@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/query_index/lib/request-encryption.js

@@ -0,0 +1,16 @@
+function bindEncryptionServiceToRequest(service, em) {
+  if (!service) return null;
+  return new Proxy(service, {
+    get(target, property, receiver) {
+      if (property === "decryptEntityPayload") {
+        return (entityId, payload, tenantId, organizationId, options) => target.decryptEntityPayload(entityId, payload, tenantId, organizationId, { ...options, em: options?.em ?? em });
+      }
+      const value = Reflect.get(target, property, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+export {
+  bindEncryptionServiceToRequest
+};
+//# sourceMappingURL=request-encryption.js.map

package/dist/modules/query_index/lib/request-encryption.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/query_index/lib/request-encryption.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\n\ntype DecryptOptions = { em?: EntityManager }\n\n/**\n * Binds row decryption to the request EntityManager so a query engine that decrypts\n * many rows resolves each encryption-policy scope once per request (the policy memo\n * is keyed by the EntityManager) instead of once per row.\n */\nexport function bindEncryptionServiceToRequest<T extends Pick<TenantDataEncryptionService, 'decryptEntityPayload'>>(\n  service: T | null | undefined,\n  em: EntityManager,\n): T | null {\n  if (!service) return null\n  return new Proxy(service, {\n    get(target, property, receiver) {\n      if (property === 'decryptEntityPayload') {\n        return (\n          entityId: string,\n          payload: Record<string, unknown>,\n          tenantId: string | null,\n          organizationId: string | null,\n          options?: DecryptOptions,\n        ) => target.decryptEntityPayload(entityId, payload, tenantId, organizationId, { ...options, em: options?.em ?? em })\n      }\n      const value = Reflect.get(target, property, receiver)\n      return typeof value === 'function' ? value.bind(target) : value\n    },\n  })\n}\n"],
+  "mappings": "AAUO,SAAS,+BACd,SACA,IACU;AACV,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,IAAI,MAAM,SAAS;AAAA,IACxB,IAAI,QAAQ,UAAU,UAAU;AAC9B,UAAI,aAAa,wBAAwB;AACvC,eAAO,CACL,UACA,SACA,UACA,gBACA,YACG,OAAO,qBAAqB,UAAU,SAAS,UAAU,gBAAgB,EAAE,GAAG,SAAS,IAAI,SAAS,MAAM,GAAG,CAAC;AAAA,MACrH;AACA,YAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;AACpD,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/query_index/lib/search-tokens.js

@@ -11,6 +11,7 @@ import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("query_index").child({ component: "search-tokens" });
 const INSERT_BATCH_SIZE = 500;
+const TOKEN_EXCLUDED_ENTITY_TYPES = /* @__PURE__ */ new Set(["audit_logs:action_log", "audit_logs:access_log"]);
 function chunk(items, size) {
   if (size <= 0) return [items];
   const out = [];
@@ -78,6 +79,7 @@ function shouldIndexField(field, value, config, entityType) {
   return collectTextValues(value).some((text) => text.length > 0);
 }
 function buildSearchTokenRows(params) {
+  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) return [];
   const config = params.config ?? resolveSearchConfig();
   if (!config.enabled) return [];
   if (!params.doc) return [];
@@ -191,6 +193,10 @@ function tallyTokenRows(rows, keyOf) {
   return tallies;
 }
 async function replaceSearchTokensForRecord(db, params, options) {
+  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) {
+    await deleteSearchTokensForRecord(db, params, options);
+    return;
+  }
   const guardCiphertext = params.guardCiphertext ?? shouldGuardCiphertext();
   const rows = buildSearchTokenRows({ ...params, guardCiphertext });
   const config = params.config ?? resolveSearchConfig();
@@ -259,11 +265,35 @@ async function deleteSearchTokensForRecord(db, params, options) {
 }
 async function replaceSearchTokensForBatch(db, allPayloads) {
   if (!allPayloads.length) return;
+  const excludedBuckets = /* @__PURE__ */ new Map();
+  const indexablePayloads = allPayloads.filter((payload) => {
+    if (!TOKEN_EXCLUDED_ENTITY_TYPES.has(payload.entityType)) return true;
+    const organizationId = payload.organizationId ?? null;
+    const tenantId = payload.tenantId ?? null;
+    const key = JSON.stringify([payload.entityType, organizationId, tenantId]);
+    const bucket = excludedBuckets.get(key) ?? {
+      entityType: payload.entityType,
+      organizationId,
+      tenantId,
+      ids: /* @__PURE__ */ new Set()
+    };
+    bucket.ids.add(String(payload.recordId));
+    excludedBuckets.set(key, bucket);
+    return false;
+  });
+  if (excludedBuckets.size) {
+    await db.transaction().execute(async (trx) => {
+      for (const bucket of excludedBuckets.values()) {
+        await trx.deleteFrom("search_tokens").where("entity_type", "=", bucket.entityType).where(sql`organization_id is not distinct from ${bucket.organizationId}`).where(sql`tenant_id is not distinct from ${bucket.tenantId}`).where("entity_id", "in", Array.from(bucket.ids)).execute();
+      }
+    });
+  }
+  if (!indexablePayloads.length) return;
   const config = resolveSearchConfig();
   if (!config.enabled) return;
   const guardCiphertext = shouldGuardCiphertext();
   const preservedRecordIds = /* @__PURE__ */ new Set();
-  const payloads = allPayloads.filter((payload) => {
+  const payloads = indexablePayloads.filter((payload) => {
     const ciphertextFields = ciphertextFieldsOf(payload.doc, guardCiphertext);
     if (!ciphertextFields.size) return true;
     warnCiphertextSkipped(payload.entityType, payload.tenantId ?? null, ciphertextFields);

package/dist/modules/query_index/lib/search-tokens.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/query_index/lib/search-tokens.ts"],
-  "sourcesContent": ["import { type Kysely, type Transaction, sql } from 'kysely'\nimport {\n  isSearchFieldBlocklisted,\n  resolveSearchConfig,\n  resolveSearchTokenLimits,\n  type SearchConfig,\n} from '@open-mercato/shared/lib/search/config'\nimport { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'\nimport { looksLikeEncryptedPayload } from '@open-mercato/shared/lib/encryption/aes'\nimport { createKmsService, resolveEncryptionMode, type KmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('query_index').child({ component: 'search-tokens' })\n\nconst INSERT_BATCH_SIZE = 500\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (size <= 0) return [items]\n  const out: T[][] = []\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))\n  return out\n}\n\nexport type SearchTokenRow = {\n  entity_type: string\n  entity_id: string\n  organization_id: string | null\n  tenant_id: string | null\n  field: string\n  token_hash: string\n  token?: string | null\n}\n\ntype BuildTokenOptions = {\n  entityType: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  doc?: Record<string, unknown> | null\n  config?: SearchConfig\n  /** Resolved once per write by the exported entry points; see {@link shouldGuardCiphertext}. */\n  guardCiphertext?: boolean\n}\n\nconst DEFAULT_SCOPE = { organizationId: null, tenantId: null }\ntype EntityFieldPair = [string, string]\ntype SearchTokenExecutor = Kysely<any> | Transaction<any>\n\nexport const isSearchDebugEnabled = (): boolean => {\n  return parseBooleanToken(process.env.OM_SEARCH_DEBUG ?? '') === true\n}\n\nconst debug = (event: string, payload: Record<string, unknown>) => {\n  if (!isSearchDebugEnabled()) return\n  try {\n    logger.debug('Search token event', { event, payload })\n  } catch {\n    // ignore\n  }\n}\n\nfunction collectTextValues(value: unknown): string[] {\n  if (typeof value === 'string') return [value]\n  if (Array.isArray(value)) {\n    const out: string[] = []\n    for (const entry of value) {\n      if (typeof entry === 'string') out.push(entry)\n    }\n    return out\n  }\n  return []\n}\n\nlet guardKmsService: KmsService | null = null\n\n/**\n * Whether the ciphertext guard below is allowed to run for this write.\n *\n * The guard recognises an envelope by its SHAPE, which is forgeable: `<16 b64>:<b64>:<24 b64>:v1`\n * is a string any user can type into a searchable field. `tenantDataEncryptionService` removed the\n * same structural test for that reason (#2720). So the guard may only run where the shape is the\n * ONLY test available -- which is exactly where no DEK is reachable:\n *\n * - `active`      -- the indexer decrypted the document before handing it here, so a value still\n *                    shaped like an envelope is plaintext somebody typed. Indexing it is correct,\n *                    and skipping it would let that person freeze their own record's tokens at a\n *                    past state. The guard stays off, which also keeps it off the hot path of\n *                    every normal deployment.\n * - `disabled`    -- `decryptIndexDocForSearch` is a no-op, so ciphertext arrives undecrypted.\n * - `unavailable` -- the decrypt was attempted and could not complete, same outcome.\n *\n * Resolved once per write rather than per document, over a KMS built once per process:\n * {@link createKmsService} logs when it falls back, and a reindex calls this once per record. The\n * toggle itself is still re-read every call by {@link resolveEncryptionMode}; only the KMS is\n * cached, and it already requires a restart to change, since DEK and map caches are in-process.\n */\nfunction shouldGuardCiphertext(): boolean {\n  guardKmsService ??= createKmsService()\n  return resolveEncryptionMode(guardKmsService) !== 'active'\n}\n\n/**\n * Fields whose value is an AES-GCM envelope rather than the text it is supposed to hold.\n *\n * Search tokens are hashes of PLAINTEXT: the indexer decrypts a document before tokenising it\n * (`indexer.ts` -> `decryptIndexDocForSearch`), which is what lets the token index survive\n * encryption being switched on or off. That decrypt step is a no-op once\n * `TENANT_DATA_ENCRYPTION=no`, so an operator who flips the toggle before running\n * `mercato entities decrypt-database` starts feeding ciphertext into the tokeniser. The tokens\n * that come out are hashes of base64 noise and match nothing, and because a write REPLACES a\n * record's tokens, the good plaintext tokens already in the table would be deleted to make room\n * for them -- turning a recoverable misordering into permanent search loss.\n *\n * Detecting the envelope by shape lets the write skip those fields and leave what is already\n * indexed alone. `guard` gates that detection; see {@link shouldGuardCiphertext} for why it is not\n * unconditional.\n */\nfunction ciphertextFieldsOf(\n  doc: Record<string, unknown> | null | undefined,\n  guard: boolean,\n): Set<string> {\n  const fields = new Set<string>()\n  if (!guard || !doc) return fields\n  for (const [field, value] of Object.entries(doc)) {\n    const values = collectTextValues(value)\n    if (values.length && values.some((text) => looksLikeEncryptedPayload(text))) fields.add(field)\n  }\n  return fields\n}\n\nconst warnedCiphertextEntities = new Set<string>()\n\nfunction warnCiphertextSkipped(entityType: string, tenantId: string | null, fields: Set<string>): void {\n  if (!fields.size) return\n  // Once per entity type per tenant per process: a full reindex would otherwise emit this per\n  // record, while keying on the entity type alone would let the first affected tenant in a shared\n  // process consume the one warning every other tenant's operator needed.\n  const key = `${entityType}|${tenantId ?? ''}`\n  if (warnedCiphertextEntities.has(key)) return\n  warnedCiphertextEntities.add(key)\n  logger.warn(\n    'Search indexing skipped ciphertext fields and preserved their existing tokens. '\n      + 'This means TENANT_DATA_ENCRYPTION was switched off while encrypted data was still at rest. '\n      + 'Run `mercato entities decrypt-database` and reindex; until then these fields are not searchable.',\n    { entityType, tenantId, fields: Array.from(fields).sort((left, right) => left.localeCompare(right)) },\n  )\n}\n\n/** Test seam: both the warning above and the KMS behind the guard are once-per-process. */\nexport function resetCiphertextGuardState(): void {\n  warnedCiphertextEntities.clear()\n  guardKmsService = null\n}\n\nfunction shouldIndexField(\n  field: string,\n  value: unknown,\n  config: SearchConfig,\n  entityType: string | null,\n): boolean {\n  if (typeof value !