@open-mercato/shared 0.5.1-develop.2975.ccbadc8198 → 0.5.1-develop.2996.ce62fd491c

package/dist/lib/crud/custom-fields.js

@@ -290,20 +290,21 @@ function decorateRecordWithCustomFields(record, definitions, context = {}) {
     const bareKey = prefixedKey.replace(/^cf_/, "");
     const normalizedKey = normalizeDefinitionKey(bareKey);
     if (!normalizedKey) return;
-    values[bareKey] = value;
     const defsForKey = definitions.get(normalizedKey) ?? [];
     const resolvedDef = selectDefinitionForRecord(defsForKey, organizationId, tenantId);
+    if (!resolvedDef) return;
+    values[bareKey] = value;
     const entry = {
       key: bareKey,
-      label: resolvedDef?.label ?? bareKey,
+      label: resolvedDef.label ?? bareKey,
       value,
-      kind: resolvedDef?.kind ?? null,
-      multi: resolvedDef?.multi ?? Array.isArray(value)
+      kind: resolvedDef.kind ?? null,
+      multi: resolvedDef.multi ?? Array.isArray(value)
     };
     entries.push({
       entry,
-      priority: resolvedDef?.priority ?? Number.MAX_SAFE_INTEGER,
-      updatedAt: resolvedDef?.updatedAt ?? 0
+      priority: resolvedDef.priority ?? Number.MAX_SAFE_INTEGER,
+      updatedAt: resolvedDef.updatedAt ?? 0
     });
   });
   const ordered = entries.sort((a, b) => {
@@ -416,7 +417,13 @@ async function loadCustomFieldValues(opts) {
     const def = pickDefinition(key, resolvedOrgId, resolvedTenantId);
     const encrypted = Boolean(def?.configJson && def.configJson?.encrypted);
     const value = valueFromRow(row);
-    const decrypted = encrypted ? await decryptCustomFieldValue(value, resolvedTenantId ?? tenantId ?? null, getEncryptionService(), encryptionCache) : value;
+    const decrypted = encrypted ? await decryptCustomFieldValue(
+      value,
+      resolvedTenantId ?? tenantId ?? null,
+      getEncryptionService(),
+      encryptionCache,
+      { kind: def?.kind ?? null }
+    ) : value;
     const existing = buckets.get(bucketKey);
     if (existing) {
       if (existing.orgId == null && resolvedOrgId) existing.orgId = resolvedOrgId;

package/dist/lib/crud/custom-fields.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/custom-fields.ts"],
-  "sourcesContent": ["import type { CustomFieldSet, EntityId } from '@open-mercato/shared/modules/entities'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { CustomFieldDef, CustomFieldValue } from '@open-mercato/core/modules/entities/data/entities'\nimport type { WhereValue } from '@open-mercato/shared/lib/query/types'\nimport type { TenantDataEncryptionService } from '../encryption/tenantDataEncryptionService'\nimport { decryptCustomFieldValue, resolveTenantEncryptionService } from '../encryption/customFieldValues'\nimport { parseBooleanToken } from '../boolean'\nimport { extractCustomFieldEntries } from './custom-fields-client'\n\nexport type CustomFieldSelectors = {\n  keys: string[]\n  selectors: string[] // e.g. ['cf:priority', 'cf:severity']\n  outputKeys: string[] // e.g. ['cf_priority', 'cf_severity']\n}\n\nexport type SplitCustomFieldPayload = {\n  base: Record<string, unknown>\n  custom: Record<string, unknown>\n}\n\nexport type CustomFieldDefinitionSummary = {\n  key: string\n  label: string | null\n  kind: string | null\n  multi: boolean\n  dictionaryId?: string | null\n  organizationId?: string | null\n  tenantId?: string | null\n  priority: number\n  updatedAt: number\n}\n\nexport type CustomFieldDefinitionIndex = Map<string, CustomFieldDefinitionSummary[]>\n\nexport type CustomFieldDisplayEntry = {\n  key: string\n  label: string | null\n  value: unknown\n  kind: string | null\n  multi: boolean\n}\n\nexport type CustomFieldDisplayPayload = {\n  customValues: Record<string, unknown> | null\n  customFields: CustomFieldDisplayEntry[]\n}\n\nexport type CustomFieldSnapshot = {\n  entries: Record<string, unknown>\n  customValues: Record<string, unknown> | null\n  customFields: CustomFieldDisplayEntry[]\n}\n\nexport function buildCustomFieldSelectorsForEntity(entityId: EntityId, sets: CustomFieldSet[]): CustomFieldSelectors {\n  const keys = Array.from(new Set(\n    (sets || [])\n      .filter((s) => s.entity === entityId)\n      .flatMap((s) => (s.fields || []).map((f) => f.key))\n  ))\n  const selectors = keys.map((k) => `cf:${k}`)\n  const outputKeys = keys.map((k) => `cf_${k}`)\n  return { keys, selectors, outputKeys }\n}\n\nexport function normalizeCustomFieldValue(val: unknown): unknown {\n  if (Array.isArray(val)) return val\n  if (typeof val === 'string') {\n    const s = val.trim()\n    // Parse Postgres array-like '{a,b,c}' to string[] when present\n    if (s.startsWith('{') && s.endsWith('}')) {\n      const inner = s.slice(1, -1).trim()\n      if (!inner) return []\n      return inner.split(/[\\s,]+/).map((x) => x.trim()).filter(Boolean)\n    }\n    return s\n  }\n  return val as any\n}\n\n// Extracts cf_* fields from a record that may contain both 'cf:<key>' and/or 'cf_<key>'\nexport function extractCustomFieldsFromItem(item: Record<string, unknown>, keys: string[]): Record<string, unknown> {\n  const out: Record<string, unknown> = {}\n  for (const key of keys) {\n    const colon = item[`cf:${key}` as keyof typeof item]\n    const snake = item[`cf_${key}` as keyof typeof item]\n    const value = colon !== undefined ? colon : snake\n    if (value !== undefined) out[`cf_${key}`] = normalizeCustomFieldValue(value)\n  }\n  return out\n}\n\nexport function extractAllCustomFieldEntries(item: Record<string, unknown>): Record<string, unknown> {\n  return extractCustomFieldEntries(item)\n}\n\nfunction normalizeFieldsetFilter(input?: string | string[] | null): Set<string | null> | null {\n  if (input == null) return null\n  const values = Array.isArray(input) ? input : [input]\n  const normalized = new Set<string | null>()\n  for (const raw of values) {\n    if (raw == null) continue\n    const trimmed = String(raw).trim()\n    if (!trimmed) {\n      normalized.add(null)\n    } else {\n      normalized.add(trimmed)\n    }\n  }\n  return normalized.size ? normalized : null\n}\n\nexport async function buildCustomFieldFiltersFromQuery(opts: {\n  entityId?: EntityId\n  entityIds?: EntityId[]\n  query: Record<string, unknown>\n  em: EntityManager\n  tenantId: string | null | undefined\n  fieldset?: string | string[] | null\n}): Promise<Record<string, WhereValue>> {\n  const out: Record<string, WhereValue> = {}\n  const entries = Object.entries(opts.query).filter(([k]) => k.startsWith('cf_'))\n  if (!entries.length) return out\n\n  const entityIdList = Array.isArray(opts.entityIds) && opts.entityIds.length\n    ? opts.entityIds\n    : opts.entityId\n      ? [opts.entityId]\n      : []\n  if (!entityIdList.length) return out\n\n  // Tenant-only scope: allow global (null) or tenant match; ignore organization here\n  const defs = await opts.em.find(CustomFieldDef, {\n    entityId: { $in: entityIdList as any },\n    isActive: true,\n    $and: [\n      { $or: [ { tenantId: opts.tenantId as any }, { tenantId: null } ] },\n    ],\n  })\n  const fieldsetFilter = normalizeFieldsetFilter(opts.fieldset)\n  const order = new Map<string, number>()\n  entityIdList.map(String).forEach((id, index) => order.set(id, index))\n  const byKey: