWereProvided = parsed.data.features !== undefined\n  const requestedFeatures = featuresWereProvided\n    ? normalizeGrantFeatureList(parsed.data.features)\n    : existingFeatures\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n\n  try {\n    await assertActorCanGrantAcl({\n      em: em as EntityManager,\n      rbacService: rbacService as RbacService,\n      actorUserId: auth.sub,\n      tenantId: actorTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // An omitted feature list is already stored and in effect. Re-sanitizing it\n  // during an unrelated organization edit would silently revoke grants the\n  // actor did not touch, so only an explicitly submitted list is sanitized.\n  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can grant super admin access.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  // Retaining an organization-only override with no features would revoke every\n  // role-granted feature instead of narrowing the role. Refuse that state rather\n  // than persisting it or silently dropping the organization scope.\n  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate(\n        'auth.acl.organizationWarning',\n        'Organization restrictions require at least one feature override. Add a feature or module wildcard, or clear the organization scope before saving.',\n      ),\n    }, { status: 400 })\n  }\n\n  // An unrestricted organization list carries no override on its own, and the guard\n  // above already refused the restricted-but-featureless case, so the override is\n  // custom exactly when it grants super admin or at least one feature.\n  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0\n\n  // What the caller asked for, handed to the command only when it exceeds what\n  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant\n  // escalations; what reaches the strip is quieter \u2014 a restricted grant the\n  // actor does hold \u2014 and it leaves before/after identical, so the audit entry\n  // would otherwise be indistinguishable from a no-op and skipped as one.\n  //\n  // Features are the only axis that can be trimmed. A super-admin request is\n  // either honoured or refused outright above, never silently downgraded, so\n  // comparing the two flags here would be dead weight.\n  //\n  // Deliberately independent of the `sanitized` response flag below:\n  // `hasRestrictedChanges` stays false when the trimmed result equals the\n  // existing ACL, to avoid nagging the user about a save that changed nothing \u2014\n  // but that is precisely an attempt the trail must keep.\n  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))\n\n  // Route the write through the command bus so the permission change lands in\n  // the action log. The command owns the transactional write (or removal) and\n  // the RBAC cache invalidation that used to live here.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  // A tenant-less actor edits an override in the target user's tenant, so their\n  // organization belongs to a tenant the entry is not about. The bus resolves\n  // the log row's organization as `metadata.organizationId ??\n  // ctx.selectedOrganizationId ?? ctx.auth.orgId` \u2014 a `??` chain, so the\n  // handler's `resolveOrganizationId` cannot express \"explicitly no\n  // organization\" and the actor's would be restored. Strip it from the context\n  // instead, exactly as the roles route does: otherwise the entry carries a\n  // (target tenant, foreign organization) pair that `ActionLogService` \u2014 which\n  // filters organization with strict equality \u2014 can never surface for anyone.\n  const isForeignTenant = tenantId !== (auth.tenantId ?? null)\n  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth: isForeignTenant ? { ...auth, orgId: null } : auth,\n    organizationScope: null,\n    selectedOrganizationId: actorOrgId,\n    organizationIds: actorOrgId ? [actorOrgId] : null,\n    request: req,\n  }\n  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {\n    input: {\n      userId: parsed.data.userId,\n      tenantId,\n      isSuperAdmin: effectiveIsSuperAdmin,\n      features: effectiveFeatures,\n      organizations: requestedOrganizations,\n      clear: !hasCustomAcl,\n      requested: strippedFeatures.length ? { features: requestedFeatures } : null,\n    },\n    ctx: commandCtx,\n  })\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin),\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\n// Whether the caller expressed an intentional narrowing. `null` and `__all__`\n// are the two documented ways to say \"every organization\"; an empty list is the\n// editor's \"no organization picked\" state (\"Empty = all organizations\"), which\n// is not a restriction an administrator chose. Only a concrete list narrows, so\n// only a concrete list has to justify itself against the feature grant below.\nfunction hasOrganizationRestriction(organizations: string[] | null): boolean {\n  if (!organizations || organizations.length === 0) return false\n  return !organizations.includes('__all__')\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction hasRestrictedChanges(requested: string[], effective: string[], existing: string[]): boolean {\n  if (requested.length === effective.length) return false\n  const effectiveSet = new Set(effective)\n  const existingSet = new Set(existing)\n  // If the effective set matches existing, we only trimmed restricted duplicates and should not report\n  if (effectiveSet.size === existingSet.size) {\n    let identical = true\n    for (const value of effectiveSet) {\n      if (!existingSet.has(value)) {\n        identical = false\n        break\n      }\n    }\n    if (identical) return false\n  }\n  return true\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch user ACL',\n      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },\n        { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user ACL',\n      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. Authorization evaluates the merged ACL, so a partial request returns 403 when a preserved grant is outside the actor\\'s grantable ACL. An organization-scoped non-super-admin override requires at least one feature grant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8CAA8C;AACvD,SAAS,2BAA2B;AAEpC,SAAS,MAAM,eAAe;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,6BAA6B;AAEtC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,OAGK;AAEP,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AA0BzD,eAAe,mBAAmB,MAMJ;AAC5B,QAAM,eAAe,KAAK,KAAK,YAAY;AAC3C,MAAI,KAAK,qBAAqB,KAAK,sBAAsB,gBAAgB,CAAC,KAAK,mBAAmB;AAChG,WAAO,EAAE,OAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC7E;AACA,QAAM,QAAQ,KAAK,qBAAqB;AACxC,MAAI,MAAO,QAAO,EAAE,UAAU,MAAM;AACpC,MAAI,CAAC,KAAK,kBAAmB,QAAO,EAAE,UAAU,KAAK;AACrD,QAAM,aAAa,MAAM;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,IAAI,KAAK,OAAO;AAAA,IAClB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK,KAAK,SAAS,KAAK;AAAA,EAC5D;AACA,SAAO,EAAE,UAAU,YAAY,WAAW,OAAO,WAAW,QAAQ,IAAI,KAAK;AAC/E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAKnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAG7C,QAAM,WAAW,WAAW;AAE5B,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MAAM,WACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC,IACvE;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc;AAAA,IACd,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAEnG,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,SAAS;AAAA,IAC9C,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAMnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAQtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAC7C,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAErF,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC;AAInF,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,CAAC,CAAC,IAAI,eAAe;AACxD,QAAM,mBAAmB,MAAM,0BAA0B,IAAI,YAAY,IAAI,CAAC;AAC9E,QAAM,wBAAwB,MAAM,uBAAuB,IAAI,iBAAiB,IAAI;AAMpF,QAAM,uBAAuB,OAAO,KAAK,aAAa;AACtD,QAAM,oBAAoB,uBACtB,0BAA0B,OAAO,KAAK,QAAQ,IAC9C;AACJ,QAAM,yBAAyB,OAAO,KAAK,kBAAkB,SACzD,wBACA,uBAAuB,OAAO,KAAK,aAAa;AAEpD,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAE1D,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,MACV,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAKA,QAAM,oBAAoB,qBAAqB,CAAC,uBAC5C,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,yDAAyD;AAAA,IAC3E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,CAAC,yBAAyB,kBAAkB,WAAW,KAAK,2BAA2B,sBAAsB,GAAG;AAClH,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAKA,QAAM,eAAe,yBAAyB,kBAAkB,SAAS;AAgBzE,QAAM,mBAAmB,kBAAkB,OAAO,CAAC,YAAY,CAAC,kBAAkB,SAAS,OAAO,CAAC;AAKnG,QAAM,aAAa,UAAU,QAAQ,YAAY;AAUjD,QAAM,kBAAkB,cAAc,KAAK,YAAY;AACvD,QAAM,aAAa,kBAAkB,OAAO,KAAK,SAAS;AAC1D,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA,MAAM,kBAAkB,EAAE,GAAG,MAAM,OAAO,KAAK,IAAI;AAAA,IACnD,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,aAAa,CAAC,UAAU,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACA,QAAM,WAAW,QAA6C,iCAAiC;AAAA,IAC7F,OAAO;AAAA,MACL,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,OAAO,CAAC;AAAA,MACR,WAAW,iBAAiB,SAAS,EAAE,UAAU,kBAAkB,IAAI;AAAA,IACzE;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,qBAAqB,mBAAmB,mBAAmB,gBAAgB,KAAK,0BAA0B;AAAA,EAC9I,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAOA,SAAS,2BAA2B,eAAyC;AAC3E,MAAI,CAAC,iBAAiB,cAAc,WAAW,EAAG,QAAO;AACzD,SAAO,CAAC,cAAc,SAAS,SAAS;AAC1C;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,qBAAqB,WAAqB,WAAqB,UAA6B;AACnG,MAAI,UAAU,WAAW,UAAU,OAAQ,QAAO;AAClD,QAAM,eAAe,IAAI,IAAI,SAAS;AACtC,QAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,MAAI,aAAa,SAAS,YAAY,MAAM;AAC1C,QAAI,YAAY;AAChB,eAAW,SAAS,cAAc;AAChC,UAAI,CAAC,YAAY,IAAI,KAAK,GAAG;AAC3B,oBAAY;AACZ;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,mBAAmB;AAAA,MACnH;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,mBAAmB;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminUserTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  AUTH_USER_ACL_UPDATE_COMMAND_ID,\n  type AclUpdateResult,\n  type UserAclUpdateInput,\n} from '@open-mercato/core/modules/auth/commands/acl'\n\nconst getSchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  userId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst userAclResponseSchema = z.object({\n  hasCustomAcl: z.boolean(),\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst userAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst userAclErrorSchema = z.object({ error: z.string() })\n\ntype TenantResolution = { tenantId: string | null } | { error: NextResponse }\n\n/**\n * The single tenant scope both handlers work in. GET and PUT MUST resolve it the\n * same way: the admin user form PUTs the ACL panel's state on every save, so a\n * GET that reads a narrower scope than the PUT writes hands the operator an\n * empty form and turns the next name-only edit into a silent revocation, with no\n * `updatedAt` to arm the optimistic lock against it.\n *\n * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a\n * global account legitimately signs in with `auth.tenantId === null` and the\n * scope has to come from the target user instead. That fallback is reserved for\n * a super admin: for anyone else it would let the target pick the scope its own\n * access is then checked against, and it decrypts a possibly foreign user ahead\n * of every guard. A tenant-less non-super-admin therefore resolves to `null`,\n * which reads as \"no override\" and refuses to write \u2014 the behaviour that held\n * before this route resolved a scope at all. The read is also skipped whenever a\n * tenant is already known.\n *\n * An explicit `tenantId` wins, mirroring the role ACL route (additive there and\n * here; no caller sends it yet) \u2014 but only for a super admin or for the actor's\n * own tenant, so it cannot widen anyone's reach. The result is that for a\n * non-super-admin the resolved scope is always the actor's own.\n */\nasync function resolveAclTenantId(args: {\n  em: EntityManager\n  auth: NonNullable<AuthContext>\n  actorIsSuperAdmin: boolean\n  userId: string\n  requestedTenantId?: string\n}): Promise<TenantResolution> {\n  const authTenantId = args.auth.tenantId ?? null\n  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {\n    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }\n  }\n  const known = args.requestedTenantId ?? authTenantId\n  if (known) return { tenantId: known }\n  if (!args.actorIsSuperAdmin) return { tenantId: null }\n  const targetUser = await findOneWithDecryption(\n    args.em,\n    User,\n    { id: args.userId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: args.auth.orgId ?? null },\n  )\n  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    userId: url.searchParams.get('userId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  // An unresolvable scope reads as \"no override\", which is what PUT then refuses\n  // to write (`Tenant required`) \u2014 so the pair still cannot destroy a row.\n  const tenantId = resolution.tenantId\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const acl = tenantId\n    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n    : null\n  const response = acl\n    ? {\n        hasCustomAcl: true,\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.userId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.user_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId,\n    query: { userId: parsed.data.userId, tenantId },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  // The scope the row is read and written in. `auth.tenantId` is `string | null`\n  // \u2014 never `undefined`, since every producer normalizes with `?? null` \u2014 so the\n  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched\n  // no row, leaving create/update to fail the NOT NULL constraint and clear to\n  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500\n  // into a working, correctly scoped write.\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  const tenantId = resolution.tenantId\n  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits\n  // cannot silently clobber each other (#2055). Strictly additive \u2014 a no-op when\n  // the client sends no expected-version header; skipped when no ACL row exists.\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.user_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false\n  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []\n  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null\n\n  // A per-user ACL is an absolute override, so an omitted dimension must keep\n  // its stored value. Normalizing an omitted `features` to `[]` or an omitted\n  // `organizations` to `null` turned a single-dimension edit into a silent\n  // clear, deleting the row and widening the user back to their full role.