@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/progress/lib/progressServiceImpl.js

@@ -10,6 +10,7 @@ import {
 } from "./progressService.js";
 import { PROGRESS_EVENTS } from "./events.js";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { buildProgressOrganizationFilter } from "./organizationScope.js";
 const DEFAULT_BROADCAST_MIN_INTERVAL_MS = 250;
 function resolveBroadcastMinIntervalMs() {
   const rawValue = process.env.OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS;
@@ -48,15 +49,29 @@ function createProgressService(em, eventBus) {
     return {
       id: jobId,
       tenantId: ctx.tenantId,
-      ...ctx.organizationId ? { organizationId: ctx.organizationId } : {}
+      ...buildProgressOrganizationFilter(ctx)
     };
   }
   async function loadFreshJob(jobId, ctx) {
     return em.findOne(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true });
   }
+  function isJobWithinScope(job, ctx) {
+    if (job.tenantId !== ctx.tenantId) return false;
+    if (ctx.organizationIds !== void 0) {
+      if (ctx.organizationIds === null) return true;
+      return typeof job.organizationId === "string" && ctx.organizationIds.includes(job.organizationId);
+    }
+    if (ctx.organizationId) return job.organizationId === ctx.organizationId;
+    return true;
+  }
   async function ensureThrottleEntry(jobId, ctx) {
     const cached = jobUpdateThrottle.get(jobId);
-    if (cached) return cached;
+    if (cached) {
+      if (!isJobWithinScope(cached.job, ctx)) {
+        throw new Error(`[internal] Progress job ${jobId} not found`);
+      }
+      return cached;
+    }
     const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true });
     const entry = {
       job,
@@ -179,6 +194,12 @@ function createProgressService(em, eventBus) {
   }
   return {
     async createJob(input, ctx) {
+      if (Array.isArray(ctx.organizationIds)) {
+        const organizationId = typeof ctx.organizationId === "string" && ctx.organizationId.trim().length > 0 ? ctx.organizationId : null;
+        if (organizationId === null || !ctx.organizationIds.includes(organizationId)) {
+          throw new Error("[internal] Progress job creation is outside the allowed organization scope");
+        }
+      }
       const job = em.create(ProgressJob, {
         jobType: input.jobType,
         name: input.name,
@@ -302,7 +323,8 @@ function createProgressService(em, eventBus) {
         forgetJobThrottle(jobId);
         return job;
       }
-      const entry = jobUpdateThrottle.get(jobId);
+      const cachedEntry = jobUpdateThrottle.get(jobId);
+      const entry = cachedEntry && isJobWithinScope(cachedEntry.job, ctx) ? cachedEntry : void 0;
       const snapshot = entry?.job ?? job;
       const now = /* @__PURE__ */ new Date();
       const data = {
@@ -350,7 +372,8 @@ function createProgressService(em, eventBus) {
         forgetJobThrottle(jobId);
         return job;
       }
-      const entry = jobUpdateThrottle.get(jobId);
+      const cachedEntry = jobUpdateThrottle.get(jobId);
+      const entry = cachedEntry && isJobWithinScope(cachedEntry.job, ctx) ? cachedEntry : void 0;
       const snapshot = entry?.job ?? job;
       const now = /* @__PURE__ */ new Date();
       const data = {
@@ -454,6 +477,8 @@ function createProgressService(em, eventBus) {
       const cancelRequestedAt = job.cancelRequestedAt ?? now;
       const cancelledByUserId = job.cancelledByUserId ?? ctx.userId ?? null;
       const finishedAt = job.finishedAt ?? now;
+      const entry = jobUpdateThrottle.get(jobId);
+      const snapshot = entry?.job;
       const affected = await em.nativeUpdate(ProgressJob, {
         ...jobScopeFilter(jobId, ctx),
         status: { $in: CANCEL_FROM_STATUSES }
@@ -463,7 +488,12 @@ function createProgressService(em, eventBus) {
         cancelledByUserId,
         finishedAt,
         etaSeconds: 0,
-        updatedAt: now
+        updatedAt: now,
+        ...entry && snapshot ? {
+          totalCount: snapshot.totalCount ?? null,
+          meta: snapshot.meta ?? null,
+          ...buildBufferedCountData(entry)
+        } : {}
       });
       forgetJobThrottle(jobId);
       if (affected === 0) {
@@ -475,25 +505,26 @@ function createProgressService(em, eventBus) {
       job.cancelledByUserId = cancelledByUserId;
       job.finishedAt = finishedAt;
       job.etaSeconds = 0;
+      const persistedJob = await loadFreshJob(jobId, ctx) ?? job;
       await eventBus.emit(PROGRESS_EVENTS.JOB_CANCELLED, {
-        ...buildJobPayload(job),
+        ...buildJobPayload(persistedJob),
         tenantId: ctx.tenantId,
-        organizationId: job.organizationId ?? null
+        organizationId: persistedJob.organizationId ?? null
       });
-      return job;
+      return persistedJob;
     },
-    async isCancellationRequested(jobId, tenantId, organizationId) {
+    async isCancellationRequested(jobId, tenantId, organizationId, organizationIds) {
       const job = await findOneWithDecryption(em.fork(), ProgressJob, {
         id: jobId,
         tenantId,
-        ...organizationId ? { organizationId } : {}
+        ...buildProgressOrganizationFilter({ organizationId, organizationIds })
       }, { disableIdentityMap: true });
       return job?.cancelRequestedAt != null;
     },
     async getActiveJobs(ctx) {
       return em.find(ProgressJob, {
         tenantId: ctx.tenantId,
-        ...ctx.organizationId ? { organizationId: ctx.organizationId } : {},
+        ...buildProgressOrganizationFilter(ctx),
         status: { $in: ["pending", "running"] },
         parentJobId: null
       }, {
@@ -505,7 +536,7 @@ function createProgressService(em, eventBus) {
       const cutoff = new Date(Date.now() - sinceSeconds * 1e3);
       return em.find(ProgressJob, {
         tenantId: ctx.tenantId,
-        ...ctx.organizationId ? { organizationId: ctx.organizationId } : {},
+        ...buildProgressOrganizationFilter(ctx),
         status: { $in: ["completed", "failed"] },
         finishedAt: { $gte: cutoff },
         parentJobId: null
@@ -518,15 +549,15 @@ function createProgressService(em, eventBus) {
       return em.findOne(ProgressJob, {
         id: jobId,
         tenantId: ctx.tenantId,
-        ...ctx.organizationId ? { organizationId: ctx.organizationId } : {}
+        ...buildProgressOrganizationFilter(ctx)
       });
     },
-    async markStaleJobsFailed(tenantId, timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS, organizationId) {
+    async markStaleJobsFailed(tenantId, timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS, organizationId, organizationIds) {
       const now = /* @__PURE__ */ new Date();
       const cutoff = new Date(now.getTime() - timeoutSeconds * 1e3);
       const scope = {
         tenantId,
-        ...organizationId ? { organizationId } : {}
+        ...buildProgressOrganizationFilter({ organizationId, organizationIds })
       };
       let failedCount = 0;
       const staleFilter = {
@@ -545,6 +576,7 @@ function createProgressService(em, eventBus) {
         const affected = await em.nativeUpdate(ProgressJob, {
           id: job.id,
           tenantId: job.tenantId,
+          organizationId: job.organizationId ?? null,
           ...staleFilter
         }, {
           status: "failed",
@@ -576,6 +608,7 @@ function createProgressService(em, eventBus) {
         const affected = await em.nativeUpdate(ProgressJob, {
           id: job.id,
           tenantId: job.tenantId,
+          organizationId: job.organizationId ?? null,
           ...stalePendingFilter
         }, {
           status: "failed",

package/dist/modules/progress/lib/progressServiceImpl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/progress/lib/progressServiceImpl.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { raw } from '@mikro-orm/core'\nimport type { EntityData, FilterQuery } from '@mikro-orm/core'\nimport { ProgressJob, type ProgressJobStatus } from '../data/entities'\nimport type { ProgressService, ProgressServiceContext } from './progressService'\nimport {\n  calculateEta,\n  calculateProgressPercent,\n  HEARTBEAT_INTERVAL_MS,\n  STALE_JOB_TIMEOUT_SECONDS,\n  STALE_PENDING_TIMEOUT_SECONDS,\n  STALE_SWEEP_ERROR_PREFIX,\n} from './progressService'\nimport { PROGRESS_EVENTS } from './events'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst DEFAULT_BROADCAST_MIN_INTERVAL_MS = 250\n\n// Minimum elapsed time between coalesced `progress.job.updated` broadcasts for a\n// single job. Bulk workers call updateProgress/incrementProgress once per record, and\n// every emit of the `clientBroadcast: true` event pays a serialized pg_notify roundtrip\n// plus a tenant-wide SSE fan-out. Setting the knob to 0 restores per-record emission.\n// Persistence is throttled separately: heartbeats hit the database at least every\n// HEARTBEAT_INTERVAL_MS regardless of this knob, so a high broadcast interval can\n// never starve the stale-job sweep of heartbeats.\nfunction resolveBroadcastMinIntervalMs(): number {\n  const rawValue = process.env.OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS\n  if (rawValue == null || rawValue.trim() === '') return DEFAULT_BROADCAST_MIN_INTERVAL_MS\n  const parsed = Number.parseInt(rawValue, 10)\n  if (!Number.isFinite(parsed) || parsed < 0) return DEFAULT_BROADCAST_MIN_INTERVAL_MS\n  return parsed\n}\n\n// Statuses a given transition is allowed to move FROM. Every write below is a\n// compare-and-swap (`nativeUpdate` guarded on status), so concurrent writers in other\n// processes can never resurrect a terminal job or double-apply a transition \u2014 the\n// UPDATE that matches zero rows simply lost the race and must not emit events.\nconst TERMINAL_STATUSES: readonly ProgressJobStatus[] = ['completed', 'failed', 'cancelled']\nconst PROGRESS_WRITABLE_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running']\n// `failed` is restartable/completable so a job wrongly swept as stale (worker alive but\n// slow) or retried by an at-least-once queue converges to its true outcome.\nconst START_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'failed']\nconst COMPLETE_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running', 'failed']\nconst FAIL_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running']\nconst CANCEL_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running', 'failed']\n\ntype JobUpdateThrottleEntry = {\n  job: ProgressJob\n  lastBroadcastAt: number\n  lastPersistedAt: number\n  lastBroadcastPercent: number\n  pendingDelta: number\n  absoluteCountsPending: boolean\n}\n\nfunction buildJobPayload(job: ProgressJob): Record<string, unknown> {\n  return {\n    jobId: job.id,\n    jobType: job.jobType,\n    name: job.name,\n    description: job.description ?? null,\n    status: job.status,\n    progressPercent: job.progressPercent,\n    processedCount: job.processedCount,\n    totalCount: job.totalCount ?? null,\n    etaSeconds: job.etaSeconds ?? null,\n    cancellable: job.cancellable,\n    meta: job.meta ?? null,\n    startedAt: job.startedAt?.toISOString() ?? null,\n    finishedAt: job.finishedAt?.toISOString() ?? null,\n  }\n}\n\nexport function createProgressService(em: EntityManager, eventBus: { emit: (event: string, payload: Record<string, unknown>) => Promise<void> }): ProgressService {\n  const broadcastMinIntervalMs = resolveBroadcastMinIntervalMs()\n  // Per-job coalescing state, scoped to this service instance (request/worker scope).\n  // The cached entity is a DETACHED snapshot (loaded with disableIdentityMap) that doubles\n  // as the in-memory buffer: intermediate updates mutate it without touching the shared\n  // identity map or UnitOfWork, so an unrelated em.flush() elsewhere can never write the\n  // buffered values. Persistence happens exclusively through the CAS nativeUpdate below.\n  const jobUpdateThrottle = new Map<string, JobUpdateThrottleEntry>()\n\n  function jobScopeFilter(jobId: string, ctx: ProgressServiceContext) {\n    return {\n      id: jobId,\n      tenantId: ctx.tenantId,\n      ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),\n    }\n  }\n\n  async function loadFreshJob(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob | null> {\n    return em.findOne(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n  }\n\n  async function ensureThrottleEntry(jobId: string, ctx: ProgressServiceContext): Promise<JobUpdateThrottleEntry> {\n    const cached = jobUpdateThrottle.get(jobId)\n    if (cached) return cached\n    const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n    const entry: JobUpdateThrottleEntry = {\n      job,\n      lastBroadcastAt: 0,\n      lastPersistedAt: 0,\n      lastBroadcastPercent: job.progressPercent,\n      pendingDelta: 0,\n      absoluteCountsPending: false,\n    }\n    jobUpdateThrottle.set(jobId, entry)\n    return entry\n  }\n\n  function forgetJobThrottle(jobId: string) {\n    jobUpdateThrottle.delete(jobId)\n  }\n\n  function buildBufferedCountData(entry: JobUpdateThrottleEntry): EntityData<ProgressJob> {\n    if (entry.absoluteCountsPending || !Number.isSafeInteger(entry.pendingDelta)) {\n      return { processedCount: entry.job.processedCount }\n    }\n    if (entry.pendingDelta !== 0) {\n      const processedCount = raw(`processed_count + ${entry.pendingDelta}`)\n      const totalCount = entry.job.totalCount\n      if (Number.isSafeInteger(totalCount) && totalCount != null && totalCount > 0) {\n        return {\n          processedCount,\n          progressPercent: raw(\n            `least(100, round(((processed_count + ${entry.pendingDelta})::numeric / ${totalCount}) * 100))`,\n          ),\n        }\n      }\n      return { processedCount }\n    }\n    return {}\n  }\n\n  // The start transition (START_FROM_STATUSES) doubles as the recovery path for jobs a\n  // stale sweep flipped to `failed` while their producer was alive but slow. Callers pass\n  // the EM to run against so the forked heartbeat path can reuse the same CAS.\n  //\n  // `staleSweptOnly` is for the revive paths: a live write proves the producer is alive,\n  // but it does NOT prove the recorded failure was the sweep's. Narrowing the CAS to rows\n  // the sweep tagged keeps a genuine failure's message and stack intact instead of\n  // resurrecting the job and erasing why it died. `startJob` stays unrestricted so an\n  // at-least-once queue can still retry a genuinely failed job from the top.\n  async function startJobViaCas(\n    targetEm: EntityManager,\n    job: ProgressJob,\n    ctx: ProgressServiceContext,\n    options: { staleSweptOnly?: boolean } = {},\n  ): Promise<ProgressJob | null> {\n    const now = new Date()\n    // Progress counts are absolute and survive across deliveries, so the elapsed window\n    // calculateEta divides them by has to survive too. Resetting it on every revive makes\n    // a job with hours of work left report seconds remaining.