Record<string, { kind: string; multi?: boolean; entityId: string }> = {}\n  for (const d of defs) {\n    if (fieldsetFilter) {\n      const fieldsets = Array.isArray(d.configJson?.fieldsets)\n        ? d.configJson.fieldsets\n            .filter((entry: unknown): entry is string => typeof entry === 'string')\n            .map((entry: string) => entry.trim())\n            .filter((entry: string) => entry.length > 0)\n        : []\n      const rawFieldset = typeof d.configJson?.fieldset === 'string' ? d.configJson.fieldset.trim() : ''\n      const normalizedFieldset = rawFieldset.length ? rawFieldset : null\n      const matches = fieldsets.length > 0\n        ? fieldsets.some((entry: string) => fieldsetFilter.has(entry))\n        : fieldsetFilter.has(normalizedFieldset)\n      if (!matches) continue\n    }\n    const key = d.key\n    const entityId = String(d.entityId)\n    const current = byKey[key]\n    const rankNew = order.get(entityId) ?? Number.MAX_SAFE_INTEGER\n    if (!current) {\n      byKey[key] = { kind: d.kind, multi: Boolean((d as any).configJson?.multi), entityId }\n      continue\n    }\n    const rankOld = order.get(current.entityId) ?? Number.MAX_SAFE_INTEGER\n    if (rankNew < rankOld) {\n      byKey[key] = { kind: d.kind, multi: Boolean((d as any).configJson?.multi), entityId }\n    }\n  }\n\n  const coerce = (kind: string, v: unknown) => {\n    if (v == null) return v as undefined\n    switch (kind) {\n      case 'integer': return Number.parseInt(String(v), 10)\n      case 'float': return Number.parseFloat(String(v))\n      case 'boolean': return parseBooleanToken(String(v)) === true\n      case 'date':\n      case 'datetime': return String(v)\n      default: return String(v)\n    }\n  }\n\n  for (const [rawKey, rawVal] of entries) {\n    const isIn = rawKey.endsWith('In')\n    const key = isIn ? rawKey.replace(/^cf_/, '').replace(/In$/, '') : rawKey.replace(/^cf_/, '')\n    const def = byKey[key]\n    const fieldId = `cf:${key}`\n    if (!def) continue\n    if (isIn) {\n      const list = Array.isArray(rawVal)\n        ? (rawVal as unknown[])\n        : String(rawVal)\n            .split(',')\n            .map((s) => s.trim())\n            .filter(Boolean)\n      if (list.length) out[fieldId] = { $in: list.map((x) => coerce(def.kind, x)) as (string[] | number[] | boolean[]) }\n    } else {\n      out[fieldId] = coerce(def.kind, rawVal)\n    }\n  }\n\n  return out\n}\n\nexport function splitCustomFieldPayload(raw: unknown): SplitCustomFieldPayload {\n  const base: Record<string, unknown> = {}\n  const custom: Record<string, unknown> = {}\n  if (!raw || typeof raw !== 'object') return { base, custom }\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (key === 'customFields') {\n      if (Array.isArray(value)) {\n        value.forEach((entry) => {\n          if (!entry || typeof entry !== 'object') return\n          const entryKey = typeof (entry as any).key === 'string' ? (entry as any).key.trim() : ''\n          if (!entryKey) return\n          custom[entryKey] = (entry as any).value\n        })\n        continue\n      }\n      if (value && typeof value === 'object') {\n        for (const [ck, cv] of Object.entries(value as Record<string, unknown>)) {\n          const normalizedKey = typeof ck === 'string' ? ck.trim() : ''\n          if (!normalizedKey) continue\n          custom[normalizedKey] = cv\n        }\n        continue\n      }\n    }\n    if (key === 'customValues' && value && typeof value === 'object' && !Array.isArray(value)) {\n      for (const [ck, cv] of Object.entries(value as Record<string, unknown>)) {\n        custom[String(ck)] = cv\n      }\n      continue\n    }\n    if (key.startsWith('cf_')) {\n      custom[key.slice(3)] = value\n      continue\n    }\n    if (key.startsWith('cf:')) {\n      custom[key.slice(3)] = value\n      continue\n    }\n    base[key] = value\n  }\n  return { base, custom }\n}\n\nexport function extractCustomFieldValuesFromPayload(raw: Record<string, unknown>): Record<string, unknown> {\n  return splitCustomFieldPayload(raw).custom\n}\n\nfunction normalizeDefinitionKey(key: unknown): string {\n  if (typeof key !== 'string') return ''\n  const trimmed = key.trim()\n  return trimmed.length ? trimmed.toLowerCase() : ''\n}\n\nfunction normalizeDefinitionConfig(raw: unknown): Record<string, any> {\n  if (!raw) return {}\n  if (typeof raw === 'string') {\n    try {\n      const parsed = JSON.parse(raw)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return { ...(parsed as Record<string, any>) }\n      }\n      return {}\n    } catch {\n      return {}\n    }\n  }\n  if (typeof raw === 'object' && !Array.isArray(raw)) {\n    return { ...(raw as Record<string, any>) }\n  }\n  return {}\n}\n\nfunction summarizeDefinition(def: CustomFieldDef): CustomFieldDefinitionSummary | null {\n  const normalizedKey = normalizeDefinitionKey(def.key)\n  if (!normalizedKey) return null\n  const cfg = normalizeDefinitionConfig((def as any).configJson)\n  const label =\n    typeof cfg.label === 'string' && cfg.label.trim().length\n      ? cfg.label.trim()\n      : def.key\n  const dictionaryId =\n    typeof cfg.dictionaryId === 'string' && cfg.dictionaryId.trim().length\n      ? cfg.dictionaryId.trim()\n      : null\n  const multi =\n    cfg.multi !== undefined ? Boolean(cfg.multi) : false\n  const priority =\n    typeof cfg.priority === 'number' ? cfg.priority : 0\n  const updatedAt =\n    def.updatedAt instanceof Date\n      ? def.updatedAt.getTime()\n      : new Date(def.updatedAt as any).getTime()\n  return {\n    key: def.key,\n    label,\n    kind: typeof def.kind === 'string' ? def.kind : null,\n    multi,\n    dictionaryId,\n    organizationId: def.organizationId ?? null,\n    tenantId: def.tenantId ?? null,\n    priority,\n    updatedAt: Number.isNaN(updatedAt) ? 0 : updatedAt,\n  }\n}\n\nfunction sortDefinitionSummaries(defs: CustomFieldDefinitionSummary[]): CustomFieldDefinitionSummary[] {\n  return [...defs].sort((a, b) => {\n    const priorityDiff = (a.priority ?? 0) - (b.priority ?? 0)\n    if (priorityDiff !== 0) return priorityDiff\n    const updatedDiff = (b.updatedAt ?? 0) - (a.updatedAt ?? 0)\n    if (updatedDiff !