@open-mercato/shared 0.4.2-canary-e6bf6a353e → 0.4.2-canary-49d47ff90e

package/dist/lib/api/context.js

@@ -0,0 +1,18 @@
+import { createRequestContainer } from "../di/container.js";
+import { getAuthFromRequest } from "../auth/server.js";
+import { resolveTranslations } from "../i18n/server.js";
+async function resolveRequestContext(req) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(req);
+  const { translate } = await resolveTranslations();
+  const ctx = {
+    container,
+    auth,
+    translate
+  };
+  return { ctx };
+}
+export {
+  resolveRequestContext
+};
+//# sourceMappingURL=context.js.map

package/dist/lib/api/context.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/api/context.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport { createRequestContainer } from '../di/container'\nimport { getAuthFromRequest, type AuthContext } from '../auth/server'\nimport { resolveTranslations } from '../i18n/server'\n\nexport type RequestContext = {\n  container: AwilixContainer\n  auth: AuthContext\n  organizationScope?: unknown\n  selectedOrganizationId?: string | null\n  organizationIds?: string[] | null\n  translate: (key: string, fallback?: string) => string\n}\n\nexport type ResolveRequestContextResult = {\n  ctx: RequestContext\n}\n\n/**\n * Resolves the request context for API routes.\n * This includes container, auth, and translations.\n * For organization-scoped routes, use resolveOrganizationScopeForRequest separately.\n */\nexport async function resolveRequestContext(req: Request): Promise<ResolveRequestContextResult> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  const ctx: RequestContext = {\n    container,\n    auth,\n    translate,\n  }\n\n  return { ctx }\n}\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,0BAA4C;AACrD,SAAS,2BAA2B;AAoBpC,eAAsB,sBAAsB,KAAoD;AAC9F,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAM,MAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,EAAE,IAAI;AACf;",
+  "names": []
+}

package/dist/lib/auth/passwordPolicy.js

@@ -0,0 +1,111 @@
+import { z } from "zod";
+import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
+const DEFAULT_POLICY = {
+  minLength: 6,
+  requireDigit: true,
+  requireUppercase: true,
+  requireSpecial: true
+};
+const ENV_KEYS = {
+  minLength: "OM_PASSWORD_MIN_LENGTH",
+  requireDigit: "OM_PASSWORD_REQUIRE_DIGIT",
+  requireUppercase: "OM_PASSWORD_REQUIRE_UPPERCASE",
+  requireSpecial: "OM_PASSWORD_REQUIRE_SPECIAL"
+};
+const PUBLIC_PREFIX = "NEXT_PUBLIC_";
+function readEnvValue(env, key) {
+  const rawKey = ENV_KEYS[key];
+  const publicKey = `${PUBLIC_PREFIX}${rawKey}`;
+  const rawValue = env[rawKey];
+  if (typeof rawValue === "string" && rawValue.trim().length > 0) return rawValue;
+  const publicValue = env[publicKey];
+  if (typeof publicValue === "string" && publicValue.trim().length > 0) return publicValue;
+  return void 0;
+}
+function parsePositiveInt(raw, fallback, min = 1) {
+  if (!raw) return fallback;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed)) return fallback;
+  return Math.max(min, parsed);
+}
+function getPasswordPolicy(env = process.env) {
+  const minLength = parsePositiveInt(
+    readEnvValue(env, "minLength"),
+    DEFAULT_POLICY.minLength,
+    1
+  );
+  return {
+    minLength,
+    requireDigit: parseBooleanWithDefault(
+      readEnvValue(env, "requireDigit"),
+      DEFAULT_POLICY.requireDigit
+    ),
+    requireUppercase: parseBooleanWithDefault(
+      readEnvValue(env, "requireUppercase"),
+      DEFAULT_POLICY.requireUppercase
+    ),
+    requireSpecial: parseBooleanWithDefault(
+      readEnvValue(env, "requireSpecial"),
+      DEFAULT_POLICY.requireSpecial
+    )
+  };
+}
+function getPasswordRequirements(policy = getPasswordPolicy()) {
+  const requirements = [{ id: "minLength", value: policy.minLength }];
+  if (policy.requireDigit) requirements.push({ id: "digit" });
+  if (policy.requireUppercase) requirements.push({ id: "uppercase" });
+  if (policy.requireSpecial) requirements.push({ id: "special" });
+  return requirements;
+}
+function formatPasswordRequirements(policy, translate, keyPrefix = "auth.password.requirements") {
+  const items = getPasswordRequirements(policy).map((requirement) => {
+    switch (requirement.id) {
+      case "minLength":
+        return translate(
+          `${keyPrefix}.minLength`,
+          "At least {min} characters",
+          { min: requirement.value ?? policy.minLength }
+        );
+      case "digit":
+        return translate(`${keyPrefix}.digit`, "One number");
+      case "uppercase":
+        return translate(`${keyPrefix}.uppercase`, "One uppercase letter");
+      case "special":
+        return translate(`${keyPrefix}.special`, "One special character");
+      default:
+        return "";
+    }
+  }).filter((value) => value && value.trim().length > 0);
+  if (!items.length) return "";
+  const separator = translate(`${keyPrefix}.separator`, ", ");
+  return items.join(separator);
+}
+function validatePassword(password, policy = getPasswordPolicy()) {
+  const violations = [];
+  if (password.length < policy.minLength) violations.push("minLength");
+  if (policy.requireDigit && !/[0-9]/.test(password)) violations.push("digit");
+  if (policy.requireUppercase && !/[A-Z]/.test(password)) violations.push("uppercase");
+  if (policy.requireSpecial && !/[^A-Za-z0-9]/.test(password)) violations.push("special");
+  return { ok: violations.length === 0, violations };
+}
+function buildPasswordSchema(options) {
+  const policy = options?.policy ?? getPasswordPolicy();
+  const maxLength = options?.maxLength;
+  const message = options?.message ?? "Password does not meet the requirements.";
+  let schema = z.string().min(policy.minLength, message);
+  if (typeof maxLength === "number") schema = schema.max(maxLength, message);
+  return schema.superRefine((value, ctx) => {
+    const result = validatePassword(value, policy);
+    if (!result.ok) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message });
+    }
+  });
+}
+export {
+  buildPasswordSchema,
+  formatPasswordRequirements,
+  getPasswordPolicy,
+  getPasswordRequirements,
+  validatePassword
+};
+//# sourceMappingURL=passwordPolicy.js.map