\n  const featuresWereProvided = parsed.data.features !== undefined\n  const requestedFeatures = featuresWereProvided\n    ? normalizeGrantFeatureList(parsed.data.features)\n    : existingFeatures\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n\n  try {\n    await assertActorCanGrantAcl({\n      em: em as EntityManager,\n      rbacService: rbacService as RbacService,\n      actorUserId: auth.sub,\n      tenantId: actorTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // An omitted feature list is already stored and in effect. Re-sanitizing it\n  // during an unrelated organization edit would silently revoke grants the\n  // actor did not touch, so only an explicitly submitted list is sanitized.\n  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can grant super admin access.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  // Retaining an organization-only override with no features would revoke every\n  // role-granted feature instead of narrowing the role. Refuse that state rather\n  // than persisting it or silently dropping the organization scope.\n  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate(\n        'auth.acl.organizationWarning',\n        'Organization restrictions require at least one feature override. Add a feature or module wildcard, or clear the organization scope before saving.',\n      ),\n    }, { status: 400 })\n  }\n\n  // An unrestricted organization list carries no override on its own, and the guard\n  // above already refused the restricted-but-featureless case, so the override is\n  // custom exactly when it grants super admin or at least one feature.\n  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0\n\n  // What the caller asked for, handed to the command only when it exceeds what\n  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant\n  // escalations; what reaches the strip is quieter \u2014 a restricted grant the\n  // actor does hold \u2014 and it leaves before/after identical, so the audit entry\n  // would otherwise be indistinguishable from a no-op and skipped as one.\n  //\n  // Features are the only axis that can be trimmed. A super-admin request is\n  // either honoured or refused outright above, never silently downgraded, so\n  // comparing the two flags here would be dead weight.\n  //\n  // Deliberately independent of the `sanitized` response flag below:\n  // `hasRestrictedChanges` stays false when the trimmed result equals the\n  // existing ACL, to avoid nagging the user about a save that changed nothing \u2014\n  // but that is precisely an attempt the trail must keep.\n  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))\n\n  // Route the write through the command bus so the permission change lands in\n  // the action log. The command owns the transactional write (or removal) and\n  // the RBAC cache invalidation that used to live here.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  // A tenant-less actor edits an override in the target user's tenant, so their\n  // organization belongs to a tenant the entry is not about. The bus resolves\n  // the log row's organization as `metadata.organizationId ??\n  // ctx.selectedOrganizationId ?? ctx.auth.orgId` \u2014 a `??` chain, so the\n  // handler's `resolveOrganizationId` cannot express \"explicitly no\n  // organization\" and the actor's would be restored. Strip it from the context\n  // instead, exactly as the roles route does: otherwise the entry carries a\n  // (target tenant, foreign organization) pair that `ActionLogService` \u2014 which\n  // filters organization with strict equality \u2014 can never surface for anyone.\n  const isForeignTenant = tenantId !== (auth.tenantId ?? null)\n  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth: isForeignTenant ? { ...auth, orgId: null } : auth,\n    organizationScope: null,\n    selectedOrganizationId: actorOrgId,\n    organizationIds: actorOrgId ? [actorOrgId] : null,\n    request: req,\n  }\n  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {\n    input: {\n      userId: parsed.data.userId,\n      tenantId,\n      isSuperAdmin: effectiveIsSuperAdmin,\n      features: effectiveFeatures,\n      organizations: requestedOrganizations,\n      clear: !hasCustomAcl,\n      requested: strippedFeatures.length ? { features: requestedFeatures } : null,\n    },\n    ctx: commandCtx,\n  })\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin),\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\n// Whether the caller expressed an intentional narrowing. `null` and `__all__`\n// are the two documented ways to say \"every organization\"; an empty list is the\n// editor's \"no organization picked\" state, which this route treats as\n// unrestricted rather than a deliberate restriction. Only a concrete list\n// narrows, so only a concrete list has to justify itself against the feature\n// grant below.\nfunction hasOrganizationRestriction(organizations: string[] | null): boolean {\n  if (!organizations || organizations.length === 0) return false\n  return !organizations.includes('__all__')\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction hasRestrictedChanges(requested: string[], effective: string[], existing: string[]): boolean {\n  if (requested.length === effective.length) return false\n  const effectiveSet = new Set(effective)\n  const existingSet = new Set(existing)\n  // If the effective set matches existing, we only trimmed restricted duplicates and should not report\n  if (effectiveSet.size === existingSet.size) {\n    let identical = true\n    for (const value of effectiveSet) {\n      if (!existingSet.has(value)) {\n        identical = false\n        break\n      }\n    }\n    if (identical) return false\n  }\n  return true\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch user ACL',\n      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },\n        { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user ACL',\n      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. Authorization evaluates the merged ACL, so a partial request returns 403 when a preserved grant is outside the actor\\'s grantable ACL. An organization-scoped non-super-admin override requires at least one feature grant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8CAA8C;AACvD,SAAS,2BAA2B;AAEpC,SAAS,MAAM,eAAe;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,6BAA6B;AAEtC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,OAGK;AAEP,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AA0BzD,eAAe,mBAAmB,MAMJ;AAC5B,QAAM,eAAe,KAAK,KAAK,YAAY;AAC3C,MAAI,KAAK,qBAAqB,KAAK,sBAAsB,gBAAgB,CAAC,KAAK,mBAAmB;AAChG,WAAO,EAAE,OAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC7E;AACA,QAAM,QAAQ,KAAK,qBAAqB;AACxC,MAAI,MAAO,QAAO,EAAE,UAAU,MAAM;AACpC,MAAI,CAAC,KAAK,kBAAmB,QAAO,EAAE,UAAU,KAAK;AACrD,QAAM,aAAa,MAAM;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,IAAI,KAAK,OAAO;AAAA,IAClB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK,KAAK,SAAS,KAAK;AAAA,EAC5D;AACA,SAAO,EAAE,UAAU,YAAY,WAAW,OAAO,WAAW,QAAQ,IAAI,KAAK;AAC/E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAKnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAG7C,QAAM,WAAW,WAAW;AAE5B,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MAAM,WACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC,IACvE;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc;AAAA,IACd,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAEnG,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,SAAS;AAAA,IAC9C,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAMnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAQtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAC7C,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAErF,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC;AAInF,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,CAAC,CAAC,IAAI,eAAe;AACxD,QAAM,mBAAmB,MAAM,0BAA0B,IAAI,YAAY,IAAI,CAAC;AAC9E,QAAM,wBAAwB,MAAM,uBAAuB,IAAI,iBAAiB,IAAI;AAMpF,QAAM,uBAAuB,OAAO,KAAK,aAAa;AACtD,QAAM,oBAAoB,uBACtB,0BAA0B,OAAO,KAAK,QAAQ,IAC9C;AACJ,QAAM,yBAAyB,OAAO,KAAK,kBAAkB,SACzD,wBACA,uBAAuB,OAAO,KAAK,aAAa;AAEpD,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAE1D,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,MACV,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAKA,QAAM,oBAAoB,qBAAqB,CAAC,uBAC5C,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,yDAAyD;AAAA,IAC3E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,CAAC,yBAAyB,kBAAkB,WAAW,KAAK,2BAA2B,sBAAsB,GAAG;AAClH,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAKA,QAAM,eAAe,yBAAyB,kBAAkB,SAAS;AAgBzE,QAAM,mBAAmB,kBAAkB,OAAO,CAAC,YAAY,CAAC,kBAAkB,SAAS,OAAO,CAAC;AAKnG,QAAM,aAAa,UAAU,QAAQ,YAAY;AAUjD,QAAM,kBAAkB,cAAc,KAAK,YAAY;AACvD,QAAM,aAAa,kBAAkB,OAAO,KAAK,SAAS;AAC1D,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA,MAAM,kBAAkB,EAAE,GAAG,MAAM,OAAO,KAAK,IAAI;AAAA,IACnD,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,aAAa,CAAC,UAAU,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACA,QAAM,WAAW,QAA6C,iCAAiC;AAAA,IAC7F,OAAO;AAAA,MACL,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,OAAO,CAAC;AAAA,MACR,WAAW,iBAAiB,SAAS,EAAE,UAAU,kBAAkB,IAAI;AAAA,IACzE;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,qBAAqB,mBAAmB,mBAAmB,gBAAgB,KAAK,0BAA0B;AAAA,EAC9I,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAQA,SAAS,2BAA2B,eAAyC;AAC3E,MAAI,CAAC,iBAAiB,cAAc,WAAW,EAAG,QAAO;AACzD,SAAO,CAAC,cAAc,SAAS,SAAS;AAC1C;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,qBAAqB,WAAqB,WAAqB,UAA6B;AACnG,MAAI,UAAU,WAAW,UAAU,OAAQ,QAAO;AAClD,QAAM,eAAe,IAAI,IAAI,SAAS;AACtC,QAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,MAAI,aAAa,SAAS,YAAY,MAAM;AAC1C,QAAI,YAAY;AAChB,eAAW,SAAS,cAAc;AAChC,UAAI,CAAC,YAAY,IAAI,KAAK,GAAG;AAC3B,oBAAY;AACZ;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,mBAAmB;AAAA,MACnH;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,mBAAmB;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/components/AclEditor.js

@@ -230,7 +230,15 @@ function AclEditor({
   );
   const hasGlobalWildcard = granted.includes("*");
   const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0;
+  const isDenyAllOrganizations = Array.isArray(organizations) && organizations.length === 0;
   const showOrganizationWarning = (kind === "role" || overrideEnabled) && canEditOrganizations && !isSuperAdmin && hasOrganizationRestriction && granted.length === 0;
+  const denyAllOrganizationsWouldPersist = kind === "role" || granted.length > 0;
+  const showDenyAllOrganizationsWarning = (kind === "role" || overrideEnabled) && canEditOrganizations && !isSuperAdmin && isDenyAllOrganizations && denyAllOrganizationsWouldPersist;
+  const organizationScopeSummary = isDenyAllOrganizations ? t("auth.acl.organizationsScopeCurrent.none", "Current scope: no organizations.") : organizations && organizations.length > 0 ? t(
+    "auth.acl.organizationsScopeCurrent.selected",
+    "Current scope: {count} selected organization(s).",
+    { count: organizations.length }
+  ) : t("auth.acl.organizationsScopeCurrent.all", "Current scope: all organizations.");
   const toggleWildcard = React.useCallback((wildcard, enable) => {
     if (!actorIsSuperAdmin && enable && isTenantRestrictedFeature(wildcard)) return;
     updateGranted((prev) => {
@@ -316,6 +324,7 @@ function AclEditor({
           /* @__PURE__ */ jsx(
             Button,
             {
+              type: "button",
               variant: "outline",
               size: "sm",
               className: "mt-2",
@@ -476,7 +485,8 @@ function AclEditor({
       ] }),
       canEditOrganizations && /* @__PURE__ */ jsxs("div", { className: "rounded border p-3", children: [
         /* @__PURE__ */ jsx("div", { className: "text-sm font-medium mb-2", children: t("auth.acl.organizationsScope", "Organizations scope") }),
-        /* @__PURE__ */ jsx("div", { className: "text-xs text-muted-foreground mb-2", children: t("auth.acl.organizationsScopeHint", "Empty means all organizations. Select one or more to restrict access.") }),
+        /* @__PURE__ */ jsx("div", { className: "text-xs text-muted-foreground mb-2", children: t("auth.acl.organizationsScopeHint", 'Select one or more organizations to restrict access to them. Use "Allow all organizations" to lift the restriction \u2014 clearing every selection instead denies access to all organizations.') }),
+        /* @__PURE__ */ jsx("div", { className: "text-xs font-medium mb-2", "data-testid": "acl-organization-scope-summary", children: organizationScopeSummary }),
         /* @__PURE__ */ jsx("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-2", children: orgOptions.map((o) => {
           const checked = organizations == null ? false : (organizations || []).includes(o.id);
           return /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
@@ -490,8 +500,16 @@ function AclEditor({
             /* @__PURE__ */ jsx("label", { htmlFor: `org-${o.id}`, className: "text-sm", children: o.name })
           ] }, o.id);
         }) }),
-        /* @__PURE__ */ jsx("div", { className: "mt-2", children: /* @__PURE__ */ jsx(Button, { variant: "outline", onClick: () => setOrganizations(null), children: t("auth.acl.allowAllOrganizations", "Allow all organizations") }) }),
-        showOrganizationWarning && /* @__PURE__ */ jsx("div", { className: "mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text", children: t("auth.acl.organizationWarning", "Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.") })
+        /* @__PURE__ */ jsx("div", { className: "mt-2", children: /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", onClick: () => setOrganizations(null), children: t("auth.acl.allowAllOrganizations", "Allow all organizations") }) }),
+        showOrganizationWarning && /* @__PURE__ */ jsx("div", { className: "mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text", children: t("auth.acl.organizationWarning", "Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.") }),
+        showDenyAllOrganizationsWarning && /* @__PURE__ */ jsx(
+          "div",
+          {
+            className: "mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text",
+            "data-testid": "acl-organization-deny-all-warning",
+            children: t("auth.acl.organizationsDenyAllWarning", 'No organization is selected, so this override denies access in every organization \u2014 including the features granted above. Choose at least one organization, or use "Allow all organizations" to leave the scope unrestricted.')