== 0) return updatedDiff\n    return a.key.localeCompare(b.key)\n  })\n}\n\nfunction selectDefinitionForRecord(\n  defs: CustomFieldDefinitionSummary[],\n  organizationId: string | null,\n  tenantId: string | null,\n): CustomFieldDefinitionSummary | null {\n  if (!defs.length) return null\n  const prioritizedForOrg = defs.filter(\n    (def) => def.organizationId && organizationId && def.organizationId === organizationId,\n  )\n  if (prioritizedForOrg.length) return sortDefinitionSummaries(prioritizedForOrg)[0]\n  const prioritizedForTenant = defs.filter(\n    (def) => def.tenantId && tenantId && def.tenantId === tenantId && !def.organizationId,\n  )\n  if (prioritizedForTenant.length) return sortDefinitionSummaries(prioritizedForTenant)[0]\n  const global = defs.filter((def) => !def.organizationId)\n  if (global.length) return sortDefinitionSummaries(global)[0]\n  return sortDefinitionSummaries(defs)[0] ?? null\n}\n\nexport async function loadCustomFieldDefinitionIndex(opts: {\n  em: EntityManager\n  entityIds: string | string[]\n  tenantId?: string | null | undefined\n  organizationIds?: Array<string | null | undefined> | null\n  fieldset?: string | string[] | null\n}): Promise<CustomFieldDefinitionIndex> {\n  const list = Array.isArray(opts.entityIds) ? opts.entityIds : [opts.entityIds]\n  const entityIds = list\n    .map((id) => (typeof id === 'string' ? id.trim() : String(id ?? '')))\n    .filter((id) => id.length > 0)\n  if (!entityIds.length) return new Map()\n  const tenantId = opts.tenantId ?? null\n  const orgCandidates = Array.isArray(opts.organizationIds)\n    ? opts.organizationIds\n        .map((id) => (typeof id === 'string' ? id.trim() : id))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0)\n    : []\n  const scopeClauses: Record<string, unknown>[] = [\n    tenantId\n      ? { $or: [{ tenantId: tenantId as any }, { tenantId: null }] }\n      : { tenantId: null },\n  ]\n  if (orgCandidates.length) {\n    scopeClauses.push({\n      $or: [{ organizationId: { $in: orgCandidates as any } }, { organizationId: null }],\n    })\n  } else {\n    scopeClauses.push({ organizationId: null })\n  }\n  const where: Record<string, unknown> = {\n    entityId: { $in: entityIds as any },\n    deletedAt: null,\n    isActive: true,\n    $and: scopeClauses,\n  }\n  const defs = await opts.em.find(CustomFieldDef, where as any)\n  const fieldsetFilter = normalizeFieldsetFilter(opts.fieldset)\n  const index: CustomFieldDefinitionIndex = new Map()\n  defs.forEach((def) => {\n    if (fieldsetFilter) {\n      const config = normalizeDefinitionConfig((def as any).configJson)\n      const fieldsets = Array.isArray(config.fieldsets)\n        ? config.fieldsets\n            .filter((entry: unknown): entry is string => typeof entry === 'string')\n            .map((entry: string) => entry.trim())\n            .filter((entry: string) => entry.length > 0)\n        : []\n      const fieldset = typeof config.fieldset === 'string' && config.fieldset.trim().length > 0\n        ? config.fieldset.trim()\n        : null\n      const matches = fieldsets.length > 0\n        ? fieldsets.some((entry: string) => fieldsetFilter.has(entry))\n        : fieldsetFilter.has(fieldset)\n      if (!matches) return\n    }\n    const summary = summarizeDefinition(def)\n    if (!summary) return\n    const normalizedKey = normalizeDefinitionKey(summary.key)\n    if (!normalizedKey) return\n    if (!index.has(normalizedKey)) index.set(normalizedKey, [])\n    index.get(normalizedKey)!.push(summary)\n  })\n  index.forEach((entries, key) => {\n    index.set(key, sortDefinitionSummaries(entries))\n  })\n  return index\n}\n\nexport function decorateRecordWithCustomFields(\n  record: Record<string, unknown>,\n  definitions: CustomFieldDefinitionIndex,\n  context: {\n    organizationId?: string | null\n    tenantId?: string | null\n  } = {},\n): CustomFieldDisplayPayload {\n  const rawEntries = extractAllCustomFieldEntries(record)\n  if (!Object.keys(rawEntries).length) {\n    return { customValues: null, customFields: [] }\n  }\n  const values: Record<string, unknown> = {}\n  const entries: Array<{ entry: CustomFieldDisplayEntry; priority: number; updatedAt: number }> = []\n  const organizationId = context.organizationId ?? null\n  const tenantId = context.tenantId ?? null\n\n  Object.entries(rawEntries).forEach(([prefixedKey, value]) => {\n    const bareKey = prefixedKey.replace(/^cf_/, '')\n    const normalizedKey = normalizeDefinitionKey(bareKey)\n    if (!normalizedKey) return\n    values[bareKey] = value\n    const defsForKey = definitions.get(normalizedKey) ?? []\n    const resolvedDef = selectDefinitionForRecord(defsForKey, organizationId, tenantId)\n    const entry: CustomFieldDisplayEntry = {\n      key: bareKey,\n      label: resolvedDef?.label ?? bareKey,\n      value,\n      kind: resolvedDef?.kind ?? null,\n      multi: resolvedDef?.multi ?? Array.isArray(value),\n    }\n    entries.push({\n      entry,\n      priority: resolvedDef?.priority ?? Number.MAX_SAFE_INTEGER,\n      updatedAt: resolvedDef?.updatedAt ?? 0,\n    })\n  })\n\n  const ordered = entries\n    .sort((a, b) => {\n      const priorityDiff = a.priority - b.priority\n      if (priorityDiff !== 0) return priorityDiff\n      const updatedDiff = b.updatedAt - a.updatedAt\n      if (updatedDiff !== 0) return updatedDiff\n      return a.entry.key.localeCompare(b.entry.key)\n    })\n    .map((item) => item.entry)\n\n  return {\n    customValues: Object.keys(values).length ? values : null,\n    customFields: ordered,\n  }\n}\n\nexport async function loadCustomFieldValues(opts: {\n  em: EntityManager\n  entityId: EntityId\n  recordIds: string[]\n  tenantIdByRecord?: Record<string, string | null | undefined>\n  organizationIdByRecord?: Record<string, string | null | undefined>\n  tenantFallbacks?: (string | null | undefined)[]\n  encryptionService?: TenantDataEncryptionService | null\n}): Promise<Record<string, Record<string, unknown>>> {\n  const { em, entityId, recordIds } = opts\n  if (!Array.isArray(recordIds) || recordIds.length === 0) return {}\n\n  const normalizedRecordIds = recordIds.map((id) => String(id))\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em, opts.encryptionService)\n    return encryptionService\n  }\n  const tenantCandidates = new Set<string | null>()\n  tenantCandidates.add(null)\n  if (opts.tenantIdByRecord) {\n    for (const val of Object.values(opts.tenantIdByRecord)) {\n      tenantCandidates.add(val ? String(val) : null)\n    }\n  }\n  if (opts.tenantFallbacks) {\n    for (const val of opts.tenantFallbacks) tenantCandidates.add(val ? String(val) : null)\n  }\n  const fallbackTenant = (opts.tenantFallbacks || []).find((t) => t != null) ?? null\n\n  const tenantList = Array.from(tenantCandidates)\n  const tenantNonNull = tenantList.filter((t): t is string => t !== null)\n  const tenantFilter = tenantNonNull.length\n    ? { tenantId: { $in: [...tenantNonNull, null] as any } }\n    : { tenantId: null }\n  const cfRows = await em.find(CustomFieldValue, {\n    entityId: entityId as any,\n    recordId: { $in: normalizedRecordIds as any },\n    deletedAt: null,\n    ...(tenantList.length ? tenantFilter : {}),\n  })\n\n  if (!cfRows.length) return {}\n\n  const allKeys = Array.from(new Set(cfRows.map((row) => String(row.fieldKey))))\n  const organizationCandidates = new Set<string | null>()\n  organizationCandidates.add(null)\n  if (opts.organizationIdByRecord) {\n    for (const val of Object.values(opts.organizationIdByRecord)) {\n      organizationCandidates.add(val ? String(val) : null)\n    }\n  }\n  for (const row of cfRows) {\n    organizationCandidates.add(row.organizationId ? String(row.organizationId) : null)\n  }\n  const orgList = Array.from(organizationCandidates)\n\n  const defs = allKeys.length\n    ? await em.find(CustomFieldDef, {\n        entityId: entityId as any,\n        key: { $in: allKeys as any },\n        deletedAt: null,\n        isActive: true,\n        ...