== 'string' && !Array.isArray(value)) return false\n  const lower = field.toLowerCase()\n  if (lower === 'id' || lower.endsWith('_id') || lower.endsWith('.id')) return false\n  if (lower.endsWith('_at')) return false\n  if (['created_at', 'updated_at', 'deleted_at', 'tenant_id', 'organization_id'].includes(lower)) return false\n  if (isSearchFieldBlocklisted(field, entityType, config)) return false\n  return collectTextValues(value).some((text) => text.length > 0)\n}\n\n/**\n * Builds the `search_tokens` rows for one document.\n *\n * `maxTokensPerRecord` is spent in the iteration order of `params.doc`'s own keys: fields are\n * tokenized one after another and the loop stops at the first field that exhausts the budget, so\n * on an over-budget record the surviving fields are whichever ones come first. That order is a\n * property of the object handed in, not of the entity, and the two write-path builders order it\n * differently: `buildIndexDocument` (`lib/document.ts`, the batch reindex path) appends `cf:*` keys\n * after the base columns and the aggregate `search_text` field last. `buildIndexDoc` (`lib/indexer.ts`,\n * the incremental single-record write path \u2014 `upsertIndexRow` \u2192 `reindexSearchTokensForRecord`) adds\n * `l10n:{locale}:{field}` translation keys between the `cf:*` keys and `search_text`. The budget is\n * spent front-to-back, so the fields nearest the end of that order are starved first: `search_text`\n * is last on both paths and starves first either way, but starves sooner on the incremental path,\n * because the `l10n:*` keys ahead of it there consume budget the batch path would have spent on it.\n * Those translation fields starve next, before any `cf:*` key or base column. The two paths can\n * therefore keep different fields searchable for an otherwise equivalent record.\n *\n * Every write path tokenizes an in-memory document it is about to write \u2014 `TokenSearchStrategy.index`\n * writes only `search_tokens` rows and never touches `entity_indexes.doc` \u2014 which keeps each path\n * self-consistent on its own. A document read back out of the `entity_indexes.doc` `jsonb` column is\n * not the same object: Postgres stores `jsonb` keys in a canonical order (by key length, then byte\n * order), not in insertion order. Re-tokenizing such a document can therefore truncate at a different\n * field than the write did, so code that verifies or recomputes a record's expected tokens must\n * rebuild the document through the builder that matches the write path being checked \u2014 `buildIndexDoc`\n * for incrementally-written records, `buildIndexDocument` for batch-reindexed ones \u2014 rather than\n * reading it back from the database.\n *\n * Making truncation reproducible from a `jsonb` read \u2014 by sorting fields before tokenization \u2014\n * would change which terms stay searchable on over-budget records, so it is a behavior decision\n * rather than a clarification (#5971).\n */\nexport function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[] {\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return []\n  if (!params.doc) return []\n  const tokens: SearchTokenRow[] = []\n  const capturePairs = isSearchDebugEnabled() && params.entityType === 'customers:customer_deal'\n  const debugPairs: Array<{ field: string; hash: string }> = []\n  const scope = {\n    organizationId: params.organizationId ?? DEFAULT_SCOPE.organizationId,\n    tenantId: params.tenantId ?? DEFAULT_SCOPE.tenantId,\n  }\n  const limits = resolveSearchTokenLimits(config)\n  const recordLimit = limits.maxTokensPerRecord > 0 ? limits.maxTokensPerRecord : Number.POSITIVE_INFINITY\n  const fieldLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY\n  const ciphertextFields = ciphertextFieldsOf(params.doc, params.guardCiphertext ?? shouldGuardCiphertext())\n  warnCiphertextSkipped(params.entityType, scope.tenantId, ciphertextFields)\n\n  for (const [field, rawValue] of Object.entries(params.doc)) {\n    if (tokens.length >= recordLimit) break\n    if (ciphertextFields.has(field)) continue\n    if (!shouldIndexField(field, rawValue, config, params.entityType)) continue\n    const values = collectTextValues(rawValue)\n    const seen = new Set<string>()\n    let fieldTokenCount = 0\n    for (const text of values) {\n      if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n      const remainingLimit = Math.min(recordLimit - tokens.length, fieldLimit - fieldTokenCount)\n      const candidateLimit = fieldTokenCount + remainingLimit\n      const tokenConfig = Number.isFinite(candidateLimit)\n        ? { ...config, maxTokensPerField: candidateLimit }\n        : config\n      const { tokens: textTokens, hashes } = tokenizeText(text, tokenConfig)\n      for (let i = 0; i < textTokens.length; i += 1) {\n        if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n        const token = textTokens[i]\n        const hash = hashes[i]\n        const dedupeKey = `${field}|${hash}`\n        if (seen.has(dedupeKey)) continue\n        seen.add(dedupeKey)\n        fieldTokenCount += 1\n        debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, hash })\n        tokens.push({\n          entity_type: params.entityType,\n          entity_id: String(params.recordId),\n          organization_id: scope.organizationId,\n          tenant_id: scope.tenantId,\n          field,\n          token_hash: hash,\n          token: config.storeRawTokens ? token : null,\n        })\n        if (capturePairs) {\n          debugPairs.push({ field, hash })\n        }\n      }\n    }\n  }\n  if (capturePairs) {\n    debug('deal.tokens', {\n      entityType: params.entityType,\n      recordId: params.recordId,\n      tokenCount: debugPairs.length,\n      tokens: debugPairs,\n    })\n  }\n  debug('doc.completed', { entityType: params.entityType, recordId: params.recordId, tokenCount: tokens.length })\n\n  return tokens\n}\n\nfunction buildFieldPairs(\n  recordId: string,\n  doc?: Record<string, unknown> | null,\n  skipFields?: Set<string>,\n): EntityFieldPair[] {\n  if (!doc) return []\n  const pairs: EntityFieldPair[] = []\n  const dedupe = new Set<string>()\n  for (const field of Object.keys(doc)) {\n    // The delete below is scoped to these pairs, so omitting a field here is what preserves the\n    // tokens already stored for it rather than merely declining to write new ones.\n    if (skipFields?.has(field)) continue\n    const key = `${recordId}|${field}`\n    if (dedupe.has(key)) continue\n    dedupe.add(key)\n    pairs.push([recordId, field])\n  }\n  return pairs\n}\n\ntype TokenRowLike = { field?: unknown; token_hash?: unknown; token?: unknown }\n\n// NUL, not a printable separator: a field name may itself contain a space, so `a b` + hash `c`\n// would otherwise sign identically to field `a` + hash `b c`.\nconst SIGNATURE_SEPARATOR = String.fromCharCode(0)\n\n// Identifies one token row for comparison. `token` is NULL unless `storeRawTokens` is on, and a\n// stored NULL has to sign the same as the `null` a freshly built row carries \u2014 otherwise every\n// record compares as changed and the skip never fires.\nfunction tokenSignature(row: TokenRowLike): string {\n  return [\n    String(row.field ?? ''),\n    String(row.token_hash ?? ''),\n    row.token == null ? '' : String(row.token),\n  ].join(SIGNATURE_SEPARATOR)\n}\n\n// Multiplicities, not sets: #4681 reports token rows duplicated by the concurrent-replacement\n// defect, and a set comparison reads such a record as already correct and preserves the duplicates\n// forever. Counting sends it through a full rewrite, which collapses them.\nfunction tallyOf(rows: Iterable<TokenRowLike>): Map<string, number> {\n  const tally = new Map<string, number>()\n  for (const row of rows) {\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n  }\n  return tally\n}\n\nfunction tallyEquals(a: Map<string, number> | undefined, b: Map<string, number> | undefined): boolean {\n  const left = a ?? new Map<string, number>()\n  const right = b ?? new Map<string, number>()\n  if (left.size !== right.size) return false\n  for (const [key, count] of left.entries()) {\n    if (right.get(key) !== count) return false\n  }\n  return true\n}\n\nfunction tallyTokenRows<TRow extends TokenRowLike>(\n  rows: Iterable<TRow>,\n  keyOf: (row: TRow) => string\n): Map<string, Map<string, number>> {\n  const tallies = new Map<string, Map<string, number>>()\n  for (const row of rows) {\n    const key = keyOf(row)\n    const tally = tallies.get(key) ?? new Map<string, number>()\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n    tallies.set(key, tally)\n  }\n  return tallies\n}\n\nexport async function replaceSearchTokensForRecord(\n  db: Kysely<any>,\n  params: BuildTokenOptions,\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  const guardCiphertext = params.guardCiphertext ?? shouldGuardCiphertext()\n  const rows = buildSearchTokenRows({ ...params, guardCiphertext })\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const ciphertextFields = ciphertextFieldsOf(params.doc, guardCiphertext)\n  const fieldPairs = buildFieldPairs(String(params.recordId), params.doc, ciphertextFields)\n\n  // An empty pair list normally means the document is gone, and the delete below then purges the\n  // record wholesale. It can now also mean every field was skipped as ciphertext, where a purge\n  // would destroy precisely the tokens the skip exists to protect. Distinguish the two.\n  if (params.doc && ciphertextFields.size && !fieldPairs.length) {\n    debug('record.preserve-ciphertext', { entityType: params.entityType, recordId: params.recordId })\n    return\n  }\n\n  // Same comparison #5402 gave the batch path, over the scope this path actually writes: the\n  // delete below is narrowed to the document's own `(entity_id, field)` pairs, so the comparison\n  // has to be narrowed the same way. Reading wider would let a token row under a field this\n  // document does not carry \u2014 the `cf_` twin the search module used to write, say \u2014 read as a\n  // difference forever and defeat the skip on every write.\n  const scopeTokenQuery = (query: any): any => {\n    let scoped = query\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n      .where('entity_id' as any, '=', String(params.recordId))\n    if (fieldPairs.length) {\n      scoped = scoped.where('field' as any, 'in', fieldPairs.map(([, field]) => field))\n    }\n    return scoped\n  }\n\n  // Read through the caller's transaction when there is one. A separate connection cannot see that\n  // transaction's own uncommitted writes, so it could report rows a pending delete has already\n  // removed and talk this call out of re-inserting them.\n  const reader = options?.trx ?? db\n\n  // Count probe first, as in the batch path: it returns one row whatever the table holds, so a\n  // record whose stored rows have run away (#4681) is settled without materializing them.\n  const storedCountRows = await scopeTokenQuery(\n    reader.selectFrom('search_tokens' as any).select(sql<number>`count(*)`.as('token_count') as any),\n  ).execute()\n  const storedCount = Number((storedCountRows as any[])[0]?.token_count ?? 0)\n\n  let unchanged = storedCount === rows.length\n  if (unchanged && rows.length) {\n    const stored = await scopeTokenQuery(\n      reader.selectFrom('search_tokens' as any).select(['field' as any, 'token_hash' as any, 'token' as any]),\n    )\n      // Counts already match, so this cannot truncate. It bounds the read if a concurrent writer\n      // inserts between the probe and here; a truncated read compares as changed, which costs a\n      // rewrite rather than a wrong skip.