+          }
+        )
       ] })
     ] })
   ] });

package/dist/modules/auth/components/AclEditor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/components/AclEditor.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport Link from 'next/link'\nimport { hasFeature, matchFeature } from '@open-mercato/shared/security/features'\nimport { useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'\nimport { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'\n\nfunction normalizeFeatureArray(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const dedup = new Set<string>()\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction formatWildcardLabel(t: TranslateFn, moduleId: string, wildcard: string): string {\n  if (!wildcard.endsWith('.*')) return wildcard\n  const prefix = `${moduleId}.`\n  const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)\n  if (!suffix) return t('auth.acl.wildcards.allFeatures', 'All features')\n  const group = suffix\n    .split('.')\n    .map((segment) => segment.replace(/[-_]/g, ' ').replace(/\\b\\w/g, (char) => char.toUpperCase()))\n    .join(' / ')\n  return t('auth.acl.wildcards.allGroup', 'All permissions in {group}', { group })\n}\n\ntype Feature = { id: string; title: string; module: string; dependsOn?: string[] }\ntype ModuleInfo = { id: string; title: string }\ntype RoleListItem = { id?: string | null; name?: string | null }\ntype RoleListResponse = { items?: RoleListItem[] }\ntype RoleSummary = { id: string; name: string }\n\nfunction buildRoleSummaries(items: RoleListItem[], allowedNames: string[]): RoleSummary[] {\n  const summaries: RoleSummary[] = []\n  for (const role of items) {\n    const name = typeof role?.name === 'string' ? role.name : ''\n    if (!name || !allowedNames.includes(name)) continue\n    const hasValidId = typeof role?.id === 'string' && role.id.length > 0\n    const id = hasValidId ? (role!.id as string) : name\n    summaries.push({ id, name })\n  }\n  return summaries\n}\n\nexport type AclData = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype FeatureListResponse = { items?: Feature[]; modules?: ModuleInfo[] }\ntype AclPayload = {\n  hasCustomAcl?: boolean\n  isSuperAdmin?: boolean\n  features?: unknown\n  organizations?: unknown\n  updatedAt?: string | null\n}\ntype OrganizationListResponse = { items?: Array<{ id?: string; name?: string }> }\n\nfunction normalizeOrganizationOptions(items: OrganizationListResponse['items']): Array<{ id: string; name: string }> {\n  if (!Array.isArray(items)) return []\n  return items.reduce<Array<{ id: string; name: string }>>((acc, org) => {\n    if (!org) return acc\n    const id = typeof org.id === 'string' && org.id.trim().length > 0 ? org.id : null\n    if (!id) return acc\n    const name = typeof org.name === 'string' && org.name.trim().length > 0 ? org.name : id\n    acc.push({ id, name })\n    return acc\n  }, [])\n}\n\nasync function readJsonOr<T>(\n  url: string,\n  init: RequestInit | undefined,\n  fallback: T,\n): Promise<T> {\n  const call = await apiCall<T>(url, init, { fallback })\n  if (!call.ok) return fallback\n  return call.result ?? fallback\n}\n\nexport function AclEditor({\n  kind,\n  targetId,\n  canEditOrganizations,\n  value,\n  onChange,\n  onVersionChange,\n  userRoles,\n  currentUserIsSuperAdmin,\n  tenantId,\n  preserveOnTenantChange = false,\n}: {\n  kind: 'user' | 'role'\n  targetId: string\n  canEditOrganizations: boolean\n  value?: AclData\n  onChange?: (data: AclData) => void\n  /**\n   * Reports the loaded ACL row's `updatedAt` (or null when none exists) so the\n   * parent can send the optimistic-lock header on save and reject stale ACL\n   * overwrites (#2055).\n   */\n  onVersionChange?: (updatedAt: string | null) => void\n  userRoles?: string[]\n  currentUserIsSuperAdmin?: boolean\n  tenantId?: string | null\n  preserveOnTenantChange?: boolean\n}) {\n  const actorIsSuperAdmin = !!currentUserIsSuperAdmin\n  const [loading, setLoading] = React.useState(true)\n  const [features, setFeatures] = React.useState<Feature[]>([])\n  const t = useT()\n  const [modules, setModules] = React.useState<ModuleInfo[]>([])\n  const [granted, setGranted] = React.useState<string[]>(() => {\n    const normalized = normalizeFeatureArray(value?.features)\n    return actorIsSuperAdmin ? normalized : normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n  })\n  const [isSuperAdmin, setIsSuperAdmin] = React.useState(value?.isSuperAdmin || false)\n  const [organizations, setOrganizations] = React.useState<string[] | null>(value?.organizations ?? null)\n  const [orgOptions, setOrgOptions] = React.useState<{ id: string; name: string }[]>([])\n  const [hasCustomAcl, setHasCustomAcl] = React.useState(true)\n  const [overrideEnabled, setOverrideEnabled] = React.useState(false)\n  const [roleDetails, setRoleDetails] = React.useState<RoleSummary[]>([])\n\n  const actorSanitizeFeatures = React.useCallback(\n    (list: unknown): string[] => {\n      const normalized = normalizeFeatureArray(list)\n      if (actorIsSuperAdmin) return normalized\n      return normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n    },\n    [actorIsSuperAdmin],\n  )\n\n  const updateGranted = React.useCallback(\n    (updater: (prev: string[]) => string[]) => {\n      setGranted((prev) => actorSanitizeFeatures(updater(prev)))\n    },\n    [actorSanitizeFeatures],\n  )\n\n  const tenantIdRef = React.useRef(tenantId)\n  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])\n  const hasMountedRef = React.useRef(false)\n\n  const fetchAclState = React.useCallback(async (forTenantId: string | null | undefined, cancelledRef: { current: boolean }) => {\n    try {\n      const aclQuery = new URLSearchParams()\n      aclQuery.set(kind === 'user' ? 'userId' : 'roleId', targetId)\n      if (forTenantId) aclQuery.set('tenantId', forTenantId)\n      const aclQueryString = aclQuery.toString()\n      const aclJson = await readJsonOr<AclPayload>(\n        `/api/auth/${kind === 'user' ? 'users' : 'roles'}/acl${aclQueryString ? `?${aclQueryString}` : ''}`,\n        undefined,\n        { hasCustomAcl: true, isSuperAdmin: false, features: [], organizations: null },\n      )\n      if (cancelledRef.current) return\n      const customAclExists = aclJson.hasCustomAcl !== false\n      setHasCustomAcl(customAclExists)\n      setOverrideEnabled(customAclExists)\n      setIsSuperAdmin(!!aclJson.isSuperAdmin)\n      setGranted(actorSanitizeFeatures(aclJson.features))\n      setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])\n      onVersionChange?.(typeof aclJson.updatedAt === 'string' ? aclJson.updatedAt : null)\n    } catch {}\n  }, [kind, targetId, actorSanitizeFeatures, onVersionChange])\n\n  React.useEffect(() => {\n    const cancelled = { current: false }\n    async function load() {\n      setLoading(true)\n      try {\n        const fJson = await readJsonOr<FeatureListResponse>(\n          '/api/auth/features',\n          undefined,\n          { items: [], modules: [] },\n        )\n        if (!cancelled.current) {\n          setFeatures(fJson.items || [])\n          setModules(fJson.modules || [])\n        }\n      } catch {}\n      await fetchAclState(tenantIdRef.current, cancelled)\n      hasMountedRef.current = true\n      if (!cancelled.current) setLoading(false)\n    }\n    load()\n    return () => { cancelled.current = true }\n  }, [kind, targetId, fetchAclState])\n\n  React.useEffect(() => {\n    if (!hasMountedRef.current) return\n    if (preserveOnTenantChange) return\n    const cancelled = { current: false }\n    fetchAclState(tenantId, cancelled)\n    return () => { cancelled.current = true }\n  }, [tenantId, preserveOnTenantChange, fetchAclState])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadTenantScoped() {\n      if (canEditOrganizations) {\n        try {\n          const orgQuery = new URLSearchParams()\n          if (tenantId) orgQuery.set('tenantId', tenantId)\n          const orgQueryString = orgQuery.toString()\n          const oJson = await readJsonOr<OrganizationListResponse>(\n            `/api/directory/organizations${orgQueryString ? `?${orgQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) setOrgOptions(normalizeOrganizationOptions(oJson.items))\n        } catch {}\n      }\n      if (kind === 'user' && userRoles && userRoles.length > 0) {\n        try {\n          const roleQuery = new URLSearchParams({ pageSize: '100' })\n          if (tenantId) roleQuery.set('tenantId', tenantId)\n          const roleQueryString = roleQuery.toString()\n          const rolesJson = await readJsonOr<RoleListResponse>(\n            `/api/auth/roles${roleQueryString ? `?${roleQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) {\n            const allRoles = Array.isArray(rolesJson.items) ? rolesJson.items : []\n            const userRoleDetails: RoleSummary[] = buildRoleSummaries(allRoles, userRoles)\n            setRoleDetails(userRoleDetails)\n          }\n        } catch {}\n      }\n    }\n    loadTenantScoped()\n    return () => { cancelled = true }\n  }, [kind, canEditOrganizations, userRoles, tenantId])\n\n  // Notify parent of changes\n  React.useEffect(() => {\n    onChange?.({ isSuperAdmin, features: granted, organizations })\n  }, [isSuperAdmin, granted, organizations, onChange])\n\n  const grouped = React.useMemo(() => {\n    const moduleMap = new Map<string, string>()\n    for (const m of modules) {\n      moduleMap.set(m.id, t(`auth.acl.modules.${m.id}`, m.title))\n    }\n    const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()\n    for (const f of features) {\n      const moduleId = f.module\n      const moduleTitle = moduleMap.get(moduleId) || moduleId\n      const localizedFeature = {\n        ...f,\n        title: t(`auth.acl.features.${f.id}`, f.title),\n      }\n      if (!map.has(moduleId)) {\n        map.set(moduleId, { moduleId, moduleTitle, features: [] })\n      }\n      map.get(moduleId)!.features.push(localizedFeature)\n    }\n    return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))\n  }, [features, modules, t])\n\n  const localizedFeatures = React.useMemo(\n    () => grouped.flatMap((group) => group.features),\n    [grouped],\n  )\n\n  const hasGlobalWildcard = granted.includes('*')\n  const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0\n  const showOrganizationWarning =\n    (kind === 'role' || overrideEnabled) &&\n    canEditOrganizations &&\n    !isSuperAdmin &&\n    hasOrganizationRestriction &&\n    granted.length === 0\n\n  \n  const toggleWildcard = React.useCallback((wildcard: string, enable: boolean) => {\n    if (!actorIsSuperAdmin && enable && isTenantRestrictedFeature(wildcard)) return\n    updateGranted((prev) => {\n      if (enable) {\n        if (prev.includes(wildcard)) return prev\n        return [...prev, wildcard]\n      }\n      return prev.filter((feature) => feature !== wildcard)\n    })\n  }, [actorIsSuperAdmin, updateGranted])\n\n  const toggleModuleWildcard = React.useCallback((moduleId: string, enable: boolean) => {\n    toggleWildcard(`${moduleId}.*`, enable)\n  }, [toggleWildcard])\n\n  const isModuleWildcardEnabled = (moduleId: string) => {\n    return granted.includes(`${moduleId}.*`)\n  }\n\n  const isFeatureCoveredByWildcard = (featureId: string) =>\n    granted.some((feature) => (feature === '*' || feature.endsWith('.*')) && matchFeature(featureId, feature))\n\n  const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)\n\n  if (loading) {\n    return (\n      <div className=\"text-sm text-muted-foreground\">\n        {t('auth.acl.loading', 'Loading access control\u2026')}\n      </div>\n    )\n  }\n\n  const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled\n\n  return (\n    <div className=\"space-y-4\">\n      {showRoleBanner && (\n        <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n          <div className=\"text-sm font-medium text-status-info-text mb-2\">\n            {t('auth.acl.inherited.title', 'Permissions inherited from roles')}\n          </div>\n          <div className=\"text-sm text-status-info-text mb-3\">\n            {t('auth.acl.inherited.description', 'This user currently inherits permissions from their assigned roles.')}\n            {roleDetails.length > 0 && (\n              <span>\n                {' '}{t('auth.acl.inherited.assignedRoles', 'Assigned roles:')}{' '}\n                {roleDetails.map((role, idx) => {\n                  const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`\n                  const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId\n                  return (\n                    <React.Fragment key={roleId}>\n                      {idx > 0 && ', '}\n                      <Link \n                        href={`/backend/roles/${roleId}/edit`}\n                        className=\"font-semibold text-status-info-text underline\"\n                      >\n                        {roleName}\n                      </Link>\n                    </React.Fragment>\n                  )\n                })}\n              </span>\n            )}\n          </div>\n          <div className=\"flex items-center gap-2\">\n            <input \n              id=\"overrideAcl\" \n              type=\"checkbox\" \n              className=\"h-4 w-4\" \n              checked={overrideEnabled} \n              onChange={(e) => setOverrideEnabled(e.target.checked)} \n            />\n            <label htmlFor=\"overrideAcl\" className=\"text-sm text-status-info-text font-medium\">\n              {t('auth.acl.inherited.override', 'Override permissions for this user only')}\n            </label>\n          </div>\n        </div>\n      )}\n      {(kind === 'role' || overrideEnabled) && (\n        <>\n          <div className=\"flex items-center gap-2\">\n            <input\n              id=\"isSuperAdmin\"\n              type=\"checkbox\"\n              className=\"h-4 w-4\"\n              checked={isSuperAdmin}\n              disabled={!actorIsSuperAdmin}\n              onChange={(e) => setIsSuperAdmin(!!e.target.checked)}\n            />\n            <label htmlFor=\"isSuperAdmin\" className=\"text-sm\">\n              {t('auth.acl.superAdmin.label', 'Super Admin (all features)')}\n            </label>\n          </div>\n          {!actorIsSuperAdmin && (\n            <p className=\"text-xs text-muted-foreground\">\n              {t('auth.acl.superAdmin.hint', 'Only super administrators can change this option.')