(tenantList.length ? { tenantId: tenantFilter.tenantId } : {}),\n        organizationId: { $in: orgList as any },\n      })\n    : []\n\n  const defsByKey = new Map<string, CustomFieldDef[]>()\n  for (const def of defs) {\n    const list = defsByKey.get(def.key) || []\n    list.push(def)\n    defsByKey.set(def.key, list)\n  }\n\n  const pickDefinition = (fieldKey: string, organizationId: string | null, tenantId: string | null) => {\n    const candidates = defsByKey.get(fieldKey)\n    if (!candidates || candidates.length === 0) return null\n    const active = candidates.filter((opt) => opt.isActive !== false && !opt.deletedAt)\n    const list = active.length ? active : candidates\n    if (organizationId && tenantId) {\n      const exact = list.find((opt) => opt.organizationId === organizationId && opt.tenantId === tenantId)\n      if (exact) return exact\n    }\n    if (organizationId) {\n      const orgMatch = list.find((opt) => opt.organizationId === organizationId && (!tenantId || opt.tenantId == null || opt.tenantId === tenantId))\n      if (orgMatch) return orgMatch\n    }\n    if (tenantId) {\n      const tenantMatch = list.find((opt) => opt.organizationId == null && opt.tenantId === tenantId)\n      if (tenantMatch) return tenantMatch\n    }\n    const global = list.find((opt) => opt.organizationId == null && opt.tenantId == null)\n    return global ?? list[0]\n  }\n\n  const valueFromRow = (row: CustomFieldValue): unknown => {\n    if (row.valueMultiline !== null && row.valueMultiline !== undefined) return row.valueMultiline\n    if (row.valueText !== null && row.valueText !== undefined) return row.valueText\n    if (row.valueInt !== null && row.valueInt !== undefined) return row.valueInt\n    if (row.valueFloat !== null && row.valueFloat !== undefined) return row.valueFloat\n    if (row.valueBool !== null && row.valueBool !== undefined) return row.valueBool\n    return null\n  }\n\n  type Bucket = { orgId: string | null; tenantId: string | null; values: unknown[]; def?: CustomFieldDef | null; encrypted?: boolean }\n  const buckets = new Map<string, Bucket>()\n\n  for (const row of cfRows) {\n    const recordId = String(row.recordId)\n    const key = String(row.fieldKey)\n    const bucketKey = `${recordId}::${key}`\n    const orgId = row.organizationId ? String(row.organizationId) : null\n    const tenantId = row.tenantId ? String(row.tenantId) : null\n    const resolvedOrgId = orgId ?? (opts.organizationIdByRecord?.[recordId] ?? null)\n    const resolvedTenantId = tenantId ?? (opts.tenantIdByRecord?.[recordId] ?? fallbackTenant)\n    const def = pickDefinition(key, resolvedOrgId, resolvedTenantId)\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const value = valueFromRow(row)\n    const decrypted = encrypted\n      ? await decryptCustomFieldValue(value, resolvedTenantId ?? tenantId ?? null, getEncryptionService(), encryptionCache)\n      : value\n    const existing = buckets.get(bucketKey)\n    if (existing) {\n      if (existing.orgId == null && resolvedOrgId) existing.orgId = resolvedOrgId\n      if (existing.tenantId == null && resolvedTenantId) existing.tenantId = resolvedTenantId\n      if (existing.def == null && def) existing.def = def\n      existing.encrypted = existing.encrypted || encrypted\n      existing.values.push(decrypted)\n    } else {\n      buckets.set(bucketKey, { orgId: resolvedOrgId, tenantId: resolvedTenantId, values: [decrypted], def: def ?? null, encrypted })\n    }\n  }\n\n  const result: Record<string, Record<string, unknown>> = {}\n  for (const [compoundKey, bucket] of buckets.entries()) {\n    const [recordId, fieldKey] = compoundKey.split('::')\n    if (!result[recordId]) result[recordId] = {}\n    const prefixed = `cf_${fieldKey}`\n    const def = bucket.def ?? pickDefinition(fieldKey, bucket.orgId ?? (opts.organizationIdByRecord?.[recordId] ?? null), bucket.tenantId ?? (opts.tenantIdByRecord?.[recordId] ?? null))\n    if (def && def.configJson && typeof def.configJson === 'object' && (def.configJson as any).multi) {\n      const cleaned = bucket.values.filter((v) => v !== undefined && v !== null)\n      result[recordId][prefixed] = cleaned\n    } else if (bucket.values.length > 1) {\n      const cleaned = bucket.values.filter((v) => v !== undefined)\n      result[recordId][prefixed] = cleaned\n    } else {\n      result[recordId][prefixed] = bucket.values[0] ?? null\n    }\n  }\n\n  return result\n}\n\nexport function summarizeCustomFields(record: Record<string, unknown>): CustomFieldSnapshot {\n  const entries = extractAllCustomFieldEntries(record)\n  const values = Object.fromEntries(\n    Object.entries(entries).map(([prefixedKey, value]) => [\n      prefixedKey.replace(/^cf_/, ''),\n      value,\n    ]),\n  )\n  const customValues = Object.keys(values).length ? values : null\n  const customFields = Object.entries(values).map(([key, value]) => ({\n    key,\n    label: key,\n    value,\n    kind: null,\n    multi: Array.isArray(value),\n  }))\n  return { entries, customValues, customFields }\n}\n"],
-  "mappings": "AAEA,SAAS,gBAAgB,wBAAwB;AAGjD,SAAS,yBAAyB,sCAAsC;AACxE,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AA8CnC,SAAS,mCAAmC,UAAoB,MAA8C;AACnH,QAAM,OAAO,MAAM,KAAK,IAAI;AAAA,KACzB,QAAQ,CAAC,GACP,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,EACnC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AAAA,EACtD,CAAC;AACD,QAAM,YAAY,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE;AAC3C,QAAM,aAAa,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE;AAC5C,SAAO,EAAE,MAAM,WAAW,WAAW;AACvC;AAEO,SAAS,0BAA0B,KAAuB;AAC/D,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC/B,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,IAAI,IAAI,KAAK;AAEnB,QAAI,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG;AACxC,YAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK;AAClC,UAAI,CAAC,MAAO,QAAO,CAAC;AACpB,aAAO,MAAM,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,4BAA4B,MAA+B,MAAyC;AAClH,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAuB;AACnD,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAuB;AACnD,UAAM,QAAQ,UAAU,SAAY,QAAQ;AAC5C,QAAI,UAAU,OAAW,KAAI,MAAM,GAAG,EAAE,IAAI,0BAA0B,KAAK;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,6BAA6B,MAAwD;AACnG,SAAO,0BAA0B,IAAI;AACvC;AAEA,SAAS,wBAAwB,OAA6D;AAC5F,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACpD,QAAM,aAAa,oBAAI,IAAmB;AAC1C,aAAW,OAAO,QAAQ;AACxB,QAAI,OAAO,KAAM;AACjB,UAAM,UAAU,OAAO,GAAG,EAAE,KAAK;AACjC,QAAI,CAAC,SAAS;AACZ,iBAAW,IAAI,IAAI;AAAA,IACrB,OAAO;AACL,iBAAW,IAAI,OAAO;AAAA,IACxB;AAAA,EACF;AACA,SAAO,WAAW,OAAO,aAAa;AACxC;AAEA,eAAsB,iCAAiC,MAOf;AACtC,QAAM,MAAkC,CAAC;AACzC,QAAM,UAAU,OAAO,QAAQ,KAAK,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC;AAC9E,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAE5B,QAAM,eAAe,MAAM,QAAQ,KAAK,SAAS,KAAK,KAAK,UAAU,SACjE,KAAK,YACL,KAAK,WACH,CAAC,KAAK,QAAQ,IACd,CAAC;AACP,MAAI,CAAC,aAAa,OAAQ,QAAO;AAGjC,QAAM,OAAO,MAAM,KAAK,GAAG,KAAK,gBAAgB;AAAA,IAC9C,UAAU,EAAE,KAAK,aAAoB;AAAA,IACrC,UAAU;AAAA,IACV,MAAM;AAAA,MACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAgB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,IACpE;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB,wBAAwB,KAAK,QAAQ;AAC5D,QAAM,QAAQ,oBAAI,IAAoB;AACtC,eAAa,IAAI,MAAM,EAAE,QAAQ,CAAC,IAAI,UAAU,MAAM,IAAI,IAAI,KAAK,CAAC;AACpE,QAAM,QAA6E,CAAC;AACpF,aAAW,KAAK,MAAM;AACpB,QAAI,gBAAgB;AAClB,YAAM,YAAY,MAAM,QAAQ,EAAE,YAAY,SAAS,IACnD,EAAE,WAAW,UACV,OAAO,CAAC,UAAoC,OAAO,UAAU,QAAQ,EACrE,IAAI,CAAC,UAAkB,MAAM,KAAK,CAAC,EACnC,OAAO,CAAC,UAAkB,MAAM,SAAS,CAAC,IAC7C,CAAC;AACL,YAAM,cAAc,OAAO,EAAE,YAAY,aAAa,WAAW,EAAE,WAAW,SAAS,KAAK,IAAI;AAChG,YAAM,qBAAqB,YAAY,SAAS,cAAc;AAC9D,YAAM,UAAU,UAAU,SAAS,IAC/B,UAAU,KAAK,CAAC,UAAkB,eAAe,IAAI,KAAK,CAAC,IAC3D,eAAe,IAAI,kBAAkB;AACzC,UAAI,CAAC,QAAS;AAAA,IAChB;AACA,UAAM,MAAM,EAAE;AACd,UAAM,WAAW,OAAO,EAAE,QAAQ;AAClC,UAAM,UAAU,MAAM,GAAG;AACzB,UAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,OAAO;AAC9C,QAAI,CAAC,SAAS;AACZ,YAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,QAAS,EAAU,YAAY,KAAK,GAAG,SAAS;AACpF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,IAAI,QAAQ,QAAQ,KAAK,OAAO;AACtD,QAAI,UAAU,SAAS;AACrB,YAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,QAAS,EAAU,YAAY,KAAK,GAAG,SAAS;AAAA,IACtF;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,MAAc,MAAe;AAC3C,QAAI,KAAK,KAAM,QAAO;AACtB,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAW,eAAO,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE;AAAA,MACpD,KAAK;AAAS,eAAO,OAAO,WAAW,OAAO,CAAC,CAAC;AAAA,MAChD,KAAK;AAAW,eAAO,kBAAkB,OAAO,CAAC,CAAC,MAAM;AAAA,MACxD,KAAK;AAAA,MACL,KAAK;AAAY,eAAO,OAAO,CAAC;AAAA,MAChC;AAAS,eAAO,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAEA,aAAW,CAAC,QAAQ,MAAM,KAAK,SAAS;AACtC,UAAM,OAAO,OAAO,SAAS,IAAI;AACjC,UAAM,MAAM,OAAO,OAAO,QAAQ,QAAQ,EAAE,EAAE,QAAQ,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,EAAE;AAC5F,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,UAAU,MAAM,GAAG;AACzB,QAAI,CAAC,IAAK;AACV,QAAI,MAAM;AACR,YAAM,OAAO,MAAM,QAAQ,MAAM,IAC5B,SACD,OAAO,MAAM,EACV,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACrB,UAAI,KAAK,OAAQ,KAAI,OAAO,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,MAAM,OAAO,IAAI,MAAM,CAAC,CAAC,EAAuC;AAAA,IACnH,OAAO;AACL,UAAI,OAAO,IAAI,OAAO,IAAI,MAAM,MAAM;AAAA,IACxC;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,wBAAwB,KAAuC;AAC7E,QAAM,OAAgC,CAAC;AACvC,QAAM,SAAkC,CAAC;AACzC,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,EAAE,MAAM,OAAO;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AACzE,QAAI,QAAQ,gBAAgB;AAC1B,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,QAAQ,CAAC,UAAU;AACvB,cAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,gBAAM,WAAW,OAAQ,MAAc,QAAQ,WAAY,MAAc,IAAI,KAAK,IAAI;AACtF,cAAI,CAAC,SAAU;AACf,iBAAO,QAAQ,IAAK,MAAc;AAAA,QACpC,CAAC;AACD;AAAA,MACF;AACA,UAAI,SAAS,OAAO,UAAU,UAAU;AACtC,mBAAW,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACvE,gBAAM,gBAAgB,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI;AAC3D,cAAI,CAAC,cAAe;AACpB,iBAAO,aAAa,IAAI;AAAA,QAC1B;AACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,QAAQ,kBAAkB,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzF,iBAAW,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACvE,eAAO,OAAO,EAAE,CAAC,IAAI;AAAA,MACvB;AACA;AAAA,IACF;AACA,QAAI,IAAI,WAAW,KAAK,GAAG;AACzB,aAAO,IAAI,MAAM,CAAC,CAAC,IAAI;AACvB;AAAA,IACF;AACA,QAAI,IAAI,WAAW,KAAK,GAAG;AACzB,aAAO,IAAI,MAAM,CAAC,CAAC,IAAI;AACvB;AAAA,IACF;AACA,SAAK,GAAG,IAAI;AAAA,EACd;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;AAEO,SAAS,oCAAoC,KAAuD;AACzG,SAAO,wBAAwB,GAAG,EAAE;AACtC;AAEA,SAAS,uBAAuB,KAAsB;AACpD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,QAAQ,YAAY,IAAI;AAClD;AAEA,SAAS,0BAA0B,KAAmC;AACpE,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO,EAAE,GAAI,OAA+B;AAAA,MAC9C;AACA,aAAO,CAAC;AAAA,IACV,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AAClD,WAAO,EAAE,GAAI,IAA4B;AAAA,EAC3C;AACA,SAAO,CAAC;AACV;AAEA,SAAS,oBAAoB,KAA0D;AACrF,QAAM,gBAAgB,uBAAuB,IAAI,GAAG;AACpD,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,MAAM,0BAA2B,IAAY,UAAU;AAC7D,QAAM,QACJ,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,KAAK,EAAE,SAC9C,IAAI,MAAM,KAAK,IACf,IAAI;AACV,QAAM,eACJ,OAAO,IAAI,iBAAiB,YAAY,IAAI,aAAa,KAAK,EAAE,SAC5D,IAAI,aAAa,KAAK,IACtB;AACN,QAAM,QACJ,IAAI,UAAU,SAAY,QAAQ,IAAI,KAAK,IAAI;AACjD,QAAM,WACJ,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AACpD,QAAM,YACJ,IAAI,qBAAqB,OACrB,IAAI,UAAU,QAAQ,IACtB,IAAI,KAAK,IAAI,SAAgB,EAAE,QAAQ;AAC7C,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT;AAAA,IACA,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AAAA,IAChD;AAAA,IACA;AAAA,IACA,gBAAgB,IAAI,kBAAkB;AAAA,IACtC,UAAU,IAAI,YAAY;AAAA,IAC1B;AAAA,IACA,WAAW,OAAO,MAAM,SAAS,IAAI,IAAI;AAAA,EAC3C;AACF;AAEA,SAAS,wBAAwB,MAAsE;AACrG,SAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM;AAC9B,UAAM,gBAAgB,EAAE,YAAY,MAAM,EAAE,YAAY;AACxD,QAAI,iBAAiB,EAAG,QAAO;AAC/B,UAAM,eAAe,EAAE,aAAa,MAAM,EAAE,aAAa;AACzD,QAAI,gBAAgB,EAAG,QAAO;AAC9B,WAAO,EAAE,IAAI,cAAc,EAAE,GAAG;AAAA,EAClC,CAAC;AACH;AAEA,SAAS,0BACP,MACA,gBACA,UACqC;AACrC,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,QAAM,oBAAoB,KAAK;AAAA,IAC7B,CAAC,QAAQ,IAAI,kBAAkB,kBAAkB,IAAI,mBAAmB;AAAA,EAC1E;AACA,MAAI,kBAAkB,OAAQ,QAAO,wBAAwB,iBAAiB,EAAE,CAAC;AACjF,QAAM,uBAAuB,KAAK;AAAA,IAChC,CAAC,QAAQ,IAAI,YAAY,YAAY,IAAI,aAAa,YAAY,CAAC,IAAI;AAAA,EACzE;AACA,MAAI,qBAAqB,OAAQ,QAAO,wBAAwB,oBAAoB,EAAE,CAAC;AACvF,QAAM,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,cAAc;AACvD,MAAI,OAAO,OAAQ,QAAO,wBAAwB,MAAM,EAAE,CAAC;AAC3D,SAAO,wBAAwB,IAAI,EAAE,CAAC,KAAK;AAC7C;AAEA,eAAsB,+BAA+B,MAMb;AACtC,QAAM,OAAO,MAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,YAAY,CAAC,KAAK,SAAS;AAC7E,QAAM,YAAY,KACf,IAAI,CAAC,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,OAAO,MAAM,EAAE,CAAE,EACnE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AAC/B,MAAI,CAAC,UAAU,OAAQ,QAAO,oBAAI,IAAI;AACtC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,gBAAgB,MAAM,QAAQ,KAAK,eAAe,IACpD,KAAK,gBACF,IAAI,CAAC,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,EAAG,EACrD,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,IACvE,CAAC;AACL,QAAM,eAA0C;AAAA,IAC9C,WACI,EAAE,KAAK,CAAC,EAAE,SAA0B,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE,IAC3D,EAAE,UAAU,KAAK;AAAA,EACvB;AACA,MAAI,cAAc,QAAQ;AACxB,iBAAa,KAAK;AAAA,MAChB,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,cAAqB,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC;AAAA,IACnF,CAAC;AAAA,EACH,OAAO;AACL,iBAAa,KAAK,EAAE,gBAAgB,KAAK,CAAC;AAAA,EAC5C;AACA,QAAM,QAAiC;AAAA,IACrC,UAAU,EAAE,KAAK,UAAiB;AAAA,IAClC,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACA,QAAM,OAAO,MAAM,KAAK,GAAG,KAAK,gBAAgB,KAAY;AAC5D,QAAM,iBAAiB,wBAAwB,KAAK,QAAQ;AAC5D,QAAM,QAAoC,oBAAI,IAAI;AAClD,OAAK,QAAQ,CAAC,QAAQ;AACpB,QAAI,gBAAgB;AAClB,YAAM,SAAS,0BAA2B,IAAY,UAAU;AAChE,YAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,IAC5C,OAAO,UACJ,OAAO,CAAC,UAAoC,OAAO,UAAU,QAAQ,EACrE,IAAI,CAAC,UAAkB,MAAM,KAAK,CAAC,EACnC,OAAO,CAAC,UAAkB,MAAM,SAAS,CAAC,IAC7C,CAAC;AACL,YAAM,WAAW,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,KAAK,EAAE,SAAS,IACpF,OAAO,SAAS,KAAK,IACrB;AACJ,YAAM,UAAU,UAAU,SAAS,IAC/B,UAAU,KAAK,CAAC,UAAkB,eAAe,IAAI,KAAK,CAAC,IAC3D,eAAe,IAAI,QAAQ;AAC/B,UAAI,CAAC,QAAS;AAAA,IAChB;AACA,UAAM,UAAU,oBAAoB,GAAG;AACvC,QAAI,CAAC,QAAS;AACd,UAAM,gBAAgB,uBAAuB,QAAQ,GAAG;AACxD,QAAI,CAAC,cAAe;AACpB,QAAI,CAAC,MAAM,IAAI,aAAa,EAAG,OAAM,IAAI,eAAe,CAAC,CAAC;AAC1D,UAAM,IAAI,aAAa,EAAG,KAAK,OAAO;AAAA,EACxC,CAAC;AACD,QAAM,QAAQ,CAAC,SAAS,QAAQ;AAC9B,UAAM,IAAI,KAAK,wBAAwB,OAAO,CAAC;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEO,SAAS,+BACd,QACA,aACA,UAGI,CAAC,GACsB;AAC3B,QAAM,aAAa,6BAA6B,MAAM;AACtD,MAAI,CAAC,OAAO,KAAK,UAAU,EAAE,QAAQ;AACnC,WAAO,EAAE,cAAc,MAAM,cAAc,CAAC,EAAE;AAAA,EAChD;AACA