package/dist/lib/auth/passwordPolicy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/auth/passwordPolicy.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\n\nexport type PasswordPolicy = {\n  minLength: number\n  requireDigit: boolean\n  requireUppercase: boolean\n  requireSpecial: boolean\n}\n\nexport type PasswordRequirementId = 'minLength' | 'digit' | 'uppercase' | 'special'\n\nexport type PasswordRequirement = {\n  id: PasswordRequirementId\n  value?: number\n}\n\nexport type PasswordValidationResult = {\n  ok: boolean\n  violations: PasswordRequirementId[]\n}\n\nexport type PasswordRequirementFormatter = (\n  key: string,\n  fallback: string,\n  params?: Record<string, string | number>,\n) => string\n\nconst DEFAULT_POLICY: PasswordPolicy = {\n  minLength: 6,\n  requireDigit: true,\n  requireUppercase: true,\n  requireSpecial: true,\n}\n\nconst ENV_KEYS = {\n  minLength: 'OM_PASSWORD_MIN_LENGTH',\n  requireDigit: 'OM_PASSWORD_REQUIRE_DIGIT',\n  requireUppercase: 'OM_PASSWORD_REQUIRE_UPPERCASE',\n  requireSpecial: 'OM_PASSWORD_REQUIRE_SPECIAL',\n} as const\n\nconst PUBLIC_PREFIX = 'NEXT_PUBLIC_'\n\nfunction readEnvValue(env: NodeJS.ProcessEnv, key: keyof typeof ENV_KEYS): string | undefined {\n  const rawKey = ENV_KEYS[key]\n  const publicKey = `${PUBLIC_PREFIX}${rawKey}`\n  const rawValue = env[rawKey]\n  if (typeof rawValue === 'string' && rawValue.trim().length > 0) return rawValue\n  const publicValue = env[publicKey]\n  if (typeof publicValue === 'string' && publicValue.trim().length > 0) return publicValue\n  return undefined\n}\n\nfunction parsePositiveInt(raw: string | undefined, fallback: number, min = 1): number {\n  if (!raw) return fallback\n  const parsed = Number.parseInt(raw, 10)\n  if (Number.isNaN(parsed)) return fallback\n  return Math.max(min, parsed)\n}\n\nexport function getPasswordPolicy(env: NodeJS.ProcessEnv = process.env): PasswordPolicy {\n  const minLength = parsePositiveInt(\n    readEnvValue(env, 'minLength'),\n    DEFAULT_POLICY.minLength,\n    1,\n  )\n  return {\n    minLength,\n    requireDigit: parseBooleanWithDefault(\n      readEnvValue(env, 'requireDigit'),\n      DEFAULT_POLICY.requireDigit,\n    ),\n    requireUppercase: parseBooleanWithDefault(\n      readEnvValue(env, 'requireUppercase'),\n      DEFAULT_POLICY.requireUppercase,\n    ),\n    requireSpecial: parseBooleanWithDefault(\n      readEnvValue(env, 'requireSpecial'),\n      DEFAULT_POLICY.requireSpecial,\n    ),\n  }\n}\n\nexport function getPasswordRequirements(policy: PasswordPolicy = getPasswordPolicy()): PasswordRequirement[] {\n  const requirements: PasswordRequirement[] = [{ id: 'minLength', value: policy.minLength }]\n  if (policy.requireDigit) requirements.push({ id: 'digit' })\n  if (policy.requireUppercase) requirements.push({ id: 'uppercase' })\n  if (policy.requireSpecial) requirements.push({ id: 'special' })\n  return requirements\n}\n\nexport function formatPasswordRequirements(\n  policy: PasswordPolicy,\n  translate: PasswordRequirementFormatter,\n  keyPrefix = 'auth.password.requirements',\n): string {\n  const items = getPasswordRequirements(policy).map((requirement) => {\n    switch (requirement.id) {\n      case 'minLength':\n        return translate(\n          `${keyPrefix}.minLength`,\n          'At least {min} characters',\n          { min: requirement.value ?? policy.minLength },\n        )\n      case 'digit':\n        return translate(`${keyPrefix}.digit`, 'One number')\n      case 'uppercase':\n        return translate(`${keyPrefix}.uppercase`, 'One uppercase letter')\n      case 'special':\n        return translate(`${keyPrefix}.special`, 'One special character')\n      default:\n        return ''\n    }\n  }).filter((value) => value && value.trim().length > 0)\n\n  if (!items.length) return ''\n  const separator = translate(`${keyPrefix}.separator`, ', ')\n  return items.join(separator)\n}\n\nexport function validatePassword(\n  password: string,\n  policy: PasswordPolicy = getPasswordPolicy(),\n): PasswordValidationResult {\n  const violations: PasswordRequirementId[] = []\n  if (password.length < policy.minLength) violations.push('minLength')\n  if (policy.requireDigit && !/[0-9]/.test(password)) violations.push('digit')\n  if (policy.requireUppercase && !/[A-Z]/.test(password)) violations.push('uppercase')\n  if (policy.requireSpecial && !/[^A-Za-z0-9]/.test(password)) violations.push('special')\n  return { ok: violations.length === 0, violations }\n}\n\nexport function buildPasswordSchema(options?: {\n  policy?: PasswordPolicy\n  maxLength?: number\n  message?: string\n}): z.ZodType<string> {\n  const policy = options?.policy ?? getPasswordPolicy()\n  const maxLength = options?.maxLength\n  const message = options?.message ?? 'Password does not meet the requirements.'\n  let schema = z.string().min(policy.minLength, message)\n  if (typeof maxLength === 'number') schema = schema.max(maxLength, message)\n  return schema.superRefine((value, ctx) => {\n    const result = validatePassword(value, policy)\n    if (!result.ok) {\n      ctx.addIssue({ code: z.ZodIssueCode.custom, message })\n    }\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,+BAA+B;AA2BxC,MAAM,iBAAiC;AAAA,EACrC,WAAW;AAAA,EACX,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,gBAAgB;AAClB;AAEA,MAAM,WAAW;AAAA,EACf,WAAW;AAAA,EACX,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,gBAAgB;AAClB;AAEA,MAAM,gBAAgB;AAEtB,SAAS,aAAa,KAAwB,KAAgD;AAC5F,QAAM,SAAS,SAAS,GAAG;AAC3B,QAAM,YAAY,GAAG,aAAa,GAAG,MAAM;AAC3C,QAAM,WAAW,IAAI,MAAM;AAC3B,MAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO;AACvE,QAAM,cAAc,IAAI,SAAS;AACjC,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,EAAG,QAAO;AAC7E,SAAO;AACT;AAEA,SAAS,iBAAiB,KAAyB,UAAkB,MAAM,GAAW;AACpF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AACjC,SAAO,KAAK,IAAI,KAAK,MAAM;AAC7B;AAEO,SAAS,kBAAkB,MAAyB,QAAQ,KAAqB;AACtF,QAAM,YAAY;AAAA,IAChB,aAAa,KAAK,WAAW;AAAA,IAC7B,eAAe;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,cAAc;AAAA,MACZ,aAAa,KAAK,cAAc;AAAA,MAChC,eAAe;AAAA,IACjB;AAAA,IACA,kBAAkB;AAAA,MAChB,aAAa,KAAK,kBAAkB;AAAA,MACpC,eAAe;AAAA,IACjB;AAAA,IACA,gBAAgB;AAAA,MACd,aAAa,KAAK,gBAAgB;AAAA,MAClC,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,wBAAwB,SAAyB,kBAAkB,GAA0B;AAC3G,QAAM,eAAsC,CAAC,EAAE,IAAI,aAAa,OAAO,OAAO,UAAU,CAAC;AACzF,MAAI,OAAO,aAAc,cAAa,KAAK,EAAE,IAAI,QAAQ,CAAC;AAC1D,MAAI,OAAO,iBAAkB,cAAa,KAAK,EAAE,IAAI,YAAY,CAAC;AAClE,MAAI,OAAO,eAAgB,cAAa,KAAK,EAAE,IAAI,UAAU,CAAC;AAC9D,SAAO;AACT;AAEO,SAAS,2BACd,QACA,WACA,YAAY,8BACJ;AACR,QAAM,QAAQ,wBAAwB,MAAM,EAAE,IAAI,CAAC,gBAAgB;AACjE,YAAQ,YAAY,IAAI;AAAA,MACtB,KAAK;AACH,eAAO;AAAA,UACL,GAAG,SAAS;AAAA,UACZ;AAAA,UACA,EAAE,KAAK,YAAY,SAAS,OAAO,UAAU;AAAA,QAC/C;AAAA,MACF,KAAK;AACH,eAAO,UAAU,GAAG,SAAS,UAAU,YAAY;AAAA,MACrD,KAAK;AACH,eAAO,UAAU,GAAG,SAAS,cAAc,sBAAsB;AAAA,MACnE,KAAK;AACH,eAAO,UAAU,GAAG,SAAS,YAAY,uBAAuB;AAAA,MAClE;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC,EAAE,OAAO,CAAC,UAAU,SAAS,MAAM,KAAK,EAAE,SAAS,CAAC;AAErD,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,QAAM,YAAY,UAAU,GAAG,SAAS,cAAc,IAAI;AAC1D,SAAO,MAAM,KAAK,SAAS;AAC7B;AAEO,SAAS,iBACd,UACA,SAAyB,kBAAkB,GACjB;AAC1B,QAAM,aAAsC,CAAC;AAC7C,MAAI,SAAS,SAAS,OAAO,UAAW,YAAW,KAAK,WAAW;AACnE,MAAI,OAAO,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAG,YAAW,KAAK,OAAO;AAC3E,MAAI,OAAO,oBAAoB,CAAC,QAAQ,KAAK,QAAQ,EAAG,YAAW,KAAK,WAAW;AACnF,MAAI,OAAO,kBAAkB,CAAC,eAAe,KAAK,QAAQ,EAAG,YAAW,KAAK,SAAS;AACtF,SAAO,EAAE,IAAI,WAAW,WAAW,GAAG,WAAW;AACnD;AAEO,SAAS,oBAAoB,SAId;AACpB,QAAM,SAAS,SAAS,UAAU,kBAAkB;AACpD,QAAM,YAAY,SAAS;AAC3B,QAAM,UAAU,SAAS,WAAW;AACpC,MAAI,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,WAAW,OAAO;AACrD,MAAI,OAAO,cAAc,SAAU,UAAS,OAAO,IAAI,WAAW,OAAO;AACzE,SAAO,OAAO,YAAY,CAAC,OAAO,QAAQ;AACxC,UAAM,SAAS,iBAAiB,OAAO,MAAM;AAC7C,QAAI,CAAC,OAAO,IAAI;AACd,UAAI,SAAS,EAAE,MAAM,EAAE,aAAa,QAAQ,QAAQ,CAAC;AAAA,IACvD;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/lib/auth/server.js