}\n            </p>\n          )}\n      {!isSuperAdmin && (\n        <>\n          {hasGlobalWildcard && (\n            <div className=\"rounded border border-status-info-border bg-status-info-bg p-3\">\n              <div className=\"text-sm font-medium text-status-info-text\">\n                {t('auth.acl.globalWildcard.title', 'Global wildcard (*) enabled')}\n              </div>\n              <div className=\"text-xs text-status-info-text mt-1\">\n                {t('auth.acl.globalWildcard.description', 'This grants access to all features in the system.')}\n              </div>\n              <Button\n                variant=\"outline\"\n                size=\"sm\"\n                className=\"mt-2\"\n                onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}\n              >\n                {t('auth.acl.globalWildcard.remove', 'Remove global wildcard')}\n              </Button>\n            </div>\n          )}\n          {!hasGlobalWildcard && (\n            <AclDependencyDiagnosticsPanel\n              granted={granted}\n              catalog={localizedFeatures as readonly FeatureDescriptor[]}\n              onGrantedChange={updateGranted}\n              hideUnknownReferences={process.env.NODE_ENV === 'production'}\n            />\n          )}\n          <div className=\"grid grid-cols-1 md:grid-cols-2 gap-4\">\n            {grouped.map((group) => {\n              const moduleWildcard = isModuleWildcardEnabled(group.moduleId)\n              const nestedWildcards = Array.from(\n                new Set(\n                  granted.filter(\n                    (feature) =>\n                      feature !== '*' &&\n                      feature.endsWith('.*') &&\n                      feature.startsWith(`${group.moduleId}.`) &&\n                      feature !== `${group.moduleId}.*`,\n                  ),\n                ),\n              )\n                .map((wildcard) => {\n                  const prefix = wildcard.slice(0, -1)\n                  const relatedFeatures = group.features.filter((feature) => feature.id.startsWith(prefix))\n                  return { wildcard, features: relatedFeatures }\n                })\n                .sort((a, b) => a.wildcard.localeCompare(b.wildcard))\n              const nestedCoveredIds = new Set<string>()\n              for (const entry of nestedWildcards) {\n                for (const feature of entry.features) nestedCoveredIds.add(feature.id)\n              }\n              const moduleRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(`${group.moduleId}.*`)\n              const moduleCheckboxDisabled = hasGlobalWildcard || moduleRestricted\n              return (\n                <div key={group.moduleId} className=\"rounded border p-3\">\n                  <div className=\"flex items-center justify-between mb-3 pb-2 border-b\">\n                    <div className=\"text-sm font-medium\">{group.moduleTitle}</div>\n                    <div className=\"flex items-center gap-2\">\n                      <input \n                        id={`module-${group.moduleId}`} \n                        type=\"checkbox\" \n                        className=\"h-4 w-4\" \n                        checked={moduleWildcard || hasGlobalWildcard} \n                        disabled={moduleCheckboxDisabled}\n                        onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} \n                      />\n                      <label htmlFor={`module-${group.moduleId}`} className=\"text-sm text-muted-foreground\">\n                        {t('auth.acl.allModuleFeatures', 'All')}{' '}\n                        {moduleWildcard && !hasGlobalWildcard ? <span className=\"font-medium text-status-info-text\">({group.moduleId}.*)</span> : ''}\n                        {moduleRestricted ? (\n                          <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                            {t('auth.acl.manageViaSuperAdmin', '(manage via super admin)')}\n                          </span>\n                        ) : null}\n                      </label>\n                    </div>\n                  </div>\n                {nestedWildcards.length > 0 && (\n                  <div className=\"space-y-3 mb-3\">\n                    {nestedWildcards.map(({ wildcard, features: wildcardFeatures }) => {\n                        const checked = granted.includes(wildcard) || hasGlobalWildcard || moduleWildcard\n                        const wildcardRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(wildcard)\n                        const disabled = hasGlobalWildcard || moduleWildcard || wildcardRestricted\n                        return (\n                          <div key={wildcard} className=\"space-y-2\">\n                            <div className=\"flex items-center gap-2\">\n                              <input\n                                id={`wildcard-${wildcard}`}\n                                type=\"checkbox\"\n                                className=\"h-4 w-4\"\n                                checked={checked}\n                                disabled={disabled}\n                                onChange={(e) => toggleWildcard(wildcard, !!e.target.checked)}\n                              />\n                              <label\n                                htmlFor={`wildcard-${wildcard}`}\n                                className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                              >\n                                {formatWildcardLabel(t, group.moduleId, wildcard)}{' '}\n                                <span className=\"text-muted-foreground text-xs font-mono\">({wildcard})</span>\n                                {wildcardRestricted ? (\n                                  <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                    {t('auth.acl.restricted', 'Restricted')}\n                                  </span>\n                                ) : null}\n                              </label>\n                            </div>\n                            {wildcardFeatures.length > 0 && (\n                              <div className=\"relative ml-6 pl-4 text-sm text-muted-foreground space-y-1\">\n                                <div className=\"absolute left-0 top-1 bottom-1 w-px bg-border\" aria-hidden />\n                                {wildcardFeatures.map((wf) => (\n                                  <div key={`${wildcard}-${wf.id}`} className=\"pl-2\">\n                                    <span>\n                                      {wf.title}{' '}\n                                      <span className=\"text-xs font-mono text-muted-foreground\">({wf.id})</span>\n                                    </span>\n                                  </div>\n                                ))}\n                              </div>\n                            )}\n                          </div>\n                        )\n                      })}\n                    </div>\n                  )}\n                  <div className=\"space-y-2\">\n                    {group.features.map((f) => {\n                      if (nestedCoveredIds.has(f.id)) return null\n                      const checked = isFeatureChecked(f.id)\n                      const isWildcardCovered = isFeatureCoveredByWildcard(f.id)\n                      const restricted = !actorIsSuperAdmin && isTenantRestrictedFeature(f.id)\n                      const disabled = isWildcardCovered || restricted\n                      return (\n                        <div key={f.id} className=\"flex items-center gap-2\">\n                          <input\n                            id={`f-${f.id}`}\n                            type=\"checkbox\"\n                            className=\"h-4 w-4\"\n                            checked={checked}\n                            disabled={disabled}\n                            onChange={(e) => {\n                              const on = !!e.target.checked\n                              updateGranted((prev) => {\n                                if (on) return [...prev, f.id]\n                                return prev.filter((x) => x !== f.id)\n                              })\n                            }}\n                          />\n                          <label\n                            htmlFor={`f-${f.id}`}\n                            className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                          >\n                            {f.title} <span className=\"text-muted-foreground text-xs\">({f.id})</span>\n                            {restricted ? (\n                              <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                {t('auth.acl.restricted', 'Restricted')}\n                              </span>\n                            ) : null}\n                          </label>\n                        </div>\n                      )\n                    })}\n                  </div>\n                </div>\n              )\n            })}\n          </div>\n        </>\n          )}\n          {canEditOrganizations && (\n            <div className=\"rounded border p-3\">\n              <div className=\"text-sm font-medium mb-2\">\n                {t('auth.acl.organizationsScope', 'Organizations scope')}\n              </div>\n              <div className=\"text-xs text-muted-foreground mb-2\">\n                {t('auth.acl.organizationsScopeHint', 'Empty means all organizations. Select one or more to restrict access.')}\n              </div>\n              <div className=\"grid grid-cols-1 md:grid-cols-2 gap-2\">\n                {orgOptions.map((o) => {\n                  const checked = organizations == null ? false : (organizations || []).includes(o.id)\n                  return (\n                    <div key={o.id} className=\"flex items-center gap-2\">\n                      <input id={`org-${o.id}`} type=\"checkbox\" className=\"h-4 w-4\" checked={checked} onChange={(e) => {\n                        const on = !!e.target.checked\n                        setOrganizations((prev) => {\n                          if (prev == null) return on ? [o.id] : []\n                          return on ? Array.from(new Set([...(prev || []), o.id])) : (prev || []).filter((x) => x !== o.id)\n                        })\n                      }} />\n                      <label htmlFor={`org-${o.id}`} className=\"text-sm\">{o.name}</label>\n                    </div>\n                  )\n                })}\n              </div>\n              <div className=\"mt-2\">\n                <Button variant=\"outline\" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>\n              </div>\n              {showOrganizationWarning && (\n                <div className=\"mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text\">\n                  {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}\n                </div>\n              )}\n            </div>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"],
-  "mappings": ";AA8TM,SAyEE,UAzEF,KAwBc,YAxBd;AA7TN,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,OAAO,UAAU;AACjB,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAA8B;AAEvC,SAAS,qCAAqC;AAE9C,SAAS,sBAAsB,OAA0B;AACvD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAgB,UAAkB,UAA0B;AACvF,MAAI,CAAC,SAAS,SAAS,IAAI,EAAG,QAAO;AACrC,QAAM,SAAS,GAAG,QAAQ;AAC1B,QAAM,SAAS,SAAS,WAAW,MAAM,IAAI,SAAS,MAAM,OAAO,QAAQ,EAAE,IAAI,SAAS,MAAM,GAAG,EAAE;AACrG,MAAI,CAAC,OAAQ,QAAO,EAAE,kCAAkC,cAAc;AACtE,QAAM,QAAQ,OACX,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,QAAQ,QAAQ,SAAS,GAAG,EAAE,QAAQ,SAAS,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,EAC7F,KAAK,KAAK;AACb,SAAO,EAAE,+BAA+B,8BAA8B,EAAE,MAAM,CAAC;AACjF;AAQA,SAAS,mBAAmB,OAAuB,cAAuC;AACxF,QAAM,YAA2B,CAAC;AAClC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,QAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,IAAI,EAAG;AAC3C,UAAM,aAAa,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS;AACpE,UAAM,KAAK,aAAc,KAAM,KAAgB;AAC/C,cAAU,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC7B;AACA,SAAO;AACT;AAkBA,SAAS,6BAA6B,OAA+E;AACnH,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAA4C,CAAC,KAAK,QAAQ;AACrE,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,KAAK,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,KAAK;AAC7E,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,IAAI,OAAO;AACrF,QAAI,KAAK,EAAE,IAAI,KAAK,CAAC;AACrB,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACP;AAEA,eAAe,WACb,KACA,MACA,UACY;AACZ,QAAM,OAAO,MAAM,QAAW,KAAK,MAAM,EAAE,SAAS,CAAC;AACrD,MAAI,CAAC,KAAK,GAAI,QAAO;AACrB,SAAO,KAAK,UAAU;AACxB;AAEO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAyB;AAC3B,GAgBG;AACD,QAAM,oBAAoB,CAAC,CAAC;AAC5B,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAoB,CAAC,CAAC;AAC5D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC7D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAmB,MAAM;AAC3D,UAAM,aAAa,sBAAsB,OAAO,QAAQ;AACxD,WAAO,oBAAoB,aAAa,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,EAC5G,CAAC;AACD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,OAAO,gBAAgB,KAAK;AACnF,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAA0B,OAAO,iBAAiB,IAAI;AACtG,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAyC,CAAC,CAAC;AACrF,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,IAAI;AAC3D,