\n    const startedAt = job.startedAt ?? now\n    const filter: Record<string, unknown> = {\n      ...jobScopeFilter(job.id, ctx),\n      status: { $in: START_FROM_STATUSES as ProgressJobStatus[] },\n    }\n    if (options.staleSweptOnly) filter.errorMessage = { $like: `${STALE_SWEEP_ERROR_PREFIX}%` }\n    const affected = await targetEm.nativeUpdate(ProgressJob, filter as FilterQuery<ProgressJob>, {\n      status: 'running',\n      startedAt,\n      heartbeatAt: now,\n      finishedAt: null,\n      errorMessage: null,\n      errorStack: null,\n      updatedAt: now,\n    })\n    if (affected === 0) return null\n\n    job.status = 'running'\n    job.startedAt = startedAt\n    job.heartbeatAt = now\n    job.finishedAt = null\n    job.errorMessage = null\n    job.errorStack = null\n\n    await eventBus.emit(PROGRESS_EVENTS.JOB_STARTED, {\n      ...buildJobPayload(job),\n      tenantId: ctx.tenantId,\n      organizationId: job.organizationId ?? null,\n    })\n\n    return job\n  }\n\n  async function persistAndMaybeBroadcast(entry: JobUpdateThrottleEntry, ctx: ProgressServiceContext): Promise<ProgressJob> {\n    const job = entry.job\n    const now = Date.now()\n    const shouldBroadcast =\n      broadcastMinIntervalMs <= 0 ||\n      now - entry.lastBroadcastAt >= broadcastMinIntervalMs ||\n      Math.abs(job.progressPercent - entry.lastBroadcastPercent) >= 1\n    const shouldPersist = shouldBroadcast || now - entry.lastPersistedAt >= HEARTBEAT_INTERVAL_MS\n\n    if (!shouldPersist) return job\n\n    const usesAtomicIncrement =\n      !entry.absoluteCountsPending && Number.isSafeInteger(entry.pendingDelta) && entry.pendingDelta !== 0\n    const data: EntityData<ProgressJob> = {\n      progressPercent: job.progressPercent,\n      totalCount: job.totalCount ?? null,\n      etaSeconds: job.etaSeconds ?? null,\n      meta: job.meta ?? null,\n      heartbeatAt: job.heartbeatAt ?? new Date(),\n      updatedAt: new Date(),\n      ...buildBufferedCountData(entry),\n    }\n    const writableFilter = {\n      ...jobScopeFilter(job.id, ctx),\n      status: { $in: PROGRESS_WRITABLE_STATUSES as ProgressJobStatus[] },\n    } as FilterQuery<ProgressJob>\n    let affected = await em.nativeUpdate(ProgressJob, writableFilter, data)\n\n    if (affected === 0) {\n      // A stale sweep may have flipped a live job to `failed` between writes. Revive it\n      // through the start CAS and retry once so the buffered delta isn't silently dropped.\n      const fresh = await loadFreshJob(job.id, ctx)\n      let revived = false\n      if (fresh && fresh.status === 'failed' && (await startJobViaCas(em, fresh, ctx, { staleSweptOnly: true }))) {\n        revived = true\n        job.status = 'running'\n        job.startedAt = fresh.startedAt\n        job.finishedAt = null\n        job.errorMessage = null\n        job.errorStack = null\n        affected = await em.nativeUpdate(ProgressJob, writableFilter, data)\n      }\n      if (affected === 0) {\n        // The job reached a genuinely terminal state in another process; stop writing to it.\n        forgetJobThrottle(job.id)\n        const latest = revived ? await loadFreshJob(job.id, ctx) : fresh\n        return latest ?? job\n      }\n    }\n\n    const persistedJob = usesAtomicIncrement ? (await loadFreshJob(job.id, ctx)) ?? job : job\n    entry.job = persistedJob\n    entry.pendingDelta = 0\n    entry.absoluteCountsPending = false\n    entry.lastPersistedAt = now\n\n    if (shouldBroadcast) {\n      await eventBus.emit(PROGRESS_EVENTS.JOB_UPDATED, {\n        ...buildJobPayload(persistedJob),\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n      entry.lastBroadcastAt = now\n      entry.lastBroadcastPercent = persistedJob.progressPercent\n    }\n\n    return persistedJob\n  }\n\n  return {\n    async createJob(input, ctx) {\n      const job = em.create(ProgressJob, {\n        jobType: input.jobType,\n        name: input.name,\n        description: input.description,\n        totalCount: input.totalCount,\n        cancellable: input.cancellable ?? false,\n        meta: input.meta,\n        parentJobId: input.parentJobId,\n        partitionIndex: input.partitionIndex,\n        partitionCount: input.partitionCount,\n        startedByUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        status: 'pending',\n      })\n\n      await em.persist(job).flush()\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_CREATED, {\n        ...buildJobPayload(job),\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n      })\n\n      return job\n    },\n\n    async startJob(jobId, ctx) {\n      const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n      if (job.status === 'running' || job.status === 'cancelled' || job.status === 'completed') {\n        return job\n      }\n\n      const started = await startJobViaCas(em, job, ctx)\n      if (started) return started\n\n      const fresh = await loadFreshJob(jobId, ctx)\n      return fresh ?? job\n    },\n\n    async touchJobHeartbeat(jobId, ctx) {\n      // Forked EM: keepalive timers call this while the shared EM may be mid-transaction\n      // inside a producer's own writes, so the heartbeat must not join that unit of work.\n      const fork = em.fork()\n      const now = new Date()\n      const affected = await fork.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: PROGRESS_WRITABLE_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, {\n        heartbeatAt: now,\n        updatedAt: now,\n      })\n      if (affected > 0) return\n\n      const job = await fork.findOne(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n      if (!job || job.status !== 'failed') return\n      // A live producer heartbeating a `failed` job means a stale sweep false-positived;\n      // revive through the start CAS so the card recovers without waiting for a batch boundary.\n      await startJobViaCas(fork, job, ctx, { staleSweptOnly: true })\n    },\n\n    async updateProgress(jobId, input, ctx) {\n      const entry = await ensureThrottleEntry(jobId, ctx)\n      const job = entry.job\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        // `failed` may be a false-positive stale sweep on a slow-but-alive producer; the\n        // fact that this write is happening proves the producer is alive, so revive and\n        // apply the update. `completed`/`cancelled` stay terminal, and a failure the sweep\n        // did not write keeps its diagnostics (see startJobViaCas).\n        const revived = job.status === 'failed' && (await startJobViaCas(em, job, ctx, { staleSweptOnly: true }))\n        if (!revived) {\n          forgetJobThrottle(jobId)\n          return job\n        }\n        entry.lastPersistedAt = 0\n      }\n\n      if (input.processedCount !== undefined) {\n        job.processedCount = input.processedCount\n        entry.absoluteCountsPending = true\n        entry.pendingDelta = 0\n      }\n      if (input.totalCount !== undefined) {\n        job.totalCount = input.totalCount\n      }\n      if (input.meta !== undefined) {\n        job.meta = { ...job.meta, ...input.meta }\n      }\n\n      if (input.progressPercent !== undefined) {\n        job.progressPercent = input.progressPercent\n      } else if (job.totalCount) {\n        job.progressPercent = calculateProgressPercent(job.processedCount, job.totalCount)\n      }\n\n      if (input.etaSeconds !== undefined) {\n        job.etaSeconds = input.etaSeconds\n      } else if (job.startedAt && job.totalCount) {\n        job.etaSeconds = calculateEta(job.processedCount, job.totalCount, job.startedAt)\n      }\n\n      job.heartbeatAt = new Date()\n\n      return persistAndMaybeBroadcast(entry, ctx)\n    },\n\n    async incrementProgress(jobId, delta, ctx) {\n      const entry = await ensureThrottleEntry(jobId, ctx)\n      let job = entry.job\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        let writable = false\n        if (job.status === 'failed') {\n          writable = (await startJobViaCas(em, job, ctx, { staleSweptOnly: true })) != null\n          if (!writable) {\n            // The cached snapshot's status lags the row whenever another writer \u2014 typically\n            // the forked heartbeat in touchJobHeartbeat \u2014 already revived this job: the start\n            // CAS then misses because the row is `running`, not `failed`. Increments are\n            // relative, so returning here would lose the caller's delta for good (unlike\n            // updateProgress, whose next absolute write self-corrects). Unlike\n            // persistAndMaybeBroadcast, the re-read happens after the CAS rather than before\n            // it: startJobViaCas filters on database state, so retrying it against the fresh\n            // row could not change whether it matches.\n            const fresh = await loadFreshJob(jobId, ctx)\n            if (fresh) {\n              job = fresh\n              writable = PROGRESS_WRITABLE_STATUSES.includes(fresh.status)\n              // Adopting the fresh row cannot desync entry.pendingDelta, which is provably 0\n              // here: this guard is only reachable on a cached terminal status, and the only\n              // writers that cache one \u2014 ensureThrottleEntry's initial load and\n              // persistAndMaybeBroadcast's post-persist assignment \u2014 both leave the buffer empty.\n              if (writable) entry.job = fresh\n            }\n          }\n        }\n        if (!writable) {\n          forgetJobThrottle(jobId)\n          return job\n        }\n        entry.lastPersistedAt = 0\n      }\n\n      job.processedCount += delta\n      entry.pendingDelta += delta\n      job.heartbeatAt = new Date()\n\n      if (job.totalCount) {\n        job.progressPercent = calculateProgressPercent(job.processedCount, job.totalCount)\n        if (job.startedAt) {\n          job.etaSeconds = calculateEta(job.processedCount, job.totalCount, job.startedAt)\n        }\n      }\n\n      return persistAndMaybeBroadcast(entry, ctx)\n    },\n\n    async completeJob(jobId, input, ctx) {\n      const job = await loadFreshJob(jobId, ctx)\n      if (!job) throw new Error(`Job ${jobId} not found`)\n      if (job.status === 'cancelled' || job.status === 'completed') {\n        forgetJobThrottle(jobId)\n        return job\n      }\n\n      const entry = jobUpdateThrottle.get(jobId)\n      const snapshot = entry?.job ?? job\n      const now = new Date()\n      const data: EntityData<ProgressJob> = {\n        status: 'completed',\n        finishedAt: now,\n        etaSeconds: 0,\n        updatedAt: now,\n        ...(input?.resultSummary ? { resultSummary: input.resultSummary } : {}),\n        ...(entry\n          ? {\n              totalCount: snapshot.totalCount ?? null,\n              meta: snapshot.meta ?? null,\n              ...buildBufferedCountData(entry),\n            }\n          : {}),\n        progressPercent: 100,\n      }\n\n      const affected = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: COMPLETE_FROM_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, data)\n      forgetJobThrottle(jobId)\n\n      if (affected === 0) {\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      snapshot.status = 'completed'\n      snapshot.finishedAt = now\n      snapshot.progressPercent = 100\n      snapshot.etaSeconds = 0\n      if (input?.resultSummary) {\n        snapshot.resultSummary = input.resultSummary\n      }\n\n      const persistedJob = (await loadFreshJob(jobId, ctx)) ?? snapshot\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_COMPLETED, {\n        ...buildJobPayload(persistedJob),\n        resultSummary: persistedJob.resultSummary,\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n\n      return persistedJob\n    },\n\n    async failJob(jobId, input, ctx) {\n      const job = await loadFreshJob(jobId, ctx)\n      if (!job) throw new Error(`Job ${jobId} not found`)\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        forgetJobThrottle(jobId)\n        return job\n      }\n\n      const entry = jobUpdateThrottle.get(jobId)\n      const snapshot = entry?.job ?? job\n      const now = new Date()\n      const data: EntityData<ProgressJob> = {\n        status: 'failed',\n        finishedAt: now,\n        errorMessage: input.errorMessage,\n        errorStack: input.errorStack,\n        ...(input.resultSummary ? { resultSummary: input.resultSummary } : {}),\n        updatedAt: now,\n        ...(entry\n          ? {\n              totalCount: snapshot.totalCount ?? null,\n              meta: snapshot.meta ?? null,\n              ...buildBufferedCountData(entry),\n            }\n          : {}),\n      }\n\n      const affected = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: FAIL_FROM_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, data)\n      forgetJobThrottle(jobId)\n\n      if (affected === 0) {\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      snapshot.status = 'failed'\n      snapshot.finishedAt = now\n      snapshot.errorMessage = input.errorMessage\n      snapshot.errorStack = input.errorStack\n      if (input.resultSummary) {\n        snapshot.resultSummary = input.resultSummary\n      }\n\n      const persistedJob = (await loadFreshJob(jobId, ctx)) ?? snapshot\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_FAILED, {\n        ...buildJobPayload(persistedJob),\n        errorMessage: persistedJob.errorMessage,\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n\n      return persistedJob\n    },\n\n    async cancelJob(jobId, ctx) {\n      const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        // The job finished while the user clicked cancel \u2014 a benign race, not an error.\n        return job\n      }\n      if (!job.cancellable) {\n        throw new Error(`Job ${jobId} is not cancellable`)\n      }\n\n      const now = new Date()\n      const cancelledNow = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        cancellable: true,\n        status: 'pending',\n      } as FilterQuery<ProgressJob>, {\n        status: 'cancelled',\n        cancelRequestedAt: now,\n        cancelledByUserId: ctx.userId ?? null,\n        finishedAt: now,\n        etaSeconds: 0,\n        updatedAt: now,\n      })\n\n      let requested = 0\n      if (cancelledNow === 0) {\n        requested = await em.nativeUpdate(ProgressJob, {\n          ...jobScopeFilter(jobId, ctx),\n          cancellable: true,\n          status: 'running',\n        } as FilterQuery<ProgressJob>, {\n          cancelRequestedAt: now,\n          cancelledByUserId: ctx.userId ?? null,\n          updatedAt: now,\n        })\n      }\n\n      if (cancelledNow === 0 && requested === 0) {\n        // Raced into a terminal state between the read and the CAS.