@@ -90,6 +90,7 @@ async function resolveApiKeyAuth(secret) {
       await em.persistAndFlush(record);
     } catch {
     }
+    const actualUserId = record.sessionUserId ?? record.createdBy ?? null;
     return {
       sub: `api_key:${record.id}`,
       tenantId: record.tenantId ?? null,
@@ -97,7 +98,8 @@ async function resolveApiKeyAuth(secret) {
       roles: roleNames,
       isApiKey: true,
       keyId: record.id,
-      keyName: record.name
+      keyName: record.name,
+      ...actualUserId ? { userId: actualUserId } : {}
     };
   } catch {
     return null;

package/dist/lib/auth/server.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/auth/server.ts"],
-  "sourcesContent": ["import { cookies } from 'next/headers'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { verifyJwt } from './jwt'\n\nconst TENANT_COOKIE_NAME = 'om_selected_tenant'\nconst ORGANIZATION_COOKIE_NAME = 'om_selected_org'\nconst ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'\nconst SUPERADMIN_ROLE = 'superadmin'\n\nexport type AuthContext = {\n  sub: string\n  tenantId: string | null\n  orgId: string | null\n  email?: string\n  roles?: string[]\n  isApiKey?: boolean\n  keyId?: string\n  keyName?: string\n  [k: string]: unknown\n} | null\n\ntype CookieOverride = { applied: boolean; value: string | null }\n\nfunction decodeCookieValue(raw: string | undefined): string | null {\n  if (raw === undefined) return null\n  try {\n    const decoded = decodeURIComponent(raw)\n    return decoded ?? null\n  } catch {\n    return raw ?? null\n  }\n}\n\nfunction readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nfunction resolveTenantOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded) return { applied: true, value: null }\n  const trimmed = decoded.trim()\n  if (!trimmed) return { applied: true, value: null }\n  return { applied: true, value: trimmed }\n}\n\nfunction resolveOrganizationOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded || decoded === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  const trimmed = decoded.trim()\n  if (!trimmed || trimmed === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  return { applied: true, value: trimmed }\n}\n\nfunction isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  if ((auth as Record<string, unknown>).isSuperAdmin === true) return true\n  const roles = Array.isArray(auth?.roles) ? auth.roles : []\n  return roles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)\n}\n\nfunction applySuperAdminScope(\n  auth: AuthContext,\n  tenantCookie: string | undefined,\n  orgCookie: string | undefined\n): AuthContext {\n  if (!auth || !isSuperAdminAuth(auth)) return auth\n\n  const tenantOverride = resolveTenantOverride(tenantCookie)\n  const orgOverride = resolveOrganizationOverride(orgCookie)\n  if (!tenantOverride.applied && !orgOverride.applied) return auth\n\n  type MutableAuthContext = Exclude<AuthContext, null> & {\n    actorTenantId?: string | null\n    actorOrgId?: string | null\n  }\n  const baseAuth = auth as Exclude<AuthContext, null>\n  const next: MutableAuthContext = { ...baseAuth }\n  if (tenantOverride.applied) {\n    if (!('actorTenantId' in next)) next.actorTenantId = auth?.tenantId ?? null\n    next.tenantId = tenantOverride.value\n  }\n  if (orgOverride.applied) {\n    if (!('actorOrgId' in next)) next.actorOrgId = auth?.orgId ?? null\n    next.orgId = orgOverride.value\n  }\n  next.isSuperAdmin = true\n  const existingRoles = Array.isArray(next.roles) ? next.roles : []\n  if (!existingRoles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)) {\n    next.roles = [...existingRoles, 'superadmin']\n  }\n  return next\n}\n\nasync function resolveApiKeyAuth(secret: string): Promise<AuthContext> {\n  if (!secret) return null\n  try {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')\n    const { Role } = await import('@open-mercato/core/modules/auth/data/entities')\n\n    const record = await findApiKeyBySecret(em, secret)\n    if (!record) return null\n\n    const roleIds = Array.isArray(record.rolesJson)\n      ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)\n      : []\n    const roles = roleIds.length\n      ? await em.find(Role, { id: { $in: roleIds } })\n      : []\n    const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)\n\n    try {\n      record.lastUsedAt = new Date()\n      await em.persistAndFlush(record)\n    } catch {\n      // best-effort update; ignore write failures\n    }\n\n    return {\n      sub: `api_key:${record.id}`,\n      tenantId: record.tenantId ?? null,\n      orgId: record.organizationId ?? null,\n      roles: roleNames,\n      isApiKey: true,\n      keyId: record.id,\n      keyName: record.name,\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction extractApiKey(req: Request): string | null {\n  const header = (req.headers.get('x-api-key') || '').trim()\n  if (header) return header\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  if (authHeader.toLowerCase().startsWith('apikey ')) {\n    return authHeader.slice(7).trim()\n  }\n  return null\n}\n\nexport async function getAuthFromCookies(): Promise<AuthContext> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('auth_token')?.value\n  if (!token) return null\n  try {\n    const payload = verifyJwt(token) as AuthContext\n    if (!payload) return null\n    const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value\n    const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value\n    return applySuperAdminScope(payload, tenantCookie, orgCookie)\n  } catch {\n    return null\n  }\n}\n\nexport async function getAuthFromRequest(req: Request): Promise<AuthContext> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const tenantCookie = readCookieFromHeader(cookieHeader, TENANT_COOKIE_NAME)\n  const orgCookie = readCookieFromHeader(cookieHeader, ORGANIZATION_COOKIE_NAME)\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()\n  if (!token) {\n    const match = cookieHeader.match(/(?:^|;\\s*)auth_token=([^;]+)/)\n    if (match) token = decodeURIComponent(match[1])\n  }\n  if (token) {\n    try {\n      const payload = verifyJwt(token) as AuthContext\n      if (payload) return applySuperAdminScope(payload, tenantCookie, orgCookie)\n    } catch {\n      // fall back to API key detection\n    }\n  }\n\n  const apiKey = extractApiKey(req)\n  if (!apiKey) return null\n  const apiAuth = await resolveApiKeyAuth(apiKey)\n  if (!apiAuth) return null\n  return applySuperAdminScope(apiAuth, tenantCookie, orgCookie)\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,iBAAiB;AAE1B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iCAAiC;AACvC,MAAM,kBAAkB;AAgBxB,SAAS,kBAAkB,KAAwC;AACjE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,UAAM,UAAU,mBAAmB,GAAG;AACtC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,QAAmC,MAAkC;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAyC;AACtE,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,4BAA4B,KAAyC;AAC5E,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,iBAAiB,MAA+C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAiC,iBAAiB,KAAM,QAAO;AACpE,QAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC;AACzD,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe;AACvG;AAEA,SAAS,qBACP,MACA,cACA,WACa;AACb,MAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAG,QAAO;AAE7C,QAAM,iBAAiB,sBAAsB,YAAY;AACzD,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,eAAe,WAAW,CAAC,YAAY,QAAS,QAAO;AAM5D,QAAM,WAAW;AACjB,QAAM,OAA2B,EAAE,GAAG,SAAS;AAC/C,MAAI,eAAe,SAAS;AAC1B,QAAI,EAAE,mBAAmB,MAAO,MAAK,gBAAgB,MAAM,YAAY;AACvE,SAAK,WAAW,eAAe;AAAA,EACjC;AACA,MAAI,YAAY,SAAS;AACvB,QAAI,EAAE,gBAAgB,MAAO,MAAK,aAAa,MAAM,SAAS;AAC9D,SAAK,QAAQ,YAAY;AAAA,EAC3B;AACA,OAAK,eAAe;AACpB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAChE,MAAI,CAAC,cAAc,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe,GAAG;AAC5G,SAAK,QAAQ,CAAC,GAAG,eAAe,YAAY;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAe,kBAAkB,QAAsC;AACrE,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,4DAA4D;AACxG,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,+CAA+C;AAE7E,UAAM,SAAS,MAAM,mBAAmB,IAAI,MAAM;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,UAAU,MAAM,QAAQ,OAAO,SAAS,IAC1C,OAAO,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IACjG,CAAC;AACL,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC,IAC5C,CAAC;AACL,UAAM,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAE7H,QAAI;AACF,aAAO,aAAa,oBAAI,KAAK;AAC7B,YAAM,GAAG,gBAAgB,MAAM;AAAA,IACjC,QAAQ;AAAA,IAER;AAEA,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,EAAE;AAAA,MACzB,UAAU,OAAO,YAAY;AAAA,MAC7B,OAAO,OAAO,kBAAkB;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,IAClB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAA6B;AAClD,QAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK;AACzD,MAAI,OAAQ,QAAO;AACnB,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,WAAO,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAsB,qBAA2C;AAC/D,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,eAAe,YAAY,IAAI,kBAAkB,GAAG;AAC1D,UAAM,YAAY,YAAY,IAAI,wBAAwB,GAAG;AAC7D,WAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,mBAAmB,KAAoC;AAC3E,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,eAAe,qBAAqB,cAAc,kBAAkB;AAC1E,QAAM,YAAY,qBAAqB,cAAc,wBAAwB;AAC7E,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,EAAG,SAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,aAAa,MAAM,8BAA8B;AAC/D,QAAI,MAAO,SAAQ,mBAAmB,MAAM,CAAC,CAAC;AAAA,EAChD;AACA,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU,UAAU,KAAK;AAC/B,UAAI,QAAS,QAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,IAC3E,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,MAAM,kBAAkB,MAAM;AAC9C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,qBAAqB,SAAS,cAAc,SAAS;AAC9D;",