\n      .limit(rows.length)\n      .execute()\n    unchanged = tallyEquals(tallyOf(rows), tallyOf(stored as any[]))\n  }\n  if (unchanged) {\n    debug('record.skip', { entityType: params.entityType, recordId: params.recordId, tokenCount: rows.length })\n    return\n  }\n\n  const writeTokens = async (executor: SearchTokenExecutor): Promise<void> => {\n    let deleteQuery = executor\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    if (fieldPairs.length) {\n      deleteQuery = deleteQuery.where((eb: any) => eb.or(\n        fieldPairs.map(([rid, field]) => eb.and([\n          eb('entity_id' as any, '=', rid),\n          eb('field' as any, '=', field),\n        ])),\n      ))\n    } else {\n      deleteQuery = deleteQuery.where('entity_id' as any, '=', String(params.recordId))\n    }\n    await deleteQuery.execute()\n    if (!rows.length) return\n    const payloads = rows.map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloads, INSERT_BATCH_SIZE)) {\n      await executor.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  }\n\n  if (options?.trx) {\n    await writeTokens(options.trx)\n    return\n  }\n\n  await db.transaction().execute(writeTokens)\n}\n\nexport async function deleteSearchTokensForRecord(\n  db: Kysely<any>,\n  params: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const executor = options?.trx ?? db\n  await executor\n    .deleteFrom('search_tokens' as any)\n    .where('entity_type' as any, '=', params.entityType)\n    .where('entity_id' as any, '=', String(params.recordId))\n    .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n    .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    .execute()\n}\n\nexport async function replaceSearchTokensForBatch(\n  db: Kysely<any>,\n  allPayloads: Array<BuildTokenOptions & { doc: Record<string, unknown> }>\n): Promise<void> {\n  if (!allPayloads.length) return\n  const config = resolveSearchConfig()\n  if (!config.enabled) return\n\n  // A record carrying ciphertext drops out of the batch entirely, rather than being rewritten\n  // without its encrypted fields. This path deletes by `entity_id` -- it cannot express \"replace\n  // these fields and leave those alone\" the way the per-record path can -- so partial handling\n  // here would still delete the tokens we are trying to protect. Skipping the record leaves every\n  // one of its tokens, encrypted-field and plaintext-field alike, exactly as it was. The state is\n  // transient by construction: `decrypt-database` followed by a reindex rebuilds all of it.\n  const guardCiphertext = shouldGuardCiphertext()\n  const preservedRecordIds = new Set<string>()\n  const payloads = allPayloads.filter((payload) => {\n    const ciphertextFields = ciphertextFieldsOf(payload.doc, guardCiphertext)\n    if (!ciphertextFields.size) return true\n    warnCiphertextSkipped(payload.entityType, payload.tenantId ?? null, ciphertextFields)\n    preservedRecordIds.add(String(payload.recordId))\n    return false\n  })\n  if (!payloads.length) return\n\n  const rows = payloads.flatMap((payload) => buildSearchTokenRows({ ...payload, config, guardCiphertext }))\n  if (!rows.length) {\n    const entityType = payloads[0]?.entityType\n    if (!entityType) return\n    const ids = payloads.map((p) => String(p.recordId))\n    await db\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', entityType)\n      .where('entity_id' as any, 'in', ids)\n      .execute()\n    return\n  }\n\n  const scopeKey = (org: string | null, tenant: string | null) => `${org ?? '__null__'}|${tenant ?? '__null__'}`\n  const scopeBuckets = new Map<string, { organizationId: string | null; tenantId: string | null; ids: Set<string> }>()\n\n  for (const payload of payloads) {\n    const org = payload.organizationId ?? null\n    const tenant = payload.tenantId ?? null\n    const key = scopeKey(org, tenant)\n    const bucket = scopeBuckets.get(key) ?? { organizationId: org, tenantId: tenant, ids: new Set<string>() }\n    bucket.ids.add(String(payload.recordId))\n    scopeBuckets.set(key, bucket)\n  }\n\n  const recordKeyOf = (row: SearchTokenRow) =>\n    `${scopeKey(row.organization_id ?? null, row.tenant_id ?? null)}|${String(row.entity_id)}`\n  const builtTally = tallyTokenRows(rows, recordKeyOf)\n\n  // Read outside the transaction, deliberately. The comparison decides only whether to skip a\n  // rewrite, so a concurrent writer costs us at most a rewrite we declined \u2014 declined because the\n  // table already held exactly the rows this call wanted to write. One ordering is worth naming\n  // though: if the read matches and a concurrent writer then commits tokens built from a *staler*\n  // doc, the unconditional rewrite this call used to perform would have overwritten them by\n  // accident. It no longer does, so those stale rows survive until the record's next write. That\n  // is a repair we lose, not a guarantee we break.\n  const changedIdsByBucket = new Map<string, Set<string>>()\n  for (const [key, bucket] of scopeBuckets.entries()) {\n    const ids = Array.from(bucket.ids)\n    const builtCountById = new Map<string, number>()\n    for (const id of ids) {\n      let total = 0\n      const tally = builtTally.get(`${key}|${id}`)\n      if (tally) for (const count of tally.values()) total += count\n      builtCountById.set(id, total)\n    }\n\n    // Count probe first. Its result is one row per record in the batch, so it is bounded by the\n    // batch size \u2014 unlike a bare row read, which would be bounded only by how many token rows the\n    // table already holds for these ids, a quantity this function does not control and (per #4681)\n    // has no reason to trust.\n    const storedCounts = await db\n      .selectFrom('search_tokens' as any)\n      .select(['entity_id' as any, sql<number>`count(*)`.as('token_count') as any])\n      .where('entity_type' as any, '=', payloads[0].entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n      .where('entity_id' as any, 'in', ids)\n      .groupBy('entity_id' as any)\n      .execute()\n    const storedCountById = new Map<string, number>()\n    for (const row of storedCounts as any[]) {\n      storedCountById.set(String(row.entity_id), Number(row.token_count))\n    }\n\n    const changed = new Set<string>()\n    // A record whose stored row count already differs is changed, whatever the rows say \u2014 the\n    // duplicate case from #4681 resolves here without ever materializing the duplicated rows.\n    const contentCandidates = ids.filter((id) => {\n      const builtCount = builtCountById.get(id) ?? 0\n      if ((storedCountById.get(id) ?? 0) !== builtCount) {\n        changed.add(id)\n        return false\n      }\n      return builtCount > 0\n    })\n\n    if (contentCandidates.length) {\n      const rowBudget = contentCandidates.reduce((sum, id) => sum + (builtCountById.get(id) ?? 0), 0)\n      const stored = await db\n        .selectFrom('search_tokens' as any)\n        .select(['entity_id' as any, 'field' as any, 'token_hash' as any, 'token' as any])\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', contentCandidates)\n        // Counts already match, so this cannot truncate \u2014 it bounds the damage if a concurrent\n        // writer inserts between the probe and this read. A truncated read compares as changed,\n        // which costs a rewrite rather than a wrong skip.\n        .limit(rowBudget)\n        .execute()\n      const storedTally = tallyTokenRows(stored as any[], (row) => String(row.entity_id))\n      for (const id of contentCandidates) {\n        if (!tallyEquals(builtTally.get(`${key}|${id}`), storedTally.get(id))) changed.add(id)\n      }\n    }\n    changedIdsByBucket.set(key, changed)\n  }\n\n  const changedRecordKeys = new Set<string>()\n  for (const [key, changed] of changedIdsByBucket.entries()) {\n    for (const id of changed) changedRecordKeys.add(`${key}|${id}`)\n  }\n  debug('batch.skip', {\n    entityType: payloads[0].entityType,\n    recordCount: payloads.length,\n    changedCount: changedRecordKeys.size,\n    preservedCiphertextRecordCount: preservedRecordIds.size,\n  })\n  if (!changedRecordKeys.size) return\n\n  await db.transaction().execute(async (trx) => {\n    for (const [key, bucket] of scopeBuckets.entries()) {\n      const changed = changedIdsByBucket.get(key)\n      if (!changed?.size) continue\n      // Delete by entity_id: a batch replaces all of a record's tokens, and a per-field OR over the\n      // whole batch overflows the query compiler's call stack on large batches.\n      const deleteQuery = trx\n        .deleteFrom('search_tokens' as any)\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', Array.from(changed))\n      await deleteQuery.execute()\n    }\n    const payloadWithTimestamps = rows\n      .filter((row) => changedRecordKeys.has(recordKeyOf(row)))\n      .map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloadWithTimestamps, INSERT_BATCH_SIZE)) {\n      await trx.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  })\n}\n"],
-  "mappings": "AAAA,SAAwC,WAAW;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kBAAkB,6BAA8C;AACzE,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE/E,MAAM,oBAAoB;AAE1B,SAAS,MAAS,OAAY,MAAqB;AACjD,MAAI,QAAQ,EAAG,QAAO,CAAC,KAAK;AAC5B,QAAM,MAAa,CAAC;AACpB,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAM,KAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;AAC9E,SAAO;AACT;AAuBA,MAAM,gBAAgB,EAAE,gBAAgB,MAAM,UAAU,KAAK;AAItD,MAAM,uBAAuB,MAAe;AACjD,SAAO,kBAAkB,QAAQ,IAAI,mBAAmB,EAAE,MAAM;AAClE;AAEA,MAAM,QAAQ,CAAC,OAAe,YAAqC;AACjE,MAAI,CAAC,qBAAqB,EAAG;AAC7B,MAAI;AACF,WAAO,MAAM,sBAAsB,EAAE,OAAO,QAAQ,CAAC;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,kBAAkB,OAA0B;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC,KAAK;AAC5C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,MAAgB,CAAC;AACvB,eAAW,SAAS,OAAO;AACzB,UAAI,OAAO,UAAU,SAAU,KAAI,KAAK,KAAK;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACA,SAAO,CAAC;AACV;AAEA,IAAI,kBAAqC;AAuBzC,SAAS,wBAAiC;AACxC,sBAAoB,iBAAiB;AACrC,SAAO,sBAAsB,eAAe,MAAM;AACpD;AAkBA,SAAS,mBACP,KACA,OACa;AACb,QAAM,SAAS,oBAAI,IAAY;AAC/B,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,kBAAkB,KAAK;AACtC,QAAI,OAAO,UAAU,OAAO,KAAK,CAAC,SAAS,0BAA0B,IAAI,CAAC,EAAG,QAAO,IAAI,KAAK;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,MAAM,2BAA2B,oBAAI,IAAY;AAEjD,SAAS,sBAAsB,YAAoB,UAAyB,QAA2B;AACrG,MAAI,CAAC,OAAO,KAAM;AAIlB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,EAAE;AAC3C,MAAI,yBAAyB,IAAI,GAAG,EAAG;AACvC,2BAAyB,IAAI,GAAG;AAChC,SAAO;AAAA,IACL;AAAA,IAGA,EAAE,YAAY,UAAU,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,EAAE;AAAA,EACtG;AACF;AAGO,SAAS,4BAAkC;AAChD,2BAAyB,MAAM;AAC/B,oBAAkB;AACpB;AAEA,SAAS,iBACP,OACA,OACA,QACA,YACS;AACT,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAC/D,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,UAAU,QAAQ,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,KAAK,EAAG,QAAO;AAC7E,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,cAAc,cAAc,aAAa,iBAAiB,EAAE,SAAS,KAAK,EAAG,QAAO;AACvG,MAAI,yBAAyB,OAAO,YAAY,MAAM,EAAG,QAAO;AAChE,SAAO,kBAAkB,KAAK,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AAChE;AAiCO,SAAS,qBAAqB,QAA6C;AAChF,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC;AAC7B,MAAI,CAAC,OAAO,IAAK,QAAO,CAAC;AACzB,QAAM,SAA2B,CAAC;AAClC,QAAM,eAAe,qBAAqB,KAAK,OAAO,eAAe;AACrE,QAAM,aAAqD,CAAC;AAC5D,QAAM,QAAQ;AAAA,IACZ,gBAAgB,OAAO,kBAAkB,cAAc;AAAA,IACvD,UAAU,OAAO,YAAY,cAAc;AAAA,EAC7C;AACA,QAAM,SAAS,yBAAyB,MAAM;AAC9C,QAAM,cAAc,OAAO,qBAAqB,IAAI,OAAO,qBAAqB,OAAO;AACvF,QAAM,aAAa,OAAO,oBAAoB,IAAI,OAAO,oBAAoB,OAAO;AACpF,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,OAAO,mBAAmB,sBAAsB,CAAC;AACzG,wBAAsB,OAAO,YAAY,MAAM,UAAU,gBAAgB;AAEzE,aAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG,GAAG;AAC1D,QAAI,OAAO,UAAU,YAAa;AAClC,QAAI,iBAAiB,IAAI,KAAK,EAAG;AACjC,QAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,OAAO,UAAU,EAAG;AACnE,UAAM,SAAS,kBAAkB,QAAQ;AACzC,UAAM,OAAO,oBAAI,IAAY;AAC7B,QAAI,kBAAkB;AACtB,eAAW,QAAQ,QAAQ;AACzB,UAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,YAAM,iBAAiB,KAAK,IAAI,cAAc,OAAO,QAAQ,aAAa,eAAe;AACzF,YAAM,iBAAiB,kBAAkB;AACzC,YAAM,cAAc,OAAO,SAAS,cAAc,IAC9C,EAAE,GAAG,QAAQ,mBAAmB,eAAe,IAC/C;AACJ,YAAM,EAAE,QAAQ,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW;AACrE,eAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK,GAAG;AAC7C,YAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,cAAM,QAAQ,WAAW,CAAC;AAC1B,cAAM,OAAO,OAAO,CAAC;AACrB,cAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,YAAI,KAAK,IAAI,SAAS,EAAG;AACzB,aAAK,IAAI,SAAS;AAClB,2BAAmB;AACnB,cAAM,mBAAmB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,OAAO,KAAK,CAAC;AAClG,eAAO,KAAK;AAAA,UACV,aAAa,OAAO;AAAA,UACpB,WAAW,OAAO,OAAO,QAAQ;AAAA,UACjC,iBAAiB,MAAM;AAAA,UACvB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,YAAY;AAAA,UACZ,OAAO,OAAO,iBAAiB,QAAQ;AAAA,QACzC,CAAC;AACD,YAAI,cAAc;AAChB,qBAAW,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,eAAe;AAAA,MACnB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,YAAY,WAAW;AAAA,MACvB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,OAAO,OAAO,CAAC;AAE9G,SAAO;AACT;AAEA,SAAS,gBACP,UACA,KACA,YACmB;AACnB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,QAA2B,CAAC;AAClC,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,OAAO,KAAK,GAAG,GAAG;AAGpC,QAAI,YAAY,IAAI,KAAK,EAAG;AAC5B,UAAM,MAAM,GAAG,QAAQ,IAAI,KAAK;AAChC,QAAI,OAAO,IAAI,GAAG,EAAG;AACrB,WAAO,IAAI,GAAG;AACd,UAAM,KAAK,CAAC,UAAU,KAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAMA,MAAM,sBAAsB,OAAO,aAAa,CAAC;AAKjD,SAAS,eAAe,KAA2B;AACjD,SAAO;AAAA,IACL,OAAO,IAAI,SAAS,EAAE;AAAA,IACtB,OAAO,IAAI,cAAc,EAAE;AAAA,IAC3B,IAAI,SAAS,OAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC3C,EAAE,KAAK,mBAAmB;AAC5B;AAKA,SAAS,QAAQ,MAAmD;AAClE,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAAoC,GAA6C;AACpG,QAAM,OAAO,KAAK,oBAAI,IAAoB;AAC1C,QAAM,QAAQ,KAAK,oBAAI,IAAoB;AAC3C,MAAI,KAAK,SAAS,MAAM,KAAM,QAAO;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ,GAAG;AACzC,QAAI,MAAM,IAAI,GAAG,MAAM,MAAO,QAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,eACP,MACA,OACkC;AAClC,QAAM,UAAU,oBAAI,IAAiC;AACrD,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,QAAQ,QAAQ,IAAI,GAAG,KAAK,oBAAI,IAAoB;AAC1D,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AACpD,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,IACA,QACA,SACe;AACf,QAAM,kBAAkB,OAAO,mBAAmB,sBAAsB;AACxE,QAAM,OAAO,qBAAqB,EAAE,GAAG,QAAQ,gBAAgB,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS;AACrB,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,eAAe;AACvE,QAAM,aAAa,gBAAgB,OAAO,OAAO,QAAQ,GAAG,OAAO,KAAK,gBAAgB;AAKxF,MAAI,OAAO,OAAO,iBAAiB,QAAQ,CAAC,WAAW,QAAQ;AAC7D,UAAM,8BAA8B,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,SAAS,CAAC;AAChG;AAAA,EACF;AAOA,QAAM,kBAAkB,CAAC,UAAoB;AAC3C,QAAI,SAAS,MACV,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AACzD,QAAI,WAAW,QAAQ;AACrB,eAAS,OAAO,MAAM,SAAgB,MAAM,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAKA,QAAM,SAAS,SAAS,OAAO;AAI/B,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,WAAW,eAAsB,EAAE,OAAO,cAAsB,GAAG,aAAa,CAAQ;AAAA,EACjG,EAAE,QAAQ;AACV,QAAM,cAAc,OAAQ,gBAA0B,CAAC,GAAG,eAAe,CAAC;AAE1E,MAAI,YAAY,gBAAgB,KAAK;AACrC,MAAI,aAAa,KAAK,QAAQ;AAC5B,UAAM,SAAS,MAAM;AAAA,MACnB,OAAO,WAAW,eAAsB,EAAE,OAAO,CAAC,SAAgB,cAAqB,OAAc,CAAC;AAAA,IACxG,EAIG,MAAM,KAAK,MAAM,EACjB,QAAQ;AACX,gBAAY,YAAY,QAAQ,IAAI,GAAG,QAAQ,MAAe,CAAC;AAAA,EACjE;AACA,MAAI,WAAW;AACb,UAAM,eAAe,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,KAAK,OAAO,CAAC;AAC1G;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,aAAiD;AAC1E,QAAI,cAAc,SACf,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE;AACjE,QAAI,WAAW,QAAQ;AACrB,oBAAc,YAAY,MAAM,CAAC,OAAY,GAAG;AAAA,QAC9C,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI;AAAA,UACtC,GAAG,aAAoB,KAAK,GAAG;AAAA,UAC/B,GAAG,SAAgB,KAAK,KAAK;AAAA,QAC/B,CAAC,CAAC;AAAA,MACJ,CAAC;AAAA,IACH,OAAO;AACL,oBAAc,YAAY,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AAAA,IAClF;AACA,UAAM,YAAY,QAAQ;AAC1B,QAAI,CAAC,KAAK,OAAQ;AAClB,UAAM,WAAW,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACvE,eAAW,SAAS,MAAM,UAAU,iBAAiB,GAAG;AACtD,YAAM,SAAS,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IACjF;AAAA,EACF;AAEA,MAAI,SAAS,KAAK;AAChB,UAAM,YAAY,QAAQ,GAAG;AAC7B;AAAA,EACF;AAEA,QAAM,GAAG,YAAY,EAAE,QAAQ,WAAW;AAC5C;AAEA,eAAsB,4BACpB,IACA,QACA,SACe;AACf,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,WAAW,SAAS,OAAO;AACjC,QAAM,SACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC,EACtD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,QAAQ;AACb;AAEA,eAAsB,4BACpB,IACA,aACe;AACf,MAAI,CAAC,YAAY,OAAQ;AACzB,QAAM,SAAS,oBAAoB;AACnC,MAAI,CAAC,OAAO,QAAS;AAQrB,QAAM,kBAAkB,sBAAsB;AAC9C,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,WAAW,YAAY,OAAO,CAAC,YAAY;AAC/C,UAAM,mBAAmB,mBAAmB,QAAQ,KAAK,eAAe;AACxE,QAAI,CAAC,iBAAiB,KAAM,QAAO;AACnC,0BAAsB,QAAQ,YAAY,QAAQ,YAAY,MAAM,gBAAgB;AACpF,uBAAmB,IAAI,OAAO,QAAQ,QAAQ,CAAC;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,SAAS,OAAQ;AAEtB,QAAM,OAAO,SAAS,QAAQ,CAAC,YAAY,qBAAqB,EAAE,GAAG,SAAS,QAAQ,gBAAgB,CAAC,CAAC;AACxG,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,aAAa,SAAS,CAAC,GAAG;AAChC,QAAI,CAAC,WAAY;AACjB,UAAM,MAAM,SAAS,IAAI,CAAC,MAAM,OAAO,EAAE,QAAQ,CAAC;AAClD,UAAM,GACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,UAAU,EAC3C,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ;AACX;AAAA,EACF;AAEA,QAAM,WAAW,CAAC,KAAoB,WAA0B,GAAG,OAAO,UAAU,IAAI,UAAU,UAAU;AAC5G,QAAM,eAAe,oBAAI,IAA0F;AAEnH,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAM,QAAQ,kBAAkB;AACtC,UAAM,SAAS,QAAQ,YAAY;AACnC,UAAM,MAAM,SAAS,KAAK,MAAM;AAChC,UAAM,SAAS,aAAa,IAAI,GAAG,KAAK,EAAE,gBAAgB,KAAK,UAAU,QAAQ,KAAK,oBAAI,IAAY,EAAE;AACxG,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,iBAAa,IAAI,KAAK,MAAM;AAAA,EAC9B;AAEA,QAAM,cAAc,CAAC,QACnB,GAAG,SAAS,IAAI,mBAAmB,MAAM,IAAI,aAAa,IAAI,CAAC,IAAI,OAAO,IAAI,SAAS,CAAC;AAC1F,QAAM,aAAa,eAAe,MAAM,WAAW;AASnD,QAAM,qBAAqB,oBAAI,IAAyB;AACxD,aAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,UAAM,MAAM,MAAM,KAAK,OAAO,GAAG;AACjC,UAAM,iBAAiB,oBAAI,IAAoB;AAC/C,eAAW,MAAM,KAAK;AACpB,UAAI,QAAQ;AACZ,YAAM,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAC3C,UAAI,MAAO,YAAW,SAAS,MAAM,OAAO,EAAG,UAAS;AACxD,qBAAe,IAAI,IAAI,KAAK;AAAA,IAC9B;AAMA,UAAM,eAAe,MAAM,GACxB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,cAAsB,GAAG,aAAa,CAAQ,CAAC,EAC3E,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ,WAAkB,EAC1B,QAAQ;AACX,UAAM,kBAAkB,oBAAI,IAAoB;AAChD,eAAW,OAAO,cAAuB;AACvC,sBAAgB,IAAI,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,IACpE;AAEA,UAAM,UAAU,oBAAI,IAAY;AAGhC,UAAM,oBAAoB,IAAI,OAAO,CAAC,OAAO;AAC3C,YAAM,aAAa,eAAe,IAAI,EAAE,KAAK;AAC7C,WAAK,gBAAgB,IAAI,EAAE,KAAK,OAAO,YAAY;AACjD,gBAAQ,IAAI,EAAE;AACd,eAAO;AAAA,MACT;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,kBAAkB,QAAQ;AAC5B,YAAM,YAAY,kBAAkB,OAAO,CAAC,KAAK,OAAO,OAAO,eAAe,IAAI,EAAE,KAAK,IAAI,CAAC;AAC9F,YAAM,SAAS,MAAM,GAClB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,SAAgB,cAAqB,OAAc,CAAC,EAChF,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,iBAAiB,EAIjD,MAAM,SAAS,EACf,QAAQ;AACX,YAAM,cAAc,eAAe,QAAiB,CAAC,QAAQ,OAAO,IAAI,SAAS,CAAC;AAClF,iBAAW,MAAM,mBAAmB;AAClC,YAAI,CAAC,YAAY,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE,GAAG,YAAY,IAAI,EAAE,CAAC,EAAG,SAAQ,IAAI,EAAE;AAAA,MACvF;AAAA,IACF;AACA,uBAAmB,IAAI,KAAK,OAAO;AAAA,EACrC;AAEA,QAAM,oBAAoB,oBAAI,IAAY;AAC1C,aAAW,CAAC,KAAK,OAAO,KAAK,mBAAmB,QAAQ,GAAG;AACzD,eAAW,MAAM,QAAS,mBAAkB,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAAA,EAChE;AACA,QAAM,cAAc;AAAA,IAClB,YAAY,SAAS,CAAC,EAAE;AAAA,IACxB,aAAa,SAAS;AAAA,IACtB,cAAc,kBAAkB;AAAA,IAChC,gCAAgC,mBAAmB;AAAA,EACrD,CAAC;AACD,MAAI,CAAC,kBAAkB,KAAM;AAE7B,QAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,eAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,YAAM,UAAU,mBAAmB,IAAI,GAAG;AAC1C,UAAI,CAAC,SAAS,KAAM;AAGpB,YAAM,cAAc,IACjB,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,MAAM,KAAK,OAAO,CAAC;AACtD,YAAM,YAAY,QAAQ;AAAA,IAC5B;AACA,UAAM,wBAAwB,KAC3B,OAAO,CAAC,QAAQ,kBAAkB,IAAI,YAAY,GAAG,CAAC,CAAC,EACvD,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACpD,eAAW,SAAS,MAAM,uBAAuB,iBAAiB,GAAG;AACnE,YAAM,IAAI,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import { type Kysely, type Transaction, sql } from 'kysely'\nimport {\n  isSearchFieldBlocklisted,\n  resolveSearchConfig,\n  resolveSearchTokenLimits,\n  type SearchConfig,\n} from '@open-mercato/shared/lib/search/config'\nimport { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'\nimport { looksLikeEncryptedPayload } from '@open-mercato/shared/lib/encryption/aes'\nimport { createKmsService, resolveEncryptionMode, type KmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('query_index').child({ component: 'search-tokens' })\n\nconst INSERT_BATCH_SIZE = 500\nconst TOKEN_EXCLUDED_ENTITY_TYPES = new Set(['audit_logs:action_log', 'audit_logs:access_log'])\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (size <= 0) return [items]\n  const out: T[][] = []\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))\n  return out\n}\n\nexport type SearchTokenRow = {\n  entity_type: string\n  entity_id: string\n  organization_id: string | null\n  tenant_id: string | null\n  field: string\n  token_hash: string\n  token?: string | null\n}\n\ntype BuildTokenOptions = {\n  entityType: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  doc?: Record<string, unknown> | null\n  config?: SearchConfig\n  /** Resolved once per write by the exported entry points; see {@link shouldGuardCiphertext}. */\n  guardCiphertext?: boolean\n}\n\nconst DEFAULT_SCOPE = { organizationId: null, tenantId: null }\ntype EntityFieldPair = [string, string]\ntype SearchTokenExecutor = Kysely<any> | Transaction<any>\n\nexport const isSearchDebugEnabled = (): boolean => {\n  return parseBooleanToken(process.env.OM_SEARCH_DEBUG ?? '') === true\n}\n\nconst debug = (event: string, payload: Record<string, unknown>) => {\n  if (!isSearchDebugEnabled()) return\n  try {\n    logger.debug('Search token event', { event, payload })\n  } catch {\n    // ignore\n  }\n}\n\nfunction collectTextValues(value: unknown): string[] {\n  if (typeof value === 'string') return [value]\n  if (Array.isArray(value)) {\n    const out: string[] = []\n    for (const entry of value) {\n      if (typeof entry === 'string') out.push(entry)\n    }\n    return out\n  }\n  return []\n}\n\nlet guardKmsService: KmsService | null = null\n\n/**\n * Whether the ciphertext guard below is allowed to run for this write.\n *\n * The guard recognises an envelope by its SHAPE, which is forgeable: `<16 b64>:<b64>:<24 b64>:v1`\n * is a string any user can type into a searchable field. `tenantDataEncryptionService` removed the\n * same structural test for that reason (#2720). So the guard may only run where the shape is the\n * ONLY test available -- which is exactly where no DEK is reachable:\n *\n * - `active`      -- the indexer decrypted the document before handing it here, so a value still\n *                    shaped like an envelope is plaintext somebody typed. Indexing it is correct,\n *                    and skipping it would let that person freeze their own record's tokens at a\n *                    past state. The guard stays off, which also keeps it off the hot path of\n *                    every normal deployment.\n * - `disabled`    -- `decryptIndexDocForSearch` is a no-op, so ciphertext arrives undecrypted.\n * - `unavailable` -- the decrypt was attempted and could not complete, same outcome.\n *\n * Resolved once per write rather than per document, over a KMS built once per process:\n * {@link createKmsService} logs when it falls back, and a reindex calls this once per record. The\n * toggle itself is still re-read every call by {@link resolveEncryptionMode}; only the KMS is\n * cached, and it already requires a restart to change, since DEK and map caches are in-process.\n */\nfunction shouldGuardCiphertext(): boolean {\n  guardKmsService ??