,QAAM,SAAkC,CAAC;AACzC,QAAM,UAA0F,CAAC;AACjG,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,WAAW,QAAQ,YAAY;AAErC,SAAO,QAAQ,UAAU,EAAE,QAAQ,CAAC,CAAC,aAAa,KAAK,MAAM;AAC3D,UAAM,UAAU,YAAY,QAAQ,QAAQ,EAAE;AAC9C,UAAM,gBAAgB,uBAAuB,OAAO;AACpD,QAAI,CAAC,cAAe;AACpB,WAAO,OAAO,IAAI;AAClB,UAAM,aAAa,YAAY,IAAI,aAAa,KAAK,CAAC;AACtD,UAAM,cAAc,0BAA0B,YAAY,gBAAgB,QAAQ;AAClF,UAAM,QAAiC;AAAA,MACrC,KAAK;AAAA,MACL,OAAO,aAAa,SAAS;AAAA,MAC7B;AAAA,MACA,MAAM,aAAa,QAAQ;AAAA,MAC3B,OAAO,aAAa,SAAS,MAAM,QAAQ,KAAK;AAAA,IAClD;AACA,YAAQ,KAAK;AAAA,MACX;AAAA,MACA,UAAU,aAAa,YAAY,OAAO;AAAA,MAC1C,WAAW,aAAa,aAAa;AAAA,IACvC,CAAC;AAAA,EACH,CAAC;AAED,QAAM,UAAU,QACb,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,eAAe,EAAE,WAAW,EAAE;AACpC,QAAI,iBAAiB,EAAG,QAAO;AAC/B,UAAM,cAAc,EAAE,YAAY,EAAE;AACpC,QAAI,gBAAgB,EAAG,QAAO;AAC9B,WAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,GAAG;AAAA,EAC9C,CAAC,EACA,IAAI,CAAC,SAAS,KAAK,KAAK;AAE3B,SAAO;AAAA,IACL,cAAc,OAAO,KAAK,MAAM,EAAE,SAAS,SAAS;AAAA,IACpD,cAAc;AAAA,EAChB;AACF;AAEA,eAAsB,sBAAsB,MAQS;AACnD,QAAM,EAAE,IAAI,UAAU,UAAU,IAAI;AACpC,MAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,WAAW,EAAG,QAAO,CAAC;AAEjE,QAAM,sBAAsB,UAAU,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC;AAC5D,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAI,KAAK,iBAAiB;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,mBAAmB,oBAAI,IAAmB;AAChD,mBAAiB,IAAI,IAAI;AACzB,MAAI,KAAK,kBAAkB;AACzB,eAAW,OAAO,OAAO,OAAO,KAAK,gBAAgB,GAAG;AACtD,uBAAiB,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI;AAAA,IAC/C;AAAA,EACF;AACA,MAAI,KAAK,iBAAiB;AACxB,eAAW,OAAO,KAAK,gBAAiB,kBAAiB,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI;AAAA,EACvF;AACA,QAAM,kBAAkB,KAAK,mBAAmB,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,KAAK;AAE9E,QAAM,aAAa,MAAM,KAAK,gBAAgB;AAC9C,QAAM,gBAAgB,WAAW,OAAO,CAAC,MAAmB,MAAM,IAAI;AACtE,QAAM,eAAe,cAAc,SAC/B,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,eAAe,IAAI,EAAS,EAAE,IACrD,EAAE,UAAU,KAAK;AACrB,QAAM,SAAS,MAAM,GAAG,KAAK,kBAAkB;AAAA,IAC7C;AAAA,IACA,UAAU,EAAE,KAAK,oBAA2B;AAAA,IAC5C,WAAW;AAAA,IACX,GAAI,WAAW,SAAS,eAAe,CAAC;AAAA,EAC1C,CAAC;AAED,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC;AAC7E,QAAM,yBAAyB,oBAAI,IAAmB;AACtD,yBAAuB,IAAI,IAAI;AAC/B,MAAI,KAAK,wBAAwB;AAC/B,eAAW,OAAO,OAAO,OAAO,KAAK,sBAAsB,GAAG;AAC5D,6BAAuB,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI;AAAA,IACrD;AAAA,EACF;AACA,aAAW,OAAO,QAAQ;AACxB,2BAAuB,IAAI,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AAAA,EACnF;AACA,QAAM,UAAU,MAAM,KAAK,sBAAsB;AAEjD,QAAM,OAAO,QAAQ,SACjB,MAAM,GAAG,KAAK,gBAAgB;AAAA,IAC5B;AAAA,IACA,KAAK,EAAE,KAAK,QAAe;AAAA,IAC3B,WAAW;AAAA,IACX,UAAU;AAAA,IACV,GAAI,WAAW,SAAS,EAAE,UAAU,aAAa,SAAS,IAAI,CAAC;AAAA,IAC/D,gBAAgB,EAAE,KAAK,QAAe;AAAA,EACxC,CAAC,IACD,CAAC;AAEL,QAAM,YAAY,oBAAI,IAA8B;AACpD,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,UAAU,IAAI,IAAI,GAAG,KAAK,CAAC;AACxC,SAAK,KAAK,GAAG;AACb,cAAU,IAAI,IAAI,KAAK,IAAI;AAAA,EAC7B;AAEA,QAAM,iBAAiB,CAAC,UAAkB,gBAA+B,aAA4B;AACnG,UAAM,aAAa,UAAU,IAAI,QAAQ;AACzC,QAAI,CAAC,cAAc,WAAW,WAAW,EAAG,QAAO;AACnD,UAAM,SAAS,WAAW,OAAO,CAAC,QAAQ,IAAI,aAAa,SAAS,CAAC,IAAI,SAAS;AAClF,UAAM,OAAO,OAAO,SAAS,SAAS;AACtC,QAAI,kBAAkB,UAAU;AAC9B,YAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,mBAAmB,kBAAkB,IAAI,aAAa,QAAQ;AACnG,UAAI,MAAO,QAAO;AAAA,IACpB;AACA,QAAI,gBAAgB;AAClB,YAAM,WAAW,KAAK,KAAK,CAAC,QAAQ,IAAI,mBAAmB,mBAAmB,CAAC,YAAY,IAAI,YAAY,QAAQ,IAAI,aAAa,SAAS;AAC7I,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,QAAI,UAAU;AACZ,YAAM,cAAc,KAAK,KAAK,CAAC,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,aAAa,QAAQ;AAC9F,UAAI,YAAa,QAAO;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,YAAY,IAAI;AACpF,WAAO,UAAU,KAAK,CAAC;AAAA,EACzB;AAEA,QAAM,eAAe,CAAC,QAAmC;AACvD,QAAI,IAAI,mBAAmB,QAAQ,IAAI,mBAAmB,OAAW,QAAO,IAAI;AAChF,QAAI,IAAI,cAAc,QAAQ,IAAI,cAAc,OAAW,QAAO,IAAI;AACtE,QAAI,IAAI,aAAa,QAAQ,IAAI,aAAa,OAAW,QAAO,IAAI;AACpE,QAAI,IAAI,eAAe,QAAQ,IAAI,eAAe,OAAW,QAAO,IAAI;AACxE,QAAI,IAAI,cAAc,QAAQ,IAAI,cAAc,OAAW,QAAO,IAAI;AACtE,WAAO;AAAA,EACT;AAGA,QAAM,UAAU,oBAAI,IAAoB;AAExC,aAAW,OAAO,QAAQ;AACxB,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,UAAM,MAAM,OAAO,IAAI,QAAQ;AAC/B,UAAM,YAAY,GAAG,QAAQ,KAAK,GAAG;AACrC,UAAM,QAAQ,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI;AAChE,UAAM,WAAW,IAAI,WAAW,OAAO,IAAI,QAAQ,IAAI;AACvD,UAAM,gBAAgB,UAAU,KAAK,yBAAyB,QAAQ,KAAK;AAC3E,UAAM,mBAAmB,aAAa,KAAK,mBAAmB,QAAQ,KAAK;AAC3E,UAAM,MAAM,eAAe,KAAK,eAAe,gBAAgB;AAC/D,UAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,YAAY,YACd,MAAM,wBAAwB,OAAO,oBAAoB,YAAY,MAAM,qBAAqB,GAAG,eAAe,IAClH;AACJ,UAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,QAAI,UAAU;AACZ,UAAI,SAAS,SAAS,QAAQ,cAAe,UAAS,QAAQ;AAC9D,UAAI,SAAS,YAAY,QAAQ,iBAAkB,UAAS,WAAW;AACvE,UAAI,SAAS,OAAO,QAAQ,IAAK,UAAS,MAAM;AAChD,eAAS,YAAY,SAAS,aAAa;AAC3C,eAAS,OAAO,KAAK,SAAS;AAAA,IAChC,OAAO;AACL,cAAQ,IAAI,WAAW,EAAE,OAAO,eAAe,UAAU,kBAAkB,QAAQ,CAAC,SAAS,GAAG,KAAK,OAAO,MAAM,UAAU,CAAC;AAAA,IAC/H;AAAA,EACF;AAEA,QAAM,SAAkD,CAAC;AACzD,aAAW,CAAC,aAAa,MAAM,KAAK,QAAQ,QAAQ,GAAG;AACrD,UAAM,CAAC,UAAU,QAAQ,IAAI,YAAY,MAAM,IAAI;AACnD,QAAI,CAAC,OAAO,QAAQ,EAAG,QAAO,QAAQ,IAAI,CAAC;AAC3C,UAAM,WAAW,MAAM,QAAQ;AAC/B,UAAM,MAAM,OAAO,OAAO,eAAe,UAAU,OAAO,UAAU,KAAK,yBAAyB,QAAQ,KAAK,OAAO,OAAO,aAAa,KAAK,mBAAmB,QAAQ,KAAK,KAAK;AACpL,QAAI,OAAO,IAAI,cAAc,OAAO,IAAI,eAAe,YAAa,IAAI,WAAmB,OAAO;AAChG,YAAM,UAAU,OAAO,OAAO,OAAO,CAAC,MAAM,MAAM,UAAa,MAAM,IAAI;AACzE,aAAO,QAAQ,EAAE,QAAQ,IAAI;AAAA,IAC/B,WAAW,OAAO,OAAO,SAAS,GAAG;AACnC,YAAM,UAAU,OAAO,OAAO,OAAO,CAAC,MAAM,MAAM,MAAS;AAC3D,aAAO,QAAQ,EAAE,QAAQ,IAAI;AAAA,IAC/B,OAAO;AACL,aAAO,QAAQ,EAAE,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK;AAAA,IACnD;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,sBAAsB,QAAsD;AAC1F,QAAM,UAAU,6BAA6B,MAAM;AACnD,QAAM,SAAS,OAAO;AAAA,IACpB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM;AAAA,MACpD,YAAY,QAAQ,QAAQ,EAAE;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,eAAe,OAAO,KAAK,MAAM,EAAE,SAAS,SAAS;AAC3D,QAAM,eAAe,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,IACjE;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,MAAM;AAAA,IACN,OAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,EAAE;AACF,SAAO,EAAE,SAAS,cAAc,aAAa;AAC/C;",
+  "sourcesContent": ["import type { CustomFieldSet, EntityId } from '@open-mercato/shared/modules/entities'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { CustomFieldDef, CustomFieldValue } from '@open-mercato/core/modules/entities/data/entities'\nimport type { WhereValue } from '@open-mercato/shared/lib/query/types'\nimport type { TenantDataEncryptionService } from '../encryption/tenantDataEncryptionService'\nimport { decryptCustomFieldValue, resolveTenantEncryptionService } from '../encryption/customFieldValues'\nimport { parseBooleanToken } from '../boolean'\nimport { extractCustomFieldEntries } from './custom-fields-client'\n\nexport type CustomFieldSelectors = {\n  keys: string[]\n  selectors: string[] // e.g. ['cf:priority', 'cf:severity']\n  outputKeys: string[] // e.g. ['cf_priority', 'cf_severity']\n}\n\nexport type SplitCustomFieldPayload = {\n  base: Record<string, unknown>\n  custom: Record<string, unknown>\n}\n\nexport type CustomFieldDefinitionSummary = {\n  key: string\n  label: string | null\n  kind: string | null\n  multi: boolean\n  dictionaryId?: string | null\n  organizationId?: string | null\n  tenantId?: string | null\n  priority: number\n  updatedAt: number\n}\n\nexport type CustomFieldDefinitionIndex = Map<string, CustomFieldDefinitionSummary[]>\n\nexport type CustomFieldDisplayEntry = {\n  key: string\n  label: string | null\n  value: unknown\n  kind: string | null\n  multi: boolean\n}\n\nexport type CustomFieldDisplayPayload = {\n  customValues: Record<string, unknown> | null\n  customFields: CustomFieldDisplayEntry[]\n}\n\nexport type CustomFieldSnapshot = {\n  entries: Record<string, unknown>\n  customValues: Record<string, unknown> | null\n  customFields: CustomFieldDisplayEntry[]\n}\n\nexport function buildCustomFieldSelectorsForEntity(entityId: EntityId, sets: CustomFieldSet[]): CustomFieldSelectors {\n  const keys = Array.from(new Set(\n    (sets || [])\n      .filter((s) => s.entity === entityId)\n      .flatMap((s) => (s.fields || []).map((f) => f.key))\n  ))\n  const selectors = keys.map((k) => `cf:${k}`)\n  const outputKeys = keys.map((k) => `cf_${k}`)\n  return { keys, selectors, outputKeys }\n}\n\nexport function normalizeCustomFieldValue(val: unknown): unknown {\n  if (Array.isArray(val)) return val\n  if (typeof val === 'string') {\n    const s = val.trim()\n    // Parse Postgres array-like '{a,b,c}' to string[] when present\n    if (s.startsWith('{') && s.endsWith('}')) {\n      const inner = s.slice(1, -1).trim()\n      if (!inner) return []\n      return inner.split(/[\\s,]+/).map((x) => x.trim()).filter(Boolean)\n    }\n    return s\n  }\n  return val as any\n}\n\n// Extracts cf_* fields from a record that may contain both 'cf:<key>' and/or 'cf_<key>'\nexport function extractCustomFieldsFromItem(item: Record<string, unknown>, keys: string[]): Record<string, unknown> {\n  const out: Record<string, unknown> = {}\n  for (const key of keys) {\n    const colon = item[`cf:${key}` as keyof typeof item]\n    const snake = item[`cf_${key}` as keyof typeof item]\n    const value = colon !== undefined ? colon : snake\n    if (value !== undefined) out[`cf_${key}`] = normalizeCustomFieldValue(value)\n  }\n  return out\n}\n\nexport function extractAllCustomFieldEntries(item: Record<string, unknown>): Record<string, unknown> {\n  return extractCustomFieldEntries(item)\n}\n\nfunction normalizeFieldsetFilter(input?: string | string[] | null): Set<string | null> | null {\n  if (input == null) return null\n  const values = Array.isArray(input) ? input : [input]\n  const normalized = new Set<string | null>()\n  for (const raw of values) {\n    if (raw == null) continue\n    const trimmed = String(raw).trim()\n    if (!trimmed) {\n      normalized.add(null)\n    } else {\n      normalized.add(trimmed)\n    }\n  }\n  return normalized.size ? normalized : null\n}\n\nexport async function buildCustomFieldFiltersFromQuery(opts: {\n  entityId?: EntityId\n  entityIds?: EntityId[]\n  query: Record<string, unknown>\n  em: EntityManager\n  tenantId: string | null | undefined\n  fieldset?: string | string[] | null\n}): Promise<Record<string, WhereValue>> {\n  const out: Record<string, WhereValue> = {}\n  const entries = Object.entries(opts.query).filter(([k]) => k.startsWith('cf_'))\n  if (!entries.length) return out\n\n  const entityIdList = Array.isArray(opts.entityIds) && opts.entityIds.length\n    ? opts.entityIds\n    : opts.entityId\n      ? [opts.entityId]\n      : []\n  if (!entityIdList.length) return out\n\n  // Tenant-only scope: allow global (null) or tenant match; ignore organization here\n  const defs = await opts.em.find(CustomFieldDef, {\n    entityId: { $in: entityIdList as any },\n    isActive: true,\n    $and: [\n      { $or: [ { tenantId: opts.tenantId as any }, { tenantId: null } ] },\n    ],\n  })\n  const fieldsetFilter = normalizeFieldsetFilter(opts.fieldset)\n  const order = new Map<string, number>()\n  entityIdList.map(String).forEach((id, index) => order.set(id, index))\n  const byKey: Record<string, { kind: string; multi?: boolean; entityId: string }> = {}\n  for (const d of defs) {\n    if (fieldsetFilter) {\n      const fieldsets = Array.isArray(d.configJson?.fieldsets)\n        ? d.configJson.fieldsets\n            .filter((entry: unknown): entry is string => typeof entry === 'string')\n            .map((entry: string) => entry.trim())\n            .filter((entry: string) => entry.length > 0)\n        : []\n      const rawFieldset = typeof d.configJson?.fieldset === 'string' ? d.configJson.fieldset.trim() : ''\n      const normalizedFieldset = rawFieldset.length ? rawFieldset : null\n      const matches = fieldsets.length > 0\n        ? fieldsets.some((entry: string) => fieldsetFilter.has(entry))\n        : fieldsetFilter.has(normalizedFieldset)\n      if (!matches) continue\n    }\n    const key = d.key\n    const entityId = String(d.entityId)\n    const current = byKey[key]\n    const rankNew = order.get(entityId) ?? Number.MAX_SAFE_INTEGER\n    if (!current) {\n      byKey[key] = { kind: d.kind, multi: Boolean((d as any).configJson?.multi), entityId }\n      continue\n    }\n    const rankOld = order.get(current.entityId) ?? Number.MAX_SAFE_INTEGER\n    if (rankNew < rankOld) {\n      byKey[key] = { kind: d.kind, multi: Boolean((d as any).configJson?.multi), entityId }\n    }\n  }\n\n  const coerce = (kind: string, v: unknown) => {\n    if (v == null) return v as undefined\n    switch (kind) {\n      case 'integer': return Number.parseInt(String(v), 10)\n      case 'float': return Number.parseFloat(String(v))\n      case 'boolean': return parseBooleanToken(String(v)) === true\n      case 'date':\n      case 'datetime': return String(v)\n      default: return String(v)\n    }\n  }\n\n  for (const [rawKey, rawVal] of entries) {\n    const isIn = rawKey.endsWith('In')\n    const key = isIn ? rawKey.replace(/^cf_/, '').replace(/In$/, '') : rawKey.replace(/^cf_/, '')\n    const def = byKey[key]\n    const fieldId = `cf:${key}`\n    if (!def) continue\n    if (isIn) {\n      const list = Array.isArray(rawVal)\n        ? (rawVal as unknown[])\n        : String(rawVal)\n            .split(',')\n            .map((s) => s.trim())\n            .filter(Boolean)\n      if (list.length) out[fieldId] = { $in: list.map((x) => coerce(def.kind, x)) as (string[] | number[] | boolean[]) }\n    } else {\n      out[fieldId] = coerce(def.kind, rawVal)\n    }\n  }\n\n  return out\n}\n\nexport function splitCustomFieldPayload(raw: unknown): SplitCustomFieldPayload {\n  const base: Record<string, unknown> = {}\n  const custom: Record<string, unknown> = {}\n  if (!raw || typeof raw !== 'object') return { base, custom }\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (key === 'customFields') {\n      if (Array.isArray(value)) {\n        value.forEach((entry) => {\n          if (!entry || typeof entry !