+  "sourcesContent": ["import { cookies } from 'next/headers'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { verifyJwt } from './jwt'\n\nconst TENANT_COOKIE_NAME = 'om_selected_tenant'\nconst ORGANIZATION_COOKIE_NAME = 'om_selected_org'\nconst ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'\nconst SUPERADMIN_ROLE = 'superadmin'\n\nexport type AuthContext = {\n  sub: string\n  tenantId: string | null\n  orgId: string | null\n  email?: string\n  roles?: string[]\n  isApiKey?: boolean\n  userId?: string\n  keyId?: string\n  keyName?: string\n  [k: string]: unknown\n} | null\n\ntype CookieOverride = { applied: boolean; value: string | null }\n\nfunction decodeCookieValue(raw: string | undefined): string | null {\n  if (raw === undefined) return null\n  try {\n    const decoded = decodeURIComponent(raw)\n    return decoded ?? null\n  } catch {\n    return raw ?? null\n  }\n}\n\nfunction readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nfunction resolveTenantOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded) return { applied: true, value: null }\n  const trimmed = decoded.trim()\n  if (!trimmed) return { applied: true, value: null }\n  return { applied: true, value: trimmed }\n}\n\nfunction resolveOrganizationOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded || decoded === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  const trimmed = decoded.trim()\n  if (!trimmed || trimmed === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  return { applied: true, value: trimmed }\n}\n\nfunction isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  if ((auth as Record<string, unknown>).isSuperAdmin === true) return true\n  const roles = Array.isArray(auth?.roles) ? auth.roles : []\n  return roles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)\n}\n\nfunction applySuperAdminScope(\n  auth: AuthContext,\n  tenantCookie: string | undefined,\n  orgCookie: string | undefined\n): AuthContext {\n  if (!auth || !isSuperAdminAuth(auth)) return auth\n\n  const tenantOverride = resolveTenantOverride(tenantCookie)\n  const orgOverride = resolveOrganizationOverride(orgCookie)\n  if (!tenantOverride.applied && !orgOverride.applied) return auth\n\n  type MutableAuthContext = Exclude<AuthContext, null> & {\n    actorTenantId?: string | null\n    actorOrgId?: string | null\n  }\n  const baseAuth = auth as Exclude<AuthContext, null>\n  const next: MutableAuthContext = { ...baseAuth }\n  if (tenantOverride.applied) {\n    if (!('actorTenantId' in next)) next.actorTenantId = auth?.tenantId ?? null\n    next.tenantId = tenantOverride.value\n  }\n  if (orgOverride.applied) {\n    if (!('actorOrgId' in next)) next.actorOrgId = auth?.orgId ?? null\n    next.orgId = orgOverride.value\n  }\n  next.isSuperAdmin = true\n  const existingRoles = Array.isArray(next.roles) ? next.roles : []\n  if (!existingRoles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)) {\n    next.roles = [...existingRoles, 'superadmin']\n  }\n  return next\n}\n\nasync function resolveApiKeyAuth(secret: string): Promise<AuthContext> {\n  if (!secret) return null\n  try {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')\n    const { Role } = await import('@open-mercato/core/modules/auth/data/entities')\n\n    const record = await findApiKeyBySecret(em, secret)\n    if (!record) return null\n\n    const roleIds = Array.isArray(record.rolesJson)\n      ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)\n      : []\n    const roles = roleIds.length\n      ? await em.find(Role, { id: { $in: roleIds } })\n      : []\n    const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)\n\n    try {\n      record.lastUsedAt = new Date()\n      await em.persistAndFlush(record)\n    } catch {\n      // best-effort update; ignore write failures\n    }\n\n    // For session keys, use sessionUserId; for regular keys, use createdBy\n    const actualUserId = record.sessionUserId ?? record.createdBy ?? null\n\n    return {\n      sub: `api_key:${record.id}`,\n      tenantId: record.tenantId ?? null,\n      orgId: record.organizationId ?? null,\n      roles: roleNames,\n      isApiKey: true,\n      keyId: record.id,\n      keyName: record.name,\n      ...(actualUserId ? { userId: actualUserId } : {}),\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction extractApiKey(req: Request): string | null {\n  const header = (req.headers.get('x-api-key') || '').trim()\n  if (header) return header\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  if (authHeader.toLowerCase().startsWith('apikey ')) {\n    return authHeader.slice(7).trim()\n  }\n  return null\n}\n\nexport async function getAuthFromCookies(): Promise<AuthContext> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('auth_token')?.value\n  if (!token) return null\n  try {\n    const payload = verifyJwt(token) as AuthContext\n    if (!payload) return null\n    const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value\n    const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value\n    return applySuperAdminScope(payload, tenantCookie, orgCookie)\n  } catch {\n    return null\n  }\n}\n\nexport async function getAuthFromRequest(req: Request): Promise<AuthContext> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const tenantCookie = readCookieFromHeader(cookieHeader, TENANT_COOKIE_NAME)\n  const orgCookie = readCookieFromHeader(cookieHeader, ORGANIZATION_COOKIE_NAME)\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()\n  if (!token) {\n    const match = cookieHeader.match(/(?:^|;\\s*)auth_token=([^;]+)/)\n    if (match) token = decodeURIComponent(match[1])\n  }\n  if (token) {\n    try {\n      const payload = verifyJwt(token) as AuthContext\n      if (payload) return applySuperAdminScope(payload, tenantCookie, orgCookie)\n    } catch {\n      // fall back to API key detection\n    }\n  }\n\n  const apiKey = extractApiKey(req)\n  if (!apiKey) return null\n  const apiAuth = await resolveApiKeyAuth(apiKey)\n  if (!apiAuth) return null\n  return applySuperAdminScope(apiAuth, tenantCookie, orgCookie)\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,iBAAiB;AAE1B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iCAAiC;AACvC,MAAM,kBAAkB;AAiBxB,SAAS,kBAAkB,KAAwC;AACjE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,UAAM,UAAU,mBAAmB,GAAG;AACtC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,QAAmC,MAAkC;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAyC;AACtE,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,4BAA4B,KAAyC;AAC5E,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,iBAAiB,MAA+C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAiC,iBAAiB,KAAM,QAAO;AACpE,QAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC;AACzD,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe;AACvG;AAEA,SAAS,qBACP,MACA,cACA,WACa;AACb,MAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAG,QAAO;AAE7C,QAAM,iBAAiB,sBAAsB,YAAY;AACzD,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,eAAe,WAAW,CAAC,YAAY,QAAS,QAAO;AAM5D,QAAM,WAAW;AACjB,QAAM,OAA2B,EAAE,GAAG,SAAS;AAC/C,MAAI,eAAe,SAAS;AAC1B,QAAI,EAAE,mBAAmB,MAAO,MAAK,gBAAgB,MAAM,YAAY;AACvE,SAAK,WAAW,eAAe;AAAA,EACjC;AACA,MAAI,YAAY,SAAS;AACvB,QAAI,EAAE,gBAAgB,MAAO,MAAK,aAAa,MAAM,SAAS;AAC9D,SAAK,QAAQ,YAAY;AAAA,EAC3B;AACA,OAAK,eAAe;AACpB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAChE,MAAI,CAAC,cAAc,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe,GAAG;AAC5G,SAAK,QAAQ,CAAC,GAAG,eAAe,YAAY;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAe,kBAAkB,QAAsC;AACrE,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,4DAA4D;AACxG,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,+CAA+C;AAE7E,UAAM,SAAS,MAAM,mBAAmB,IAAI,MAAM;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,UAAU,MAAM,QAAQ,OAAO,SAAS,IAC1C,OAAO,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IACjG,CAAC;AACL,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC,IAC5C,CAAC;AACL,UAAM,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAE7H,QAAI;AACF,aAAO,aAAa,oBAAI,KAAK;AAC7B,YAAM,GAAG,gBAAgB,MAAM;AAAA,IACjC,QAAQ;AAAA,IAER;AAGA,UAAM,eAAe,OAAO,iBAAiB,OAAO,aAAa;AAEjE,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,EAAE;AAAA,MACzB,UAAU,OAAO,YAAY;AAAA,MAC7B,OAAO,OAAO,kBAAkB;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,IACjD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAA6B;AAClD,QAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK;AACzD,MAAI,OAAQ,QAAO;AACnB,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,WAAO,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAsB,qBAA2C;AAC/D,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,eAAe,YAAY,IAAI,kBAAkB,GAAG;AAC1D,UAAM,YAAY,YAAY,IAAI,wBAAwB,GAAG;AAC7D,WAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,mBAAmB,KAAoC;AAC3E,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,eAAe,qBAAqB,cAAc,kBAAkB;AAC1E,QAAM,YAAY,qBAAqB,cAAc,wBAAwB;AAC7E,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,EAAG,SAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,aAAa,MAAM,8BAA8B;AAC/D,QAAI,MAAO,SAAQ,mBAAmB,MAAM,CAAC,CAAC;AAAA,EAChD;AACA,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU,UAAU,KAAK;AAC/B,UAAI,QAAS,QAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,IAC3E,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,MAAM,kBAAkB,MAAM;AAC9C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,qBAAqB,SAAS,cAAc,SAAS;AAC9D;",
   "names": []
 }