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAClE,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAwB,CAAC,CAAC;AAEtE,QAAM,wBAAwB,MAAM;AAAA,IAClC,CAAC,SAA4B;AAC3B,YAAM,aAAa,sBAAsB,IAAI;AAC7C,UAAI,kBAAmB,QAAO;AAC9B,aAAO,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,IAC3E;AAAA,IACA,CAAC,iBAAiB;AAAA,EACpB;AAEA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,CAAC,YAA0C;AACzC,iBAAW,CAAC,SAAS,sBAAsB,QAAQ,IAAI,CAAC,CAAC;AAAA,IAC3D;AAAA,IACA,CAAC,qBAAqB;AAAA,EACxB;AAEA,QAAM,cAAc,MAAM,OAAO,QAAQ;AACzC,QAAM,UAAU,MAAM;AAAE,gBAAY,UAAU;AAAA,EAAS,GAAG,CAAC,QAAQ,CAAC;AACpE,QAAM,gBAAgB,MAAM,OAAO,KAAK;AAExC,QAAM,gBAAgB,MAAM,YAAY,OAAO,aAAwC,iBAAuC;AAC5H,QAAI;AACF,YAAM,WAAW,IAAI,gBAAgB;AACrC,eAAS,IAAI,SAAS,SAAS,WAAW,UAAU,QAAQ;AAC5D,UAAI,YAAa,UAAS,IAAI,YAAY,WAAW;AACrD,YAAM,iBAAiB,SAAS,SAAS;AACzC,YAAM,UAAU,MAAM;AAAA,QACpB,aAAa,SAAS,SAAS,UAAU,OAAO,OAAO,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,QACjG;AAAA,QACA,EAAE,cAAc,MAAM,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AAAA,MAC/E;AACA,UAAI,aAAa,QAAS;AAC1B,YAAM,kBAAkB,QAAQ,iBAAiB;AACjD,sBAAgB,eAAe;AAC/B,yBAAmB,eAAe;AAClC,sBAAgB,CAAC,CAAC,QAAQ,YAAY;AACtC,iBAAW,sBAAsB,QAAQ,QAAQ,CAAC;AAClD,uBAAiB,QAAQ,iBAAiB,OAAO,OAAO,MAAM,QAAQ,QAAQ,aAAa,IAAI,QAAQ,gBAAgB,CAAC,CAAC;AACzH,wBAAkB,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI;AAAA,IACpF,QAAQ;AAAA,IAAC;AAAA,EACX,GAAG,CAAC,MAAM,UAAU,uBAAuB,eAAe,CAAC;AAE3D,QAAM,UAAU,MAAM;AACpB,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,QAC3B;AACA,YAAI,CAAC,UAAU,SAAS;AACtB,sBAAY,MAAM,SAAS,CAAC,CAAC;AAC7B,qBAAW,MAAM,WAAW,CAAC,CAAC;AAAA,QAChC;AAAA,MACF,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,YAAY,SAAS,SAAS;AAClD,oBAAc,UAAU;AACxB,UAAI,CAAC,UAAU,QAAS,YAAW,KAAK;AAAA,IAC1C;AACA,SAAK;AACL,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,MAAM,UAAU,aAAa,CAAC;AAElC,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,cAAc,QAAS;AAC5B,QAAI,uBAAwB;AAC5B,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,kBAAc,UAAU,SAAS;AACjC,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,UAAU,wBAAwB,aAAa,CAAC;AAEpD,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,WAAW,IAAI,gBAAgB;AACrC,cAAI,SAAU,UAAS,IAAI,YAAY,QAAQ;AAC/C,gBAAM,iBAAiB,SAAS,SAAS;AACzC,gBAAM,QAAQ,MAAM;AAAA,YAClB,+BAA+B,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,YACzE;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,UAAW,eAAc,6BAA6B,MAAM,KAAK,CAAC;AAAA,QACzE,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,UAAI,SAAS,UAAU,aAAa,UAAU,SAAS,GAAG;AACxD,YAAI;AACF,gBAAM,YAAY,IAAI,gBAAgB,EAAE,UAAU,MAAM,CAAC;AACzD,cAAI,SAAU,WAAU,IAAI,YAAY,QAAQ;AAChD,gBAAM,kBAAkB,UAAU,SAAS;AAC3C,gBAAM,YAAY,MAAM;AAAA,YACtB,kBAAkB,kBAAkB,IAAI,eAAe,KAAK,EAAE;AAAA,YAC9D;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,WAAW;AACd,kBAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,IAAI,UAAU,QAAQ,CAAC;AACrE,kBAAM,kBAAiC,mBAAmB,UAAU,SAAS;AAC7E,2BAAe,eAAe;AAAA,UAChC;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AACA,qBAAiB;AACjB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,sBAAsB,WAAW,QAAQ,CAAC;AAGpD,QAAM,UAAU,MAAM;AACpB,eAAW,EAAE,cAAc,UAAU,SAAS,cAAc,CAAC;AAAA,EAC/D,GAAG,CAAC,cAAc,SAAS,eAAe,QAAQ,CAAC;AAEnD,QAAM,UAAU,MAAM,QAAQ,MAAM;AAClC,UAAM,YAAY,oBAAI,IAAoB;AAC1C,eAAW,KAAK,SAAS;AACvB,gBAAU,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC;AAAA,IAC5D;AACA,UAAM,MAAM,oBAAI,IAA4E;AAC5F,eAAW,KAAK,UAAU;AACxB,YAAM,WAAW,EAAE;AACnB,YAAM,cAAc,UAAU,IAAI,QAAQ,KAAK;AAC/C,YAAM,mBAAmB;AAAA,QACvB,GAAG;AAAA,QACH,OAAO,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK;AAAA,MAC/C;AACA,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACtB,YAAI,IAAI,UAAU,EAAE,UAAU,aAAa,UAAU,CAAC,EAAE,CAAC;AAAA,MAC3D;AACA,UAAI,IAAI,QAAQ,EAAG,SAAS,KAAK,gBAAgB;AAAA,IACnD;AACA,WAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,cAAc,EAAE,WAAW,CAAC;AAAA,EAC3F,GAAG,CAAC,UAAU,SAAS,CAAC,CAAC;AAEzB,QAAM,oBAAoB,MAAM;AAAA,IAC9B,MAAM,QAAQ,QAAQ,CAAC,UAAU,MAAM,QAAQ;AAAA,IAC/C,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,oBAAoB,QAAQ,SAAS,GAAG;AAC9C,QAAM,6BAA6B,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS;AAC1F,QAAM,2BACH,SAAS,UAAU,oBACpB,wBACA,CAAC,gBACD,8BACA,QAAQ,WAAW;AAGrB,QAAM,iBAAiB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AAC9E,QAAI,CAAC,qBAAqB,UAAU,0BAA0B,QAAQ,EAAG;AACzE,kBAAc,CAAC,SAAS;AACtB,UAAI,QAAQ;AACV,YAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,eAAO,CAAC,GAAG,MAAM,QAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,OAAO,CAAC,YAAY,YAAY,QAAQ;AAAA,IACtD,CAAC;AAAA,EACH,GAAG,CAAC,mBAAmB,aAAa,CAAC;AAErC,QAAM,uBAAuB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AACpF,mBAAe,GAAG,QAAQ,MAAM,MAAM;AAAA,EACxC,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,0BAA0B,CAAC,aAAqB;AACpD,WAAO,QAAQ,SAAS,GAAG,QAAQ,IAAI;AAAA,EACzC;AAEA,QAAM,6BAA6B,CAAC,cAClC,QAAQ,KAAK,CAAC,aAAa,YAAY,OAAO,QAAQ,SAAS,IAAI,MAAM,aAAa,WAAW,OAAO,CAAC;AAE3G,QAAM,mBAAmB,CAAC,cAAsB,WAAW,SAAS,SAAS;AAE7E,MAAI,SAAS;AACX,WACE,oBAAC,SAAI,WAAU,iCACZ,YAAE,oBAAoB,8BAAyB,GAClD;AAAA,EAEJ;AAEA,QAAM,iBAAiB,SAAS,UAAU,CAAC,gBAAgB,CAAC;AAE5D,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,sBACC,qBAAC,SAAI,WAAU,qEACb;AAAA,0BAAC,SAAI,WAAU,kDACZ,YAAE,4BAA4B,kCAAkC,GACnE;AAAA,MACA,qBAAC,SAAI,WAAU,sCACZ;AAAA,UAAE,kCAAkC,qEAAqE;AAAA,QACzG,YAAY,SAAS,KACpB,qBAAC,UACE;AAAA;AAAA,UAAK,EAAE,oCAAoC,iBAAiB;AAAA,UAAG;AAAA,UAC/D,YAAY,IAAI,CAAC,MAAM,QAAQ;AAC9B,kBAAM,SAAS,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,IAAI,KAAK,KAAK,QAAQ,GAAG;AACzF,kBAAM,WAAW,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,SAAS,IAAI,KAAK,OAAO;AACtF,mBACE,qBAAC,MAAM,UAAN,EACE;AAAA,oBAAM,KAAK;AAAA,cACZ;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAM,kBAAkB,MAAM;AAAA,kBAC9B,WAAU;AAAA,kBAET;AAAA;AAAA,cACH;AAAA,iBAPmB,MAQrB;AAAA,UAEJ,CAAC;AAAA,WACH;AAAA,SAEJ;AAAA,MACA,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,OAAO;AAAA;AAAA,QACtD;AAAA,QACA,oBAAC,WAAM,SAAQ,eAAc,WAAU,6CACpC,YAAE,+BAA+B,yCAAyC,GAC7E;AAAA,SACF;AAAA,OACF;AAAA,KAEA,SAAS,UAAU,oBACnB,iCACE;AAAA,2BAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC;AAAA,YACX,UAAU,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,QACrD;AAAA,QACA,oBAAC,WAAM,SAAQ,gBAAe,WAAU,WACrC,YAAE,6BAA6B,4BAA4B,GAC9D;AAAA,SACF;AAAA,MACC,CAAC,qBACA,oBAAC,OAAE,WAAU,iCACV,YAAE,4BAA4B,mDAAmD,GACpF;AAAA,MAEL,CAAC,gBACA,iCACG;AAAA,6BACC,qBAAC,SAAI,WAAU,kEACb;AAAA,8BAAC,SAAI,WAAU,6CACZ,YAAE,iCAAiC,6BAA6B,GACnE;AAAA,UACA,oBAAC,SAAI,WAAU,sCACZ,YAAE,uCAAuC,mDAAmD,GAC/F;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,cAAc,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,MAAM,GAAG,CAAC;AAAA,cAEnE,YAAE,kCAAkC,wBAAwB;AAAA;AAAA,UAC/D;AAAA,WACF;AAAA,QAED,CAAC,qBACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA,SAAS;AAAA,YACT,iBAAiB;AAAA,YACjB,uBAAuB,QAAQ,IAAI,aAAa;AAAA;AAAA,QAClD;AAAA,QAEF,oBAAC,SAAI,WAAU,yCACZ,kBAAQ,IAAI,CAAC,UAAU;AACtB,gBAAM,iBAAiB,wBAAwB,MAAM,QAAQ;AAC7D,gBAAM,kBAAkB,MAAM;AAAA,YAC5B,IAAI;AAAA,cACF,QAAQ;AAAA,gBACN,CAAC,YACC,YAAY,OACZ,QAAQ,SAAS,IAAI,KACrB,QAAQ,WAAW,GAAG,MAAM,QAAQ,GAAG,KACvC,YAAY,GAAG,MAAM,QAAQ;AAAA,cACjC;AAAA,YACF;AAAA,UACF,EACG,IAAI,CAAC,aAAa;AACjB,kBAAM,SAAS,SAAS,MAAM,GAAG,EAAE;AACnC,kBAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC,YAAY,QAAQ,GAAG,WAAW,MAAM,CAAC;AACxF,mBAAO,EAAE,UAAU,UAAU,gBAAgB;AAAA,UAC/C,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtD,gBAAM,mBAAmB,oBAAI,IAAY;AACzC,qBAAW,SAAS,iBAAiB;AACnC,uBAAW,WAAW,MAAM,SAAU,kBAAiB,IAAI,QAAQ,EAAE;AAAA,UACvE;AACA,gBAAM,mBAAmB,CAAC,qBAAqB,0BAA0B,GAAG,MAAM,QAAQ,IAAI;AAC9F,gBAAM,yBAAyB,qBAAqB;AACpD,iBACE,qBAAC,SAAyB,WAAU,sBAClC;AAAA,iCAAC,SAAI,WAAU,wDACb;AAAA,kCAAC,SAAI,WAAU,uBAAuB,gBAAM,aAAY;AAAA,cACxD,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,UAAU,MAAM,QAAQ;AAAA,oBAC5B,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV,SAAS,kBAAkB;AAAA,oBAC3B,UAAU;AAAA,oBACV,UAAU,CAAC,MAAM,qBAAqB,MAAM,UAAU,EAAE,OAAO,OAAO;AAAA;AAAA,gBACxE;AAAA,gBACA,qBAAC,WAAM,SAAS,UAAU,MAAM,QAAQ,IAAI,WAAU,iCACnD;AAAA,oBAAE,8BAA8B,KAAK;AAAA,kBAAG;AAAA,kBACxC,kBAAkB,CAAC,oBAAoB,qBAAC,UAAK,WAAU,qCAAoC;AAAA;AAAA,oBAAE,MAAM;AAAA,oBAAS;AAAA,qBAAG,IAAU;AAAA,kBACzH,mBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,gCAAgC,0BAA0B,GAC/D,IACE;AAAA,mBACN;AAAA,iBACF;AAAA,eACF;AAAA,YACD,gBAAgB,SAAS,KACxB,oBAAC,SAAI,WAAU,kBACZ,0BAAgB,IAAI,CAAC,EAAE,UAAU,UAAU,iBAAiB,MAAM;AAC/D,oBAAM,UAAU,QAAQ,SAAS,QAAQ,KAAK,qBAAqB;AACnE,oBAAM,qBAAqB,CAAC,qBAAqB,0BAA0B,QAAQ;AACnF,oBAAM,WAAW,qBAAqB,kBAAkB;AACxD,qBACE,qBAAC,SAAmB,WAAU,aAC5B;AAAA,qCAAC,SAAI,WAAU,2BACb;AAAA;AAAA,oBAAC;AAAA;AAAA,sBACC,IAAI,YAAY,QAAQ;AAAA,sBACxB,MAAK;AAAA,sBACL,WAAU;AAAA,sBACV;AAAA,sBACA;AAAA,sBACA,UAAU,CAAC,MAAM,eAAe,UAAU,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,kBAC9D;AAAA,kBACA;AAAA,oBAAC;AAAA;AAAA,sBACC,SAAS,YAAY,QAAQ;AAAA,sBAC7B,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,sBAE5D;AAAA,4CAAoB,GAAG,MAAM,UAAU,QAAQ;AAAA,wBAAG;AAAA,wBACnD,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,0BAAE;AAAA,0BAAS;AAAA,2BAAC;AAAA,wBACrE,qBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,kBACN;AAAA,mBACF;AAAA,gBACC,iBAAiB,SAAS,KACzB,qBAAC,SAAI,WAAU,8DACb;AAAA,sCAAC,SAAI,WAAU,iDAAgD,eAAW,MAAC;AAAA,kBAC1E,iBAAiB,IAAI,CAAC,OACrB,oBAAC,SAAiC,WAAU,QAC1C,+BAAC,UACE;AAAA,uBAAG;AAAA,oBAAO;AAAA,oBACX,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,sBAAE,GAAG;AAAA,sBAAG;AAAA,uBAAC;AAAA,qBACrE,KAJQ,GAAG,QAAQ,IAAI,GAAG,EAAE,EAK9B,CACD;AAAA,mBACH;AAAA,mBAlCM,QAoCV;AAAA,YAEJ,CAAC,GACH;AAAA,YAEF,oBAAC,SAAI,WAAU,aACZ,gBAAM,SAAS,IAAI,CAAC,MAAM;AACzB,kBAAI,iBAAiB,IAAI,EAAE,EAAE,EAAG,QAAO;AACvC,oBAAM,UAAU,iBAAiB,EAAE,EAAE;AACrC,oBAAM,oBAAoB,2BAA2B,EAAE,EAAE;AACzD,oBAAM,aAAa,CAAC,qBAAqB,0BAA0B,EAAE,EAAE;AACvE,oBAAM,WAAW,qBAAqB;AACtC,qBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,KAAK,EAAE,EAAE;AAAA,oBACb,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV;AAAA,oBACA;AAAA,oBACA,UAAU,CAAC,MAAM;AACf,4BAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,oCAAc,CAAC,SAAS;AACtB,4BAAI,GAAI,QAAO,CAAC,GAAG,MAAM,EAAE,EAAE;AAC7B,+BAAO,KAAK,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,sBACtC,CAAC;AAAA,oBACH;AAAA;AAAA,gBACF;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,KAAK,EAAE,EAAE;AAAA,oBAClB,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,oBAE5D;AAAA,wBAAE;AAAA,sBAAM;AAAA,sBAAC,qBAAC,UAAK,WAAU,iCAAgC;AAAA;AAAA,wBAAE,EAAE;AAAA,wBAAG;AAAA,yBAAC;AAAA,sBACjE,aACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,gBACN;AAAA,mBAzBQ,EAAE,EA0BZ;AAAA,YAEJ,CAAC,GACH;AAAA,eA5GQ,MAAM,QA6GhB;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEG,wBACC,qBAAC,SAAI,WAAU,sBACb;AAAA,4BAAC,SAAI,WAAU,4BACZ,YAAE,+BAA+B,qBAAqB,GACzD;AAAA,QACA,oBAAC,SAAI,WAAU,sCACZ,YAAE,mCAAmC,uEAAuE,GAC/G;AAAA,QACA,oBAAC,SAAI,WAAU,yCACZ,qBAAW,IAAI,CAAC,MAAM;AACrB,gBAAM,UAAU,iBAAiB,OAAO,SAAS,iBAAiB,CAAC,GAAG,SAAS,EAAE,EAAE;AACnF,iBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA,gCAAC,WAAM,IAAI,OAAO,EAAE,EAAE,IAAI,MAAK,YAAW,WAAU,WAAU,SAAkB,UAAU,CAAC,MAAM;AAC/F,oBAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,+BAAiB,CAAC,SAAS;AACzB,oBAAI,QAAQ,KAAM,QAAO,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;AACxC,uBAAO,KAAK,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,QAAQ,CAAC,GAAI,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,cAClG,CAAC;AAAA,YACH,GAAG;AAAA,YACH,oBAAC,WAAM,SAAS,OAAO,EAAE,EAAE,IAAI,WAAU,WAAW,YAAE,MAAK;AAAA,eARnD,EAAE,EASZ;AAAA,QAEJ,CAAC,GACH;AAAA,QACA,oBAAC,SAAI,WAAU,QACb,8BAAC,UAAO,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAI,YAAE,kCAAkC,yBAAyB,GAAE,GACnI;AAAA,QACC,2BACC,oBAAC,SAAI,WAAU,oHACZ,YAAE,gCAAgC,mJAAmJ,GACxL;AAAA,SAEJ;AAAA,OAEJ;AAAA,KAEJ;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport Link from 'next/link'\nimport { hasFeature, matchFeature } from '@open-mercato/shared/security/features'\nimport { useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'\nimport { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'\n\nfunction normalizeFeatureArray(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const dedup = new Set<string>()\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction formatWildcardLabel(t: TranslateFn, moduleId: string, wildcard: string): string {\n  if (!wildcard.endsWith('.*')) return wildcard\n  const prefix = `${moduleId}.`\n  const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)\n  if (!suffix) return t('auth.acl.wildcards.allFeatures', 'All features')\n  const group = suffix\n    .split('.')\n    .map((segment) => segment.replace(/[-_]/g, ' ').replace(/\\b\\w/g, (char) => char.toUpperCase()))\n    .join(' / ')\n  return t('auth.acl.wildcards.allGroup', 'All permissions in {group}', { group })\n}\n\ntype Feature = { id: string; title: string; module: string; dependsOn?: string[] }\ntype ModuleInfo = { id: string; title: string }\ntype RoleListItem = { id?: string | null; name?: string | null }\ntype RoleListResponse = { items?: RoleListItem[] }\ntype RoleSummary = { id: string; name: string }\n\nfunction buildRoleSummaries(items: RoleListItem[], allowedNames: string[]): RoleSummary[] {\n  const summaries: RoleSummary[] = []\n  for (const role of items) {\n    const name = typeof role?.name === 'string' ? role.name : ''\n    if (!name || !allowedNames.includes(name)) continue\n    const hasValidId = typeof role?.id === 'string' && role.id.length > 0\n    const id = hasValidId ? (role!.id as string) : name\n    summaries.push({ id, name })\n  }\n  return summaries\n}\n\nexport type AclData = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype FeatureListResponse = { items?: Feature[]; modules?: ModuleInfo[] }\ntype AclPayload = {\n  hasCustomAcl?: boolean\n  isSuperAdmin?: boolean\n  features?: unknown\n  organizations?: unknown\n  updatedAt?: string | null\n}\ntype OrganizationListResponse = { items?: Array<{ id?: string; name?: string }> }\n\nfunction normalizeOrganizationOptions(items: OrganizationListResponse['items']): Array<{ id: string; name: string }> {\n  if (!Array.isArray(items)) return []\n  return items.reduce<Array<{ id: string; name: string }>>((acc, org) => {\n    if (!org) return acc\n    const id = typeof org.id === 'string' && org.id.trim().length > 0 ? org.id : null\n    if (!id) return acc\n    const name = typeof org.name === 'string' && org.name.trim().length > 0 ? org.name : id\n    acc.push({ id, name })\n    return acc\n  }, [])\n}\n\nasync function readJsonOr<T>(\n  url: string,\n  init: RequestInit | undefined,\n  fallback: T,\n): Promise<T> {\n  const call = await apiCall<T>(url, init, { fallback })\n  if (!call.ok) return fallback\n  return call.result ?? fallback\n}\n\nexport function AclEditor({\n  kind,\n  targetId,\n  canEditOrganizations,\n  value,\n  onChange,\n  onVersionChange,\n  userRoles,\n  currentUserIsSuperAdmin,\n  tenantId,\n  preserveOnTenantChange = false,\n}: {\n  kind: 'user' | 'role'\n  targetId: string\n  canEditOrganizations: boolean\n  value?: AclData\n  onChange?: (data: AclData) => void\n  /**\n   * Reports the loaded ACL row's `updatedAt` (or null when none exists) so the\n   * parent can send the optimistic-lock header on save and reject stale ACL\n   * overwrites (#2055).