\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      forgetJobThrottle(jobId)\n      if (cancelledNow > 0) {\n        job.status = 'cancelled'\n        job.finishedAt = now\n        job.etaSeconds = 0\n      }\n      job.cancelRequestedAt = now\n      job.cancelledByUserId = ctx.userId ?? null\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_CANCELLED, {\n        ...buildJobPayload(job),\n        tenantId: ctx.tenantId,\n        organizationId: job.organizationId ?? null,\n      })\n\n      return job\n    },\n\n    async markCancelled(jobId, ctx) {\n      const job = await loadFreshJob(jobId, ctx)\n      if (!job) throw new Error(`Job ${jobId} not found`)\n      if (job.status === 'cancelled' || job.status === 'completed') {\n        forgetJobThrottle(jobId)\n        return job\n      }\n\n      const now = new Date()\n      const cancelRequestedAt = job.cancelRequestedAt ?? now\n      const cancelledByUserId = job.cancelledByUserId ?? ctx.userId ?? null\n      const finishedAt = job.finishedAt ?? now\n\n      const affected = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: CANCEL_FROM_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, {\n        status: 'cancelled',\n        cancelRequestedAt,\n        cancelledByUserId,\n        finishedAt,\n        etaSeconds: 0,\n        updatedAt: now,\n      })\n      forgetJobThrottle(jobId)\n\n      if (affected === 0) {\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      job.status = 'cancelled'\n      job.cancelRequestedAt = cancelRequestedAt\n      job.cancelledByUserId = cancelledByUserId\n      job.finishedAt = finishedAt\n      job.etaSeconds = 0\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_CANCELLED, {\n        ...buildJobPayload(job),\n        tenantId: ctx.tenantId,\n        organizationId: job.organizationId ?? null,\n      })\n\n      return job\n    },\n\n    async isCancellationRequested(jobId, tenantId, organizationId) {\n      // Forked EM, for the same reason touchJobHeartbeat forks: this is polled from the\n      // keepalive timer, which spans the producer's own transactional writes on the shared\n      // EM, so an unawaited poll would issue a SELECT into an open em.begin()/em.commit()\n      // window and interleave with its UnitOfWork. Every caller only reads the flag, so a\n      // fork costs nothing and no caller depends on joining an ambient transaction.\n      //\n      // disableIdentityMap forces a fresh read: a managed copy of the job in this\n      // EntityManager (loaded by updateProgress) must never mask a cancellation\n      // requested from another process.\n      const job = await findOneWithDecryption(em.fork(), ProgressJob, {\n        id: jobId,\n        tenantId,\n        ...(organizationId ? { organizationId } : {}),\n      }, { disableIdentityMap: true })\n      return job?.cancelRequestedAt != null\n    },\n\n    async getActiveJobs(ctx) {\n      return em.find(ProgressJob, {\n        tenantId: ctx.tenantId,\n        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),\n        status: { $in: ['pending', 'running'] },\n        parentJobId: null,\n      }, {\n        orderBy: { createdAt: 'DESC' },\n        limit: 50,\n      })\n    },\n\n    async getRecentlyCompletedJobs(ctx, sinceSeconds = 30) {\n      const cutoff = new Date(Date.now() - sinceSeconds * 1000)\n      return em.find(ProgressJob, {\n        tenantId: ctx.tenantId,\n        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),\n        status: { $in: ['completed', 'failed'] },\n        finishedAt: { $gte: cutoff },\n        parentJobId: null,\n      }, {\n        orderBy: { finishedAt: 'DESC' },\n        limit: 10,\n      })\n    },\n\n    async getJob(jobId, ctx) {\n      return em.findOne(ProgressJob, {\n        id: jobId,\n        tenantId: ctx.tenantId,\n        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),\n      })\n    },\n\n    async markStaleJobsFailed(tenantId: string, timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS, organizationId?: string | null) {\n      const now = new Date()\n      const cutoff = new Date(now.getTime() - timeoutSeconds * 1000)\n      const scope = {\n        tenantId,\n        ...(organizationId ? { organizationId } : {}),\n      }\n      let failedCount = 0\n\n      const staleFilter = {\n        status: 'running' as ProgressJobStatus,\n        $or: [\n          { heartbeatAt: { $lt: cutoff } },\n          {\n            heartbeatAt: null,\n            startedAt: { $lt: cutoff },\n          },\n        ],\n      }\n      const staleRunning = await em.find(ProgressJob, { ...scope, ...staleFilter }, { disableIdentityMap: true })\n\n      for (const job of staleRunning) {\n        const errorMessage = `${STALE_SWEEP_ERROR_PREFIX} no heartbeat for ${timeoutSeconds} seconds`\n        // Per-row CAS (re-checking the staleness condition): exactly one concurrent\n        // sweeper wins, and a heartbeat that landed after the SELECT aborts the failure.\n        const affected = await em.nativeUpdate(ProgressJob, {\n          id: job.id,\n          tenantId: job.tenantId,\n          ...staleFilter,\n        } as FilterQuery<ProgressJob>, {\n          status: 'failed',\n          finishedAt: now,\n          errorMessage,\n          updatedAt: now,\n        })\n        if (affected === 0) continue\n\n        failedCount += 1\n        job.status = 'failed'\n        job.finishedAt = now\n        job.errorMessage = errorMessage\n\n        await eventBus.emit(PROGRESS_EVENTS.JOB_FAILED, {\n          ...buildJobPayload(job),\n          errorMessage: job.errorMessage,\n          tenantId: job.tenantId,\n          stale: true,\n          organizationId: job.organizationId ?? null,\n        })\n      }\n\n      // Jobs stuck in `pending` (enqueue failed, worker died before startJob) have no\n      // heartbeat, so they need their own sweep or they stay in the active list forever.\n      // A late queue delivery still recovers such a job: startJob transitions failed \u2192 running.\n      const pendingCutoff = new Date(now.getTime() - STALE_PENDING_TIMEOUT_SECONDS * 1000)\n      const stalePendingFilter = {\n        status: 'pending' as ProgressJobStatus,\n        createdAt: { $lt: pendingCutoff },\n      }\n      const stalePending = await em.find(ProgressJob, { ...scope, ...stalePendingFilter }, { disableIdentityMap: true })\n\n      for (const job of stalePending) {\n        const errorMessage = `${STALE_SWEEP_ERROR_PREFIX} never started within ${STALE_PENDING_TIMEOUT_SECONDS} seconds`\n        const affected = await em.nativeUpdate(ProgressJob, {\n          id: job.id,\n          tenantId: job.tenantId,\n          ...stalePendingFilter,\n        } as FilterQuery<ProgressJob>, {\n          status: 'failed',\n          finishedAt: now,\n          errorMessage,\n          updatedAt: now,\n        })\n        if (affected === 0) continue\n\n        failedCount += 1\n        job.status = 'failed'\n        job.finishedAt = now\n        job.errorMessage = errorMessage\n\n        await eventBus.emit(PROGRESS_EVENTS.JOB_FAILED, {\n          ...buildJobPayload(job),\n          errorMessage: job.errorMessage,\n          tenantId: job.tenantId,\n          stale: true,\n          organizationId: job.organizationId ?? null,\n        })\n      }\n\n      return failedCount\n    },\n  }\n}\n"],
-  "mappings": "AACA,SAAS,WAAW;AAEpB,SAAS,mBAA2C;AAEpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AAEtC,MAAM,oCAAoC;AAS1C,SAAS,gCAAwC;AAC/C,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,YAAY,QAAQ,SAAS,KAAK,MAAM,GAAI,QAAO;AACvD,QAAM,SAAS,OAAO,SAAS,UAAU,EAAE;AAC3C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;AAMA,MAAM,oBAAkD,CAAC,aAAa,UAAU,WAAW;AAC3F,MAAM,6BAA2D,CAAC,WAAW,SAAS;AAGtF,MAAM,sBAAoD,CAAC,WAAW,QAAQ;AAC9E,MAAM,yBAAuD,CAAC,WAAW,WAAW,QAAQ;AAC5F,MAAM,qBAAmD,CAAC,WAAW,SAAS;AAC9E,MAAM,uBAAqD,CAAC,WAAW,WAAW,QAAQ;AAW1F,SAAS,gBAAgB,KAA2C;AAClE,SAAO;AAAA,IACL,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,MAAM,IAAI;AAAA,IACV,aAAa,IAAI,eAAe;AAAA,IAChC,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI,cAAc;AAAA,IAC9B,YAAY,IAAI,cAAc;AAAA,IAC9B,aAAa,IAAI;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,WAAW,IAAI,WAAW,YAAY,KAAK;AAAA,IAC3C,YAAY,IAAI,YAAY,YAAY,KAAK;AAAA,EAC/C;AACF;AAEO,SAAS,sBAAsB,IAAmB,UAAyG;AAChK,QAAM,yBAAyB,8BAA8B;AAM7D,QAAM,oBAAoB,oBAAI,IAAoC;AAElE,WAAS,eAAe,OAAe,KAA6B;AAClE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,IAAI;AAAA,MACd,GAAI,IAAI,iBAAiB,EAAE,gBAAgB,IAAI,eAAe,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AAEA,iBAAe,aAAa,OAAe,KAA0D;AACnG,WAAO,GAAG,QAAQ,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAAA,EACzF;AAEA,iBAAe,oBAAoB,OAAe,KAA8D;AAC9G,UAAM,SAAS,kBAAkB,IAAI,KAAK;AAC1C,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,GAAG,cAAc,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACxG,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,MACjB,sBAAsB,IAAI;AAAA,MAC1B,cAAc;AAAA,MACd,uBAAuB;AAAA,IACzB;AACA,sBAAkB,IAAI,OAAO,KAAK;AAClC,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,OAAe;AACxC,sBAAkB,OAAO,KAAK;AAAA,EAChC;AAEA,WAAS,uBAAuB,OAAwD;AACtF,QAAI,MAAM,yBAAyB,CAAC,OAAO,cAAc,MAAM,YAAY,GAAG;AAC5E,aAAO,EAAE,gBAAgB,MAAM,IAAI,eAAe;AAAA,IACpD;AACA,QAAI,MAAM,iBAAiB,GAAG;AAC5B,YAAM,iBAAiB,IAAI,qBAAqB,MAAM,YAAY,EAAE;AACpE,YAAM,aAAa,MAAM,IAAI;AAC7B,UAAI,OAAO,cAAc,UAAU,KAAK,cAAc,QAAQ,aAAa,GAAG;AAC5E,eAAO;AAAA,UACL;AAAA,UACA,iBAAiB;AAAA,YACf,wCAAwC,MAAM,YAAY,gBAAgB,UAAU;AAAA,UACtF;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,eAAe;AAAA,IAC1B;AACA,WAAO,CAAC;AAAA,EACV;AAWA,iBAAe,eACb,UACA,KACA,KACA,UAAwC,CAAC,GACZ;AAC7B,UAAM,MAAM,oBAAI,KAAK;AAIrB,UAAM,YAAY,IAAI,aAAa;AACnC,UAAM,SAAkC;AAAA,MACtC,GAAG,eAAe,IAAI,IAAI,GAAG;AAAA,MAC7B,QAAQ,EAAE,KAAK,oBAA2C;AAAA,IAC5D;AACA,QAAI,QAAQ,eAAgB,QAAO,eAAe,EAAE,OAAO,GAAG,wBAAwB,IAAI;AAC1F,UAAM,WAAW,MAAM,SAAS,aAAa,aAAa,QAAoC;AAAA,MAC5F,QAAQ;AAAA,MACR;AAAA,MACA,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,aAAa,EAAG,QAAO;AAE3B,QAAI,SAAS;AACb,QAAI,YAAY;AAChB,QAAI,cAAc;AAClB,QAAI,aAAa;AACjB,QAAI,eAAe;AACnB,QAAI,aAAa;AAEjB,UAAM,SAAS,KAAK,gBAAgB,aAAa;AAAA,MAC/C,GAAG,gBAAgB,GAAG;AAAA,MACtB,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI,kBAAkB;AAAA,IACxC,CAAC;AAED,WAAO;AAAA,EACT;AAEA,iBAAe,yBAAyB,OAA+B,KAAmD;AACxH,UAAM,MAAM,MAAM;AAClB,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,kBACJ,0BAA0B,KAC1B,MAAM,MAAM,mBAAmB,0BAC/B,KAAK,IAAI,IAAI,kBAAkB,MAAM,oBAAoB,KAAK;AAChE,UAAM,gBAAgB,mBAAmB,MAAM,MAAM,mBAAmB;AAExE,QAAI,CAAC,cAAe,QAAO;AAE3B,UAAM,sBACJ,CAAC,MAAM,yBAAyB,OAAO,cAAc,MAAM,YAAY,KAAK,MAAM,iBAAiB;AACrG,UAAM,OAAgC;AAAA,MACpC,iBAAiB,IAAI;AAAA,MACrB,YAAY,IAAI,cAAc;AAAA,MAC9B,YAAY,IAAI,cAAc;AAAA,MAC9B,MAAM,IAAI,QAAQ;AAAA,MAClB,aAAa,IAAI,eAAe,oBAAI,KAAK;AAAA,MACzC,WAAW,oBAAI,KAAK;AAAA,MACpB,GAAG,uBAAuB,KAAK;AAAA,IACjC;AACA,UAAM,iBAAiB;AAAA,MACrB,GAAG,eAAe,IAAI,IAAI,GAAG;AAAA,MAC7B,QAAQ,EAAE,KAAK,2BAAkD;AAAA,IACnE;AACA,QAAI,WAAW,MAAM,GAAG,aAAa,aAAa,gBAAgB,IAAI;AAEtE,QAAI,aAAa,GAAG;AAGlB,YAAM,QAAQ,MAAM,aAAa,IAAI,IAAI,GAAG;AAC5C,UAAI,UAAU;AACd,UAAI,SAAS,MAAM,WAAW,YAAa,MAAM,eAAe,IAAI,OAAO,KAAK,EAAE,gBAAgB,KAAK,CAAC,GAAI;AAC1G,kBAAU;AACV,YAAI,SAAS;AACb,YAAI,YAAY,MAAM;AACtB,YAAI,aAAa;AACjB,YAAI,eAAe;AACnB,YAAI,aAAa;AACjB,mBAAW,MAAM,GAAG,aAAa,aAAa,gBAAgB,IAAI;AAAA,MACpE;AACA,UAAI,aAAa,GAAG;AAElB,0BAAkB,IAAI,EAAE;AACxB,cAAM,SAAS,UAAU,MAAM,aAAa,IAAI,IAAI,GAAG,IAAI;AAC3D,eAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,eAAe,sBAAuB,MAAM,aAAa,IAAI,IAAI,GAAG,KAAM,MAAM;AACtF,UAAM,MAAM;AACZ,UAAM,eAAe;AACrB,UAAM,wBAAwB;AAC9B,UAAM,kBAAkB;AAExB,QAAI,iBAAiB;AACnB,YAAM,SAAS,KAAK,gBAAgB,aAAa;AAAA,QAC/C,GAAG,gBAAgB,YAAY;AAAA,QAC/B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AACD,YAAM,kBAAkB;AACxB,YAAM,uBAAuB,aAAa;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,OAAO,KAAK;AAC1B,YAAM,MAAM,GAAG,OAAO,aAAa;AAAA,QACjC,SAAS,MAAM;AAAA,QACf,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,YAAY,MAAM;AAAA,QAClB,aAAa,MAAM,eAAe;AAAA,QAClC,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,gBAAgB,MAAM;AAAA,QACtB,gBAAgB,MAAM;AAAA,QACtB,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ;AAAA,MACV,CAAC;AAED,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAE5B,YAAM,SAAS,KAAK,gBAAgB,aAAa;AAAA,QAC/C,GAAG,gBAAgB,GAAG;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS,OAAO,KAAK;AACzB,YAAM,MAAM,MAAM,GAAG,cAAc,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACxG,UAAI,IAAI,WAAW,aAAa,IAAI,WAAW,eAAe,IAAI,WAAW,aAAa;AACxF,eAAO;AAAA,MACT;AAEA,YAAM,UAAU,MAAM,eAAe,IAAI,KAAK,GAAG;AACjD,UAAI,QAAS,QAAO;AAEpB,YAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,kBAAkB,OAAO,KAAK;AAGlC,YAAM,OAAO,GAAG,KAAK;AACrB,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,WAAW,MAAM,KAAK,aAAa,aAAa;AAAA,QACpD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,2BAAkD;AAAA,MACnE,GAA+B;AAAA,QAC7B,aAAa;AAAA,QACb,WAAW;AAAA,MACb,CAAC;AACD,UAAI,WAAW,EAAG;AAElB,YAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACpG,UAAI,CAAC,OAAO,IAAI,WAAW,SAAU;AAGrC,YAAM,eAAe,MAAM,KAAK,KAAK,EAAE,gBAAgB,KAAK,CAAC;AAAA,IAC/D;AAAA,IAEA,MAAM,eAAe,OAAO,OAAO,KAAK;AACtC,YAAM,QAAQ,MAAM,oBAAoB,OAAO,GAAG;AAClD,YAAM,MAAM,MAAM;AAClB,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAK1C,cAAM,UAAU,IAAI,WAAW,YAAa,MAAM,eAAe,IAAI,KAAK,KAAK,EAAE,gBAAgB,KAAK,CAAC;AACvG,YAAI,CAAC,SAAS;AACZ,4BAAkB,KAAK;AACvB,iBAAO;AAAA,QACT;AACA,cAAM,kBAAkB;AAAA,MAC1B;AAEA,UAAI,MAAM,mBAAmB,QAAW;AACtC,YAAI,iBAAiB,MAAM;AAC3B,cAAM,wBAAwB;AAC9B,cAAM,eAAe;AAAA,MACvB;AACA,UAAI,MAAM,eAAe,QAAW;AAClC,YAAI,aAAa,MAAM;AAAA,MACzB;AACA,UAAI,MAAM,SAAS,QAAW;AAC5B,YAAI,OAAO,EAAE,GAAG,IAAI,MAAM,GAAG,MAAM,KAAK;AAAA,MAC1C;AAEA,UAAI,MAAM,oBAAoB,QAAW;AACvC,YAAI,kBAAkB,MAAM;AAAA,MAC9B,WAAW,IAAI,YAAY;AACzB,YAAI,kBAAkB,yBAAyB,IAAI,gBAAgB,IAAI,UAAU;AAAA,MACnF;AAEA,UAAI,MAAM,eAAe,QAAW;AAClC,YAAI,aAAa,MAAM;AAAA,MACzB,WAAW,IAAI,aAAa,IAAI,YAAY;AAC1C,YAAI,aAAa,aAAa,IAAI,gBAAgB,IAAI,YAAY,IAAI,SAAS;AAAA,MACjF;AAEA,UAAI,cAAc,oBAAI,KAAK;AAE3B,aAAO,yBAAyB,OAAO,GAAG;AAAA,IAC5C;AAAA,IAEA,MAAM,kBAAkB,OAAO,OAAO,KAAK;AACzC,YAAM,QAAQ,MAAM,oBAAoB,OAAO,GAAG;AAClD,UAAI,MAAM,MAAM;AAChB,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAC1C,YAAI,WAAW;AACf,YAAI,IAAI,WAAW,UAAU;AAC3B,qBAAY,MAAM,eAAe,IAAI,KAAK,KAAK,EAAE,gBAAgB,KAAK,CAAC,KAAM;AAC7E,cAAI,CAAC,UAAU;AASb,kBAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,gBAAI,OAAO;AACT,oBAAM;AACN,yBAAW,2BAA2B,SAAS,MAAM,MAAM;AAK3D,kBAAI,SAAU,OAAM,MAAM;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,UAAU;AACb,4BAAkB,KAAK;AACvB,iBAAO;AAAA,QACT;AACA,cAAM,kBAAkB;AAAA,MAC1B;AAEA,UAAI,kBAAkB;AACtB,YAAM,gBAAgB;AACtB,UAAI,cAAc,oBAAI,KAAK;AAE3B,UAAI,IAAI,YAAY;AAClB,YAAI,kBAAkB,yBAAyB,IAAI,gBAAgB,IAAI,UAAU;AACjF,YAAI,IAAI,WAAW;AACjB,cAAI,aAAa,aAAa,IAAI,gBAAgB,IAAI,YAAY,IAAI,SAAS;AAAA,QACjF;AAAA,MACF;AAEA,aAAO,yBAAyB,OAAO,GAAG;AAAA,IAC5C;AAAA,IAEA,MAAM,YAAY,OAAO,OAAO,KAAK;AACnC,YAAM,MAAM,MAAM,aAAa,OAAO,GAAG;AACzC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,OAAO,KAAK,YAAY;AAClD,UAAI,IAAI,WAAW,eAAe,IAAI,WAAW,aAAa;AAC5D,0BAAkB,KAAK;AACvB,eAAO;AAAA,MACT;AAEA,YAAM,QAAQ,kBAAkB,IAAI,KAAK;AACzC,YAAM,WAAW,OAAO,OAAO;AAC/B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,OAAgC;AAAA,QACpC,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,GAAI,OAAO,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,QACrE,GAAI,QACA;AAAA,UACE,YAAY,SAAS,cAAc;AAAA,UACnC,MAAM,SAAS,QAAQ;AAAA,UACvB,GAAG,uBAAuB,KAAK;AAAA,QACjC,IACA,CAAC;AAAA,QACL,iBAAiB;AAAA,MACnB;AAEA,YAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,QAClD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,uBAA8C;AAAA,MAC/D,GAA+B,IAAI;AACnC,wBAAkB,KAAK;AAEvB,UAAI,aAAa,GAAG;AAClB,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,eAAS,SAAS;AAClB,eAAS,aAAa;AACtB,eAAS,kBAAkB;AAC3B,eAAS,aAAa;AACtB,UAAI,OAAO,eAAe;AACxB,iBAAS,gBAAgB,MAAM;AAAA,MACjC;AAEA,YAAM,eAAgB,MAAM,aAAa,OAAO,GAAG,KAAM;AAEzD,YAAM,SAAS,KAAK,gBAAgB,eAAe;AAAA,QACjD,GAAG,gBAAgB,YAAY;AAAA,QAC/B,eAAe,aAAa;AAAA,QAC5B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,KAAK;AAC/B,YAAM,MAAM,MAAM,aAAa,OAAO,GAAG;AACzC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,OAAO,KAAK,YAAY;AAClD,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAC1C,0BAAkB,KAAK;AACvB,eAAO;AAAA,MACT;AAEA,YAAM,QAAQ,kBAAkB,IAAI,KAAK;AACzC,YAAM,WAAW,OAAO,OAAO;AAC/B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,OAAgC;AAAA,QACpC,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,cAAc,MAAM;AAAA,QACpB,YAAY,MAAM;AAAA,QAClB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,QACpE,WAAW;AAAA,QACX,GAAI,QACA;AAAA,UACE,YAAY,SAAS,cAAc;AAAA,UACnC,MAAM,SAAS,QAAQ;AAAA,UACvB,GAAG,uBAAuB,KAAK;AAAA,QACjC,IACA,CAAC;AAAA,MACP;AAEA,YAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,QAClD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,mBAA0C;AAAA,MAC3D,GAA+B,IAAI;AACnC,wBAAkB,KAAK;AAEvB,UAAI,aAAa,GAAG;AAClB,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,eAAS,SAAS;AAClB,eAAS,aAAa;AACtB,eAAS,eAAe,MAAM;AAC9B,eAAS,aAAa,MAAM;AAC5B,UAAI,MAAM,eAAe;AACvB,iBAAS,gBAAgB,MAAM;AAAA,MACjC;AAEA,YAAM,eAAgB,MAAM,aAAa,OAAO,GAAG,KAAM;AAEzD,YAAM,SAAS,KAAK,gBAAgB,YAAY;AAAA,QAC9C,GAAG,gBAAgB,YAAY;AAAA,QAC/B,cAAc,aAAa;AAAA,QAC3B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,OAAO,KAAK;AAC1B,YAAM,MAAM,MAAM,GAAG,cAAc,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACxG,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAE1C,eAAO;AAAA,MACT;AACA,UAAI,CAAC,IAAI,aAAa;AACpB,cAAM,IAAI,MAAM,OAAO,KAAK,qBAAqB;AAAA,MACnD;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,eAAe,MAAM,GAAG,aAAa,aAAa;AAAA,QACtD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,aAAa;AAAA,QACb,QAAQ;AAAA,MACV,GAA+B;AAAA,QAC7B,QAAQ;AAAA,QACR,mBAAmB;AAAA,QACnB,mBAAmB,IAAI,UAAU;AAAA,QACjC,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,WAAW;AAAA,MACb,CAAC;AAED,UAAI,YAAY;AAChB,UAAI,iBAAiB,GAAG;AACtB,oBAAY,MAAM,GAAG,aAAa,aAAa;AAAA,UAC7C,GAAG,eAAe,OAAO,GAAG;AAAA,UAC5B,aAAa;AAAA,UACb,QAAQ;AAAA,QACV,GAA+B;AAAA,UAC7B,mBAAmB;AAAA,UACnB,mBAAmB,IAAI,UAAU;AAAA,UACjC,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,UAAI,iBAAiB,KAAK,cAAc,GAAG;AAEzC,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,wBAAkB,KAAK;AACvB,UAAI,eAAe,GAAG;AACpB,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,aAAa;AAAA,MACnB;AACA,UAAI,oBAAoB;AACxB,UAAI,oBAAoB,IAAI,UAAU;AAEtC,YAAM,SAAS,KAAK,gBAAgB,eAAe;AAAA,QACjD,GAAG,gBAAgB,GAAG;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI,kBAAkB;AAAA,MACxC,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,OAAO,KAAK;AAC9B,YAAM,MAAM,MAAM,aAAa,OAAO,GAAG;AACzC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,OAAO,KAAK,YAAY;AAClD,UAAI,IAAI,WAAW,eAAe,IAAI,WAAW,aAAa;AAC5D,0BAAkB,KAAK;AACvB,eAAO;AAAA,MACT;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,oBAAoB,IAAI,qBAAqB;AACnD,YAAM,oBAAoB,IAAI,qBAAqB,IAAI,UAAU;AACjE,YAAM,aAAa,IAAI,cAAc;AAErC,YAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,QAClD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,qBAA4C;AAAA,MAC7D,GAA+B;AAAA,QAC7B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,MACb,CAAC;AACD,wBAAkB,KAAK;AAEvB,UAAI,aAAa,GAAG;AAClB,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,UAAI,SAAS;AACb,UAAI,oBAAoB;AACxB,UAAI,oBAAoB;AACxB,UAAI,aAAa;AACjB,UAAI,aAAa;AAEjB,YAAM,SAAS,KAAK,gBAAgB,eAAe;AAAA,QACjD,GAAG,gBAAgB,GAAG;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI,kBAAkB;AAAA,MACxC,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,wBAAwB,OAAO,UAAU,gBAAgB;AAU7D,YAAM,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,aAAa;AAAA,QAC9D,IAAI;AAAA,QACJ;AAAA,QACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC7C,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAC/B,aAAO,KAAK,qBAAqB;AAAA,IACnC;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,aAAO,GAAG,KAAK,aAAa;AAAA,QAC1B,UAAU,IAAI;AAAA,QACd,GAAI,IAAI,iBAAiB,EAAE,gBAAgB,IAAI,eAAe,IAAI,CAAC;AAAA,QACnE,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,QACtC,aAAa;AAAA,MACf,GAAG;AAAA,QACD,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,yBAAyB,KAAK,eAAe,IAAI;AACrD,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAI;AACxD,aAAO,GAAG,KAAK,aAAa;AAAA,QAC1B,UAAU,IAAI;AAAA,QACd,GAAI,IAAI,iBAAiB,EAAE,gBAAgB,IAAI,eAAe,IAAI,CAAC;AAAA,QACnE,QAAQ,EAAE,KAAK,CAAC,aAAa,QAAQ,EAAE;AAAA,QACvC,YAAY,EAAE,MAAM,OAAO;AAAA,QAC3B,aAAa;AAAA,MACf,GAAG;AAAA,QACD,SAAS,EAAE,YAAY,OAAO;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,OAAO,OAAO,KAAK;AACvB,aAAO,GAAG,QAAQ,aAAa;AAAA,QAC7B,IAAI;AAAA,QACJ,UAAU,IAAI;AAAA,QACd,GAAI,IAAI,iBAAiB,EAAE,gBAAgB,IAAI,eAAe,IAAI,CAAC;AAAA,MACrE,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,oBAAoB,UAAkB,iBAAiB,2BAA2B,gBAAgC;AACtH,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,iBAAiB,GAAI;AAC7D,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC7C;AACA,UAAI,cAAc;AAElB,YAAM,cAAc;AAAA,QAClB,QAAQ;AAAA,QACR,KAAK;AAAA,UACH,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE;AAAA,UAC/B;AAAA,YACE,aAAa;AAAA,YACb,WAAW,EAAE,KAAK,OAAO;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,MAAM,GAAG,KAAK,aAAa,EAAE,GAAG,OAAO,GAAG,YAAY,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAE1G,iBAAW,OAAO,cAAc;AAC9B,cAAM,eAAe,GAAG,wBAAwB,qBAAqB,cAAc;AAGnF,cAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,UAClD,IAAI,IAAI;AAAA,UACR,UAAU,IAAI;AAAA,UACd,GAAG;AAAA,QACL,GAA+B;AAAA,UAC7B,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,aAAa,EAAG;AAEpB,uBAAe;AACf,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,eAAe;AAEnB,cAAM,SAAS,KAAK,gBAAgB,YAAY;AAAA,UAC9C,GAAG,gBAAgB,GAAG;AAAA,UACtB,cAAc,IAAI;AAAA,UAClB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,gBAAgB,IAAI,kBAAkB;AAAA,QACxC,CAAC;AAAA,MACH;AAKA,YAAM,gBAAgB,IAAI,KAAK,IAAI,QAAQ,IAAI,gCAAgC,GAAI;AACnF,YAAM,qBAAqB;AAAA,QACzB,QAAQ;AAAA,QACR,WAAW,EAAE,KAAK,cAAc;AAAA,MAClC;AACA,YAAM,eAAe,MAAM,GAAG,KAAK,aAAa,EAAE,GAAG,OAAO,GAAG,mBAAmB,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAEjH,iBAAW,OAAO,cAAc;AAC9B,cAAM,eAAe,GAAG,wBAAwB,yBAAyB,6BAA6B;AACtG,cAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,UAClD,IAAI,IAAI;AAAA,UACR,UAAU,IAAI;AAAA,UACd,GAAG;AAAA,QACL,GAA+B;AAAA,UAC7B,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,aAAa,EAAG;AAEpB,uBAAe;AACf,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,eAAe;AAEnB,cAAM,SAAS,KAAK,gBAAgB,YAAY;AAAA,UAC9C,GAAG,gBAAgB,GAAG;AAAA,UACtB,cAAc,IAAI;AAAA,UAClB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,gBAAgB,IAAI,kBAAkB;AAAA,QACxC,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { raw } from '@mikro-orm/core'\nimport type { EntityData, FilterQuery } from '@mikro-orm/core'\nimport { ProgressJob, type ProgressJobStatus } from '../data/entities'\nimport type { ProgressService, ProgressServiceContext } from './progressService'\nimport {\n  calculateEta,\n  calculateProgressPercent,\n  HEARTBEAT_INTERVAL_MS,\n  STALE_JOB_TIMEOUT_SECONDS,\n  STALE_PENDING_TIMEOUT_SECONDS,\n  STALE_SWEEP_ERROR_PREFIX,\n} from './progressService'\nimport { PROGRESS_EVENTS } from './events'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildProgressOrganizationFilter } from './organizationScope'\n\nconst DEFAULT_BROADCAST_MIN_INTERVAL_MS = 250\n\n// Minimum elapsed time between coalesced `progress.job.updated` broadcasts for a\n// single job. Bulk workers call updateProgress/incrementProgress once per record, and\n// every emit of the `clientBroadcast: true` event pays a serialized pg_notify roundtrip\n// plus a tenant-wide SSE fan-out. Setting the knob to 0 restores per-record emission.\n// Persistence is throttled separately: heartbeats hit the database at least every\n// HEARTBEAT_INTERVAL_MS regardless of this knob, so a high broadcast interval can\n// never starve the stale-job sweep of heartbeats.\nfunction resolveBroadcastMinIntervalMs(): number {\n  const rawValue = process.env.OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS\n  if (rawValue == null || rawValue.trim() === '') return DEFAULT_BROADCAST_MIN_INTERVAL_MS\n  const parsed = Number.parseInt(rawValue, 10)\n  if (!Number.isFinite(parsed) || parsed < 0) return DEFAULT_BROADCAST_MIN_INTERVAL_MS\n  return parsed\n}\n\n// Statuses a given transition is allowed to move FROM. Every write below is a\n// compare-and-swap (`nativeUpdate` guarded on status), so concurrent writers in other\n// processes can never resurrect a terminal job or double-apply a transition \u2014 the\n// UPDATE that matches zero rows simply lost the race and must not emit events.\nconst TERMINAL_STATUSES: readonly ProgressJobStatus[] = ['completed', 'failed', 'cancelled']\nconst PROGRESS_WRITABLE_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running']\n// `failed` is restartable/completable so a job wrongly swept as stale (worker alive but\n// slow) or retried by an at-least-once queue converges to its true outcome.\nconst START_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'failed']\nconst COMPLETE_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running', 'failed']\nconst FAIL_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running']\nconst CANCEL_FROM_STATUSES: readonly ProgressJobStatus[] = ['pending', 'running', 'failed']\n\ntype JobUpdateThrottleEntry = {\n  job: ProgressJob\n  lastBroadcastAt: number\n  lastPersistedAt: number\n  lastBroadcastPercent: number\n  pendingDelta: number\n  absoluteCountsPending: boolean\n}\n\nfunction buildJobPayload(job: ProgressJob): Record<string, unknown> {\n  return {\n    jobId: job.id,\n    jobType: job.jobType,\n    name: job.name,\n    description: job.description ?? null,\n    status: job.status,\n    progressPercent: job.progressPercent,\n    processedCount: job.processedCount,\n    totalCount: job.totalCount ?? null,\n    etaSeconds: job.etaSeconds ?? null,\n    cancellable: job.cancellable,\n    meta: job.meta ?? null,\n    startedAt: job.startedAt?.toISOString() ?? null,\n    finishedAt: job.finishedAt?.toISOString() ?? null,\n  }\n}\n\nexport function createProgressService(em: EntityManager, eventBus: { emit: (event: string, payload: Record<string, unknown>) => Promise<void> }): ProgressService {\n  const broadcastMinIntervalMs = resolveBroadcastMinIntervalMs()\n  // Per-job coalescing state, scoped to this service instance (request/worker scope).\n  // The cached entity is a DETACHED snapshot (loaded with disableIdentityMap) that doubles\n  // as the in-memory buffer: intermediate updates mutate it without touching the shared\n  // identity map or UnitOfWork, so an unrelated em.flush() elsewhere can never write the\n  // buffered values. Persistence happens exclusively through the CAS nativeUpdate below.\n  const jobUpdateThrottle = new Map<string, JobUpdateThrottleEntry>()\n\n  function jobScopeFilter(jobId: string, ctx: ProgressServiceContext) {\n    return {\n      id: jobId,\n      tenantId: ctx.tenantId,\n      ...buildProgressOrganizationFilter(ctx),\n    }\n  }\n\n  async function loadFreshJob(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob | null> {\n    return em.findOne(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n  }\n\n  function isJobWithinScope(job: ProgressJob, ctx: ProgressServiceContext): boolean {\n    if (job.tenantId !== ctx.tenantId) return false\n    if (ctx.organizationIds !== undefined) {\n      if (ctx.organizationIds === null) return true\n      return typeof job.organizationId === 'string' && ctx.organizationIds.includes(job.organizationId)\n    }\n    if (ctx.organizationId) return job.organizationId === ctx.organizationId\n    return true\n  }\n\n  async function ensureThrottleEntry(jobId: string, ctx: ProgressServiceContext): Promise<JobUpdateThrottleEntry> {\n    const cached = jobUpdateThrottle.get(jobId)\n    if (cached) {\n      if (!isJobWithinScope(cached.job, ctx)) {\n        throw new Error(`[internal] Progress job ${jobId} not found`)\n      }\n      return cached\n    }\n    const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n    const entry: JobUpdateThrottleEntry = {\n      job,\n      lastBroadcastAt: 0,\n      lastPersistedAt: 0,\n      lastBroadcastPercent: job.progressPercent,\n      pendingDelta: 0,\n      absoluteCountsPending: false,\n    }\n    jobUpdateThrottle.set(jobId, entry)\n    return entry\n  }\n\n  function forgetJobThrottle(jobId: string) {\n    jobUpdateThrottle.delete(jobId)\n  }\n\n  function buildBufferedCountData(entry: JobUpdateThrottleEntry): EntityData<ProgressJob> {\n    if (entry.absoluteCountsPending || !Number.isSafeInteger(entry.pendingDelta)) {\n      return { processedCount: entry.job.processedCount }\n    }\n    if (entry.pendingDelta !== 0) {\n      const processedCount = raw(`processed_count + ${entry.pendingDelta}`)\n      const totalCount = entry.job.totalCount\n      if (Number.isSafeInteger(totalCount) && totalCount != null && totalCount > 0) {\n        return {\n          processedCount,\n          progressPercent: raw(\n            `least(100, round(((processed_count + ${entry.pendingDelta})::numeric / ${totalCount}) * 100))`,\n          ),\n        }\n      }\n      return { processedCount }\n    }\n    return {}\n  }\n\n  // The start transition (START_FROM_STATUSES) doubles as the recovery path for jobs a\n  // stale sweep flipped to `failed` while their producer was alive but slow. Callers pass\n  // the EM to run against so the forked heartbeat path can reuse the same CAS.