package/dist/lib/email/send.js

@@ -1,10 +1,17 @@
 import { Resend } from "resend";
-async function sendEmail({ to, subject, react, from }) {
+async function sendEmail({ to, subject, react, from, replyTo }) {
   const apiKey = process.env.RESEND_API_KEY;
   if (!apiKey) throw new Error("RESEND_API_KEY is not set");
   const resend = new Resend(apiKey);
   const fromAddr = from || process.env.EMAIL_FROM || "no-reply@localhost";
-  await resend.emails.send({ to, subject, from: fromAddr, react });
+  const payload = {
+    to,
+    subject,
+    from: fromAddr,
+    react,
+    ...replyTo ? { reply_to: replyTo } : {}
+  };
+  await resend.emails.send(payload);
 }
 export {
   sendEmail

package/dist/lib/email/send.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/email/send.ts"],
-  "sourcesContent": ["import { Resend } from 'resend'\nimport React from 'react'\n\nexport type SendEmailOptions = {\n  to: string\n  subject: string\n  react: React.ReactElement\n  from?: string\n}\n\nexport async function sendEmail({ to, subject, react, from }: SendEmailOptions) {\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is not set')\n  const resend = new Resend(apiKey)\n  const fromAddr = from || process.env.EMAIL_FROM || 'no-reply@localhost'\n  await resend.emails.send({ to, subject, from: fromAddr, react })\n}\n\n"],
-  "mappings": "AAAA,SAAS,cAAc;AAUvB,eAAsB,UAAU,EAAE,IAAI,SAAS,OAAO,KAAK,GAAqB;AAC9E,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AACxD,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,WAAW,QAAQ,QAAQ,IAAI,cAAc;AACnD,QAAM,OAAO,OAAO,KAAK,EAAE,IAAI,SAAS,MAAM,UAAU,MAAM,CAAC;AACjE;",
+  "sourcesContent": ["import { Resend } from 'resend'\nimport React from 'react'\n\nexport type SendEmailOptions = {\n  to: string\n  subject: string\n  react: React.ReactElement\n  from?: string\n  replyTo?: string\n}\n\nexport async function sendEmail({ to, subject, react, from, replyTo }: SendEmailOptions) {\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is not set')\n  const resend = new Resend(apiKey)\n  const fromAddr = from || process.env.EMAIL_FROM || 'no-reply@localhost'\n  const payload = {\n    to,\n    subject,\n    from: fromAddr,\n    react,\n    ...(replyTo ? { reply_to: replyTo } : {}),\n  }\n  await resend.emails.send(payload)\n}\n"],
+  "mappings": "AAAA,SAAS,cAAc;AAWvB,eAAsB,UAAU,EAAE,IAAI,SAAS,OAAO,MAAM,QAAQ,GAAqB;AACvF,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AACxD,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,WAAW,QAAQ,QAAQ,IAAI,cAAc;AACnD,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,GAAI,UAAU,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,EACzC;AACA,QAAM,OAAO,OAAO,KAAK,OAAO;AAClC;",
   "names": []
 }

package/dist/lib/frontend/notificationEvents.js

@@ -0,0 +1,48 @@
+const NOTIFICATION_DOM_EVENTS = {
+  NEW: "om:notifications:new",
+  ACTIONED: "om:notifications:actioned",
+  COUNT_CHANGED: "om:notifications:count-changed"
+};
+function emitNotificationNew(detail) {
+  if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.NEW, { detail }));
+}
+function emitNotificationActioned(notificationId) {
+  if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.ACTIONED, { detail: { notificationId } }));
+}
+function emitNotificationCountChanged(count) {
+  if (typeof window === "undefined" || typeof CustomEvent === "undefined") return;
+  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, { detail: { count } }));
+}
+function subscribeNotificationNew(handler) {
+  if (typeof window === "undefined") return () => {
+  };
+  const listener = (event) => handler(event.detail);
+  window.addEventListener(NOTIFICATION_DOM_EVENTS.NEW, listener);
+  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.NEW, listener);
+}
+function subscribeNotificationActioned(handler) {
+  if (typeof window === "undefined") return () => {
+  };
+  const listener = (event) => handler(event.detail.notificationId);
+  window.addEventListener(NOTIFICATION_DOM_EVENTS.ACTIONED, listener);
+  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.ACTIONED, listener);
+}
+function subscribeNotificationCountChanged(handler) {
+  if (typeof window === "undefined") return () => {
+  };
+  const listener = (event) => handler(event.detail.count);
+  window.addEventListener(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, listener);
+  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, listener);
+}
+export {
+  NOTIFICATION_DOM_EVENTS,
+  emitNotificationActioned,
+  emitNotificationCountChanged,
+  emitNotificationNew,
+  subscribeNotificationActioned,
+  subscribeNotificationCountChanged,
+  subscribeNotificationNew
+};
+//# sourceMappingURL=notificationEvents.js.map