= createKmsService()\n  return resolveEncryptionMode(guardKmsService) !== 'active'\n}\n\n/**\n * Fields whose value is an AES-GCM envelope rather than the text it is supposed to hold.\n *\n * Search tokens are hashes of PLAINTEXT: the indexer decrypts a document before tokenising it\n * (`indexer.ts` -> `decryptIndexDocForSearch`), which is what lets the token index survive\n * encryption being switched on or off. That decrypt step is a no-op once\n * `TENANT_DATA_ENCRYPTION=no`, so an operator who flips the toggle before running\n * `mercato entities decrypt-database` starts feeding ciphertext into the tokeniser. The tokens\n * that come out are hashes of base64 noise and match nothing, and because a write REPLACES a\n * record's tokens, the good plaintext tokens already in the table would be deleted to make room\n * for them -- turning a recoverable misordering into permanent search loss.\n *\n * Detecting the envelope by shape lets the write skip those fields and leave what is already\n * indexed alone. `guard` gates that detection; see {@link shouldGuardCiphertext} for why it is not\n * unconditional.\n */\nfunction ciphertextFieldsOf(\n  doc: Record<string, unknown> | null | undefined,\n  guard: boolean,\n): Set<string> {\n  const fields = new Set<string>()\n  if (!guard || !doc) return fields\n  for (const [field, value] of Object.entries(doc)) {\n    const values = collectTextValues(value)\n    if (values.length && values.some((text) => looksLikeEncryptedPayload(text))) fields.add(field)\n  }\n  return fields\n}\n\nconst warnedCiphertextEntities = new Set<string>()\n\nfunction warnCiphertextSkipped(entityType: string, tenantId: string | null, fields: Set<string>): void {\n  if (!fields.size) return\n  // Once per entity type per tenant per process: a full reindex would otherwise emit this per\n  // record, while keying on the entity type alone would let the first affected tenant in a shared\n  // process consume the one warning every other tenant's operator needed.\n  const key = `${entityType}|${tenantId ?? ''}`\n  if (warnedCiphertextEntities.has(key)) return\n  warnedCiphertextEntities.add(key)\n  logger.warn(\n    'Search indexing skipped ciphertext fields and preserved their existing tokens. '\n      + 'This means TENANT_DATA_ENCRYPTION was switched off while encrypted data was still at rest. '\n      + 'Run `mercato entities decrypt-database` and reindex; until then these fields are not searchable.',\n    { entityType, tenantId, fields: Array.from(fields).sort((left, right) => left.localeCompare(right)) },\n  )\n}\n\n/** Test seam: both the warning above and the KMS behind the guard are once-per-process. */\nexport function resetCiphertextGuardState(): void {\n  warnedCiphertextEntities.clear()\n  guardKmsService = null\n}\n\nfunction shouldIndexField(\n  field: string,\n  value: unknown,\n  config: SearchConfig,\n  entityType: string | null,\n): boolean {\n  if (typeof value !== 'string' && !Array.isArray(value)) return false\n  const lower = field.toLowerCase()\n  if (lower === 'id' || lower.endsWith('_id') || lower.endsWith('.id')) return false\n  if (lower.endsWith('_at')) return false\n  if (['created_at', 'updated_at', 'deleted_at', 'tenant_id', 'organization_id'].includes(lower)) return false\n  if (isSearchFieldBlocklisted(field, entityType, config)) return false\n  return collectTextValues(value).some((text) => text.length > 0)\n}\n\n/**\n * Builds the `search_tokens` rows for one document.\n *\n * `maxTokensPerRecord` is spent in the iteration order of `params.doc`'s own keys: fields are\n * tokenized one after another and the loop stops at the first field that exhausts the budget, so\n * on an over-budget record the surviving fields are whichever ones come first. That order is a\n * property of the object handed in, not of the entity, and the two write-path builders order it\n * differently: `buildIndexDocument` (`lib/document.ts`, the batch reindex path) appends `cf:*` keys\n * after the base columns and the aggregate `search_text` field last. `buildIndexDoc` (`lib/indexer.ts`,\n * the incremental single-record write path \u2014 `upsertIndexRow` \u2192 `reindexSearchTokensForRecord`) adds\n * `l10n:{locale}:{field}` translation keys between the `cf:*` keys and `search_text`. The budget is\n * spent front-to-back, so the fields nearest the end of that order are starved first: `search_text`\n * is last on both paths and starves first either way, but starves sooner on the incremental path,\n * because the `l10n:*` keys ahead of it there consume budget the batch path would have spent on it.\n * Those translation fields starve next, before any `cf:*` key or base column. The two paths can\n * therefore keep different fields searchable for an otherwise equivalent record.\n *\n * Every write path tokenizes an in-memory document it is about to write \u2014 `TokenSearchStrategy.index`\n * writes only `search_tokens` rows and never touches `entity_indexes.doc` \u2014 which keeps each path\n * self-consistent on its own. A document read back out of the `entity_indexes.doc` `jsonb` column is\n * not the same object: Postgres stores `jsonb` keys in a canonical order (by key length, then byte\n * order), not in insertion order. Re-tokenizing such a document can therefore truncate at a different\n * field than the write did, so code that verifies or recomputes a record's expected tokens must\n * rebuild the document through the builder that matches the write path being checked \u2014 `buildIndexDoc`\n * for incrementally-written records, `buildIndexDocument` for batch-reindexed ones \u2014 rather than\n * reading it back from the database.\n *\n * Making truncation reproducible from a `jsonb` read \u2014 by sorting fields before tokenization \u2014\n * would change which terms stay searchable on over-budget records, so it is a behavior decision\n * rather than a clarification (#5971).\n */\nexport function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[] {\n  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) return []\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return []\n  if (!params.doc) return []\n  const tokens: SearchTokenRow[] = []\n  const capturePairs = isSearchDebugEnabled() && params.entityType === 'customers:customer_deal'\n  const debugPairs: Array<{ field: string; hash: string }> = []\n  const scope = {\n    organizationId: params.organizationId ?? DEFAULT_SCOPE.organizationId,\n    tenantId: params.tenantId ?? DEFAULT_SCOPE.tenantId,\n  }\n  const limits = resolveSearchTokenLimits(config)\n  const recordLimit = limits.maxTokensPerRecord > 0 ? limits.maxTokensPerRecord : Number.POSITIVE_INFINITY\n  const fieldLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY\n  const ciphertextFields = ciphertextFieldsOf(params.doc, params.guardCiphertext ?? shouldGuardCiphertext())\n  warnCiphertextSkipped(params.entityType, scope.tenantId, ciphertextFields)\n\n  for (const [field, rawValue] of Object.entries(params.doc)) {\n    if (tokens.length >= recordLimit) break\n    if (ciphertextFields.has(field)) continue\n    if (!shouldIndexField(field, rawValue, config, params.entityType)) continue\n    const values = collectTextValues(rawValue)\n    const seen = new Set<string>()\n    let fieldTokenCount = 0\n    for (const text of values) {\n      if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n      const remainingLimit = Math.min(recordLimit - tokens.length, fieldLimit - fieldTokenCount)\n      const candidateLimit = fieldTokenCount + remainingLimit\n      const tokenConfig = Number.isFinite(candidateLimit)\n        ? { ...config, maxTokensPerField: candidateLimit }\n        : config\n      const { tokens: textTokens, hashes } = tokenizeText(text, tokenConfig)\n      for (let i = 0; i < textTokens.length; i += 1) {\n        if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n        const token = textTokens[i]\n        const hash = hashes[i]\n        const dedupeKey = `${field}|${hash}`\n        if (seen.has(dedupeKey)) continue\n        seen.add(dedupeKey)\n        fieldTokenCount += 1\n        debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, hash })\n        tokens.push({\n          entity_type: params.entityType,\n          entity_id: String(params.recordId),\n          organization_id: scope.organizationId,\n          tenant_id: scope.tenantId,\n          field,\n          token_hash: hash,\n          token: config.storeRawTokens ? token : null,\n        })\n        if (capturePairs) {\n          debugPairs.push({ field, hash })\n        }\n      }\n    }\n  }\n  if (capturePairs) {\n    debug('deal.tokens', {\n      entityType: params.entityType,\n      recordId: params.recordId,\n      tokenCount: debugPairs.length,\n      tokens: debugPairs,\n    })\n  }\n  debug('doc.completed', { entityType: params.entityType, recordId: params.recordId, tokenCount: tokens.length })\n\n  return tokens\n}\n\nfunction buildFieldPairs(\n  recordId: string,\n  doc?: Record<string, unknown> | null,\n  skipFields?: Set<string>,\n): EntityFieldPair[] {\n  if (!doc) return []\n  const pairs: EntityFieldPair[] = []\n  const dedupe = new Set<string>()\n  for (const field of Object.keys(doc)) {\n    // The delete below is scoped to these pairs, so omitting a field here is what preserves the\n    // tokens already stored for it rather than merely declining to write new ones.\n    if (skipFields?.has(field)) continue\n    const key = `${recordId}|${field}`\n    if (dedupe.has(key)) continue\n    dedupe.add(key)\n    pairs.push([recordId, field])\n  }\n  return pairs\n}\n\ntype TokenRowLike = { field?: unknown; token_hash?: unknown; token?: unknown }\n\n// NUL, not a printable separator: a field name may itself contain a space, so `a b` + hash `c`\n// would otherwise sign identically to field `a` + hash `b c`.\nconst SIGNATURE_SEPARATOR = String.fromCharCode(0)\n\n// Identifies one token row for comparison. `token` is NULL unless `storeRawTokens` is on, and a\n// stored NULL has to sign the same as the `null` a freshly built row carries \u2014 otherwise every\n// record compares as changed and the skip never fires.\nfunction tokenSignature(row: TokenRowLike): string {\n  return [\n    String(row.field ?? ''),\n    String(row.token_hash ?? ''),\n    row.token == null ? '' : String(row.token),\n  ].join(SIGNATURE_SEPARATOR)\n}\n\n// Multiplicities, not sets: #4681 reports token rows duplicated by the concurrent-replacement\n// defect, and a set comparison reads such a record as already correct and preserves the duplicates\n// forever. Counting sends it through a full rewrite, which collapses them.\nfunction tallyOf(rows: Iterable<TokenRowLike>): Map<string, number> {\n  const tally = new Map<string, number>()\n  for (const row of rows) {\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n  }\n  return tally\n}\n\nfunction tallyEquals(a: Map<string, number> | undefined, b: Map<string, number> | undefined): boolean {\n  const left = a ?? new Map<string, number>()\n  const right = b ?? new Map<string, number>()\n  if (left.size !== right.size) return false\n  for (const [key, count] of left.entries()) {\n    if (right.get(key) !== count) return false\n  }\n  return true\n}\n\nfunction tallyTokenRows<TRow extends TokenRowLike>(\n  rows: Iterable<TRow>,\n  keyOf: (row: TRow) => string\n): Map<string, Map<string, number>> {\n  const tallies = new Map<string, Map<string, number>>()\n  for (const row of rows) {\n    const key = keyOf(row)\n    const tally = tallies.get(key) ?? new Map<string, number>()\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n    tallies.set(key, tally)\n  }\n  return tallies\n}\n\nexport async function replaceSearchTokensForRecord(\n  db: Kysely<any>,\n  params: BuildTokenOptions,\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) {\n    await deleteSearchTokensForRecord(db, params, options)\n    return\n  }\n  const guardCiphertext = params.guardCiphertext ?? shouldGuardCiphertext()\n  const rows = buildSearchTokenRows({ ...params, guardCiphertext })\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const ciphertextFields = ciphertextFieldsOf(params.doc, guardCiphertext)\n  const fieldPairs = buildFieldPairs(String(params.recordId), params.doc, ciphertextFields)\n\n  // An empty pair list normally means the document is gone, and the delete below then purges the\n  // record wholesale. It can now also mean every field was skipped as ciphertext, where a purge\n  // would destroy precisely the tokens the skip exists to protect. Distinguish the two.