\n  //\n  // `staleSweptOnly` is for the revive paths: a live write proves the producer is alive,\n  // but it does NOT prove the recorded failure was the sweep's. Narrowing the CAS to rows\n  // the sweep tagged keeps a genuine failure's message and stack intact instead of\n  // resurrecting the job and erasing why it died. `startJob` stays unrestricted so an\n  // at-least-once queue can still retry a genuinely failed job from the top.\n  async function startJobViaCas(\n    targetEm: EntityManager,\n    job: ProgressJob,\n    ctx: ProgressServiceContext,\n    options: { staleSweptOnly?: boolean } = {},\n  ): Promise<ProgressJob | null> {\n    const now = new Date()\n    // Progress counts are absolute and survive across deliveries, so the elapsed window\n    // calculateEta divides them by has to survive too. Resetting it on every revive makes\n    // a job with hours of work left report seconds remaining.\n    const startedAt = job.startedAt ?? now\n    const filter: Record<string, unknown> = {\n      ...jobScopeFilter(job.id, ctx),\n      status: { $in: START_FROM_STATUSES as ProgressJobStatus[] },\n    }\n    if (options.staleSweptOnly) filter.errorMessage = { $like: `${STALE_SWEEP_ERROR_PREFIX}%` }\n    const affected = await targetEm.nativeUpdate(ProgressJob, filter as FilterQuery<ProgressJob>, {\n      status: 'running',\n      startedAt,\n      heartbeatAt: now,\n      finishedAt: null,\n      errorMessage: null,\n      errorStack: null,\n      updatedAt: now,\n    })\n    if (affected === 0) return null\n\n    job.status = 'running'\n    job.startedAt = startedAt\n    job.heartbeatAt = now\n    job.finishedAt = null\n    job.errorMessage = null\n    job.errorStack = null\n\n    await eventBus.emit(PROGRESS_EVENTS.JOB_STARTED, {\n      ...buildJobPayload(job),\n      tenantId: ctx.tenantId,\n      organizationId: job.organizationId ?? null,\n    })\n\n    return job\n  }\n\n  async function persistAndMaybeBroadcast(entry: JobUpdateThrottleEntry, ctx: ProgressServiceContext): Promise<ProgressJob> {\n    const job = entry.job\n    const now = Date.now()\n    const shouldBroadcast =\n      broadcastMinIntervalMs <= 0 ||\n      now - entry.lastBroadcastAt >= broadcastMinIntervalMs ||\n      Math.abs(job.progressPercent - entry.lastBroadcastPercent) >= 1\n    const shouldPersist = shouldBroadcast || now - entry.lastPersistedAt >= HEARTBEAT_INTERVAL_MS\n\n    if (!shouldPersist) return job\n\n    const usesAtomicIncrement =\n      !entry.absoluteCountsPending && Number.isSafeInteger(entry.pendingDelta) && entry.pendingDelta !== 0\n    const data: EntityData<ProgressJob> = {\n      progressPercent: job.progressPercent,\n      totalCount: job.totalCount ?? null,\n      etaSeconds: job.etaSeconds ?? null,\n      meta: job.meta ?? null,\n      heartbeatAt: job.heartbeatAt ?? new Date(),\n      updatedAt: new Date(),\n      ...buildBufferedCountData(entry),\n    }\n    const writableFilter = {\n      ...jobScopeFilter(job.id, ctx),\n      status: { $in: PROGRESS_WRITABLE_STATUSES as ProgressJobStatus[] },\n    } as FilterQuery<ProgressJob>\n    let affected = await em.nativeUpdate(ProgressJob, writableFilter, data)\n\n    if (affected === 0) {\n      // A stale sweep may have flipped a live job to `failed` between writes. Revive it\n      // through the start CAS and retry once so the buffered delta isn't silently dropped.\n      const fresh = await loadFreshJob(job.id, ctx)\n      let revived = false\n      if (fresh && fresh.status === 'failed' && (await startJobViaCas(em, fresh, ctx, { staleSweptOnly: true }))) {\n        revived = true\n        job.status = 'running'\n        job.startedAt = fresh.startedAt\n        job.finishedAt = null\n        job.errorMessage = null\n        job.errorStack = null\n        affected = await em.nativeUpdate(ProgressJob, writableFilter, data)\n      }\n      if (affected === 0) {\n        // The job reached a genuinely terminal state in another process; stop writing to it.\n        forgetJobThrottle(job.id)\n        const latest = revived ? await loadFreshJob(job.id, ctx) : fresh\n        return latest ?? job\n      }\n    }\n\n    const persistedJob = usesAtomicIncrement ? (await loadFreshJob(job.id, ctx)) ?? job : job\n    entry.job = persistedJob\n    entry.pendingDelta = 0\n    entry.absoluteCountsPending = false\n    entry.lastPersistedAt = now\n\n    if (shouldBroadcast) {\n      await eventBus.emit(PROGRESS_EVENTS.JOB_UPDATED, {\n        ...buildJobPayload(persistedJob),\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n      entry.lastBroadcastAt = now\n      entry.lastBroadcastPercent = persistedJob.progressPercent\n    }\n\n    return persistedJob\n  }\n\n  return {\n    async createJob(input, ctx) {\n      if (Array.isArray(ctx.organizationIds)) {\n        const organizationId = typeof ctx.organizationId === 'string' && ctx.organizationId.trim().length > 0\n          ? ctx.organizationId\n          : null\n        if (organizationId === null || !ctx.organizationIds.includes(organizationId)) {\n          throw new Error('[internal] Progress job creation is outside the allowed organization scope')\n        }\n      }\n\n      const job = em.create(ProgressJob, {\n        jobType: input.jobType,\n        name: input.name,\n        description: input.description,\n        totalCount: input.totalCount,\n        cancellable: input.cancellable ?? false,\n        meta: input.meta,\n        parentJobId: input.parentJobId,\n        partitionIndex: input.partitionIndex,\n        partitionCount: input.partitionCount,\n        startedByUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        status: 'pending',\n      })\n\n      await em.persist(job).flush()\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_CREATED, {\n        ...buildJobPayload(job),\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n      })\n\n      return job\n    },\n\n    async startJob(jobId, ctx) {\n      const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n      if (job.status === 'running' || job.status === 'cancelled' || job.status === 'completed') {\n        return job\n      }\n\n      const started = await startJobViaCas(em, job, ctx)\n      if (started) return started\n\n      const fresh = await loadFreshJob(jobId, ctx)\n      return fresh ?? job\n    },\n\n    async touchJobHeartbeat(jobId, ctx) {\n      // Forked EM: keepalive timers call this while the shared EM may be mid-transaction\n      // inside a producer's own writes, so the heartbeat must not join that unit of work.\n      const fork = em.fork()\n      const now = new Date()\n      const affected = await fork.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: PROGRESS_WRITABLE_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, {\n        heartbeatAt: now,\n        updatedAt: now,\n      })\n      if (affected > 0) return\n\n      const job = await fork.findOne(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n      if (!job || job.status !== 'failed') return\n      // A live producer heartbeating a `failed` job means a stale sweep false-positived;\n      // revive through the start CAS so the card recovers without waiting for a batch boundary.\n      await startJobViaCas(fork, job, ctx, { staleSweptOnly: true })\n    },\n\n    async updateProgress(jobId, input, ctx) {\n      const entry = await ensureThrottleEntry(jobId, ctx)\n      const job = entry.job\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        // `failed` may be a false-positive stale sweep on a slow-but-alive producer; the\n        // fact that this write is happening proves the producer is alive, so revive and\n        // apply the update. `completed`/`cancelled` stay terminal, and a failure the sweep\n        // did not write keeps its diagnostics (see startJobViaCas).\n        const revived = job.status === 'failed' && (await startJobViaCas(em, job, ctx, { staleSweptOnly: true }))\n        if (!revived) {\n          forgetJobThrottle(jobId)\n          return job\n        }\n        entry.lastPersistedAt = 0\n      }\n\n      if (input.processedCount !== undefined) {\n        job.processedCount = input.processedCount\n        entry.absoluteCountsPending = true\n        entry.pendingDelta = 0\n      }\n      if (input.totalCount !== undefined) {\n        job.totalCount = input.totalCount\n      }\n      if (input.meta !== undefined) {\n        job.meta = { ...job.meta, ...input.meta }\n      }\n\n      if (input.progressPercent !== undefined) {\n        job.progressPercent = input.progressPercent\n      } else if (job.totalCount) {\n        job.progressPercent = calculateProgressPercent(job.processedCount, job.totalCount)\n      }\n\n      if (input.etaSeconds !== undefined) {\n        job.etaSeconds = input.etaSeconds\n      } else if (job.startedAt && job.totalCount) {\n        job.etaSeconds = calculateEta(job.processedCount, job.totalCount, job.startedAt)\n      }\n\n      job.heartbeatAt = new Date()\n\n      return persistAndMaybeBroadcast(entry, ctx)\n    },\n\n    async incrementProgress(jobId, delta, ctx) {\n      const entry = await ensureThrottleEntry(jobId, ctx)\n      let job = entry.job\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        let writable = false\n        if (job.status === 'failed') {\n          writable = (await startJobViaCas(em, job, ctx, { staleSweptOnly: true })) != null\n          if (!writable) {\n            // The cached snapshot's status lags the row whenever another writer \u2014 typically\n            // the forked heartbeat in touchJobHeartbeat \u2014 already revived this job: the start\n            // CAS then misses because the row is `running`, not `failed`. Increments are\n            // relative, so returning here would lose the caller's delta for good (unlike\n            // updateProgress, whose next absolute write self-corrects). Unlike\n            // persistAndMaybeBroadcast, the re-read happens after the CAS rather than before\n            // it: startJobViaCas filters on database state, so retrying it against the fresh\n            // row could not change whether it matches.\n            const fresh = await loadFreshJob(jobId, ctx)\n            if (fresh) {\n              job = fresh\n              writable = PROGRESS_WRITABLE_STATUSES.includes(fresh.status)\n              // Adopting the fresh row cannot desync entry.pendingDelta, which is provably 0\n              // here: this guard is only reachable on a cached terminal status, and the only\n              // writers that cache one \u2014 ensureThrottleEntry's initial load and\n              // persistAndMaybeBroadcast's post-persist assignment \u2014 both leave the buffer empty.\n              if (writable) entry.job = fresh\n            }\n          }\n        }\n        if (!writable) {\n          forgetJobThrottle(jobId)\n          return job\n        }\n        entry.lastPersistedAt = 0\n      }\n\n      job.processedCount += delta\n      entry.pendingDelta += delta\n      job.heartbeatAt = new Date()\n\n      if (job.totalCount) {\n        job.progressPercent = calculateProgressPercent(job.processedCount, job.totalCount)\n        if (job.startedAt) {\n          job.etaSeconds = calculateEta(job.processedCount, job.totalCount, job.startedAt)\n        }\n      }\n\n      return persistAndMaybeBroadcast(entry, ctx)\n    },\n\n    async completeJob(jobId, input, ctx) {\n      const job = await loadFreshJob(jobId, ctx)\n      if (!job) throw new Error(`Job ${jobId} not found`)\n      if (job.status === 'cancelled' || job.status === 'completed') {\n        forgetJobThrottle(jobId)\n        return job\n      }\n\n      const cachedEntry = jobUpdateThrottle.get(jobId)\n      const entry = cachedEntry && isJobWithinScope(cachedEntry.job, ctx) ? cachedEntry : undefined\n      const snapshot = entry?.job ?? job\n      const now = new Date()\n      const data: EntityData<ProgressJob> = {\n        status: 'completed',\n        finishedAt: now,\n        etaSeconds: 0,\n        updatedAt: now,\n        ...(input?.resultSummary ? { resultSummary: input.resultSummary } : {}),\n        ...(entry\n          ? {\n              totalCount: snapshot.totalCount ?? null,\n              meta: snapshot.meta ?? null,\n              ...buildBufferedCountData(entry),\n            }\n          : {}),\n        progressPercent: 100,\n      }\n\n      const affected = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: COMPLETE_FROM_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, data)\n      forgetJobThrottle(jobId)\n\n      if (affected === 0) {\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      snapshot.status = 'completed'\n      snapshot.finishedAt = now\n      snapshot.progressPercent = 100\n      snapshot.etaSeconds = 0\n      if (input?.resultSummary) {\n        snapshot.resultSummary = input.resultSummary\n      }\n\n      const persistedJob = (await loadFreshJob(jobId, ctx)) ?? snapshot\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_COMPLETED, {\n        ...buildJobPayload(persistedJob),\n        resultSummary: persistedJob.resultSummary,\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n\n      return persistedJob\n    },\n\n    async failJob(jobId, input, ctx) {\n      const job = await loadFreshJob(jobId, ctx)\n      if (!job) throw new Error(`Job ${jobId} not found`)\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        forgetJobThrottle(jobId)\n        return job\n      }\n\n      const cachedEntry = jobUpdateThrottle.get(jobId)\n      const entry = cachedEntry && isJobWithinScope(cachedEntry.job, ctx) ? cachedEntry : undefined\n      const snapshot = entry?.job ?? job\n      const now = new Date()\n      const data: EntityData<ProgressJob> = {\n        status: 'failed',\n        finishedAt: now,\n        errorMessage: input.errorMessage,\n        errorStack: input.errorStack,\n        ...(input.resultSummary ? { resultSummary: input.resultSummary } : {}),\n        updatedAt: now,\n        ...(entry\n          ? {\n              totalCount: snapshot.totalCount ?? null,\n              meta: snapshot.meta ?? null,\n              ...buildBufferedCountData(entry),\n            }\n          : {}),\n      }\n\n      const affected = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: FAIL_FROM_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, data)\n      forgetJobThrottle(jobId)\n\n      if (affected === 0) {\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      snapshot.status = 'failed'\n      snapshot.finishedAt = now\n      snapshot.errorMessage = input.errorMessage\n      snapshot.errorStack = input.errorStack\n      if (input.resultSummary) {\n        snapshot.resultSummary = input.resultSummary\n      }\n\n      const persistedJob = (await loadFreshJob(jobId, ctx)) ?? snapshot\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_FAILED, {\n        ...buildJobPayload(persistedJob),\n        errorMessage: persistedJob.errorMessage,\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n\n      return persistedJob\n    },\n\n    async cancelJob(jobId, ctx) {\n      const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })\n      if (TERMINAL_STATUSES.includes(job.status)) {\n        // The job finished while the user clicked cancel \u2014 a benign race, not an error.