\n   */\n  onVersionChange?: (updatedAt: string | null) => void\n  userRoles?: string[]\n  currentUserIsSuperAdmin?: boolean\n  tenantId?: string | null\n  preserveOnTenantChange?: boolean\n}) {\n  const actorIsSuperAdmin = !!currentUserIsSuperAdmin\n  const [loading, setLoading] = React.useState(true)\n  const [features, setFeatures] = React.useState<Feature[]>([])\n  const t = useT()\n  const [modules, setModules] = React.useState<ModuleInfo[]>([])\n  const [granted, setGranted] = React.useState<string[]>(() => {\n    const normalized = normalizeFeatureArray(value?.features)\n    return actorIsSuperAdmin ? normalized : normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n  })\n  const [isSuperAdmin, setIsSuperAdmin] = React.useState(value?.isSuperAdmin || false)\n  const [organizations, setOrganizations] = React.useState<string[] | null>(value?.organizations ?? null)\n  const [orgOptions, setOrgOptions] = React.useState<{ id: string; name: string }[]>([])\n  const [hasCustomAcl, setHasCustomAcl] = React.useState(true)\n  const [overrideEnabled, setOverrideEnabled] = React.useState(false)\n  const [roleDetails, setRoleDetails] = React.useState<RoleSummary[]>([])\n\n  const actorSanitizeFeatures = React.useCallback(\n    (list: unknown): string[] => {\n      const normalized = normalizeFeatureArray(list)\n      if (actorIsSuperAdmin) return normalized\n      return normalized.filter((feature) => !isTenantRestrictedFeature(feature))\n    },\n    [actorIsSuperAdmin],\n  )\n\n  const updateGranted = React.useCallback(\n    (updater: (prev: string[]) => string[]) => {\n      setGranted((prev) => actorSanitizeFeatures(updater(prev)))\n    },\n    [actorSanitizeFeatures],\n  )\n\n  const tenantIdRef = React.useRef(tenantId)\n  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])\n  const hasMountedRef = React.useRef(false)\n\n  const fetchAclState = React.useCallback(async (forTenantId: string | null | undefined, cancelledRef: { current: boolean }) => {\n    try {\n      const aclQuery = new URLSearchParams()\n      aclQuery.set(kind === 'user' ? 'userId' : 'roleId', targetId)\n      if (forTenantId) aclQuery.set('tenantId', forTenantId)\n      const aclQueryString = aclQuery.toString()\n      const aclJson = await readJsonOr<AclPayload>(\n        `/api/auth/${kind === 'user' ? 'users' : 'roles'}/acl${aclQueryString ? `?${aclQueryString}` : ''}`,\n        undefined,\n        { hasCustomAcl: true, isSuperAdmin: false, features: [], organizations: null },\n      )\n      if (cancelledRef.current) return\n      const customAclExists = aclJson.hasCustomAcl !== false\n      setHasCustomAcl(customAclExists)\n      setOverrideEnabled(customAclExists)\n      setIsSuperAdmin(!!aclJson.isSuperAdmin)\n      setGranted(actorSanitizeFeatures(aclJson.features))\n      setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])\n      onVersionChange?.(typeof aclJson.updatedAt === 'string' ? aclJson.updatedAt : null)\n    } catch {}\n  }, [kind, targetId, actorSanitizeFeatures, onVersionChange])\n\n  React.useEffect(() => {\n    const cancelled = { current: false }\n    async function load() {\n      setLoading(true)\n      try {\n        const fJson = await readJsonOr<FeatureListResponse>(\n          '/api/auth/features',\n          undefined,\n          { items: [], modules: [] },\n        )\n        if (!cancelled.current) {\n          setFeatures(fJson.items || [])\n          setModules(fJson.modules || [])\n        }\n      } catch {}\n      await fetchAclState(tenantIdRef.current, cancelled)\n      hasMountedRef.current = true\n      if (!cancelled.current) setLoading(false)\n    }\n    load()\n    return () => { cancelled.current = true }\n  }, [kind, targetId, fetchAclState])\n\n  React.useEffect(() => {\n    if (!hasMountedRef.current) return\n    if (preserveOnTenantChange) return\n    const cancelled = { current: false }\n    fetchAclState(tenantId, cancelled)\n    return () => { cancelled.current = true }\n  }, [tenantId, preserveOnTenantChange, fetchAclState])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadTenantScoped() {\n      if (canEditOrganizations) {\n        try {\n          const orgQuery = new URLSearchParams()\n          if (tenantId) orgQuery.set('tenantId', tenantId)\n          const orgQueryString = orgQuery.toString()\n          const oJson = await readJsonOr<OrganizationListResponse>(\n            `/api/directory/organizations${orgQueryString ? `?${orgQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) setOrgOptions(normalizeOrganizationOptions(oJson.items))\n        } catch {}\n      }\n      if (kind === 'user' && userRoles && userRoles.length > 0) {\n        try {\n          const roleQuery = new URLSearchParams({ pageSize: '100' })\n          if (tenantId) roleQuery.set('tenantId', tenantId)\n          const roleQueryString = roleQuery.toString()\n          const rolesJson = await readJsonOr<RoleListResponse>(\n            `/api/auth/roles${roleQueryString ? `?${roleQueryString}` : ''}`,\n            undefined,\n            { items: [] },\n          )\n          if (!cancelled) {\n            const allRoles = Array.isArray(rolesJson.items) ? rolesJson.items : []\n            const userRoleDetails: RoleSummary[] = buildRoleSummaries(allRoles, userRoles)\n            setRoleDetails(userRoleDetails)\n          }\n        } catch {}\n      }\n    }\n    loadTenantScoped()\n    return () => { cancelled = true }\n  }, [kind, canEditOrganizations, userRoles, tenantId])\n\n  // Notify parent of changes\n  React.useEffect(() => {\n    onChange?.({ isSuperAdmin, features: granted, organizations })\n  }, [isSuperAdmin, granted, organizations, onChange])\n\n  const grouped = React.useMemo(() => {\n    const moduleMap = new Map<string, string>()\n    for (const m of modules) {\n      moduleMap.set(m.id, t(`auth.acl.modules.${m.id}`, m.title))\n    }\n    const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()\n    for (const f of features) {\n      const moduleId = f.module\n      const moduleTitle = moduleMap.get(moduleId) || moduleId\n      const localizedFeature = {\n        ...f,\n        title: t(`auth.acl.features.${f.id}`, f.title),\n      }\n      if (!map.has(moduleId)) {\n        map.set(moduleId, { moduleId, moduleTitle, features: [] })\n      }\n      map.get(moduleId)!.features.push(localizedFeature)\n    }\n    return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))\n  }, [features, modules, t])\n\n  const localizedFeatures = React.useMemo(\n    () => grouped.flatMap((group) => group.features),\n    [grouped],\n  )\n\n  const hasGlobalWildcard = granted.includes('*')\n  const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0\n  // `null` (unrestricted) and `[]` (deny-all, the #4033 semantic) both leave every\n  // checkbox unticked, so the scope has to be reported explicitly instead of being\n  // inferred from checkbox emptiness (#5642).\n  const isDenyAllOrganizations = Array.isArray(organizations) && organizations.length === 0\n  const showOrganizationWarning =\n    (kind === 'role' || overrideEnabled) &&\n    canEditOrganizations &&\n    !isSuperAdmin &&\n    hasOrganizationRestriction &&\n    granted.length === 0\n  // A role ACL is persisted verbatim, so its empty scope really is a deny-all. A\n  // per-user override without a single feature is not persisted at all \u2014 the API\n  // clears the row instead of writing an empty scope \u2014 so warning there would\n  // claim a permission loss that never happens.\n  const denyAllOrganizationsWouldPersist = kind === 'role' || granted.length > 0\n  const showDenyAllOrganizationsWarning =\n    (kind === 'role' || overrideEnabled) &&\n    canEditOrganizations &&\n    !isSuperAdmin &&\n    isDenyAllOrganizations &&\n    denyAllOrganizationsWouldPersist\n  const organizationScopeSummary = isDenyAllOrganizations\n    ? t('auth.acl.organizationsScopeCurrent.none', 'Current scope: no organizations.')\n    : organizations && organizations.length > 0\n      ? t(\n          'auth.acl.organizationsScopeCurrent.selected',\n          'Current scope: {count} selected organization(s).',\n          { count: organizations.length },\n        )\n      : t('auth.acl.organizationsScopeCurrent.all', 'Current scope: all organizations.')\n\n  \n  const toggleWildcard = React.useCallback((wildcard: string, enable: boolean) => {\n    if (!actorIsSuperAdmin && enable && isTenantRestrictedFeature(wildcard)) return\n    updateGranted((prev) => {\n      if (enable) {\n        if (prev.includes(wildcard)) return prev\n        return [...prev, wildcard]\n      }\n      return prev.filter((feature) => feature !== wildcard)\n    })\n  }, [actorIsSuperAdmin, updateGranted])\n\n  const toggleModuleWildcard = React.useCallback((moduleId: string, enable: boolean) => {\n    toggleWildcard(`${moduleId}.*`, enable)\n  }, [toggleWildcard])\n\n  const isModuleWildcardEnabled = (moduleId: string) => {\n    return granted.includes(`${moduleId}.*`)\n  }\n\n  const isFeatureCoveredByWildcard = (featureId: string) =>\n    granted.some((feature) => (feature === '*' || feature.endsWith('.*')) && matchFeature(featureId, feature))\n\n  const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)\n\n  if (loading) {\n    return (\n      <div className=\"text-sm text-muted-foreground\">\n        {t('auth.acl.loading', 'Loading access control\u2026')}\n      </div>\n    )\n  }\n\n  const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled\n\n  return (\n    <div className=\"space-y-4\">\n      {showRoleBanner && (\n        <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n          <div className=\"text-sm font-medium text-status-info-text mb-2\">\n            {t('auth.acl.inherited.title', 'Permissions inherited from roles')}\n          </div>\n          <div className=\"text-sm text-status-info-text mb-3\">\n            {t('auth.acl.inherited.description', 'This user currently inherits permissions from their assigned roles.')}\n            {roleDetails.length > 0 && (\n              <span>\n                {' '}{t('auth.acl.inherited.assignedRoles', 'Assigned roles:')}{' '}\n                {roleDetails.map((role, idx) => {\n                  const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`\n                  const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId\n                  return (\n                    <React.Fragment key={roleId}>\n                      {idx > 0 && ', '}\n                      <Link \n                        href={`/backend/roles/${roleId}/edit`}\n                        className=\"font-semibold text-status-info-text underline\"\n                      >\n                        {roleName}\n                      </Link>\n                    </React.Fragment>\n                  )\n                })}\n              </span>\n            )}\n          </div>\n          <div className=\"flex items-center gap-2\">\n            <input \n              id=\"overrideAcl\" \n              type=\"checkbox\" \n              className=\"h-4 w-4\" \n              checked={overrideEnabled} \n              onChange={(e) => setOverrideEnabled(e.target.checked)} \n            />\n            <label htmlFor=\"overrideAcl\" className=\"text-sm text-status-info-text font-medium\">\n              {t('auth.acl.inherited.override', 'Override permissions for this user only')}\n            </label>\n          </div>\n        </div>\n      )}\n      {(kind === 'role' || overrideEnabled) && (\n        <>\n          <div className=\"flex items-center gap-2\">\n            <input\n              id=\"isSuperAdmin\"\n              type=\"checkbox\"\n              className=\"h-4 w-4\"\n              checked={isSuperAdmin}\n              disabled={!actorIsSuperAdmin}\n              onChange={(e) => setIsSuperAdmin(!!e.target.checked)}\n            />\n            <label htmlFor=\"isSuperAdmin\" className=\"text-sm\">\n              {t('auth.acl.superAdmin.label', 'Super Admin (all features)')}\n            </label>\n          </div>\n          {!actorIsSuperAdmin && (\n            <p className=\"text-xs text-muted-foreground\">\n              {t('auth.acl.superAdmin.hint', 'Only super administrators can change this option.')}\n            </p>\n          )}\n      {!isSuperAdmin && (\n        <>\n          {hasGlobalWildcard && (\n            <div className=\"rounded border border-status-info-border bg-status-info-bg p-3\">\n              <div className=\"text-sm font-medium text-status-info-text\">\n                {t('auth.acl.globalWildcard.title', 'Global wildcard (*) enabled')}\n              </div>\n              <div className=\"text-xs text-status-info-text mt-1\">\n                {t('auth.acl.globalWildcard.description', 'This grants access to all features in the system.')