\n  if (params.doc && ciphertextFields.size && !fieldPairs.length) {\n    debug('record.preserve-ciphertext', { entityType: params.entityType, recordId: params.recordId })\n    return\n  }\n\n  // Same comparison #5402 gave the batch path, over the scope this path actually writes: the\n  // delete below is narrowed to the document's own `(entity_id, field)` pairs, so the comparison\n  // has to be narrowed the same way. Reading wider would let a token row under a field this\n  // document does not carry \u2014 the `cf_` twin the search module used to write, say \u2014 read as a\n  // difference forever and defeat the skip on every write.\n  const scopeTokenQuery = (query: any): any => {\n    let scoped = query\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n      .where('entity_id' as any, '=', String(params.recordId))\n    if (fieldPairs.length) {\n      scoped = scoped.where('field' as any, 'in', fieldPairs.map(([, field]) => field))\n    }\n    return scoped\n  }\n\n  // Read through the caller's transaction when there is one. A separate connection cannot see that\n  // transaction's own uncommitted writes, so it could report rows a pending delete has already\n  // removed and talk this call out of re-inserting them.\n  const reader = options?.trx ?? db\n\n  // Count probe first, as in the batch path: it returns one row whatever the table holds, so a\n  // record whose stored rows have run away (#4681) is settled without materializing them.\n  const storedCountRows = await scopeTokenQuery(\n    reader.selectFrom('search_tokens' as any).select(sql<number>`count(*)`.as('token_count') as any),\n  ).execute()\n  const storedCount = Number((storedCountRows as any[])[0]?.token_count ?? 0)\n\n  let unchanged = storedCount === rows.length\n  if (unchanged && rows.length) {\n    const stored = await scopeTokenQuery(\n      reader.selectFrom('search_tokens' as any).select(['field' as any, 'token_hash' as any, 'token' as any]),\n    )\n      // Counts already match, so this cannot truncate. It bounds the read if a concurrent writer\n      // inserts between the probe and here; a truncated read compares as changed, which costs a\n      // rewrite rather than a wrong skip.\n      .limit(rows.length)\n      .execute()\n    unchanged = tallyEquals(tallyOf(rows), tallyOf(stored as any[]))\n  }\n  if (unchanged) {\n    debug('record.skip', { entityType: params.entityType, recordId: params.recordId, tokenCount: rows.length })\n    return\n  }\n\n  const writeTokens = async (executor: SearchTokenExecutor): Promise<void> => {\n    let deleteQuery = executor\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    if (fieldPairs.length) {\n      deleteQuery = deleteQuery.where((eb: any) => eb.or(\n        fieldPairs.map(([rid, field]) => eb.and([\n          eb('entity_id' as any, '=', rid),\n          eb('field' as any, '=', field),\n        ])),\n      ))\n    } else {\n      deleteQuery = deleteQuery.where('entity_id' as any, '=', String(params.recordId))\n    }\n    await deleteQuery.execute()\n    if (!rows.length) return\n    const payloads = rows.map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloads, INSERT_BATCH_SIZE)) {\n      await executor.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  }\n\n  if (options?.trx) {\n    await writeTokens(options.trx)\n    return\n  }\n\n  await db.transaction().execute(writeTokens)\n}\n\nexport async function deleteSearchTokensForRecord(\n  db: Kysely<any>,\n  params: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const executor = options?.trx ?? db\n  await executor\n    .deleteFrom('search_tokens' as any)\n    .where('entity_type' as any, '=', params.entityType)\n    .where('entity_id' as any, '=', String(params.recordId))\n    .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n    .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    .execute()\n}\n\nexport async function replaceSearchTokensForBatch(\n  db: Kysely<any>,\n  allPayloads: Array<BuildTokenOptions & { doc: Record<string, unknown> }>\n): Promise<void> {\n  if (!allPayloads.length) return\n  const excludedBuckets = new Map<string, {\n    entityType: string\n    organizationId: string | null\n    tenantId: string | null\n    ids: Set<string>\n  }>()\n  const indexablePayloads = allPayloads.filter((payload) => {\n    if (!TOKEN_EXCLUDED_ENTITY_TYPES.has(payload.entityType)) return true\n    const organizationId = payload.organizationId ?? null\n    const tenantId = payload.tenantId ?? null\n    const key = JSON.stringify([payload.entityType, organizationId, tenantId])\n    const bucket = excludedBuckets.get(key) ?? {\n      entityType: payload.entityType,\n      organizationId,\n      tenantId,\n      ids: new Set<string>(),\n    }\n    bucket.ids.add(String(payload.recordId))\n    excludedBuckets.set(key, bucket)\n    return false\n  })\n  if (excludedBuckets.size) {\n    await db.transaction().execute(async (trx) => {\n      for (const bucket of excludedBuckets.values()) {\n        await trx\n          .deleteFrom('search_tokens')\n          .where('entity_type', '=', bucket.entityType)\n          .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n          .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n          .where('entity_id', 'in', Array.from(bucket.ids))\n          .execute()\n      }\n    })\n  }\n  if (!indexablePayloads.length) return\n  const config = resolveSearchConfig()\n  if (!config.enabled) return\n\n  // A record carrying ciphertext drops out of the batch entirely, rather than being rewritten\n  // without its encrypted fields. This path deletes by `entity_id` -- it cannot express \"replace\n  // these fields and leave those alone\" the way the per-record path can -- so partial handling\n  // here would still delete the tokens we are trying to protect. Skipping the record leaves every\n  // one of its tokens, encrypted-field and plaintext-field alike, exactly as it was. The state is\n  // transient by construction: `decrypt-database` followed by a reindex rebuilds all of it.\n  const guardCiphertext = shouldGuardCiphertext()\n  const preservedRecordIds = new Set<string>()\n  const payloads = indexablePayloads.filter((payload) => {\n    const ciphertextFields = ciphertextFieldsOf(payload.doc, guardCiphertext)\n    if (!ciphertextFields.size) return true\n    warnCiphertextSkipped(payload.entityType, payload.tenantId ?? null, ciphertextFields)\n    preservedRecordIds.add(String(payload.recordId))\n    return false\n  })\n  if (!payloads.length) return\n\n  const rows = payloads.flatMap((payload) => buildSearchTokenRows({ ...payload, config, guardCiphertext }))\n  if (!rows.length) {\n    const entityType = payloads[0]?.entityType\n    if (!entityType) return\n    const ids = payloads.map((p) => String(p.recordId))\n    await db\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', entityType)\n      .where('entity_id' as any, 'in', ids)\n      .execute()\n    return\n  }\n\n  const scopeKey = (org: string | null, tenant: string | null) => `${org ?? '__null__'}|${tenant ?? '__null__'}`\n  const scopeBuckets = new Map<string, { organizationId: string | null; tenantId: string | null; ids: Set<string> }>()\n\n  for (const payload of payloads) {\n    const org = payload.organizationId ?? null\n    const tenant = payload.tenantId ?? null\n    const key = scopeKey(org, tenant)\n    const bucket = scopeBuckets.get(key) ?? { organizationId: org, tenantId: tenant, ids: new Set<string>() }\n    bucket.ids.add(String(payload.recordId))\n    scopeBuckets.set(key, bucket)\n  }\n\n  const recordKeyOf = (row: SearchTokenRow) =>\n    `${scopeKey(row.organization_id ?? null, row.tenant_id ?? null)}|${String(row.entity_id)}`\n  const builtTally = tallyTokenRows(rows, recordKeyOf)\n\n  // Read outside the transaction, deliberately. The comparison decides only whether to skip a\n  // rewrite, so a concurrent writer costs us at most a rewrite we declined \u2014 declined because the\n  // table already held exactly the rows this call wanted to write. One ordering is worth naming\n  // though: if the read matches and a concurrent writer then commits tokens built from a *staler*\n  // doc, the unconditional rewrite this call used to perform would have overwritten them by\n  // accident. It no longer does, so those stale rows survive until the record's next write. That\n  // is a repair we lose, not a guarantee we break.\n  const changedIdsByBucket = new Map<string, Set<string>>()\n  for (const [key, bucket] of scopeBuckets.entries()) {\n    const ids = Array.from(bucket.ids)\n    const builtCountById = new Map<string, number>()\n    for (const id of ids) {\n      let total = 0\n      const tally = builtTally.get(`${key}|${id}`)\n      if (tally) for (const count of tally.values()) total += count\n      builtCountById.set(id, total)\n    }\n\n    // Count probe first. Its result is one row per record in the batch, so it is bounded by the\n    // batch size \u2014 unlike a bare row read, which would be bounded only by how many token rows the\n    // table already holds for these ids, a quantity this function does not control and (per #4681)\n    // has no reason to trust.\n    const storedCounts = await db\n      .selectFrom('search_tokens' as any)\n      .select(['entity_id' as any, sql<number>`count(*)`.as('token_count') as any])\n      .where('entity_type' as any, '=', payloads[0].entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n      .where('entity_id' as any, 'in', ids)\n      .groupBy('entity_id' as any)\n      .execute()\n    const storedCountById = new Map<string, number>()\n    for (const row of storedCounts as any[]) {\n      storedCountById.set(String(row.entity_id), Number(row.token_count))\n    }\n\n    const changed = new Set<string>()\n    // A record whose stored row count already differs is changed, whatever the rows say \u2014 the\n    // duplicate case from #4681 resolves here without ever materializing the duplicated rows.\n    const contentCandidates = ids.filter((id) => {\n      const builtCount = builtCountById.get(id) ?? 0\n      if ((storedCountById.get(id) ?? 0) !== builtCount) {\n        changed.add(id)\n        return false\n      }\n      return builtCount > 0\n    })\n\n    if (contentCandidates.length) {\n      const rowBudget = contentCandidates.reduce((sum, id) => sum + (builtCountById.get(id) ?? 0), 0)\n      const stored = await db\n        .selectFrom('search_tokens' as any)\n        .select(['entity_id' as any, 'field' as any, 'token_hash' as any, 'token' as any])\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', contentCandidates)\n        // Counts already match, so this cannot truncate \u2014 it bounds the damage if a concurrent\n        // writer inserts between the probe and this read. A truncated read compares as changed,\n        // which costs a rewrite rather than a wrong skip.\n        .limit(rowBudget)\n        .execute()\n      const storedTally = tallyTokenRows(stored as any[], (row) => String(row.entity_id))\n      for (const id of contentCandidates) {\n        if (!tallyEquals(builtTally.get(`${key}|${id}`), storedTally.get(id))) changed.add(id)\n      }\n    }\n    changedIdsByBucket.set(key, changed)\n  }\n\n  const changedRecordKeys = new Set<string>()\n  for (const [key, changed] of changedIdsByBucket.entries()) {\n    for (const id of changed) changedRecordKeys.add(`${key}|${id}`)\n  }\n  debug('batch.skip', {\n    entityType: payloads[0].entityType,\n    recordCount: payloads.length,\n    changedCount: changedRecordKeys.size,\n    preservedCiphertextRecordCount: preservedRecordIds.size,\n  })\n  if (!changedRecordKeys.size) return\n\n  await db.transaction().execute(async (trx) => {\n    for (const [key, bucket] of scopeBuckets.entries()) {\n      const changed = changedIdsByBucket.get(key)\n      if (!changed?.size) continue\n      // Delete by entity_id: a batch replaces all of a record's tokens, and a per-field OR over the\n      // whole batch overflows the query compiler's call stack on large batches.\n      const deleteQuery = trx\n        .deleteFrom('search_tokens' as any)\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', Array.from(changed))\n      await deleteQuery.execute()\n    }\n    const payloadWithTimestamps = rows\n      .filter((row) => changedRecordKeys.has(recordKeyOf(row)))\n      .map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloadWithTimestamps, INSERT_BATCH_SIZE)) {\n      await trx.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  })\n}\n"],