package/dist/lib/frontend/notificationEvents.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/frontend/notificationEvents.ts"],
+  "sourcesContent": ["export const NOTIFICATION_DOM_EVENTS = {\n  NEW: 'om:notifications:new',\n  ACTIONED: 'om:notifications:actioned',\n  COUNT_CHANGED: 'om:notifications:count-changed',\n} as const\n\nexport type NotificationNewDetail = {\n  id: string\n  type: string\n  title: string\n  severity: string\n}\n\nexport function emitNotificationNew(detail: NotificationNewDetail): void {\n  if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return\n  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.NEW, { detail }))\n}\n\nexport function emitNotificationActioned(notificationId: string): void {\n  if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return\n  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.ACTIONED, { detail: { notificationId } }))\n}\n\nexport function emitNotificationCountChanged(count: number): void {\n  if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return\n  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, { detail: { count } }))\n}\n\nexport function subscribeNotificationNew(handler: (detail: NotificationNewDetail) => void): () => void {\n  if (typeof window === 'undefined') return () => {}\n  const listener = (event: Event) => handler((event as CustomEvent<NotificationNewDetail>).detail)\n  window.addEventListener(NOTIFICATION_DOM_EVENTS.NEW, listener)\n  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.NEW, listener)\n}\n\nexport function subscribeNotificationActioned(handler: (notificationId: string) => void): () => void {\n  if (typeof window === 'undefined') return () => {}\n  const listener = (event: Event) => handler((event as CustomEvent<{ notificationId: string }>).detail.notificationId)\n  window.addEventListener(NOTIFICATION_DOM_EVENTS.ACTIONED, listener)\n  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.ACTIONED, listener)\n}\n\nexport function subscribeNotificationCountChanged(handler: (count: number) => void): () => void {\n  if (typeof window === 'undefined') return () => {}\n  const listener = (event: Event) => handler((event as CustomEvent<{ count: number }>).detail.count)\n  window.addEventListener(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, listener)\n  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, listener)\n}\n"],
+  "mappings": "AAAO,MAAM,0BAA0B;AAAA,EACrC,KAAK;AAAA,EACL,UAAU;AAAA,EACV,eAAe;AACjB;AASO,SAAS,oBAAoB,QAAqC;AACvE,MAAI,OAAO,WAAW,eAAe,OAAO,gBAAgB,YAAa;AACzE,SAAO,cAAc,IAAI,YAAY,wBAAwB,KAAK,EAAE,OAAO,CAAC,CAAC;AAC/E;AAEO,SAAS,yBAAyB,gBAA8B;AACrE,MAAI,OAAO,WAAW,eAAe,OAAO,gBAAgB,YAAa;AACzE,SAAO,cAAc,IAAI,YAAY,wBAAwB,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;AACxG;AAEO,SAAS,6BAA6B,OAAqB;AAChE,MAAI,OAAO,WAAW,eAAe,OAAO,gBAAgB,YAAa;AACzE,SAAO,cAAc,IAAI,YAAY,wBAAwB,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACpG;AAEO,SAAS,yBAAyB,SAA8D;AACrG,MAAI,OAAO,WAAW,YAAa,QAAO,MAAM;AAAA,EAAC;AACjD,QAAM,WAAW,CAAC,UAAiB,QAAS,MAA6C,MAAM;AAC/F,SAAO,iBAAiB,wBAAwB,KAAK,QAAQ;AAC7D,SAAO,MAAM,OAAO,oBAAoB,wBAAwB,KAAK,QAAQ;AAC/E;AAEO,SAAS,8BAA8B,SAAuD;AACnG,MAAI,OAAO,WAAW,YAAa,QAAO,MAAM;AAAA,EAAC;AACjD,QAAM,WAAW,CAAC,UAAiB,QAAS,MAAkD,OAAO,cAAc;AACnH,SAAO,iBAAiB,wBAAwB,UAAU,QAAQ;AAClE,SAAO,MAAM,OAAO,oBAAoB,wBAAwB,UAAU,QAAQ;AACpF;AAEO,SAAS,kCAAkC,SAA8C;AAC9F,MAAI,OAAO,WAAW,YAAa,QAAO,MAAM;AAAA,EAAC;AACjD,QAAM,WAAW,CAAC,UAAiB,QAAS,MAAyC,OAAO,KAAK;AACjG,SAAO,iBAAiB,wBAAwB,eAAe,QAAQ;AACvE,SAAO,MAAM,OAAO,oBAAoB,wBAAwB,eAAe,QAAQ;AACzF;",
+  "names": []
+}

package/dist/lib/lib/email/send.js

@@ -1,10 +1,10 @@
 import { Resend } from "resend";
-async function sendEmail({ to, subject, react, from }) {
+async function sendEmail({ to, subject, react, from, replyTo }) {
   const apiKey = process.env.RESEND_API_KEY;
   if (!apiKey) throw new Error("RESEND_API_KEY is not set");
   const resend = new Resend(apiKey);
   const fromAddr = from || process.env.EMAIL_FROM || "no-reply@localhost";
-  await resend.emails.send({ to, subject, from: fromAddr, react });
+  await resend.emails.send({ to, subject, from: fromAddr, react, replyTo });
 }
 export {
   sendEmail

package/dist/lib/lib/email/send.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/lib/lib/email/send.ts"],
-  "sourcesContent": ["import { Resend } from 'resend'\nimport React from 'react'\n\nexport type SendEmailOptions = {\n  to: string\n  subject: string\n  react: React.ReactElement\n  from?: string\n}\n\nexport async function sendEmail({ to, subject, react, from }: SendEmailOptions) {\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is not set')\n  const resend = new Resend(apiKey)\n  const fromAddr = from || process.env.EMAIL_FROM || 'no-reply@localhost'\n  await resend.emails.send({ to, subject, from: fromAddr, react })\n}\n\n"],
-  "mappings": "AAAA,SAAS,cAAc;AAUvB,eAAsB,UAAU,EAAE,IAAI,SAAS,OAAO,KAAK,GAAqB;AAC9E,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AACxD,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,WAAW,QAAQ,QAAQ,IAAI,cAAc;AACnD,QAAM,OAAO,OAAO,KAAK,EAAE,IAAI,SAAS,MAAM,UAAU,MAAM,CAAC;AACjE;",
+  "sourcesContent": ["import { Resend } from 'resend'\nimport React from 'react'\n\nexport type SendEmailOptions = {\n  to: string\n  subject: string\n  react: React.ReactElement\n  from?: string\n  replyTo?: string\n}\n\nexport async function sendEmail({ to, subject, react, from, replyTo }: SendEmailOptions) {\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is not set')\n  const resend = new Resend(apiKey)\n  const fromAddr = from || process.env.EMAIL_FROM || 'no-reply@localhost'\n  await resend.emails.send({ to, subject, from: fromAddr, react, replyTo })\n}\n"],
+  "mappings": "AAAA,SAAS,cAAc;AAWvB,eAAsB,UAAU,EAAE,IAAI,SAAS,OAAO,MAAM,QAAQ,GAAqB;AACvF,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AACxD,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,WAAW,QAAQ,QAAQ,IAAI,cAAc;AACnD,QAAM,OAAO,OAAO,KAAK,EAAE,IAAI,SAAS,MAAM,UAAU,OAAO,QAAQ,CAAC;AAC1E;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.4.2-canary-e6bf6a353e";
+const APP_VERSION = "0.4.2-canary-49d47ff90e";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.2-canary-e6bf6a353e'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.2-canary-49d47ff90e'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/notifications/index.js