}\n              </div>\n              <Button\n                type=\"button\"\n                variant=\"outline\"\n                size=\"sm\"\n                className=\"mt-2\"\n                onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}\n              >\n                {t('auth.acl.globalWildcard.remove', 'Remove global wildcard')}\n              </Button>\n            </div>\n          )}\n          {!hasGlobalWildcard && (\n            <AclDependencyDiagnosticsPanel\n              granted={granted}\n              catalog={localizedFeatures as readonly FeatureDescriptor[]}\n              onGrantedChange={updateGranted}\n              hideUnknownReferences={process.env.NODE_ENV === 'production'}\n            />\n          )}\n          <div className=\"grid grid-cols-1 md:grid-cols-2 gap-4\">\n            {grouped.map((group) => {\n              const moduleWildcard = isModuleWildcardEnabled(group.moduleId)\n              const nestedWildcards = Array.from(\n                new Set(\n                  granted.filter(\n                    (feature) =>\n                      feature !== '*' &&\n                      feature.endsWith('.*') &&\n                      feature.startsWith(`${group.moduleId}.`) &&\n                      feature !== `${group.moduleId}.*`,\n                  ),\n                ),\n              )\n                .map((wildcard) => {\n                  const prefix = wildcard.slice(0, -1)\n                  const relatedFeatures = group.features.filter((feature) => feature.id.startsWith(prefix))\n                  return { wildcard, features: relatedFeatures }\n                })\n                .sort((a, b) => a.wildcard.localeCompare(b.wildcard))\n              const nestedCoveredIds = new Set<string>()\n              for (const entry of nestedWildcards) {\n                for (const feature of entry.features) nestedCoveredIds.add(feature.id)\n              }\n              const moduleRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(`${group.moduleId}.*`)\n              const moduleCheckboxDisabled = hasGlobalWildcard || moduleRestricted\n              return (\n                <div key={group.moduleId} className=\"rounded border p-3\">\n                  <div className=\"flex items-center justify-between mb-3 pb-2 border-b\">\n                    <div className=\"text-sm font-medium\">{group.moduleTitle}</div>\n                    <div className=\"flex items-center gap-2\">\n                      <input \n                        id={`module-${group.moduleId}`} \n                        type=\"checkbox\" \n                        className=\"h-4 w-4\" \n                        checked={moduleWildcard || hasGlobalWildcard} \n                        disabled={moduleCheckboxDisabled}\n                        onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} \n                      />\n                      <label htmlFor={`module-${group.moduleId}`} className=\"text-sm text-muted-foreground\">\n                        {t('auth.acl.allModuleFeatures', 'All')}{' '}\n                        {moduleWildcard && !hasGlobalWildcard ? <span className=\"font-medium text-status-info-text\">({group.moduleId}.*)</span> : ''}\n                        {moduleRestricted ? (\n                          <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                            {t('auth.acl.manageViaSuperAdmin', '(manage via super admin)')}\n                          </span>\n                        ) : null}\n                      </label>\n                    </div>\n                  </div>\n                {nestedWildcards.length > 0 && (\n                  <div className=\"space-y-3 mb-3\">\n                    {nestedWildcards.map(({ wildcard, features: wildcardFeatures }) => {\n                        const checked = granted.includes(wildcard) || hasGlobalWildcard || moduleWildcard\n                        const wildcardRestricted = !actorIsSuperAdmin && isTenantRestrictedFeature(wildcard)\n                        const disabled = hasGlobalWildcard || moduleWildcard || wildcardRestricted\n                        return (\n                          <div key={wildcard} className=\"space-y-2\">\n                            <div className=\"flex items-center gap-2\">\n                              <input\n                                id={`wildcard-${wildcard}`}\n                                type=\"checkbox\"\n                                className=\"h-4 w-4\"\n                                checked={checked}\n                                disabled={disabled}\n                                onChange={(e) => toggleWildcard(wildcard, !!e.target.checked)}\n                              />\n                              <label\n                                htmlFor={`wildcard-${wildcard}`}\n                                className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                              >\n                                {formatWildcardLabel(t, group.moduleId, wildcard)}{' '}\n                                <span className=\"text-muted-foreground text-xs font-mono\">({wildcard})</span>\n                                {wildcardRestricted ? (\n                                  <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                    {t('auth.acl.restricted', 'Restricted')}\n                                  </span>\n                                ) : null}\n                              </label>\n                            </div>\n                            {wildcardFeatures.length > 0 && (\n                              <div className=\"relative ml-6 pl-4 text-sm text-muted-foreground space-y-1\">\n                                <div className=\"absolute left-0 top-1 bottom-1 w-px bg-border\" aria-hidden />\n                                {wildcardFeatures.map((wf) => (\n                                  <div key={`${wildcard}-${wf.id}`} className=\"pl-2\">\n                                    <span>\n                                      {wf.title}{' '}\n                                      <span className=\"text-xs font-mono text-muted-foreground\">({wf.id})</span>\n                                    </span>\n                                  </div>\n                                ))}\n                              </div>\n                            )}\n                          </div>\n                        )\n                      })}\n                    </div>\n                  )}\n                  <div className=\"space-y-2\">\n                    {group.features.map((f) => {\n                      if (nestedCoveredIds.has(f.id)) return null\n                      const checked = isFeatureChecked(f.id)\n                      const isWildcardCovered = isFeatureCoveredByWildcard(f.id)\n                      const restricted = !actorIsSuperAdmin && isTenantRestrictedFeature(f.id)\n                      const disabled = isWildcardCovered || restricted\n                      return (\n                        <div key={f.id} className=\"flex items-center gap-2\">\n                          <input\n                            id={`f-${f.id}`}\n                            type=\"checkbox\"\n                            className=\"h-4 w-4\"\n                            checked={checked}\n                            disabled={disabled}\n                            onChange={(e) => {\n                              const on = !!e.target.checked\n                              updateGranted((prev) => {\n                                if (on) return [...prev, f.id]\n                                return prev.filter((x) => x !== f.id)\n                              })\n                            }}\n                          />\n                          <label\n                            htmlFor={`f-${f.id}`}\n                            className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}\n                          >\n                            {f.title} <span className=\"text-muted-foreground text-xs\">({f.id})</span>\n                            {restricted ? (\n                              <span className=\"ml-2 text-xs font-medium text-muted-foreground\">\n                                {t('auth.acl.restricted', 'Restricted')}\n                              </span>\n                            ) : null}\n                          </label>\n                        </div>\n                      )\n                    })}\n                  </div>\n                </div>\n              )\n            })}\n          </div>\n        </>\n          )}\n          {canEditOrganizations && (\n            <div className=\"rounded border p-3\">\n              <div className=\"text-sm font-medium mb-2\">\n                {t('auth.acl.organizationsScope', 'Organizations scope')}\n              </div>\n              <div className=\"text-xs text-muted-foreground mb-2\">\n                {t('auth.acl.organizationsScopeHint', 'Select one or more organizations to restrict access to them. Use \"Allow all organizations\" to lift the restriction \u2014 clearing every selection instead denies access to all organizations.')}\n              </div>\n              <div className=\"text-xs font-medium mb-2\" data-testid=\"acl-organization-scope-summary\">\n                {organizationScopeSummary}\n              </div>\n              <div className=\"grid grid-cols-1 md:grid-cols-2 gap-2\">\n                {orgOptions.map((o) => {\n                  const checked = organizations == null ? false : (organizations || []).includes(o.id)\n                  return (\n                    <div key={o.id} className=\"flex items-center gap-2\">\n                      <input id={`org-${o.id}`} type=\"checkbox\" className=\"h-4 w-4\" checked={checked} onChange={(e) => {\n                        const on = !!e.target.checked\n                        setOrganizations((prev) => {\n                          if (prev == null) return on ? [o.id] : []\n                          return on ? Array.from(new Set([...(prev || []), o.id])) : (prev || []).filter((x) => x !== o.id)\n                        })\n                      }} />\n                      <label htmlFor={`org-${o.id}`} className=\"text-sm\">{o.name}</label>\n                    </div>\n                  )\n                })}\n              </div>\n              <div className=\"mt-2\">\n                <Button type=\"button\" variant=\"outline\" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>\n              </div>\n              {showOrganizationWarning && (\n                <div className=\"mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text\">\n                  {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}\n                </div>\n              )}\n              {showDenyAllOrganizationsWarning && (\n                <div\n                  className=\"mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text\"\n                  data-testid=\"acl-organization-deny-all-warning\"\n                >\n                  {t('auth.acl.organizationsDenyAllWarning', 'No organization is selected, so this override denies access in every organization \u2014 including the features granted above. Choose at least one organization, or use \"Allow all organizations\" to leave the scope unrestricted.')}\n                </div>\n              )}\n            </div>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"],
+  "mappings": ";AAsVM,SAyEE,UAzEF,KAwBc,YAxBd;AArVN,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,OAAO,UAAU;AACjB,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAA8B;AAEvC,SAAS,qCAAqC;AAE9C,SAAS,sBAAsB,OAA0B;AACvD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAgB,UAAkB,UAA0B;AACvF,MAAI,CAAC,SAAS,SAAS,IAAI,EAAG,QAAO;AACrC,QAAM,SAAS,GAAG,QAAQ;AAC1B,QAAM,SAAS,SAAS,WAAW,MAAM,IAAI,SAAS,MAAM,OAAO,QAAQ,EAAE,IAAI,SAAS,MAAM,GAAG,EAAE;AACrG,MAAI,CAAC,OAAQ,QAAO,EAAE,kCAAkC,cAAc;AACtE,QAAM,QAAQ,OACX,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,QAAQ,QAAQ,SAAS,GAAG,EAAE,QAAQ,SAAS,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,EAC7F,KAAK,KAAK;AACb,SAAO,EAAE,+BAA+B,8BAA8B,EAAE,MAAM,CAAC;AACjF;AAQA,SAAS,mBAAmB,OAAuB,cAAuC;AACxF,QAAM,YAA2B,CAAC;AAClC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,QAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,IAAI,EAAG;AAC3C,UAAM,aAAa,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS;AACpE,UAAM,KAAK,aAAc,KAAM,KAAgB;AAC/C,cAAU,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC7B;AACA,SAAO;AACT;AAkBA,SAAS,6BAA6B,OAA+E;AACnH,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAA4C,CAAC,KAAK,QAAQ;AACrE,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,KAAK,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,KAAK;AAC7E,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,IAAI,OAAO;AACrF,QAAI,KAAK,EAAE,IAAI,KAAK,CAAC;AACrB,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACP;AAEA,eAAe,WACb,KACA,MACA,UACY;AACZ,QAAM,OAAO,MAAM,QAAW,KAAK,MAAM,EAAE,SAAS,CAAC;AACrD,MAAI,CAAC,KAAK,GAAI,QAAO;AACrB,SAAO,KAAK,UAAU;AACxB;AAEO,SAAS,UAAU;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAyB;AAC3B,GAgBG;AACD,QAAM,oBAAoB,CAAC,CAAC;AAC5B,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAoB,CAAC,CAAC;AAC5D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC7D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAmB,MAAM;AAC3D,UAAM,aAAa,sBAAsB,OAAO,QAAQ;AACxD,WAAO,oBAAoB,aAAa,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,EAC5G,CAAC;AACD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,OAAO,gBAAgB,KAAK;AACnF,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAA0B,OAAO,iBAAiB,IAAI;AACtG,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAyC,CAAC,CAAC;AACrF,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,IAAI;AAC3D,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAClE,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAwB,CAAC,CAAC;AAEtE,QAAM,wBAAwB,MAAM;AAAA,IAClC,CAAC,SAA4B;AAC3B,YAAM,aAAa,sBAAsB,IAAI;AAC7C,UAAI,kBAAmB,QAAO;AAC9B,aAAO,WAAW,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AAAA,IAC3