+  "mappings": "AAAA,SAAwC,WAAW;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kBAAkB,6BAA8C;AACzE,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE/E,MAAM,oBAAoB;AAC1B,MAAM,8BAA8B,oBAAI,IAAI,CAAC,yBAAyB,uBAAuB,CAAC;AAE9F,SAAS,MAAS,OAAY,MAAqB;AACjD,MAAI,QAAQ,EAAG,QAAO,CAAC,KAAK;AAC5B,QAAM,MAAa,CAAC;AACpB,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAM,KAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;AAC9E,SAAO;AACT;AAuBA,MAAM,gBAAgB,EAAE,gBAAgB,MAAM,UAAU,KAAK;AAItD,MAAM,uBAAuB,MAAe;AACjD,SAAO,kBAAkB,QAAQ,IAAI,mBAAmB,EAAE,MAAM;AAClE;AAEA,MAAM,QAAQ,CAAC,OAAe,YAAqC;AACjE,MAAI,CAAC,qBAAqB,EAAG;AAC7B,MAAI;AACF,WAAO,MAAM,sBAAsB,EAAE,OAAO,QAAQ,CAAC;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,kBAAkB,OAA0B;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC,KAAK;AAC5C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,MAAgB,CAAC;AACvB,eAAW,SAAS,OAAO;AACzB,UAAI,OAAO,UAAU,SAAU,KAAI,KAAK,KAAK;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACA,SAAO,CAAC;AACV;AAEA,IAAI,kBAAqC;AAuBzC,SAAS,wBAAiC;AACxC,sBAAoB,iBAAiB;AACrC,SAAO,sBAAsB,eAAe,MAAM;AACpD;AAkBA,SAAS,mBACP,KACA,OACa;AACb,QAAM,SAAS,oBAAI,IAAY;AAC/B,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,kBAAkB,KAAK;AACtC,QAAI,OAAO,UAAU,OAAO,KAAK,CAAC,SAAS,0BAA0B,IAAI,CAAC,EAAG,QAAO,IAAI,KAAK;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,MAAM,2BAA2B,oBAAI,IAAY;AAEjD,SAAS,sBAAsB,YAAoB,UAAyB,QAA2B;AACrG,MAAI,CAAC,OAAO,KAAM;AAIlB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,EAAE;AAC3C,MAAI,yBAAyB,IAAI,GAAG,EAAG;AACvC,2BAAyB,IAAI,GAAG;AAChC,SAAO;AAAA,IACL;AAAA,IAGA,EAAE,YAAY,UAAU,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,EAAE;AAAA,EACtG;AACF;AAGO,SAAS,4BAAkC;AAChD,2BAAyB,MAAM;AAC/B,oBAAkB;AACpB;AAEA,SAAS,iBACP,OACA,OACA,QACA,YACS;AACT,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAC/D,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,UAAU,QAAQ,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,KAAK,EAAG,QAAO;AAC7E,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,cAAc,cAAc,aAAa,iBAAiB,EAAE,SAAS,KAAK,EAAG,QAAO;AACvG,MAAI,yBAAyB,OAAO,YAAY,MAAM,EAAG,QAAO;AAChE,SAAO,kBAAkB,KAAK,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AAChE;AAiCO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,4BAA4B,IAAI,OAAO,UAAU,EAAG,QAAO,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC;AAC7B,MAAI,CAAC,OAAO,IAAK,QAAO,CAAC;AACzB,QAAM,SAA2B,CAAC;AAClC,QAAM,eAAe,qBAAqB,KAAK,OAAO,eAAe;AACrE,QAAM,aAAqD,CAAC;AAC5D,QAAM,QAAQ;AAAA,IACZ,gBAAgB,OAAO,kBAAkB,cAAc;AAAA,IACvD,UAAU,OAAO,YAAY,cAAc;AAAA,EAC7C;AACA,QAAM,SAAS,yBAAyB,MAAM;AAC9C,QAAM,cAAc,OAAO,qBAAqB,IAAI,OAAO,qBAAqB,OAAO;AACvF,QAAM,aAAa,OAAO,oBAAoB,IAAI,OAAO,oBAAoB,OAAO;AACpF,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,OAAO,mBAAmB,sBAAsB,CAAC;AACzG,wBAAsB,OAAO,YAAY,MAAM,UAAU,gBAAgB;AAEzE,aAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG,GAAG;AAC1D,QAAI,OAAO,UAAU,YAAa;AAClC,QAAI,iBAAiB,IAAI,KAAK,EAAG;AACjC,QAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,OAAO,UAAU,EAAG;AACnE,UAAM,SAAS,kBAAkB,QAAQ;AACzC,UAAM,OAAO,oBAAI,IAAY;AAC7B,QAAI,kBAAkB;AACtB,eAAW,QAAQ,QAAQ;AACzB,UAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,YAAM,iBAAiB,KAAK,IAAI,cAAc,OAAO,QAAQ,aAAa,eAAe;AACzF,YAAM,iBAAiB,kBAAkB;AACzC,YAAM,cAAc,OAAO,SAAS,cAAc,IAC9C,EAAE,GAAG,QAAQ,mBAAmB,eAAe,IAC/C;AACJ,YAAM,EAAE,QAAQ,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW;AACrE,eAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK,GAAG;AAC7C,YAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,cAAM,QAAQ,WAAW,CAAC;AAC1B,cAAM,OAAO,OAAO,CAAC;AACrB,cAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,YAAI,KAAK,IAAI,SAAS,EAAG;AACzB,aAAK,IAAI,SAAS;AAClB,2BAAmB;AACnB,cAAM,mBAAmB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,OAAO,KAAK,CAAC;AAClG,eAAO,KAAK;AAAA,UACV,aAAa,OAAO;AAAA,UACpB,WAAW,OAAO,OAAO,QAAQ;AAAA,UACjC,iBAAiB,MAAM;AAAA,UACvB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,YAAY;AAAA,UACZ,OAAO,OAAO,iBAAiB,QAAQ;AAAA,QACzC,CAAC;AACD,YAAI,cAAc;AAChB,qBAAW,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,eAAe;AAAA,MACnB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,YAAY,WAAW;AAAA,MACvB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,OAAO,OAAO,CAAC;AAE9G,SAAO;AACT;AAEA,SAAS,gBACP,UACA,KACA,YACmB;AACnB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,QAA2B,CAAC;AAClC,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,OAAO,KAAK,GAAG,GAAG;AAGpC,QAAI,YAAY,IAAI,KAAK,EAAG;AAC5B,UAAM,MAAM,GAAG,QAAQ,IAAI,KAAK;AAChC,QAAI,OAAO,IAAI,GAAG,EAAG;AACrB,WAAO,IAAI,GAAG;AACd,UAAM,KAAK,CAAC,UAAU,KAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAMA,MAAM,sBAAsB,OAAO,aAAa,CAAC;AAKjD,SAAS,eAAe,KAA2B;AACjD,SAAO;AAAA,IACL,OAAO,IAAI,SAAS,EAAE;AAAA,IACtB,OAAO,IAAI,cAAc,EAAE;AAAA,IAC3B,IAAI,SAAS,OAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC3C,EAAE,KAAK,mBAAmB;AAC5B;AAKA,SAAS,QAAQ,MAAmD;AAClE,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAAoC,GAA6C;AACpG,QAAM,OAAO,KAAK,oBAAI,IAAoB;AAC1C,QAAM,QAAQ,KAAK,oBAAI,IAAoB;AAC3C,MAAI,KAAK,SAAS,MAAM,KAAM,QAAO;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ,GAAG;AACzC,QAAI,MAAM,IAAI,GAAG,MAAM,MAAO,QAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,eACP,MACA,OACkC;AAClC,QAAM,UAAU,oBAAI,IAAiC;AACrD,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,QAAQ,QAAQ,IAAI,GAAG,KAAK,oBAAI,IAAoB;AAC1D,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AACpD,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,IACA,QACA,SACe;AACf,MAAI,4BAA4B,IAAI,OAAO,UAAU,GAAG;AACtD,UAAM,4BAA4B,IAAI,QAAQ,OAAO;AACrD;AAAA,EACF;AACA,QAAM,kBAAkB,OAAO,mBAAmB,sBAAsB;AACxE,QAAM,OAAO,qBAAqB,EAAE,GAAG,QAAQ,gBAAgB,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS;AACrB,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,eAAe;AACvE,QAAM,aAAa,gBAAgB,OAAO,OAAO,QAAQ,GAAG,OAAO,KAAK,gBAAgB;AAKxF,MAAI,OAAO,OAAO,iBAAiB,QAAQ,CAAC,WAAW,QAAQ;AAC7D,UAAM,8BAA8B,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,SAAS,CAAC;AAChG;AAAA,EACF;AAOA,QAAM,kBAAkB,CAAC,UAAoB;AAC3C,QAAI,SAAS,MACV,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AACzD,QAAI,WAAW,QAAQ;AACrB,eAAS,OAAO,MAAM,SAAgB,MAAM,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAKA,QAAM,SAAS,SAAS,OAAO;AAI/B,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,WAAW,eAAsB,EAAE,OAAO,cAAsB,GAAG,aAAa,CAAQ;AAAA,EACjG,EAAE,QAAQ;AACV,QAAM,cAAc,OAAQ,gBAA0B,CAAC,GAAG,eAAe,CAAC;AAE1E,MAAI,YAAY,gBAAgB,KAAK;AACrC,MAAI,aAAa,KAAK,QAAQ;AAC5B,UAAM,SAAS,MAAM;AAAA,MACnB,OAAO,WAAW,eAAsB,EAAE,OAAO,CAAC,SAAgB,cAAqB,OAAc,CAAC;AAAA,IACxG,EAIG,MAAM,KAAK,MAAM,EACjB,QAAQ;AACX,gBAAY,YAAY,QAAQ,IAAI,GAAG,QAAQ,MAAe,CAAC;AAAA,EACjE;AACA,MAAI,WAAW;AACb,UAAM,eAAe,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,KAAK,OAAO,CAAC;AAC1G;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,aAAiD;AAC1E,QAAI,cAAc,SACf,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE;AACjE,QAAI,WAAW,QAAQ;AACrB,oBAAc,YAAY,MAAM,CAAC,OAAY,GAAG;AAAA,QAC9C,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI;AAAA,UACtC,GAAG,aAAoB,KAAK,GAAG;AAAA,UAC/B,GAAG,SAAgB,KAAK,KAAK;AAAA,QAC/B,CAAC,CAAC;AAAA,MACJ,CAAC;AAAA,IACH,OAAO;AACL,oBAAc,YAAY,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AAAA,IAClF;AACA,UAAM,YAAY,QAAQ;AAC1B,QAAI,CAAC,KAAK,OAAQ;AAClB,UAAM,WAAW,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACvE,eAAW,SAAS,MAAM,UAAU,iBAAiB,GAAG;AACtD,YAAM,SAAS,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IACjF;AAAA,EACF;AAEA,MAAI,SAAS,KAAK;AAChB,UAAM,YAAY,QAAQ,GAAG;AAC7B;AAAA,EACF;AAEA,QAAM,GAAG,YAAY,EAAE,QAAQ,WAAW;AAC5C;AAEA,eAAsB,4BACpB,IACA,QACA,SACe;AACf,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,WAAW,SAAS,OAAO;AACjC,QAAM,SACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC,EACtD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,QAAQ;AACb;AAEA,eAAsB,4BACpB,IACA,aACe;AACf,MAAI,CAAC,YAAY,OAAQ;AACzB,QAAM,kBAAkB,oBAAI,IAKzB;AACH,QAAM,oBAAoB,YAAY,OAAO,CAAC,YAAY;AACxD,QAAI,CAAC,4BAA4B,IAAI,QAAQ,UAAU,EAAG,QAAO;AACjE,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,WAAW,QAAQ,YAAY;AACrC,UAAM,MAAM,KAAK,UAAU,CAAC,QAAQ,YAAY,gBAAgB,QAAQ,CAAC;AACzE,UAAM,SAAS,gBAAgB,IAAI,GAAG,KAAK;AAAA,MACzC,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA;AAAA,MACA,KAAK,oBAAI,IAAY;AAAA,IACvB;AACA,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,oBAAgB,IAAI,KAAK,MAAM;AAC/B,WAAO;AAAA,EACT,CAAC;AACD,MAAI,gBAAgB,MAAM;AACxB,UAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,iBAAW,UAAU,gBAAgB,OAAO,GAAG;AAC7C,cAAM,IACH,WAAW,eAAe,EAC1B,MAAM,eAAe,KAAK,OAAO,UAAU,EAC3C,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAa,MAAM,MAAM,KAAK,OAAO,GAAG,CAAC,EAC/C,QAAQ;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,CAAC,kBAAkB,OAAQ;AAC/B,QAAM,SAAS,oBAAoB;AACnC,MAAI,CAAC,OAAO,QAAS;AAQrB,QAAM,kBAAkB,sBAAsB;AAC9C,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,WAAW,kBAAkB,OAAO,CAAC,YAAY;AACrD,UAAM,mBAAmB,mBAAmB,QAAQ,KAAK,eAAe;AACxE,QAAI,CAAC,iBAAiB,KAAM,QAAO;AACnC,0BAAsB,QAAQ,YAAY,QAAQ,YAAY,MAAM,gBAAgB;AACpF,uBAAmB,IAAI,OAAO,QAAQ,QAAQ,CAAC;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,SAAS,OAAQ;AAEtB,QAAM,OAAO,SAAS,QAAQ,CAAC,YAAY,qBAAqB,EAAE,GAAG,SAAS,QAAQ,gBAAgB,CAAC,CAAC;AACxG,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,aAAa,SAAS,CAAC,GAAG;AAChC,QAAI,CAAC,WAAY;AACjB,UAAM,MAAM,SAAS,IAAI,CAAC,MAAM,OAAO,EAAE,QAAQ,CAAC;AAClD,UAAM,GACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,UAAU,EAC3C,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ;AACX;AAAA,EACF;AAEA,QAAM,WAAW,CAAC,KAAoB,WAA0B,GAAG,OAAO,UAAU,IAAI,UAAU,UAAU;AAC5G,QAAM,eAAe,oBAAI,IAA0F;AAEnH,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAM,QAAQ,kBAAkB;AACtC,UAAM,SAAS,QAAQ,YAAY;AACnC,UAAM,MAAM,SAAS,KAAK,MAAM;AAChC,UAAM,SAAS,aAAa,IAAI,GAAG,KAAK,EAAE,gBAAgB,KAAK,UAAU,QAAQ,KAAK,oBAAI,IAAY,EAAE;AACxG,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,iBAAa,IAAI,KAAK,MAAM;AAAA,EAC9B;AAEA,QAAM,cAAc,CAAC,QACnB,GAAG,SAAS,IAAI,mBAAmB,MAAM,IAAI,aAAa,IAAI,CAAC,IAAI,OAAO,IAAI,SAAS,CAAC;AAC1F,QAAM,aAAa,eAAe,MAAM,WAAW;AASnD,QAAM,qBAAqB,oBAAI,IAAyB;AACxD,aAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,UAAM,MAAM,MAAM,KAAK,OAAO,GAAG;AACjC,UAAM,iBAAiB,oBAAI,IAAoB;AAC/C,eAAW,MAAM,KAAK;AACpB,UAAI,QAAQ;AACZ,YAAM,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAC3C,UAAI,MAAO,YAAW,SAAS,MAAM,OAAO,EAAG,UAAS;AACxD,qBAAe,IAAI,IAAI,KAAK;AAAA,IAC9B;AAMA,UAAM,eAAe,MAAM,GACxB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,cAAsB,GAAG,aAAa,CAAQ,CAAC,EAC3E,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ,WAAkB,EAC1B,QAAQ;AACX,UAAM,kBAAkB,oBAAI,IAAoB;AAChD,eAAW,OAAO,cAAuB;AACvC,sBAAgB,IAAI,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,IACpE;AAEA,UAAM,UAAU,oBAAI,IAAY;AAGhC,UAAM,oBAAoB,IAAI,OAAO,CAAC,OAAO;AAC3C,YAAM,aAAa,eAAe,IAAI,EAAE,KAAK;AAC7C,WAAK,gBAAgB,IAAI,EAAE,KAAK,OAAO,YAAY;AACjD,gBAAQ,IAAI,EAAE;AACd,eAAO;AAAA,MACT;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,kBAAkB,QAAQ;AAC5B,YAAM,YAAY,kBAAkB,OAAO,CAAC,KAAK,OAAO,OAAO,eAAe,IAAI,EAAE,KAAK,IAAI,CAAC;AAC9F,YAAM,SAAS,MAAM,GAClB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,SAAgB,cAAqB,OAAc,CAAC,EAChF,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,iBAAiB,EAIjD,MAAM,SAAS,EACf,QAAQ;AACX,YAAM,cAAc,eAAe,QAAiB,CAAC,QAAQ,OAAO,IAAI,SAAS,CAAC;AAClF,iBAAW,MAAM,mBAAmB;AAClC,YAAI,CAAC,YAAY,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE,GAAG,YAAY,IAAI,EAAE,CAAC,EAAG,SAAQ,IAAI,EAAE;AAAA,MACvF;AAAA,IACF;AACA,uBAAmB,IAAI,KAAK,OAAO;AAAA,EACrC;AAEA,QAAM,oBAAoB,oBAAI,IAAY;AAC1C,aAAW,CAAC,KAAK,OAAO,KAAK,mBAAmB,QAAQ,GAAG;AACzD,eAAW,MAAM,QAAS,mBAAkB,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAAA,EAChE;AACA,QAAM,cAAc;AAAA,IAClB,YAAY,SAAS,CAAC,EAAE;AAAA,IACxB,aAAa,SAAS;AAAA,IACtB,cAAc,kBAAkB;AAAA,IAChC,gCAAgC,mBAAmB;AAAA,EACrD,CAAC;AACD,MAAI,CAAC,kBAAkB,KAAM;AAE7B,QAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,eAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,YAAM,UAAU,mBAAmB,IAAI,GAAG;AAC1C,UAAI,CAAC,SAAS,KAAM;AAGpB,YAAM,cAAc,IACjB,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,MAAM,KAAK,OAAO,CAAC;AACtD,YAAM,YAAY,QAAQ;AAAA,IAC5B;AACA,UAAM,wBAAwB,KAC3B,OAAO,CAAC,QAAQ,kBAAkB,IAAI,YAAY,GAAG,CAAC,CAAC,EACvD,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACpD,eAAW,SAAS,MAAM,uBAAuB,iBAAiB,GAAG;AACnE,YAAM,IAAI,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/modules/resources/api/resources/tags/assign/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -30,7 +31,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/resources/api/resources/tags/assign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/resources/api/resources/tags/assign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  resourcesResourceTagAssignmentSchema,\n  type ResourcesResourceTagAssignmentInput,\n} from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('resources').child({ component: 'tags' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['resources.manage_resources'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('resources.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction resolveActorId(ctx: CommandRuntimeContext): string {\n  const auth = ctx.auth\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(resourcesResourceTagAssignmentSchema, body, ctx, translate)\n    const actorId = resolveActorId(ctx)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      userId: actorId,\n      resourceKind: 'resources.resourceTagAssignment',\n      resourceId: input.resourceId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<ResourcesResourceTagAssignmentInput, { assignmentId: string }>(\n      'resources.resourceTags.assign',\n      { input, ctx },\n    )\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        userId: actorId,\n        resourceKind: 'resources.resourceTagAssignment',\n        resourceId: input.resourceId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.assignmentId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'resources.resourceTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('Tag assign failed', { err })\n    return NextResponse.json({ error: translate('resources.resources.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Resources',\n  summary: 'Assign resource tag',\n  methods: {\n    POST: {\n      summary: 'Assign resource tag',\n      description: 'Assigns a tag to a resources resource.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: resourcesResourceTagAssignmentSchema,\n      },\n      responses: [\n        { status: 201, description: 'Tag assignment created', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE7D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,eAAe,KAAoC;AAC1D,QAAM,OAAO,IAAI;AACjB,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,sCAAsC,MAAM,KAAK,SAAS;AAChG,UAAM,UAAU,eAAe,GAAG;AAClC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC;AACzC,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wCAAwC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  resourcesResourceTagAssignmentSchema,\n  type ResourcesResourceTagAssignmentInput,\n} from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('resources').child({ component: 'tags' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['resources.manage_resources'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('resources.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction resolveActorId(ctx: CommandRuntimeContext): string {\n  const auth = ctx.auth\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(resourcesResourceTagAssignmentSchema, body, ctx, translate)\n    const actorId = resolveActorId(ctx)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      userId: actorId,\n      resourceKind: 'resources.resourceTagAssignment',\n      resourceId: input.resourceId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<ResourcesResourceTagAssignmentInput, { assignmentId: string }>(\n      'resources.resourceTags.assign',\n      { input, ctx },\n    )\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        userId: actorId,\n        resourceKind: 'resources.resourceTagAssignment',\n        resourceId: input.resourceId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.assignmentId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'resources.resourceTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('Tag assign failed', { err })\n    return NextResponse.json({ error: translate('resources.resources.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Resources',\n  summary: 'Assign resource tag',\n  methods: {\n    POST: {\n      summary: 'Assign resource tag',\n      description: 'Assigns a tag to a resources resource.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: resourcesResourceTagAssignmentSchema,\n      },\n      responses: [\n        { status: 201, description: 'Tag assignment created', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE7D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,eAAe,KAAoC;AAC1D,QAAM,OAAO,IAAI;AACjB,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,sCAAsC,MAAM,KAAK,SAAS;AAChG,UAAM,UAAU,eAAe,GAAG;AAClC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC;AACzC,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wCAAwC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/resources/api/resources/tags/unassign/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -30,7 +31,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/resources/api/resources/tags/unassign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/resources/api/resources/tags/unassign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  resourcesResourceTagAssignmentSchema,\n  type ResourcesResourceTagAssignmentInput,\n} from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('resources').child({ component: 'tags' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['resources.manage_resources'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('resources.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction resolveActorId(ctx: CommandRuntimeContext): string {\n  const auth = ctx.auth\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(resourcesResourceTagAssignmentSchema, body, ctx, translate)\n    const actorId = resolveActorId(ctx)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      userId: actorId,\n      resourceKind: 'resources.resourceTagAssignment',\n      resourceId: input.resourceId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<ResourcesResourceTagAssignmentInput, { assignmentId: string | null }>(\n      'resources.resourceTags.unassign',\n      { input, ctx },\n    )\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        userId: actorId,\n        resourceKind: 'resources.resourceTagAssignment',\n        resourceId: input.resourceId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.assignmentId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'resources.resourceTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('Tag unassign failed', { err })\n    return NextResponse.json({ error: translate('resources.resources.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Resources',\n  summary: 'Unassign resource tag',\n  methods: {\n    POST: {\n      summary: 'Unassign resource tag',\n      description: 'Removes a tag from a resources resource.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: resourcesResourceTagAssignmentSchema,\n      },\n      responses: [\n        { status: 200, description: 'Tag assignment removed', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE7D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,eAAe,KAAoC;AAC1D,QAAM,OAAO,IAAI;AACjB,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,sCAAsC,MAAM,KAAK,SAAS;AAChG,UAAM,UAAU,eAAe,GAAG;AAClC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,CAAC;AACvE,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wCAAwC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  resourcesResourceTagAssignmentSchema,\n  type ResourcesResourceTagAssignmentInput,\n} from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('resources').child({ component: 'tags' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['resources.manage_resources'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('resources.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction resolveActorId(ctx: CommandRuntimeContext): string {\n  const auth = ctx.auth\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(resourcesResourceTagAssignmentSchema, body, ctx, translate)\n    const actorId = resolveActorId(ctx)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      userId: actorId,\n      resourceKind: 'resources.resourceTagAssignment',\n      resourceId: input.resourceId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<ResourcesResourceTagAssignmentInput, { assignmentId: string | null }>(\n      'resources.resourceTags.unassign',\n      { input, ctx },\n    )\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        userId: actorId,\n        resourceKind: 'resources.resourceTagAssignment',\n        resourceId: input.resourceId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.assignmentId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'resources.resourceTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('Tag unassign failed', { err })\n    return NextResponse.json({ error: translate('resources.resources.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Resources',\n  summary: 'Unassign resource tag',\n  methods: {\n    POST: {\n      summary: 'Unassign resource tag',\n      description: 'Removes a tag from a resources resource.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: resourcesResourceTagAssignmentSchema,\n      },\n      responses: [\n        { status: 200, description: 'Tag assignment removed', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE7D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,eAAe,KAAoC;AAC1D,QAAM,OAAO,IAAI;AACjB,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,sCAAsC,MAAM,KAAK,SAAS;AAChG,UAAM,UAAU,eAAe,GAAG;AAClC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,CAAC;AACvE,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wCAAwC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/resources/commands/activities.js

@@ -287,7 +287,7 @@ const updateActivityCommand = {
     };
   },
   undo: async ({ logEntry, ctx }) => {
-    const payload = extractUndoPayload(logEntry);
+    const payload = extractUndoPayload(logEntry, { datePaths: ["before.activity.occurredAt"] });
     const before = payload?.before;
     if (!before) return;
     const em = ctx.container.resolve("em").fork();
@@ -401,7 +401,7 @@ const deleteActivityCommand = {
     };
   },
   undo: async ({ logEntry, ctx }) => {
-    const payload = extractUndoPayload(logEntry);
+    const payload = extractUndoPayload(logEntry, { datePaths: ["before.activity.occurredAt"] });
     const before = payload?.before;
     if (!before) return;
     const em = ctx.container.resolve("em").fork();