@@ -0,0 +1,2 @@
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/modules/notifications/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/notifications/index.ts"],
+  "sourcesContent": ["export * from './types'\n"],
+  "mappings": "AAAA,cAAc;",
+  "names": []
+}

package/dist/modules/notifications/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/modules/notifications/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.4.2-canary-e6bf6a353e",
+  "version": "0.4.2-canary-49d47ff90e",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {

package/src/lib/api/context.ts

@@ -0,0 +1,36 @@
+import type { AwilixContainer } from 'awilix'
+import { createRequestContainer } from '../di/container'
+import { getAuthFromRequest, type AuthContext } from '../auth/server'
+import { resolveTranslations } from '../i18n/server'
+
+export type RequestContext = {
+  container: AwilixContainer
+  auth: AuthContext
+  organizationScope?: unknown
+  selectedOrganizationId?: string | null
+  organizationIds?: string[] | null
+  translate: (key: string, fallback?: string) => string
+}
+
+export type ResolveRequestContextResult = {
+  ctx: RequestContext
+}
+
+/**
+ * Resolves the request context for API routes.
+ * This includes container, auth, and translations.
+ * For organization-scoped routes, use resolveOrganizationScopeForRequest separately.
+ */
+export async function resolveRequestContext(req: Request): Promise<ResolveRequestContextResult> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+
+  const ctx: RequestContext = {
+    container,
+    auth,
+    translate,
+  }
+
+  return { ctx }
+}

package/src/lib/auth/passwordPolicy.ts

@@ -0,0 +1,150 @@
+import { z } from 'zod'
+import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+
+export type PasswordPolicy = {
+  minLength: number
+  requireDigit: boolean
+  requireUppercase: boolean
+  requireSpecial: boolean
+}
+
+export type PasswordRequirementId = 'minLength' | 'digit' | 'uppercase' | 'special'
+
+export type PasswordRequirement = {
+  id: PasswordRequirementId
+  value?: number
+}
+
+export type PasswordValidationResult = {
+  ok: boolean
+  violations: PasswordRequirementId[]
+}
+
+export type PasswordRequirementFormatter = (
+  key: string,
+  fallback: string,
+  params?: Record<string, string | number>,
+) => string
+
+const DEFAULT_POLICY: PasswordPolicy = {
+  minLength: 6,
+  requireDigit: true,
+  requireUppercase: true,
+  requireSpecial: true,
+}
+
+const ENV_KEYS = {
+  minLength: 'OM_PASSWORD_MIN_LENGTH',
+  requireDigit: 'OM_PASSWORD_REQUIRE_DIGIT',
+  requireUppercase: 'OM_PASSWORD_REQUIRE_UPPERCASE',
+  requireSpecial: 'OM_PASSWORD_REQUIRE_SPECIAL',
+} as const
+
+const PUBLIC_PREFIX = 'NEXT_PUBLIC_'
+
+function readEnvValue(env: NodeJS.ProcessEnv, key: keyof typeof ENV_KEYS): string | undefined {
+  const rawKey = ENV_KEYS[key]
+  const publicKey = `${PUBLIC_PREFIX}${rawKey}`
+  const rawValue = env[rawKey]
+  if (typeof rawValue === 'string' && rawValue.trim().length > 0) return rawValue
+  const publicValue = env[publicKey]
+  if (typeof publicValue === 'string' && publicValue.trim().length > 0) return publicValue
+  return undefined
+}
+
+function parsePositiveInt(raw: string | undefined, fallback: number, min = 1): number {
+  if (!raw) return fallback
+  const parsed = Number.parseInt(raw, 10)
+  if (Number.isNaN(parsed)) return fallback
+  return Math.max(min, parsed)
+}
+
+export function getPasswordPolicy(env: NodeJS.ProcessEnv = process.env): PasswordPolicy {
+  const minLength = parsePositiveInt(
+    readEnvValue(env, 'minLength'),
+    DEFAULT_POLICY.minLength,
+    1,
+  )
+  return {
+    minLength,
+    requireDigit: parseBooleanWithDefault(
+      readEnvValue(env, 'requireDigit'),
+      DEFAULT_POLICY.requireDigit,
+    ),
+    requireUppercase: parseBooleanWithDefault(
+      readEnvValue(env, 'requireUppercase'),
+      DEFAULT_POLICY.requireUppercase,
+    ),
+    requireSpecial: parseBooleanWithDefault(
+      readEnvValue(env, 'requireSpecial'),
+      DEFAULT_POLICY.requireSpecial,
+    ),
+  }
+}
+
+export function getPasswordRequirements(policy: PasswordPolicy = getPasswordPolicy()): PasswordRequirement[] {
+  const requirements: PasswordRequirement[] = [{ id: 'minLength', value: policy.minLength }]
+  if (policy.requireDigit) requirements.push({ id: 'digit' })
+  if (policy.requireUppercase) requirements.push({ id: 'uppercase' })
+  if (policy.requireSpecial) requirements.push({ id: 'special' })
+  return requirements
+}
+
+export function formatPasswordRequirements(
+  policy: PasswordPolicy,
+  translate: PasswordRequirementFormatter,
+  keyPrefix = 'auth.password.requirements',
+): string {
+  const items = getPasswordRequirements(policy).map((requirement) => {
+    switch (requirement.id) {
+      case 'minLength':
+        return translate(
+          `${keyPrefix}.minLength`,
+          'At least {min} characters',
+          { min: requirement.value ?? policy.minLength },
+        )
+      case 'digit':
+        return translate(`${keyPrefix}.digit`, 'One number')
+      case 'uppercase':
+        return translate(`${keyPrefix}.uppercase`, 'One uppercase letter')
+      case 'special':
+        return translate(`${keyPrefix}.special`, 'One special character')
+      default:
+        return ''
+    }
+  }).filter((value) => value && value.trim().length > 0)
+
+  if (!items.length) return ''
+  const separator = translate(`${keyPrefix}.separator`, ', ')
+  return items.join(separator)
+}
+
+export function validatePassword(
+  password: string,
+  policy: PasswordPolicy = getPasswordPolicy(),
+): PasswordValidationResult {
+  const violations: PasswordRequirementId[] = []
+  if (password.length < policy.minLength) violations.push('minLength')
+  if (policy.requireDigit && !/[0-9]/.test(password)) violations.push('digit')
+  if (policy.requireUppercase && !/[A-Z]/.test(password)) violations.push('uppercase')
+  if (policy.requireSpecial && !/[^A-Za-z0-9]/.test(password)) violations.push('special')
+  return { ok: violations.length === 0, violations }
+}
+
+export function buildPasswordSchema(options?: {
+  policy?: PasswordPolicy
+  maxLength?: number
+  message?: string
+}): z.ZodType<string> {
+  const policy = options?.policy ?? getPasswordPolicy()
+  const maxLength = options?.maxLength
+  const message = options?.message ?? 'Password does not meet the requirements.'
+  let schema = z.string().min(policy.minLength, message)
+  if (typeof maxLength === 'number') schema = schema.max(maxLength, message)
+  return schema.superRefine((value, ctx) => {
+    const result = validatePassword(value, policy)
+    if (!result.ok) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message })
+    }
+  })
+}

package/src/lib/auth/server.ts

@@ -14,6 +14,7 @@ export type AuthContext = {
   email?: string
   roles?: string[]
   isApiKey?: boolean
+  userId?: string
   keyId?: string
   keyName?: string
   [k: string]: unknown
@@ -132,6 +133,9 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       // best-effort update; ignore write failures
     }
 