E;AAAA,IACA,CAAC,iBAAiB;AAAA,EACpB;AAEA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,CAAC,YAA0C;AACzC,iBAAW,CAAC,SAAS,sBAAsB,QAAQ,IAAI,CAAC,CAAC;AAAA,IAC3D;AAAA,IACA,CAAC,qBAAqB;AAAA,EACxB;AAEA,QAAM,cAAc,MAAM,OAAO,QAAQ;AACzC,QAAM,UAAU,MAAM;AAAE,gBAAY,UAAU;AAAA,EAAS,GAAG,CAAC,QAAQ,CAAC;AACpE,QAAM,gBAAgB,MAAM,OAAO,KAAK;AAExC,QAAM,gBAAgB,MAAM,YAAY,OAAO,aAAwC,iBAAuC;AAC5H,QAAI;AACF,YAAM,WAAW,IAAI,gBAAgB;AACrC,eAAS,IAAI,SAAS,SAAS,WAAW,UAAU,QAAQ;AAC5D,UAAI,YAAa,UAAS,IAAI,YAAY,WAAW;AACrD,YAAM,iBAAiB,SAAS,SAAS;AACzC,YAAM,UAAU,MAAM;AAAA,QACpB,aAAa,SAAS,SAAS,UAAU,OAAO,OAAO,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,QACjG;AAAA,QACA,EAAE,cAAc,MAAM,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AAAA,MAC/E;AACA,UAAI,aAAa,QAAS;AAC1B,YAAM,kBAAkB,QAAQ,iBAAiB;AACjD,sBAAgB,eAAe;AAC/B,yBAAmB,eAAe;AAClC,sBAAgB,CAAC,CAAC,QAAQ,YAAY;AACtC,iBAAW,sBAAsB,QAAQ,QAAQ,CAAC;AAClD,uBAAiB,QAAQ,iBAAiB,OAAO,OAAO,MAAM,QAAQ,QAAQ,aAAa,IAAI,QAAQ,gBAAgB,CAAC,CAAC;AACzH,wBAAkB,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY,IAAI;AAAA,IACpF,QAAQ;AAAA,IAAC;AAAA,EACX,GAAG,CAAC,MAAM,UAAU,uBAAuB,eAAe,CAAC;AAE3D,QAAM,UAAU,MAAM;AACpB,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,UAAI;AACF,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,QAC3B;AACA,YAAI,CAAC,UAAU,SAAS;AACtB,sBAAY,MAAM,SAAS,CAAC,CAAC;AAC7B,qBAAW,MAAM,WAAW,CAAC,CAAC;AAAA,QAChC;AAAA,MACF,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,YAAY,SAAS,SAAS;AAClD,oBAAc,UAAU;AACxB,UAAI,CAAC,UAAU,QAAS,YAAW,KAAK;AAAA,IAC1C;AACA,SAAK;AACL,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,MAAM,UAAU,aAAa,CAAC;AAElC,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,cAAc,QAAS;AAC5B,QAAI,uBAAwB;AAC5B,UAAM,YAAY,EAAE,SAAS,MAAM;AACnC,kBAAc,UAAU,SAAS;AACjC,WAAO,MAAM;AAAE,gBAAU,UAAU;AAAA,IAAK;AAAA,EAC1C,GAAG,CAAC,UAAU,wBAAwB,aAAa,CAAC;AAEpD,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,WAAW,IAAI,gBAAgB;AACrC,cAAI,SAAU,UAAS,IAAI,YAAY,QAAQ;AAC/C,gBAAM,iBAAiB,SAAS,SAAS;AACzC,gBAAM,QAAQ,MAAM;AAAA,YAClB,+BAA+B,iBAAiB,IAAI,cAAc,KAAK,EAAE;AAAA,YACzE;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,UAAW,eAAc,6BAA6B,MAAM,KAAK,CAAC;AAAA,QACzE,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,UAAI,SAAS,UAAU,aAAa,UAAU,SAAS,GAAG;AACxD,YAAI;AACF,gBAAM,YAAY,IAAI,gBAAgB,EAAE,UAAU,MAAM,CAAC;AACzD,cAAI,SAAU,WAAU,IAAI,YAAY,QAAQ;AAChD,gBAAM,kBAAkB,UAAU,SAAS;AAC3C,gBAAM,YAAY,MAAM;AAAA,YACtB,kBAAkB,kBAAkB,IAAI,eAAe,KAAK,EAAE;AAAA,YAC9D;AAAA,YACA,EAAE,OAAO,CAAC,EAAE;AAAA,UACd;AACA,cAAI,CAAC,WAAW;AACd,kBAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,IAAI,UAAU,QAAQ,CAAC;AACrE,kBAAM,kBAAiC,mBAAmB,UAAU,SAAS;AAC7E,2BAAe,eAAe;AAAA,UAChC;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AACA,qBAAiB;AACjB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,sBAAsB,WAAW,QAAQ,CAAC;AAGpD,QAAM,UAAU,MAAM;AACpB,eAAW,EAAE,cAAc,UAAU,SAAS,cAAc,CAAC;AAAA,EAC/D,GAAG,CAAC,cAAc,SAAS,eAAe,QAAQ,CAAC;AAEnD,QAAM,UAAU,MAAM,QAAQ,MAAM;AAClC,UAAM,YAAY,oBAAI,IAAoB;AAC1C,eAAW,KAAK,SAAS;AACvB,gBAAU,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC;AAAA,IAC5D;AACA,UAAM,MAAM,oBAAI,IAA4E;AAC5F,eAAW,KAAK,UAAU;AACxB,YAAM,WAAW,EAAE;AACnB,YAAM,cAAc,UAAU,IAAI,QAAQ,KAAK;AAC/C,YAAM,mBAAmB;AAAA,QACvB,GAAG;AAAA,QACH,OAAO,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK;AAAA,MAC/C;AACA,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACtB,YAAI,IAAI,UAAU,EAAE,UAAU,aAAa,UAAU,CAAC,EAAE,CAAC;AAAA,MAC3D;AACA,UAAI,IAAI,QAAQ,EAAG,SAAS,KAAK,gBAAgB;AAAA,IACnD;AACA,WAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,cAAc,EAAE,WAAW,CAAC;AAAA,EAC3F,GAAG,CAAC,UAAU,SAAS,CAAC,CAAC;AAEzB,QAAM,oBAAoB,MAAM;AAAA,IAC9B,MAAM,QAAQ,QAAQ,CAAC,UAAU,MAAM,QAAQ;AAAA,IAC/C,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,oBAAoB,QAAQ,SAAS,GAAG;AAC9C,QAAM,6BAA6B,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS;AAI1F,QAAM,yBAAyB,MAAM,QAAQ,aAAa,KAAK,cAAc,WAAW;AACxF,QAAM,2BACH,SAAS,UAAU,oBACpB,wBACA,CAAC,gBACD,8BACA,QAAQ,WAAW;AAKrB,QAAM,mCAAmC,SAAS,UAAU,QAAQ,SAAS;AAC7E,QAAM,mCACH,SAAS,UAAU,oBACpB,wBACA,CAAC,gBACD,0BACA;AACF,QAAM,2BAA2B,yBAC7B,EAAE,2CAA2C,kCAAkC,IAC/E,iBAAiB,cAAc,SAAS,IACtC;AAAA,IACE;AAAA,IACA;AAAA,IACA,EAAE,OAAO,cAAc,OAAO;AAAA,EAChC,IACA,EAAE,0CAA0C,mCAAmC;AAGrF,QAAM,iBAAiB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AAC9E,QAAI,CAAC,qBAAqB,UAAU,0BAA0B,QAAQ,EAAG;AACzE,kBAAc,CAAC,SAAS;AACtB,UAAI,QAAQ;AACV,YAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,eAAO,CAAC,GAAG,MAAM,QAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,OAAO,CAAC,YAAY,YAAY,QAAQ;AAAA,IACtD,CAAC;AAAA,EACH,GAAG,CAAC,mBAAmB,aAAa,CAAC;AAErC,QAAM,uBAAuB,MAAM,YAAY,CAAC,UAAkB,WAAoB;AACpF,mBAAe,GAAG,QAAQ,MAAM,MAAM;AAAA,EACxC,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,0BAA0B,CAAC,aAAqB;AACpD,WAAO,QAAQ,SAAS,GAAG,QAAQ,IAAI;AAAA,EACzC;AAEA,QAAM,6BAA6B,CAAC,cAClC,QAAQ,KAAK,CAAC,aAAa,YAAY,OAAO,QAAQ,SAAS,IAAI,MAAM,aAAa,WAAW,OAAO,CAAC;AAE3G,QAAM,mBAAmB,CAAC,cAAsB,WAAW,SAAS,SAAS;AAE7E,MAAI,SAAS;AACX,WACE,oBAAC,SAAI,WAAU,iCACZ,YAAE,oBAAoB,8BAAyB,GAClD;AAAA,EAEJ;AAEA,QAAM,iBAAiB,SAAS,UAAU,CAAC,gBAAgB,CAAC;AAE5D,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,sBACC,qBAAC,SAAI,WAAU,qEACb;AAAA,0BAAC,SAAI,WAAU,kDACZ,YAAE,4BAA4B,kCAAkC,GACnE;AAAA,MACA,qBAAC,SAAI,WAAU,sCACZ;AAAA,UAAE,kCAAkC,qEAAqE;AAAA,QACzG,YAAY,SAAS,KACpB,qBAAC,UACE;AAAA;AAAA,UAAK,EAAE,oCAAoC,iBAAiB;AAAA,UAAG;AAAA,UAC/D,YAAY,IAAI,CAAC,MAAM,QAAQ;AAC9B,kBAAM,SAAS,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,IAAI,KAAK,KAAK,QAAQ,GAAG;AACzF,kBAAM,WAAW,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,SAAS,IAAI,KAAK,OAAO;AACtF,mBACE,qBAAC,MAAM,UAAN,EACE;AAAA,oBAAM,KAAK;AAAA,cACZ;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAM,kBAAkB,MAAM;AAAA,kBAC9B,WAAU;AAAA,kBAET;AAAA;AAAA,cACH;AAAA,iBAPmB,MAQrB;AAAA,UAEJ,CAAC;AAAA,WACH;AAAA,SAEJ;AAAA,MACA,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,OAAO;AAAA;AAAA,QACtD;AAAA,QACA,oBAAC,WAAM,SAAQ,eAAc,WAAU,6CACpC,YAAE,+BAA+B,yCAAyC,GAC7E;AAAA,SACF;AAAA,OACF;AAAA,KAEA,SAAS,UAAU,oBACnB,iCACE;AAAA,2BAAC,SAAI,WAAU,2BACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,UAAU,CAAC;AAAA,YACX,UAAU,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,QACrD;AAAA,QACA,oBAAC,WAAM,SAAQ,gBAAe,WAAU,WACrC,YAAE,6BAA6B,4BAA4B,GAC9D;AAAA,SACF;AAAA,MACC,CAAC,qBACA,oBAAC,OAAE,WAAU,iCACV,YAAE,4BAA4B,mDAAmD,GACpF;AAAA,MAEL,CAAC,gBACA,iCACG;AAAA,6BACC,qBAAC,SAAI,WAAU,kEACb;AAAA,8BAAC,SAAI,WAAU,6CACZ,YAAE,iCAAiC,6BAA6B,GACnE;AAAA,UACA,oBAAC,SAAI,WAAU,sCACZ,YAAE,uCAAuC,mDAAmD,GAC/F;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS,MAAM,cAAc,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,MAAM,GAAG,CAAC;AAAA,cAEnE,YAAE,kCAAkC,wBAAwB;AAAA;AAAA,UAC/D;AAAA,WACF;AAAA,QAED,CAAC,qBACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA,SAAS;AAAA,YACT,iBAAiB;AAAA,YACjB,uBAAuB,QAAQ,IAAI,aAAa;AAAA;AAAA,QAClD;AAAA,QAEF,oBAAC,SAAI,WAAU,yCACZ,kBAAQ,IAAI,CAAC,UAAU;AACtB,gBAAM,iBAAiB,wBAAwB,MAAM,QAAQ;AAC7D,gBAAM,kBAAkB,MAAM;AAAA,YAC5B,IAAI;AAAA,cACF,QAAQ;AAAA,gBACN,CAAC,YACC,YAAY,OACZ,QAAQ,SAAS,IAAI,KACrB,QAAQ,WAAW,GAAG,MAAM,QAAQ,GAAG,KACvC,YAAY,GAAG,MAAM,QAAQ;AAAA,cACjC;AAAA,YACF;AAAA,UACF,EACG,IAAI,CAAC,aAAa;AACjB,kBAAM,SAAS,SAAS,MAAM,GAAG,EAAE;AACnC,kBAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC,YAAY,QAAQ,GAAG,WAAW,MAAM,CAAC;AACxF,mBAAO,EAAE,UAAU,UAAU,gBAAgB;AAAA,UAC/C,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtD,gBAAM,mBAAmB,oBAAI,IAAY;AACzC,qBAAW,SAAS,iBAAiB;AACnC,uBAAW,WAAW,MAAM,SAAU,kBAAiB,IAAI,QAAQ,EAAE;AAAA,UACvE;AACA,gBAAM,mBAAmB,CAAC,qBAAqB,0BAA0B,GAAG,MAAM,QAAQ,IAAI;AAC9F,gBAAM,yBAAyB,qBAAqB;AACpD,iBACE,qBAAC,SAAyB,WAAU,sBAClC;AAAA,iCAAC,SAAI,WAAU,wDACb;AAAA,kCAAC,SAAI,WAAU,uBAAuB,gBAAM,aAAY;AAAA,cACxD,qBAAC,SAAI,WAAU,2BACb;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,UAAU,MAAM,QAAQ;AAAA,oBAC5B,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV,SAAS,kBAAkB;AAAA,oBAC3B,UAAU;AAAA,oBACV,UAAU,CAAC,MAAM,qBAAqB,MAAM,UAAU,EAAE,OAAO,OAAO;AAAA;AAAA,gBACxE;AAAA,gBACA,qBAAC,WAAM,SAAS,UAAU,MAAM,QAAQ,IAAI,WAAU,iCACnD;AAAA,oBAAE,8BAA8B,KAAK;AAAA,kBAAG;AAAA,kBACxC,kBAAkB,CAAC,oBAAoB,qBAAC,UAAK,WAAU,qCAAoC;AAAA;AAAA,oBAAE,MAAM;AAAA,oBAAS;AAAA,qBAAG,IAAU;AAAA,kBACzH,mBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,gCAAgC,0BAA0B,GAC/D,IACE;AAAA,mBACN;AAAA,iBACF;AAAA,eACF;AAAA,YACD,gBAAgB,SAAS,KACxB,oBAAC,SAAI,WAAU,kBACZ,0BAAgB,IAAI,CAAC,EAAE,UAAU,UAAU,iBAAiB,MAAM;AAC/D,oBAAM,UAAU,QAAQ,SAAS,QAAQ,KAAK,qBAAqB;AACnE,oBAAM,qBAAqB,CAAC,qBAAqB,0BAA0B,QAAQ;AACnF,oBAAM,WAAW,qBAAqB,kBAAkB;AACxD,qBACE,qBAAC,SAAmB,WAAU,aAC5B;AAAA,qCAAC,SAAI,WAAU,2BACb;AAAA;AAAA,oBAAC;AAAA;AAAA,sBACC,IAAI,YAAY,QAAQ;AAAA,sBACxB,MAAK;AAAA,sBACL,WAAU;AAAA,sBACV;AAAA,sBACA;AAAA,sBACA,UAAU,CAAC,MAAM,eAAe,UAAU,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA;AAAA,kBAC9D;AAAA,kBACA;AAAA,oBAAC;AAAA;AAAA,sBACC,SAAS,YAAY,QAAQ;AAAA,sBAC7B,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,sBAE5D;AAAA,4CAAoB,GAAG,MAAM,UAAU,QAAQ;AAAA,wBAAG;AAAA,wBACnD,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,0BAAE;AAAA,0BAAS;AAAA,2BAAC;AAAA,wBACrE,qBACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,kBACN;AAAA,mBACF;AAAA,gBACC,iBAAiB,SAAS,KACzB,qBAAC,SAAI,WAAU,8DACb;AAAA,sCAAC,SAAI,WAAU,iDAAgD,eAAW,MAAC;AAAA,kBAC1E,iBAAiB,IAAI,CAAC,OACrB,oBAAC,SAAiC,WAAU,QAC1C,+BAAC,UACE;AAAA,uBAAG;AAAA,oBAAO;AAAA,oBACX,qBAAC,UAAK,WAAU,2CAA0C;AAAA;AAAA,sBAAE,GAAG;AAAA,sBAAG;AAAA,uBAAC;AAAA,qBACrE,KAJQ,GAAG,QAAQ,IAAI,GAAG,EAAE,EAK9B,CACD;AAAA,mBACH;AAAA,mBAlCM,QAoCV;AAAA,YAEJ,CAAC,GACH;AAAA,YAEF,oBAAC,SAAI,WAAU,aACZ,gBAAM,SAAS,IAAI,CAAC,MAAM;AACzB,kBAAI,iBAAiB,IAAI,EAAE,EAAE,EAAG,QAAO;AACvC,oBAAM,UAAU,iBAAiB,EAAE,EAAE;AACrC,oBAAM,oBAAoB,2BAA2B,EAAE,EAAE;AACzD,oBAAM,aAAa,CAAC,qBAAqB,0BAA0B,EAAE,EAAE;AACvE,oBAAM,WAAW,qBAAqB;AACtC,qBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA;AAAA,kBAAC;AAAA;AAAA,oBACC,IAAI,KAAK,EAAE,EAAE;AAAA,oBACb,MAAK;AAAA,oBACL,WAAU;AAAA,oBACV;AAAA,oBACA;AAAA,oBACA,UAAU,CAAC,MAAM;AACf,4BAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,oCAAc,CAAC,SAAS;AACtB,4BAAI,GAAI,QAAO,CAAC,GAAG,MAAM,EAAE,EAAE;AAC7B,+BAAO,KAAK,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,sBACtC,CAAC;AAAA,oBACH;AAAA;AAAA,gBACF;AAAA,gBACA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,KAAK,EAAE,EAAE;AAAA,oBAClB,WAAW,WAAW,WAAW,0BAA0B,EAAE;AAAA,oBAE5D;AAAA,wBAAE;AAAA,sBAAM;AAAA,sBAAC,qBAAC,UAAK,WAAU,iCAAgC;AAAA;AAAA,wBAAE,EAAE;AAAA,wBAAG;AAAA,yBAAC;AAAA,sBACjE,aACC,oBAAC,UAAK,WAAU,kDACb,YAAE,uBAAuB,YAAY,GACxC,IACE;AAAA;AAAA;AAAA,gBACN;AAAA,mBAzBQ,EAAE,EA0BZ;AAAA,YAEJ,CAAC,GACH;AAAA,eA5GQ,MAAM,QA6GhB;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEG,wBACC,qBAAC,SAAI,WAAU,sBACb;AAAA,4BAAC,SAAI,WAAU,4BACZ,YAAE,+BAA+B,qBAAqB,GACzD;AAAA,QACA,oBAAC,SAAI,WAAU,sCACZ,YAAE,mCAAmC,gMAA2L,GACnO;AAAA,QACA,oBAAC,SAAI,WAAU,4BAA2B,eAAY,kCACnD,oCACH;AAAA,QACA,oBAAC,SAAI,WAAU,yCACZ,qBAAW,IAAI,CAAC,MAAM;AACrB,gBAAM,UAAU,iBAAiB,OAAO,SAAS,iBAAiB,CAAC,GAAG,SAAS,EAAE,EAAE;AACnF,iBACE,qBAAC,SAAe,WAAU,2BACxB;AAAA,gCAAC,WAAM,IAAI,OAAO,EAAE,EAAE,IAAI,MAAK,YAAW,WAAU,WAAU,SAAkB,UAAU,CAAC,MAAM;AAC/F,oBAAM,KAAK,CAAC,CAAC,EAAE,OAAO;AACtB,+BAAiB,CAAC,SAAS;AACzB,oBAAI,QAAQ,KAAM,QAAO,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;AACxC,uBAAO,KAAK,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,QAAQ,CAAC,GAAI,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE;AAAA,cAClG,CAAC;AAAA,YACH,GAAG;AAAA,YACH,oBAAC,WAAM,SAAS,OAAO,EAAE,EAAE,IAAI,WAAU,WAAW,YAAE,MAAK;AAAA,eARnD,EAAE,EASZ;AAAA,QAEJ,CAAC,GACH;AAAA,QACA,oBAAC,SAAI,WAAU,QACb,8BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAI,YAAE,kCAAkC,yBAAyB,GAAE,GACjJ;AAAA,QACC,2BACC,oBAAC,SAAI,WAAU,oHACZ,YAAE,gCAAgC,mJAAmJ,GACxL;AAAA,QAED,mCACC;AAAA,UAAC;AAAA;AAAA,YACC,WAAU;AAAA,YACV,eAAY;AAAA,YAEX,YAAE,wCAAwC,oOAA+N;AAAA;AAAA,QAC5Q;AAAA,SAEJ;AAAA,OAEJ;AAAA,KAEJ;AAEJ;",
   "names": []
 }

package/dist/modules/customers/backend/customers/companies/page.js

@@ -21,6 +21,7 @@ import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
 import { createEmptyTree, makeRuleTree } from "@open-mercato/shared/lib/query/advanced-filter-tree";
 import { deserializeAdvancedFilter, deserializeTree, flatToTree, mapDictionaryColorToTone, serializeTree } from "@open-mercato/shared/lib/query/advanced-filter";
 import { useCurrentUserId } from "@open-mercato/ui/backend/utils/useCurrentUserId";
+import { useCurrentOrganization } from "@open-mercato/ui/backend/BackendChromeProvider";
 import {
   DictionaryValue,
   createEmptyCustomerDictionaryMaps,
@@ -246,11 +247,12 @@ function CustomersCompaniesPage() {
     { keyExtras: [scopeVersion, reloadToken] }
   );
   const currentUserId = useCurrentUserId();
+  const activeOrgId = useCurrentOrganization()?.id ?? null;
   const [ownerFilterOptions, setOwnerFilterOptions] = React.useState([]);
   React.useEffect(() => {
     const controller = new AbortController();
     let cancelled = false;
-    void fetchAssignableStaffMembers("", { pageSize: 100, signal: controller.signal }).then((items) => {
+    void fetchAssignableStaffMembers("", { pageSize: 100, activeOrgId, signal: controller.signal }).then((items) => {
       if (!cancelled) setOwnerFilterOptions(mapAssignableStaffToFilterOptions(items));
     }).catch(() => {
       if (!cancelled) setOwnerFilterOptions([]);
@@ -259,7 +261,7 @@ function CustomersCompaniesPage() {
       cancelled = true;
       controller.abort();
     };
-  }, [scopeVersion]);
+  }, [activeOrgId, scopeVersion]);
   const resolvedOwnerFilterOptions = React.useMemo(
     () => ensureCurrentUserFilterOption(
       ownerFilterOptions,
@@ -269,9 +271,9 @@ function CustomersCompaniesPage() {
     [currentUserId, ownerFilterOptions, t]
   );
   const loadOwnerFilterOptions = React.useCallback(async (query) => {
-    const items = await fetchAssignableStaffMembers(query ?? "", { pageSize: 100 });
+    const items = await fetchAssignableStaffMembers(query ?? "", { pageSize: 100, activeOrgId });
     return mapAssignableStaffToFilterOptions(items);
-  }, []);
+  }, [activeOrgId]);
   const queryParams = React.useMemo(() => {
     const params = new URLSearchParams();
     params.set("page", String(page));