\n        return job\n      }\n      if (!job.cancellable) {\n        throw new Error(`Job ${jobId} is not cancellable`)\n      }\n\n      const now = new Date()\n      const cancelledNow = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        cancellable: true,\n        status: 'pending',\n      } as FilterQuery<ProgressJob>, {\n        status: 'cancelled',\n        cancelRequestedAt: now,\n        cancelledByUserId: ctx.userId ?? null,\n        finishedAt: now,\n        etaSeconds: 0,\n        updatedAt: now,\n      })\n\n      let requested = 0\n      if (cancelledNow === 0) {\n        requested = await em.nativeUpdate(ProgressJob, {\n          ...jobScopeFilter(jobId, ctx),\n          cancellable: true,\n          status: 'running',\n        } as FilterQuery<ProgressJob>, {\n          cancelRequestedAt: now,\n          cancelledByUserId: ctx.userId ?? null,\n          updatedAt: now,\n        })\n      }\n\n      if (cancelledNow === 0 && requested === 0) {\n        // Raced into a terminal state between the read and the CAS.\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      forgetJobThrottle(jobId)\n      if (cancelledNow > 0) {\n        job.status = 'cancelled'\n        job.finishedAt = now\n        job.etaSeconds = 0\n      }\n      job.cancelRequestedAt = now\n      job.cancelledByUserId = ctx.userId ?? null\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_CANCELLED, {\n        ...buildJobPayload(job),\n        tenantId: ctx.tenantId,\n        organizationId: job.organizationId ?? null,\n      })\n\n      return job\n    },\n\n    async markCancelled(jobId, ctx) {\n      const job = await loadFreshJob(jobId, ctx)\n      if (!job) throw new Error(`Job ${jobId} not found`)\n      if (job.status === 'cancelled' || job.status === 'completed') {\n        forgetJobThrottle(jobId)\n        return job\n      }\n\n      const now = new Date()\n      const cancelRequestedAt = job.cancelRequestedAt ?? now\n      const cancelledByUserId = job.cancelledByUserId ?? ctx.userId ?? null\n      const finishedAt = job.finishedAt ?? now\n\n      // Flush the throttled entry the way completeJob and failJob do. Without this a producer\n      // that writes its partial result through updateProgress immediately before cancelling\n      // loses it whenever that write landed inside the persistence throttle window, because\n      // forgetJobThrottle below discards the only copy that ever existed.\n      const entry = jobUpdateThrottle.get(jobId)\n      const snapshot = entry?.job\n      const affected = await em.nativeUpdate(ProgressJob, {\n        ...jobScopeFilter(jobId, ctx),\n        status: { $in: CANCEL_FROM_STATUSES as ProgressJobStatus[] },\n      } as FilterQuery<ProgressJob>, {\n        status: 'cancelled',\n        cancelRequestedAt,\n        cancelledByUserId,\n        finishedAt,\n        etaSeconds: 0,\n        updatedAt: now,\n        ...(entry && snapshot\n          ? {\n              totalCount: snapshot.totalCount ?? null,\n              meta: snapshot.meta ?? null,\n              ...buildBufferedCountData(entry),\n            }\n          : {}),\n      })\n      forgetJobThrottle(jobId)\n\n      if (affected === 0) {\n        const fresh = await loadFreshJob(jobId, ctx)\n        return fresh ?? job\n      }\n\n      job.status = 'cancelled'\n      job.cancelRequestedAt = cancelRequestedAt\n      job.cancelledByUserId = cancelledByUserId\n      job.finishedAt = finishedAt\n      job.etaSeconds = 0\n\n      const persistedJob = (await loadFreshJob(jobId, ctx)) ?? job\n\n      await eventBus.emit(PROGRESS_EVENTS.JOB_CANCELLED, {\n        ...buildJobPayload(persistedJob),\n        tenantId: ctx.tenantId,\n        organizationId: persistedJob.organizationId ?? null,\n      })\n\n      return persistedJob\n    },\n\n    async isCancellationRequested(jobId, tenantId, organizationId, organizationIds) {\n      // Forked EM, for the same reason touchJobHeartbeat forks: this is polled from the\n      // keepalive timer, which spans the producer's own transactional writes on the shared\n      // EM, so an unawaited poll would issue a SELECT into an open em.begin()/em.commit()\n      // window and interleave with its UnitOfWork. Every caller only reads the flag, so a\n      // fork costs nothing and no caller depends on joining an ambient transaction.\n      //\n      // disableIdentityMap forces a fresh read: a managed copy of the job in this\n      // EntityManager (loaded by updateProgress) must never mask a cancellation\n      // requested from another process.\n      const job = await findOneWithDecryption(em.fork(), ProgressJob, {\n        id: jobId,\n        tenantId,\n        ...buildProgressOrganizationFilter({ organizationId, organizationIds }),\n      }, { disableIdentityMap: true })\n      return job?.cancelRequestedAt != null\n    },\n\n    async getActiveJobs(ctx) {\n      return em.find(ProgressJob, {\n        tenantId: ctx.tenantId,\n        ...buildProgressOrganizationFilter(ctx),\n        status: { $in: ['pending', 'running'] },\n        parentJobId: null,\n      }, {\n        orderBy: { createdAt: 'DESC' },\n        limit: 50,\n      })\n    },\n\n    async getRecentlyCompletedJobs(ctx, sinceSeconds = 30) {\n      const cutoff = new Date(Date.now() - sinceSeconds * 1000)\n      return em.find(ProgressJob, {\n        tenantId: ctx.tenantId,\n        ...buildProgressOrganizationFilter(ctx),\n        status: { $in: ['completed', 'failed'] },\n        finishedAt: { $gte: cutoff },\n        parentJobId: null,\n      }, {\n        orderBy: { finishedAt: 'DESC' },\n        limit: 10,\n      })\n    },\n\n    async getJob(jobId, ctx) {\n      return em.findOne(ProgressJob, {\n        id: jobId,\n        tenantId: ctx.tenantId,\n        ...buildProgressOrganizationFilter(ctx),\n      })\n    },\n\n    async markStaleJobsFailed(\n      tenantId: string,\n      timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS,\n      organizationId?: string | null,\n      organizationIds?: string[] | null,\n    ) {\n      const now = new Date()\n      const cutoff = new Date(now.getTime() - timeoutSeconds * 1000)\n      const scope = {\n        tenantId,\n        ...buildProgressOrganizationFilter({ organizationId, organizationIds }),\n      }\n      let failedCount = 0\n\n      const staleFilter = {\n        status: 'running' as ProgressJobStatus,\n        $or: [\n          { heartbeatAt: { $lt: cutoff } },\n          {\n            heartbeatAt: null,\n            startedAt: { $lt: cutoff },\n          },\n        ],\n      }\n      const staleRunning = await em.find(ProgressJob, { ...scope, ...staleFilter }, { disableIdentityMap: true })\n\n      for (const job of staleRunning) {\n        const errorMessage = `${STALE_SWEEP_ERROR_PREFIX} no heartbeat for ${timeoutSeconds} seconds`\n        // Per-row CAS (re-checking the staleness condition): exactly one concurrent\n        // sweeper wins, and a heartbeat that landed after the SELECT aborts the failure.\n        const affected = await em.nativeUpdate(ProgressJob, {\n          id: job.id,\n          tenantId: job.tenantId,\n          organizationId: job.organizationId ?? null,\n          ...staleFilter,\n        } as FilterQuery<ProgressJob>, {\n          status: 'failed',\n          finishedAt: now,\n          errorMessage,\n          updatedAt: now,\n        })\n        if (affected === 0) continue\n\n        failedCount += 1\n        job.status = 'failed'\n        job.finishedAt = now\n        job.errorMessage = errorMessage\n\n        await eventBus.emit(PROGRESS_EVENTS.JOB_FAILED, {\n          ...buildJobPayload(job),\n          errorMessage: job.errorMessage,\n          tenantId: job.tenantId,\n          stale: true,\n          organizationId: job.organizationId ?? null,\n        })\n      }\n\n      // Jobs stuck in `pending` (enqueue failed, worker died before startJob) have no\n      // heartbeat, so they need their own sweep or they stay in the active list forever.\n      // A late queue delivery still recovers such a job: startJob transitions failed \u2192 running.\n      const pendingCutoff = new Date(now.getTime() - STALE_PENDING_TIMEOUT_SECONDS * 1000)\n      const stalePendingFilter = {\n        status: 'pending' as ProgressJobStatus,\n        createdAt: { $lt: pendingCutoff },\n      }\n      const stalePending = await em.find(ProgressJob, { ...scope, ...stalePendingFilter }, { disableIdentityMap: true })\n\n      for (const job of stalePending) {\n        const errorMessage = `${STALE_SWEEP_ERROR_PREFIX} never started within ${STALE_PENDING_TIMEOUT_SECONDS} seconds`\n        const affected = await em.nativeUpdate(ProgressJob, {\n          id: job.id,\n          tenantId: job.tenantId,\n          organizationId: job.organizationId ?? null,\n          ...stalePendingFilter,\n        } as FilterQuery<ProgressJob>, {\n          status: 'failed',\n          finishedAt: now,\n          errorMessage,\n          updatedAt: now,\n        })\n        if (affected === 0) continue\n\n        failedCount += 1\n        job.status = 'failed'\n        job.finishedAt = now\n        job.errorMessage = errorMessage\n\n        await eventBus.emit(PROGRESS_EVENTS.JOB_FAILED, {\n          ...buildJobPayload(job),\n          errorMessage: job.errorMessage,\n          tenantId: job.tenantId,\n          stale: true,\n          organizationId: job.organizationId ?? null,\n        })\n      }\n\n      return failedCount\n    },\n  }\n}\n"],
+  "mappings": "AACA,SAAS,WAAW;AAEpB,SAAS,mBAA2C;AAEpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAEhD,MAAM,oCAAoC;AAS1C,SAAS,gCAAwC;AAC/C,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,YAAY,QAAQ,SAAS,KAAK,MAAM,GAAI,QAAO;AACvD,QAAM,SAAS,OAAO,SAAS,UAAU,EAAE;AAC3C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;AAMA,MAAM,oBAAkD,CAAC,aAAa,UAAU,WAAW;AAC3F,MAAM,6BAA2D,CAAC,WAAW,SAAS;AAGtF,MAAM,sBAAoD,CAAC,WAAW,QAAQ;AAC9E,MAAM,yBAAuD,CAAC,WAAW,WAAW,QAAQ;AAC5F,MAAM,qBAAmD,CAAC,WAAW,SAAS;AAC9E,MAAM,uBAAqD,CAAC,WAAW,WAAW,QAAQ;AAW1F,SAAS,gBAAgB,KAA2C;AAClE,SAAO;AAAA,IACL,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,MAAM,IAAI;AAAA,IACV,aAAa,IAAI,eAAe;AAAA,IAChC,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI,cAAc;AAAA,IAC9B,YAAY,IAAI,cAAc;AAAA,IAC9B,aAAa,IAAI;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,WAAW,IAAI,WAAW,YAAY,KAAK;AAAA,IAC3C,YAAY,IAAI,YAAY,YAAY,KAAK;AAAA,EAC/C;AACF;AAEO,SAAS,sBAAsB,IAAmB,UAAyG;AAChK,QAAM,yBAAyB,8BAA8B;AAM7D,QAAM,oBAAoB,oBAAI,IAAoC;AAElE,WAAS,eAAe,OAAe,KAA6B;AAClE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,IAAI;AAAA,MACd,GAAG,gCAAgC,GAAG;AAAA,IACxC;AAAA,EACF;AAEA,iBAAe,aAAa,OAAe,KAA0D;AACnG,WAAO,GAAG,QAAQ,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAAA,EACzF;AAEA,WAAS,iBAAiB,KAAkB,KAAsC;AAChF,QAAI,IAAI,aAAa,IAAI,SAAU,QAAO;AAC1C,QAAI,IAAI,oBAAoB,QAAW;AACrC,UAAI,IAAI,oBAAoB,KAAM,QAAO;AACzC,aAAO,OAAO,IAAI,mBAAmB,YAAY,IAAI,gBAAgB,SAAS,IAAI,cAAc;AAAA,IAClG;AACA,QAAI,IAAI,eAAgB,QAAO,IAAI,mBAAmB,IAAI;AAC1D,WAAO;AAAA,EACT;AAEA,iBAAe,oBAAoB,OAAe,KAA8D;AAC9G,UAAM,SAAS,kBAAkB,IAAI,KAAK;AAC1C,QAAI,QAAQ;AACV,UAAI,CAAC,iBAAiB,OAAO,KAAK,GAAG,GAAG;AACtC,cAAM,IAAI,MAAM,2BAA2B,KAAK,YAAY;AAAA,MAC9D;AACA,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,GAAG,cAAc,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACxG,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,MACjB,sBAAsB,IAAI;AAAA,MAC1B,cAAc;AAAA,MACd,uBAAuB;AAAA,IACzB;AACA,sBAAkB,IAAI,OAAO,KAAK;AAClC,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,OAAe;AACxC,sBAAkB,OAAO,KAAK;AAAA,EAChC;AAEA,WAAS,uBAAuB,OAAwD;AACtF,QAAI,MAAM,yBAAyB,CAAC,OAAO,cAAc,MAAM,YAAY,GAAG;AAC5E,aAAO,EAAE,gBAAgB,MAAM,IAAI,eAAe;AAAA,IACpD;AACA,QAAI,MAAM,iBAAiB,GAAG;AAC5B,YAAM,iBAAiB,IAAI,qBAAqB,MAAM,YAAY,EAAE;AACpE,YAAM,aAAa,MAAM,IAAI;AAC7B,UAAI,OAAO,cAAc,UAAU,KAAK,cAAc,QAAQ,aAAa,GAAG;AAC5E,eAAO;AAAA,UACL;AAAA,UACA,iBAAiB;AAAA,YACf,wCAAwC,MAAM,YAAY,gBAAgB,UAAU;AAAA,UACtF;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,eAAe;AAAA,IAC1B;AACA,WAAO,CAAC;AAAA,EACV;AAWA,iBAAe,eACb,UACA,KACA,KACA,UAAwC,CAAC,GACZ;AAC7B,UAAM,MAAM,oBAAI,KAAK;AAIrB,UAAM,YAAY,IAAI,aAAa;AACnC,UAAM,SAAkC;AAAA,MACtC,GAAG,eAAe,IAAI,IAAI,GAAG;AAAA,MAC7B,QAAQ,EAAE,KAAK,oBAA2C;AAAA,IAC5D;AACA,QAAI,QAAQ,eAAgB,QAAO,eAAe,EAAE,OAAO,GAAG,wBAAwB,IAAI;AAC1F,UAAM,WAAW,MAAM,SAAS,aAAa,aAAa,QAAoC;AAAA,MAC5F,QAAQ;AAAA,MACR;AAAA,MACA,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,aAAa,EAAG,QAAO;AAE3B,QAAI,SAAS;AACb,QAAI,YAAY;AAChB,QAAI,cAAc;AAClB,QAAI,aAAa;AACjB,QAAI,eAAe;AACnB,QAAI,aAAa;AAEjB,UAAM,SAAS,KAAK,gBAAgB,aAAa;AAAA,MAC/C,GAAG,gBAAgB,GAAG;AAAA,MACtB,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI,kBAAkB;AAAA,IACxC,CAAC;AAED,WAAO;AAAA,EACT;AAEA,iBAAe,yBAAyB,OAA+B,KAAmD;AACxH,UAAM,MAAM,MAAM;AAClB,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,kBACJ,0BAA0B,KAC1B,MAAM,MAAM,mBAAmB,0BAC/B,KAAK,IAAI,IAAI,kBAAkB,MAAM,oBAAoB,KAAK;AAChE,UAAM,gBAAgB,mBAAmB,MAAM,MAAM,mBAAmB;AAExE,QAAI,CAAC,cAAe,QAAO;AAE3B,UAAM,sBACJ,CAAC,MAAM,yBAAyB,OAAO,cAAc,MAAM,YAAY,KAAK,MAAM,iBAAiB;AACrG,UAAM,OAAgC;AAAA,MACpC,iBAAiB,IAAI;AAAA,MACrB,YAAY,IAAI,cAAc;AAAA,MAC9B,YAAY,IAAI,cAAc;AAAA,MAC9B,MAAM,IAAI,QAAQ;AAAA,MAClB,aAAa,IAAI,eAAe,oBAAI,KAAK;AAAA,MACzC,WAAW,oBAAI,KAAK;AAAA,MACpB,GAAG,uBAAuB,KAAK;AAAA,IACjC;AACA,UAAM,iBAAiB;AAAA,MACrB,GAAG,eAAe,IAAI,IAAI,GAAG;AAAA,MAC7B,QAAQ,EAAE,KAAK,2BAAkD;AAAA,IACnE;AACA,QAAI,WAAW,MAAM,GAAG,aAAa,aAAa,gBAAgB,IAAI;AAEtE,QAAI,aAAa,GAAG;AAGlB,YAAM,QAAQ,MAAM,aAAa,IAAI,IAAI,GAAG;AAC5C,UAAI,UAAU;AACd,UAAI,SAAS,MAAM,WAAW,YAAa,MAAM,eAAe,IAAI,OAAO,KAAK,EAAE,gBAAgB,KAAK,CAAC,GAAI;AAC1G,kBAAU;AACV,YAAI,SAAS;AACb,YAAI,YAAY,MAAM;AACtB,YAAI,aAAa;AACjB,YAAI,eAAe;AACnB,YAAI,aAAa;AACjB,mBAAW,MAAM,GAAG,aAAa,aAAa,gBAAgB,IAAI;AAAA,MACpE;AACA,UAAI,aAAa,GAAG;AAElB,0BAAkB,IAAI,EAAE;AACxB,cAAM,SAAS,UAAU,MAAM,aAAa,IAAI,IAAI,GAAG,IAAI;AAC3D,eAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,eAAe,sBAAuB,MAAM,aAAa,IAAI,IAAI,GAAG,KAAM,MAAM;AACtF,UAAM,MAAM;AACZ,UAAM,eAAe;AACrB,UAAM,wBAAwB;AAC9B,UAAM,kBAAkB;AAExB,QAAI,iBAAiB;AACnB,YAAM,SAAS,KAAK,gBAAgB,aAAa;AAAA,QAC/C,GAAG,gBAAgB,YAAY;AAAA,QAC/B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AACD,YAAM,kBAAkB;AACxB,YAAM,uBAAuB,aAAa;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,OAAO,KAAK;AAC1B,