+    // For session keys, use sessionUserId; for regular keys, use createdBy
+    const actualUserId = record.sessionUserId ?? record.createdBy ?? null
+
     return {
       sub: `api_key:${record.id}`,
       tenantId: record.tenantId ?? null,
@@ -140,6 +144,7 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       isApiKey: true,
       keyId: record.id,
       keyName: record.name,
+      ...(actualUserId ? { userId: actualUserId } : {}),
     }
   } catch {
     return null

package/src/lib/email/__tests__/send.test.ts

@@ -0,0 +1,60 @@
+import React from 'react'
+import { sendEmail } from '../send'
+
+const sendMock = jest.fn().mockResolvedValue({ id: 'email-1' })
+const ResendMock = jest.fn().mockImplementation(() => ({
+  emails: { send: sendMock },
+}))
+
+jest.mock('resend', () => ({
+  Resend: ResendMock,
+}))
+
+describe('sendEmail', () => {
+  const originalEnv = process.env
+
+  beforeEach(() => {
+    process.env = {
+      ...originalEnv,
+      RESEND_API_KEY: 'test-key',
+      EMAIL_FROM: 'from@example.com',
+    }
+    sendMock.mockClear()
+    ResendMock.mockClear()
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  it('maps replyTo to reply_to in Resend payload', async () => {
+    await sendEmail({
+      to: 'user@example.com',
+      subject: 'Hello',
+      react: React.createElement('div', null, 'Hi'),
+      replyTo: 'reply@example.com',
+    })
+
+    expect(ResendMock).toHaveBeenCalledWith('test-key')
+    expect(sendMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'user@example.com',
+        subject: 'Hello',
+        from: 'from@example.com',
+        reply_to: 'reply@example.com',
+      })
+    )
+  })
+
+  it('omits reply_to when replyTo is not provided', async () => {
+    await sendEmail({
+      to: 'user@example.com',
+      subject: 'Hello',
+      react: React.createElement('div', null, 'Hi'),
+    })
+
+    const payload = sendMock.mock.calls[0]?.[0] as Record<string, unknown>
+    expect(payload).toBeDefined()
+    expect(payload.reply_to).toBeUndefined()
+  })
+})

package/src/lib/email/send.ts

@@ -6,13 +6,20 @@ export type SendEmailOptions = {
   subject: string
   react: React.ReactElement
   from?: string
+  replyTo?: string
 }
 
-export async function sendEmail({ to, subject, react, from }: SendEmailOptions) {
+export async function sendEmail({ to, subject, react, from, replyTo }: SendEmailOptions) {
   const apiKey = process.env.RESEND_API_KEY
   if (!apiKey) throw new Error('RESEND_API_KEY is not set')
   const resend = new Resend(apiKey)
   const fromAddr = from || process.env.EMAIL_FROM || 'no-reply@localhost'
-  await resend.emails.send({ to, subject, from: fromAddr, react })
+  const payload = {
+    to,
+    subject,
+    from: fromAddr,
+    react,
+    ...(replyTo ? { reply_to: replyTo } : {}),
+  }
+  await resend.emails.send(payload)
 }
-

package/src/lib/frontend/notificationEvents.ts

@@ -0,0 +1,48 @@
+export const NOTIFICATION_DOM_EVENTS = {
+  NEW: 'om:notifications:new',
+  ACTIONED: 'om:notifications:actioned',
+  COUNT_CHANGED: 'om:notifications:count-changed',
+} as const
+
+export type NotificationNewDetail = {
+  id: string
+  type: string
+  title: string
+  severity: string
+}
+
+export function emitNotificationNew(detail: NotificationNewDetail): void {
+  if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return
+  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.NEW, { detail }))
+}
+
+export function emitNotificationActioned(notificationId: string): void {
+  if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return
+  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.ACTIONED, { detail: { notificationId } }))
+}
+
+export function emitNotificationCountChanged(count: number): void {
+  if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return
+  window.dispatchEvent(new CustomEvent(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, { detail: { count } }))
+}
+
+export function subscribeNotificationNew(handler: (detail: NotificationNewDetail) => void): () => void {
+  if (typeof window === 'undefined') return () => {}
+  const listener = (event: Event) => handler((event as CustomEvent<NotificationNewDetail>).detail)
+  window.addEventListener(NOTIFICATION_DOM_EVENTS.NEW, listener)
+  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.NEW, listener)
+}
+
+export function subscribeNotificationActioned(handler: (notificationId: string) => void): () => void {
+  if (typeof window === 'undefined') return () => {}
+  const listener = (event: Event) => handler((event as CustomEvent<{ notificationId: string }>).detail.notificationId)
+  window.addEventListener(NOTIFICATION_DOM_EVENTS.ACTIONED, listener)
+  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.ACTIONED, listener)
+}
+
+export function subscribeNotificationCountChanged(handler: (count: number) => void): () => void {
+  if (typeof window === 'undefined') return () => {}
+  const listener = (event: Event) => handler((event as CustomEvent<{ count: number }>).detail.count)
+  window.addEventListener(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, listener)
+  return () => window.removeEventListener(NOTIFICATION_DOM_EVENTS.COUNT_CHANGED, listener)
+}

package/src/lib/lib/email/send.ts

@@ -6,13 +6,13 @@ export type SendEmailOptions = {
   subject: string
   react: React.ReactElement
   from?: string
+  replyTo?: string
 }
 
-export async function sendEmail({ to, subject, react, from }: SendEmailOptions) {
+export async function sendEmail({ to, subject, react, from, replyTo }: SendEmailOptions) {
   const apiKey = process.env.RESEND_API_KEY
   if (!apiKey) throw new Error('RESEND_API_KEY is not set')
   const resend = new Resend(apiKey)
   const fromAddr = from || process.env.EMAIL_FROM || 'no-reply@localhost'
-  await resend.emails.send({ to, subject, from: fromAddr, react })
+  await resend.emails.send({ to, subject, from: fromAddr, react, replyTo })
 }
-

package/src/modules/notifications/index.ts

@@ -0,0 +1 @@
+export * from './types'

package/src/modules/notifications/types.ts

@@ -0,0 +1,106 @@
+import type { ComponentType } from 'react'
+
+export type NotificationStatus = 'unread' | 'read' | 'actioned' | 'dismissed'
+export type NotificationSeverity = 'info' | 'warning' | 'success' | 'error'
+
+export type NotificationAction = {
+  id: string
+  label: string
+  labelKey?: string
+  variant?: 'default' | 'secondary' | 'destructive' | 'outline' | 'ghost'
+  icon?: string
+  commandId?: string
+  href?: string
+  confirmRequired?: boolean
+  confirmMessage?: string
+}
+
+export type NotificationActionData = {
+  actions: NotificationAction[]
+  primaryActionId?: string
+}
+
+export type NotificationTypeAction = {
+  id: string
+  labelKey: string
+  variant?: 'default' | 'secondary' | 'destructive' | 'outline' | 'ghost'
+  icon?: string
+  commandId?: string
+  href?: string
+  confirmRequired?: boolean
+  confirmMessageKey?: string
+}
+
+export type NotificationRendererProps = {
+  notification: {
+    id: string
+    type: string
+    title: string
+    body?: string | null
+    titleKey?: string | null
+    bodyKey?: string | null
+    titleVariables?: Record<string, string> | null
+    bodyVariables?: Record<string, string> | null
+    icon?: string | null
+    severity: string
+    status: string
+    sourceModule?: string | null
+    sourceEntityType?: string | null
+    sourceEntityId?: string | null
+    linkHref?: string | null
+    createdAt: string
+  }
+  onAction: (actionId: string) => Promise<void>
+  onDismiss: () => Promise<void>
+  actions: NotificationTypeAction[]
+}
+
+export type NotificationTypeDefinition = {
+  type: string
+  module: string
+  titleKey: string
+  bodyKey?: string
+  icon: string
+  severity: NotificationSeverity
+  actions: NotificationTypeAction[]
+  primaryActionId?: string
+  linkHref?: string
+  Renderer?: ComponentType<NotificationRendererProps>
+  expiresAfterHours?: number
+}
+
+export type NotificationDto = {
+  id: string
+  type: string
+  title: string
+  body?: string | null
+  titleKey?: string | null
+  bodyKey?: string | null
+  titleVariables?: Record<string, string> | null
+  bodyVariables?: Record<string, string> | null
+  icon?: string | null
+  severity: string
+  status: string
+  actions: Array<{
+    id: string
+    label: string
+    labelKey?: string
+    variant?: string
+    icon?: string
+  }>
+  primaryActionId?: string
+  sourceModule?: string | null
+  sourceEntityType?: string | null
+  sourceEntityId?: string | null
+  linkHref?: string | null
+  createdAt: string
+  readAt?: string | null
+  actionTaken?: string | null
+}
+
+export type NotificationPollData = {
+  unreadCount: number
+  recent: NotificationDto[]
+  hasNew: boolean
+  lastId?: string
+}