UAAI,MAAM,QAAQ,IAAI,eAAe,GAAG;AACtC,cAAM,iBAAiB,OAAO,IAAI,mBAAmB,YAAY,IAAI,eAAe,KAAK,EAAE,SAAS,IAChG,IAAI,iBACJ;AACJ,YAAI,mBAAmB,QAAQ,CAAC,IAAI,gBAAgB,SAAS,cAAc,GAAG;AAC5E,gBAAM,IAAI,MAAM,4EAA4E;AAAA,QAC9F;AAAA,MACF;AAEA,YAAM,MAAM,GAAG,OAAO,aAAa;AAAA,QACjC,SAAS,MAAM;AAAA,QACf,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,YAAY,MAAM;AAAA,QAClB,aAAa,MAAM,eAAe;AAAA,QAClC,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,gBAAgB,MAAM;AAAA,QACtB,gBAAgB,MAAM;AAAA,QACtB,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ;AAAA,MACV,CAAC;AAED,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAE5B,YAAM,SAAS,KAAK,gBAAgB,aAAa;AAAA,QAC/C,GAAG,gBAAgB,GAAG;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS,OAAO,KAAK;AACzB,YAAM,MAAM,MAAM,GAAG,cAAc,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACxG,UAAI,IAAI,WAAW,aAAa,IAAI,WAAW,eAAe,IAAI,WAAW,aAAa;AACxF,eAAO;AAAA,MACT;AAEA,YAAM,UAAU,MAAM,eAAe,IAAI,KAAK,GAAG;AACjD,UAAI,QAAS,QAAO;AAEpB,YAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,kBAAkB,OAAO,KAAK;AAGlC,YAAM,OAAO,GAAG,KAAK;AACrB,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,WAAW,MAAM,KAAK,aAAa,aAAa;AAAA,QACpD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,2BAAkD;AAAA,MACnE,GAA+B;AAAA,QAC7B,aAAa;AAAA,QACb,WAAW;AAAA,MACb,CAAC;AACD,UAAI,WAAW,EAAG;AAElB,YAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACpG,UAAI,CAAC,OAAO,IAAI,WAAW,SAAU;AAGrC,YAAM,eAAe,MAAM,KAAK,KAAK,EAAE,gBAAgB,KAAK,CAAC;AAAA,IAC/D;AAAA,IAEA,MAAM,eAAe,OAAO,OAAO,KAAK;AACtC,YAAM,QAAQ,MAAM,oBAAoB,OAAO,GAAG;AAClD,YAAM,MAAM,MAAM;AAClB,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAK1C,cAAM,UAAU,IAAI,WAAW,YAAa,MAAM,eAAe,IAAI,KAAK,KAAK,EAAE,gBAAgB,KAAK,CAAC;AACvG,YAAI,CAAC,SAAS;AACZ,4BAAkB,KAAK;AACvB,iBAAO;AAAA,QACT;AACA,cAAM,kBAAkB;AAAA,MAC1B;AAEA,UAAI,MAAM,mBAAmB,QAAW;AACtC,YAAI,iBAAiB,MAAM;AAC3B,cAAM,wBAAwB;AAC9B,cAAM,eAAe;AAAA,MACvB;AACA,UAAI,MAAM,eAAe,QAAW;AAClC,YAAI,aAAa,MAAM;AAAA,MACzB;AACA,UAAI,MAAM,SAAS,QAAW;AAC5B,YAAI,OAAO,EAAE,GAAG,IAAI,MAAM,GAAG,MAAM,KAAK;AAAA,MAC1C;AAEA,UAAI,MAAM,oBAAoB,QAAW;AACvC,YAAI,kBAAkB,MAAM;AAAA,MAC9B,WAAW,IAAI,YAAY;AACzB,YAAI,kBAAkB,yBAAyB,IAAI,gBAAgB,IAAI,UAAU;AAAA,MACnF;AAEA,UAAI,MAAM,eAAe,QAAW;AAClC,YAAI,aAAa,MAAM;AAAA,MACzB,WAAW,IAAI,aAAa,IAAI,YAAY;AAC1C,YAAI,aAAa,aAAa,IAAI,gBAAgB,IAAI,YAAY,IAAI,SAAS;AAAA,MACjF;AAEA,UAAI,cAAc,oBAAI,KAAK;AAE3B,aAAO,yBAAyB,OAAO,GAAG;AAAA,IAC5C;AAAA,IAEA,MAAM,kBAAkB,OAAO,OAAO,KAAK;AACzC,YAAM,QAAQ,MAAM,oBAAoB,OAAO,GAAG;AAClD,UAAI,MAAM,MAAM;AAChB,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAC1C,YAAI,WAAW;AACf,YAAI,IAAI,WAAW,UAAU;AAC3B,qBAAY,MAAM,eAAe,IAAI,KAAK,KAAK,EAAE,gBAAgB,KAAK,CAAC,KAAM;AAC7E,cAAI,CAAC,UAAU;AASb,kBAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,gBAAI,OAAO;AACT,oBAAM;AACN,yBAAW,2BAA2B,SAAS,MAAM,MAAM;AAK3D,kBAAI,SAAU,OAAM,MAAM;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,UAAU;AACb,4BAAkB,KAAK;AACvB,iBAAO;AAAA,QACT;AACA,cAAM,kBAAkB;AAAA,MAC1B;AAEA,UAAI,kBAAkB;AACtB,YAAM,gBAAgB;AACtB,UAAI,cAAc,oBAAI,KAAK;AAE3B,UAAI,IAAI,YAAY;AAClB,YAAI,kBAAkB,yBAAyB,IAAI,gBAAgB,IAAI,UAAU;AACjF,YAAI,IAAI,WAAW;AACjB,cAAI,aAAa,aAAa,IAAI,gBAAgB,IAAI,YAAY,IAAI,SAAS;AAAA,QACjF;AAAA,MACF;AAEA,aAAO,yBAAyB,OAAO,GAAG;AAAA,IAC5C;AAAA,IAEA,MAAM,YAAY,OAAO,OAAO,KAAK;AACnC,YAAM,MAAM,MAAM,aAAa,OAAO,GAAG;AACzC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,OAAO,KAAK,YAAY;AAClD,UAAI,IAAI,WAAW,eAAe,IAAI,WAAW,aAAa;AAC5D,0BAAkB,KAAK;AACvB,eAAO;AAAA,MACT;AAEA,YAAM,cAAc,kBAAkB,IAAI,KAAK;AAC/C,YAAM,QAAQ,eAAe,iBAAiB,YAAY,KAAK,GAAG,IAAI,cAAc;AACpF,YAAM,WAAW,OAAO,OAAO;AAC/B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,OAAgC;AAAA,QACpC,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,GAAI,OAAO,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,QACrE,GAAI,QACA;AAAA,UACE,YAAY,SAAS,cAAc;AAAA,UACnC,MAAM,SAAS,QAAQ;AAAA,UACvB,GAAG,uBAAuB,KAAK;AAAA,QACjC,IACA,CAAC;AAAA,QACL,iBAAiB;AAAA,MACnB;AAEA,YAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,QAClD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,uBAA8C;AAAA,MAC/D,GAA+B,IAAI;AACnC,wBAAkB,KAAK;AAEvB,UAAI,aAAa,GAAG;AAClB,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,eAAS,SAAS;AAClB,eAAS,aAAa;AACtB,eAAS,kBAAkB;AAC3B,eAAS,aAAa;AACtB,UAAI,OAAO,eAAe;AACxB,iBAAS,gBAAgB,MAAM;AAAA,MACjC;AAEA,YAAM,eAAgB,MAAM,aAAa,OAAO,GAAG,KAAM;AAEzD,YAAM,SAAS,KAAK,gBAAgB,eAAe;AAAA,QACjD,GAAG,gBAAgB,YAAY;AAAA,QAC/B,eAAe,aAAa;AAAA,QAC5B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,KAAK;AAC/B,YAAM,MAAM,MAAM,aAAa,OAAO,GAAG;AACzC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,OAAO,KAAK,YAAY;AAClD,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAC1C,0BAAkB,KAAK;AACvB,eAAO;AAAA,MACT;AAEA,YAAM,cAAc,kBAAkB,IAAI,KAAK;AAC/C,YAAM,QAAQ,eAAe,iBAAiB,YAAY,KAAK,GAAG,IAAI,cAAc;AACpF,YAAM,WAAW,OAAO,OAAO;AAC/B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,OAAgC;AAAA,QACpC,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,cAAc,MAAM;AAAA,QACpB,YAAY,MAAM;AAAA,QAClB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,QACpE,WAAW;AAAA,QACX,GAAI,QACA;AAAA,UACE,YAAY,SAAS,cAAc;AAAA,UACnC,MAAM,SAAS,QAAQ;AAAA,UACvB,GAAG,uBAAuB,KAAK;AAAA,QACjC,IACA,CAAC;AAAA,MACP;AAEA,YAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,QAClD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,mBAA0C;AAAA,MAC3D,GAA+B,IAAI;AACnC,wBAAkB,KAAK;AAEvB,UAAI,aAAa,GAAG;AAClB,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,eAAS,SAAS;AAClB,eAAS,aAAa;AACtB,eAAS,eAAe,MAAM;AAC9B,eAAS,aAAa,MAAM;AAC5B,UAAI,MAAM,eAAe;AACvB,iBAAS,gBAAgB,MAAM;AAAA,MACjC;AAEA,YAAM,eAAgB,MAAM,aAAa,OAAO,GAAG,KAAM;AAEzD,YAAM,SAAS,KAAK,gBAAgB,YAAY;AAAA,QAC9C,GAAG,gBAAgB,YAAY;AAAA,QAC/B,cAAc,aAAa;AAAA,QAC3B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,OAAO,KAAK;AAC1B,YAAM,MAAM,MAAM,GAAG,cAAc,aAAa,eAAe,OAAO,GAAG,GAAG,EAAE,oBAAoB,KAAK,CAAC;AACxG,UAAI,kBAAkB,SAAS,IAAI,MAAM,GAAG;AAE1C,eAAO;AAAA,MACT;AACA,UAAI,CAAC,IAAI,aAAa;AACpB,cAAM,IAAI,MAAM,OAAO,KAAK,qBAAqB;AAAA,MACnD;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,eAAe,MAAM,GAAG,aAAa,aAAa;AAAA,QACtD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,aAAa;AAAA,QACb,QAAQ;AAAA,MACV,GAA+B;AAAA,QAC7B,QAAQ;AAAA,QACR,mBAAmB;AAAA,QACnB,mBAAmB,IAAI,UAAU;AAAA,QACjC,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,WAAW;AAAA,MACb,CAAC;AAED,UAAI,YAAY;AAChB,UAAI,iBAAiB,GAAG;AACtB,oBAAY,MAAM,GAAG,aAAa,aAAa;AAAA,UAC7C,GAAG,eAAe,OAAO,GAAG;AAAA,UAC5B,aAAa;AAAA,UACb,QAAQ;AAAA,QACV,GAA+B;AAAA,UAC7B,mBAAmB;AAAA,UACnB,mBAAmB,IAAI,UAAU;AAAA,UACjC,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,UAAI,iBAAiB,KAAK,cAAc,GAAG;AAEzC,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,wBAAkB,KAAK;AACvB,UAAI,eAAe,GAAG;AACpB,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,aAAa;AAAA,MACnB;AACA,UAAI,oBAAoB;AACxB,UAAI,oBAAoB,IAAI,UAAU;AAEtC,YAAM,SAAS,KAAK,gBAAgB,eAAe;AAAA,QACjD,GAAG,gBAAgB,GAAG;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI,kBAAkB;AAAA,MACxC,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,OAAO,KAAK;AAC9B,YAAM,MAAM,MAAM,aAAa,OAAO,GAAG;AACzC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,OAAO,KAAK,YAAY;AAClD,UAAI,IAAI,WAAW,eAAe,IAAI,WAAW,aAAa;AAC5D,0BAAkB,KAAK;AACvB,eAAO;AAAA,MACT;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,oBAAoB,IAAI,qBAAqB;AACnD,YAAM,oBAAoB,IAAI,qBAAqB,IAAI,UAAU;AACjE,YAAM,aAAa,IAAI,cAAc;AAMrC,YAAM,QAAQ,kBAAkB,IAAI,KAAK;AACzC,YAAM,WAAW,OAAO;AACxB,YAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,QAClD,GAAG,eAAe,OAAO,GAAG;AAAA,QAC5B,QAAQ,EAAE,KAAK,qBAA4C;AAAA,MAC7D,GAA+B;AAAA,QAC7B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,GAAI,SAAS,WACT;AAAA,UACE,YAAY,SAAS,cAAc;AAAA,UACnC,MAAM,SAAS,QAAQ;AAAA,UACvB,GAAG,uBAAuB,KAAK;AAAA,QACjC,IACA,CAAC;AAAA,MACP,CAAC;AACD,wBAAkB,KAAK;AAEvB,UAAI,aAAa,GAAG;AAClB,cAAM,QAAQ,MAAM,aAAa,OAAO,GAAG;AAC3C,eAAO,SAAS;AAAA,MAClB;AAEA,UAAI,SAAS;AACb,UAAI,oBAAoB;AACxB,UAAI,oBAAoB;AACxB,UAAI,aAAa;AACjB,UAAI,aAAa;AAEjB,YAAM,eAAgB,MAAM,aAAa,OAAO,GAAG,KAAM;AAEzD,YAAM,SAAS,KAAK,gBAAgB,eAAe;AAAA,QACjD,GAAG,gBAAgB,YAAY;AAAA,QAC/B,UAAU,IAAI;AAAA,QACd,gBAAgB,aAAa,kBAAkB;AAAA,MACjD,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,wBAAwB,OAAO,UAAU,gBAAgB,iBAAiB;AAU9E,YAAM,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,aAAa;AAAA,QAC9D,IAAI;AAAA,QACJ;AAAA,QACA,GAAG,gCAAgC,EAAE,gBAAgB,gBAAgB,CAAC;AAAA,MACxE,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAC/B,aAAO,KAAK,qBAAqB;AAAA,IACnC;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,aAAO,GAAG,KAAK,aAAa;AAAA,QAC1B,UAAU,IAAI;AAAA,QACd,GAAG,gCAAgC,GAAG;AAAA,QACtC,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,QACtC,aAAa;AAAA,MACf,GAAG;AAAA,QACD,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,yBAAyB,KAAK,eAAe,IAAI;AACrD,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAI;AACxD,aAAO,GAAG,KAAK,aAAa;AAAA,QAC1B,UAAU,IAAI;AAAA,QACd,GAAG,gCAAgC,GAAG;AAAA,QACtC,QAAQ,EAAE,KAAK,CAAC,aAAa,QAAQ,EAAE;AAAA,QACvC,YAAY,EAAE,MAAM,OAAO;AAAA,QAC3B,aAAa;AAAA,MACf,GAAG;AAAA,QACD,SAAS,EAAE,YAAY,OAAO;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,OAAO,OAAO,KAAK;AACvB,aAAO,GAAG,QAAQ,aAAa;AAAA,QAC7B,IAAI;AAAA,QACJ,UAAU,IAAI;AAAA,QACd,GAAG,gCAAgC,GAAG;AAAA,MACxC,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,oBACJ,UACA,iBAAiB,2BACjB,gBACA,iBACA;AACA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,iBAAiB,GAAI;AAC7D,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,GAAG,gCAAgC,EAAE,gBAAgB,gBAAgB,CAAC;AAAA,MACxE;AACA,UAAI,cAAc;AAElB,YAAM,cAAc;AAAA,QAClB,QAAQ;AAAA,QACR,KAAK;AAAA,UACH,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE;AAAA,UAC/B;AAAA,YACE,aAAa;AAAA,YACb,WAAW,EAAE,KAAK,OAAO;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,MAAM,GAAG,KAAK,aAAa,EAAE,GAAG,OAAO,GAAG,YAAY,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAE1G,iBAAW,OAAO,cAAc;AAC9B,cAAM,eAAe,GAAG,wBAAwB,qBAAqB,cAAc;AAGnF,cAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,UAClD,IAAI,IAAI;AAAA,UACR,UAAU,IAAI;AAAA,UACd,gBAAgB,IAAI,kBAAkB;AAAA,UACtC,GAAG;AAAA,QACL,GAA+B;AAAA,UAC7B,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,aAAa,EAAG;AAEpB,uBAAe;AACf,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,eAAe;AAEnB,cAAM,SAAS,KAAK,gBAAgB,YAAY;AAAA,UAC9C,GAAG,gBAAgB,GAAG;AAAA,UACtB,cAAc,IAAI;AAAA,UAClB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,gBAAgB,IAAI,kBAAkB;AAAA,QACxC,CAAC;AAAA,MACH;AAKA,YAAM,gBAAgB,IAAI,KAAK,IAAI,QAAQ,IAAI,gCAAgC,GAAI;AACnF,YAAM,qBAAqB;AAAA,QACzB,QAAQ;AAAA,QACR,WAAW,EAAE,KAAK,cAAc;AAAA,MAClC;AACA,YAAM,eAAe,MAAM,GAAG,KAAK,aAAa,EAAE,GAAG,OAAO,GAAG,mBAAmB,GAAG,EAAE,oBAAoB,KAAK,CAAC;AAEjH,iBAAW,OAAO,cAAc;AAC9B,cAAM,eAAe,GAAG,wBAAwB,yBAAyB,6BAA6B;AACtG,cAAM,WAAW,MAAM,GAAG,aAAa,aAAa;AAAA,UAClD,IAAI,IAAI;AAAA,UACR,UAAU,IAAI;AAAA,UACd,gBAAgB,IAAI,kBAAkB;AAAA,UACtC,GAAG;AAAA,QACL,GAA+B;AAAA,UAC7B,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,aAAa,EAAG;AAEpB,uBAAe;AACf,YAAI,SAAS;AACb,YAAI,aAAa;AACjB,YAAI,eAAe;AAEnB,cAAM,SAAS,KAAK,gBAAgB,YAAY;AAAA,UAC9C,GAAG,gBAAgB,GAAG;AAAA,UACtB,cAAc,IAAI;AAAA,UAClB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,gBAAgB,IAAI,kBAAkB;AAAA,QACxC,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/push_notifications/api/custom-send/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -15,6 +16,7 @@ import {
   customSendResponseSchema,
   CUSTOM_SEND_NO_DEVICES_WARNING
 } from "../../data/validators.js";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const logger = createLogger("push_notifications");
 const RESOURCE_KIND = "push_notifications.push_notification_delivery";
 const errorResponseSchema = z.object({ error: z.string() });
@@ -44,7 +46,7 @@ async function POST(req) {
     }
     const body = customSendSchema.parse(await readJsonSafe(req, {}));
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     const guardInput = {
       tenantId: auth.tenantId,
       organizationId,
@@ -94,6 +96,7 @@ async function POST(req) {
     } : { enqueued: result.enqueued };
     return NextResponse.json(responseBody, { status: result.enqueued === 0 ? 200 : 201 });
   } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
     if (err instanceof z.ZodError) {
       return NextResponse.json(
         { error: translate("push_notifications.errors.invalid_payload", "Invalid request"), details: err.flatten() },

package/dist/modules/push_notifications/api/custom-send/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/push_notifications/api/custom-send/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { AwilixContainer } from 'awilix'\nimport {\n  customSendSchema,\n  customSendResponseSchema,\n  CUSTOM_SEND_NO_DEVICES_WARNING,\n} from '../../data/validators'\nimport type { PushNotificationService } from '../../lib/send-custom-push'\n\nconst logger = createLogger('push_notifications')\n\nconst RESOURCE_KIND = 'push_notifications.push_notification_delivery'\n\nconst errorResponseSchema = z.object({ error: z.string() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['push_notifications.send_custom'] },\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  container: AwilixContainer,\n  userFeatures: string[],\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (!legacyGuard) return { ok: true, afterSuccessCallbacks: [] }\n  return runMutationGuards([legacyGuard], input, { userFeatures })\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId || !auth.sub) {\n      return NextResponse.json(\n        { error: translate('push_notifications.errors.unauthorized', 'Unauthorized') },\n        { status: 401 },\n      )\n    }\n\n    const body = customSendSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    // Custom write route \u2192 wire the mutation-guard registry (AGENTS \u2192 API Routes). The send creates\n    // append-only delivery rows; map it to a `create` on the delivery resource keyed by recipient.\n    const guardInput: MutationGuardInput = {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub,\n      resourceKind: RESOURCE_KIND,\n      resourceId: body.recipientUserId,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    }\n    const guardResult = await runGuards(container, resolveUserFeatures(auth), guardInput)\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: translate('push_notifications.errors.send_failed', 'Operation blocked') },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const service = container.resolve('pushNotificationService') as PushNotificationService\n    const result = await service.sendCustomPush({\n      resolve: (<T = unknown,>(name: string): T => container.resolve(name) as T),\n      tenantId: auth.tenantId,\n      userId: body.recipientUserId,\n      organizationId,\n      deviceId: body.deviceId,\n      title: body.title,\n      body: body.body ?? null,\n      data: body.data,\n      pushOptions: body.pushOptions,\n      silent: body.silent ?? false,\n    })\n\n    for (const callback of guardResult.afterSuccessCallbacks) {\n      if (!callback.guard.afterSuccess) continue\n      await callback.guard.afterSuccess({\n        ...guardInput,\n        resourceId: body.recipientUserId,\n        metadata: callback.metadata ?? null,\n      })\n    }\n\n    // A well-formed request that enqueued nothing (no push channel, no in-scope device, or no device\n    // whose provider matches an active channel) previously returned a bare 201 \u2014 a silent\n    // success-with-no-send that hid, for example, a tenant-level admin targeting org-scoped devices.\n    // Surface an explicit machine-readable warning + human message so the caller can react.\n    const responseBody: z.infer<typeof customSendResponseSchema> =\n      result.enqueued === 0\n        ? {\n            enqueued: 0,\n            warning: CUSTOM_SEND_NO_DEVICES_WARNING,\n            message: translate(\n              'push_notifications.warnings.no_matching_devices_in_scope',\n              'No push-capable devices matched this recipient in the selected scope, so nothing was sent.',\n            ),\n          }\n        : { enqueued: result.enqueued }\n\n    // 201 Created only when jobs were actually enqueued; the no-op branch returns 200 OK so callers\n    // that key off the status code aren't told something was created when nothing was.\n    return NextResponse.json(responseBody, { status: result.enqueued === 0 ? 200 : 201 })\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('push_notifications.errors.invalid_payload', 'Invalid request'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    logger.error('push_notifications.custom-send.POST failed', { err })\n    return NextResponse.json(\n      { error: translate('push_notifications.errors.send_failed', 'Failed to send push notification') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi = {\n  POST: {\n    summary: 'Send a custom push notification',\n    description:\n      \"Admin-only: deliver a one-off, free-text visible push to all of a single user's push-capable devices. No in-app notification or email is created.\",\n    tags: ['PushNotifications'],\n    requestBody: { schema: customSendSchema },\n    responses: {\n      200: {\n        description:\n          'Nothing was deliverable in scope: `enqueued` is 0 and a `warning` code plus human `message` explain why (no silent no-op). Returned instead of 201 because nothing was created.',\n        content: { 'application/json': { schema: customSendResponseSchema } },\n      },\n      201: {\n        description: 'Per-device push jobs enqueued.',\n        content: { 'application/json': { schema: customSendResponseSchema } },\n      },\n      400: {\n        description: 'Invalid request',\n        content: { 'application/json': { schema: errorResponseSchema } },\n      },\n      401: {\n        description: 'Unauthorized',\n        content: { 'application/json': { schema: errorResponseSchema } },\n      },\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,MAAM,SAAS,aAAa,oBAAoB;AAEhD,MAAM,gBAAgB;AAEtB,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AACjF;AAEA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,WACA,cACA,OAMC;AACD,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,CAAC,YAAa,QAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAC/D,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO,EAAE,aAAa,CAAC;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,KAAK;AACxC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,0CAA0C,cAAc,EAAE;AAAA,QAC7E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,iBAAiB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC/D,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAI1D,UAAM,aAAiC;AAAA,MACrC,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AACA,UAAM,cAAc,MAAM,UAAU,WAAW,oBAAoB,IAAI,GAAG,UAAU;AACpF,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,UAAU,yCAAyC,mBAAmB,EAAE;AAAA,QAC1G,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,UAAU,UAAU,QAAQ,yBAAyB;AAC3D,UAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,MAC1C,UAAU,CAAe,SAAoB,UAAU,QAAQ,IAAI;AAAA,MACnE,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK;AAAA,MACX,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK,UAAU;AAAA,IACzB,CAAC;AAED,eAAW,YAAY,YAAY,uBAAuB;AACxD,UAAI,CAAC,SAAS,MAAM,aAAc;AAClC,YAAM,SAAS,MAAM,aAAa;AAAA,QAChC,GAAG;AAAA,QACH,YAAY,KAAK;AAAA,QACjB,UAAU,SAAS,YAAY;AAAA,MACjC,CAAC;AAAA,IACH;AAMA,UAAM,eACJ,OAAO,aAAa,IAChB;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF,IACA,EAAE,UAAU,OAAO,SAAS;AAIlC,WAAO,aAAa,KAAK,cAAc,EAAE,QAAQ,OAAO,aAAa,IAAI,MAAM,IAAI,CAAC;AAAA,EACtF,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,6CAA6C,iBAAiB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QAC3G,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yCAAyC,kCAAkC,EAAE;AAAA,MAChG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,aACE;AAAA,IACF,MAAM,CAAC,mBAAmB;AAAA,IAC1B,aAAa,EAAE,QAAQ,iBAAiB;AAAA,IACxC,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aACE;AAAA,QACF,SAAS,EAAE,oBAAoB,EAAE,QAAQ,yBAAyB,EAAE;AAAA,MACtE;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,yBAAyB,EAAE;AAAA,MACtE;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;AAAA,MACjE;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { AwilixContainer } from 'awilix'\nimport {\n  customSendSchema,\n  customSendResponseSchema,\n  CUSTOM_SEND_NO_DEVICES_WARNING,\n} from '../../data/validators'\nimport type { PushNotificationService } from '../../lib/send-custom-push'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst logger = createLogger('push_notifications')\n\nconst RESOURCE_KIND = 'push_notifications.push_notification_delivery'\n\nconst errorResponseSchema = z.object({ error: z.string() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['push_notifications.send_custom'] },\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  container: AwilixContainer,\n  userFeatures: string[],\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (!legacyGuard) return { ok: true, afterSuccessCallbacks: [] }\n  return runMutationGuards([legacyGuard], input, { userFeatures })\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId || !auth.sub) {\n      return NextResponse.json(\n        { error: translate('push_notifications.errors.unauthorized', 'Unauthorized') },\n        { status: 401 },\n      )\n    }\n\n    const body = customSendSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n    // Custom write route \u2192 wire the mutation-guard registry (AGENTS \u2192 API Routes). The send creates\n    // append-only delivery rows; map it to a `create` on the delivery resource keyed by recipient.\n    const guardInput: MutationGuardInput = {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub,\n      resourceKind: RESOURCE_KIND,\n      resourceId: body.recipientUserId,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    }\n    const guardResult = await runGuards(container, resolveUserFeatures(auth), guardInput)\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: translate('push_notifications.errors.send_failed', 'Operation blocked') },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const service = container.resolve('pushNotificationService') as PushNotificationService\n    const result = await service.sendCustomPush({\n      resolve: (<T = unknown,>(name: string): T => container.resolve(name) as T),\n      tenantId: auth.tenantId,\n      userId: body.recipientUserId,\n      organizationId,\n      deviceId: body.deviceId,\n      title: body.title,\n      body: body.body ?? null,\n      data: body.data,\n      pushOptions: body.pushOptions,\n      silent: body.silent ?? false,\n    })\n\n    for (const callback of guardResult.afterSuccessCallbacks) {\n      if (!callback.guard.afterSuccess) continue\n      await callback.guard.afterSuccess({\n        ...guardInput,\n        resourceId: body.recipientUserId,\n        metadata: callback.metadata ?? null,\n      })\n    }\n\n    // A well-formed request that enqueued nothing (no push channel, no in-scope device, or no device\n    // whose provider matches an active channel) previously returned a bare 201 \u2014 a silent\n    // success-with-no-send that hid, for example, a tenant-level admin targeting org-scoped devices.\n    // Surface an explicit machine-readable warning + human message so the caller can react.\n    const responseBody: z.infer<typeof customSendResponseSchema> =\n      result.enqueued === 0\n        ? {\n            enqueued: 0,\n            warning: CUSTOM_SEND_NO_DEVICES_WARNING,\n            message: translate(\n              'push_notifications.warnings.no_matching_devices_in_scope',\n              'No push-capable devices matched this recipient in the selected scope, so nothing was sent.',\n            ),\n          }\n        : { enqueued: result.enqueued }\n\n    // 201 Created only when jobs were actually enqueued; the no-op branch returns 200 OK so callers\n    // that key off the status code aren't told something was created when nothing was.\n    return NextResponse.json(responseBody, { status: result.enqueued === 0 ? 200 : 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('push_notifications.errors.invalid_payload', 'Invalid request'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    logger.error('push_notifications.custom-send.POST failed', { err })\n    return NextResponse.json(\n      { error: translate('push_notifications.errors.send_failed', 'Failed to send push notification') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi = {\n  POST: {\n    summary: 'Send a custom push notification',\n    description:\n      \"Admin-only: deliver a one-off, free-text visible push to all of a single user's push-capable devices. No in-app notification or email is created.\",\n    tags: ['PushNotifications'],\n    requestBody: { schema: customSendSchema },\n    responses: {\n      200: {\n        description:\n          'Nothing was deliverable in scope: `enqueued` is 0 and a `warning` code plus human `message` explain why (no silent no-op). Returned instead of 201 because nothing was created.',\n        content: { 'application/json': { schema: customSendResponseSchema } },\n      },\n      201: {\n        description: 'Per-device push jobs enqueued.',\n        content: { 'application/json': { schema: customSendResponseSchema } },\n      },\n      400: {\n        description: 'Invalid request',\n        content: { 'application/json': { schema: errorResponseSchema } },\n      },\n      401: {\n        description: 'Unauthorized',\n        content: { 'application/json': { schema: errorResponseSchema } },\n      },\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB;AAEhC,MAAM,SAAS,aAAa,oBAAoB;AAEhD,MAAM,gBAAgB;AAEtB,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AACjF;AAEA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,WACA,cACA,OAMC;AACD,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,CAAC,YAAa,QAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAC/D,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO,EAAE,aAAa,CAAC;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,KAAK;AACxC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,0CAA0C,cAAc,EAAE;AAAA,QAC7E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,iBAAiB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC/D,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAIzE,UAAM,aAAiC;AAAA,MACrC,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AACA,UAAM,cAAc,MAAM,UAAU,WAAW,oBAAoB,IAAI,GAAG,UAAU;AACpF,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,UAAU,yCAAyC,mBAAmB,EAAE;AAAA,QAC1G,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,UAAU,UAAU,QAAQ,yBAAyB;AAC3D,UAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,MAC1C,UAAU,CAAe,SAAoB,UAAU,QAAQ,IAAI;AAAA,MACnE,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK;AAAA,MACX,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK,UAAU;AAAA,IACzB,CAAC;AAED,eAAW,YAAY,YAAY,uBAAuB;AACxD,UAAI,CAAC,SAAS,MAAM,aAAc;AAClC,YAAM,SAAS,MAAM,aAAa;AAAA,QAChC,GAAG;AAAA,QACH,YAAY,KAAK;AAAA,QACjB,UAAU,SAAS,YAAY;AAAA,MACjC,CAAC;AAAA,IACH;AAMA,UAAM,eACJ,OAAO,aAAa,IAChB;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF,IACA,EAAE,UAAU,OAAO,SAAS;AAIlC,WAAO,aAAa,KAAK,cAAc,EAAE,QAAQ,OAAO,aAAa,IAAI,MAAM,IAAI,CAAC;AAAA,EACtF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,6CAA6C,iBAAiB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QAC3G,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yCAAyC,kCAAkC,EAAE;AAAA,MAChG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,aACE;AAAA,IACF,MAAM,CAAC,mBAAmB;AAAA,IAC1B,aAAa,EAAE,QAAQ,iBAAiB;AAAA,IACxC,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aACE;AAAA,QACF,SAAS,EAAE,oBAAoB,EAAE,QAAQ,yBAAyB,EAAE;AAAA,MACtE;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,yBAAyB,EAAE;AAAA,MACtE;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;AAAA,MACjE;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/query_index/api/status.js

@@ -13,6 +13,7 @@ import {
   SEARCH_AUTO_INDEX_CONFIG_MODULE
 } from "@open-mercato/shared/lib/search/auto-indexing";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["query_index.status.view"] }
 };
@@ -43,12 +44,12 @@ async function GET(req) {
   const em = container.resolve("em");
   const db = em.getKysely();
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope.selectedId ?? auth.orgId ?? null;
+  const { organizationIds, rbacOrganizationId: organizationId } = resolveOrganizationScopeFilter(scope, auth);
   const tenantId = typeof scope.tenantId === "string" && scope.tenantId.trim().length > 0 ? scope.tenantId.trim() : typeof auth.tenantId === "string" && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null;
   if (!tenantId) {
     return NextResponse.json({ error: "Tenant context is required" }, { status: 400 });
   }
-  const organizationFilter = scope.filterIds === null ? null : Array.isArray(scope.filterIds) && scope.filterIds.length > 0 ? scope.filterIds : organizationId ? [organizationId] : [];
+  const organizationFilter = organizationIds ?? null;
   if (Array.isArray(organizationFilter) && organizationFilter.length === 0) {
     return NextResponse.json({ error: "Organization access denied" }, { status: 403 });
   }
@@ -467,7 +468,8 @@ const queryIndexStatusDoc = {
   ],
   errors: [
     { status: 400, description: "Tenant or organization context required", schema: queryIndexErrorSchema },
-    { status: 401, description: "Authentication required", schema: queryIndexErrorSchema }
+    { status: 401, description: "Authentication required", schema: queryIndexErrorSchema },
+    { status: 403, description: "Organization access denied", schema: queryIndexErrorSchema }
   ]
 };
 const openApi = {