== 'object') return\n          const entryKey = typeof (entry as any).key === 'string' ? (entry as any).key.trim() : ''\n          if (!entryKey) return\n          custom[entryKey] = (entry as any).value\n        })\n        continue\n      }\n      if (value && typeof value === 'object') {\n        for (const [ck, cv] of Object.entries(value as Record<string, unknown>)) {\n          const normalizedKey = typeof ck === 'string' ? ck.trim() : ''\n          if (!normalizedKey) continue\n          custom[normalizedKey] = cv\n        }\n        continue\n      }\n    }\n    if (key === 'customValues' && value && typeof value === 'object' && !Array.isArray(value)) {\n      for (const [ck, cv] of Object.entries(value as Record<string, unknown>)) {\n        custom[String(ck)] = cv\n      }\n      continue\n    }\n    if (key.startsWith('cf_')) {\n      custom[key.slice(3)] = value\n      continue\n    }\n    if (key.startsWith('cf:')) {\n      custom[key.slice(3)] = value\n      continue\n    }\n    base[key] = value\n  }\n  return { base, custom }\n}\n\nexport function extractCustomFieldValuesFromPayload(raw: Record<string, unknown>): Record<string, unknown> {\n  return splitCustomFieldPayload(raw).custom\n}\n\nfunction normalizeDefinitionKey(key: unknown): string {\n  if (typeof key !== 'string') return ''\n  const trimmed = key.trim()\n  return trimmed.length ? trimmed.toLowerCase() : ''\n}\n\nfunction normalizeDefinitionConfig(raw: unknown): Record<string, any> {\n  if (!raw) return {}\n  if (typeof raw === 'string') {\n    try {\n      const parsed = JSON.parse(raw)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return { ...(parsed as Record<string, any>) }\n      }\n      return {}\n    } catch {\n      return {}\n    }\n  }\n  if (typeof raw === 'object' && !Array.isArray(raw)) {\n    return { ...(raw as Record<string, any>) }\n  }\n  return {}\n}\n\nfunction summarizeDefinition(def: CustomFieldDef): CustomFieldDefinitionSummary | null {\n  const normalizedKey = normalizeDefinitionKey(def.key)\n  if (!normalizedKey) return null\n  const cfg = normalizeDefinitionConfig((def as any).configJson)\n  const label =\n    typeof cfg.label === 'string' && cfg.label.trim().length\n      ? cfg.label.trim()\n      : def.key\n  const dictionaryId =\n    typeof cfg.dictionaryId === 'string' && cfg.dictionaryId.trim().length\n      ? cfg.dictionaryId.trim()\n      : null\n  const multi =\n    cfg.multi !== undefined ? Boolean(cfg.multi) : false\n  const priority =\n    typeof cfg.priority === 'number' ? cfg.priority : 0\n  const updatedAt =\n    def.updatedAt instanceof Date\n      ? def.updatedAt.getTime()\n      : new Date(def.updatedAt as any).getTime()\n  return {\n    key: def.key,\n    label,\n    kind: typeof def.kind === 'string' ? def.kind : null,\n    multi,\n    dictionaryId,\n    organizationId: def.organizationId ?? null,\n    tenantId: def.tenantId ?? null,\n    priority,\n    updatedAt: Number.isNaN(updatedAt) ? 0 : updatedAt,\n  }\n}\n\nfunction sortDefinitionSummaries(defs: CustomFieldDefinitionSummary[]): CustomFieldDefinitionSummary[] {\n  return [...defs].sort((a, b) => {\n    const priorityDiff = (a.priority ?? 0) - (b.priority ?? 0)\n    if (priorityDiff !== 0) return priorityDiff\n    const updatedDiff = (b.updatedAt ?? 0) - (a.updatedAt ?? 0)\n    if (updatedDiff !== 0) return updatedDiff\n    return a.key.localeCompare(b.key)\n  })\n}\n\nfunction selectDefinitionForRecord(\n  defs: CustomFieldDefinitionSummary[],\n  organizationId: string | null,\n  tenantId: string | null,\n): CustomFieldDefinitionSummary | null {\n  if (!defs.length) return null\n  const prioritizedForOrg = defs.filter(\n    (def) => def.organizationId && organizationId && def.organizationId === organizationId,\n  )\n  if (prioritizedForOrg.length) return sortDefinitionSummaries(prioritizedForOrg)[0]\n  const prioritizedForTenant = defs.filter(\n    (def) => def.tenantId && tenantId && def.tenantId === tenantId && !def.organizationId,\n  )\n  if (prioritizedForTenant.length) return sortDefinitionSummaries(prioritizedForTenant)[0]\n  const global = defs.filter((def) => !def.organizationId)\n  if (global.length) return sortDefinitionSummaries(global)[0]\n  return sortDefinitionSummaries(defs)[0] ?? null\n}\n\nexport async function loadCustomFieldDefinitionIndex(opts: {\n  em: EntityManager\n  entityIds: string | string[]\n  tenantId?: string | null | undefined\n  organizationIds?: Array<string | null | undefined> | null\n  fieldset?: string | string[] | null\n}): Promise<CustomFieldDefinitionIndex> {\n  const list = Array.isArray(opts.entityIds) ? opts.entityIds : [opts.entityIds]\n  const entityIds = list\n    .map((id) => (typeof id === 'string' ? id.trim() : String(id ?? '')))\n    .filter((id) => id.length > 0)\n  if (!entityIds.length) return new Map()\n  const tenantId = opts.tenantId ?? null\n  const orgCandidates = Array.isArray(opts.organizationIds)\n    ? opts.organizationIds\n        .map((id) => (typeof id === 'string' ? id.trim() : id))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0)\n    : []\n  const scopeClauses: Record<string, unknown>[] = [\n    tenantId\n      ? { $or: [{ tenantId: tenantId as any }, { tenantId: null }] }\n      : { tenantId: null },\n  ]\n  if (orgCandidates.length) {\n    scopeClauses.push({\n      $or: [{ organizationId: { $in: orgCandidates as any } }, { organizationId: null }],\n    })\n  } else {\n    scopeClauses.push({ organizationId: null })\n  }\n  const where: Record<string, unknown> = {\n    entityId: { $in: entityIds as any },\n    deletedAt: null,\n    isActive: true,\n    $and: scopeClauses,\n  }\n  const defs = await opts.em.find(CustomFieldDef, where as any)\n  const fieldsetFilter = normalizeFieldsetFilter(opts.fieldset)\n  const index: CustomFieldDefinitionIndex = new Map()\n  defs.forEach((def) => {\n    if (fieldsetFilter) {\n      const config = normalizeDefinitionConfig((def as any).configJson)\n      const fieldsets = Array.isArray(config.fieldsets)\n        ? config.fieldsets\n            .filter((entry: unknown): entry is string => typeof entry === 'string')\n            .map((entry: string) => entry.trim())\n            .filter((entry: string) => entry.length > 0)\n        : []\n      const fieldset = typeof config.fieldset === 'string' && config.fieldset.trim().length > 0\n        ? config.fieldset.trim()\n        : null\n      const matches = fieldsets.length > 0\n        ? fieldsets.some((entry: string) => fieldsetFilter.has(entry))\n        : fieldsetFilter.has(fieldset)\n      if (!matches) return\n    }\n    const summary = summarizeDefinition(def)\n    if (!summary) return\n    const normalizedKey = normalizeDefinitionKey(summary.key)\n    if (!normalizedKey) return\n    if (!index.has(normalizedKey)) index.set(normalizedKey, [])\n    index.get(normalizedKey)!.push(summary)\n  })\n  index.forEach((entries, key) => {\n    index.set(key, sortDefinitionSummaries(entries))\n  })\n  return index\n}\n\nexport function decorateRecordWithCustomFields(\n  record: Record<string, unknown>,\n  definitions: CustomFieldDefinitionIndex,\n  context: {\n    organizationId?: string | null\n    tenantId?: string | null\n  } = {},\n): CustomFieldDisplayPayload {\n  const rawEntries = extractAllCustomFieldEntries(record)\n  if (!Object.keys(rawEntries).length) {\n    return { customValues: null, customFields: [] }\n  }\n  const values: Record<string, unknown> = {}\n  const entries: Array<{ entry: CustomFieldDisplayEntry; priority: number; updatedAt: number }> = []\n  const organizationId = context.organizationId ?? null\n  const tenantId = context.tenantId ?? null\n\n  Object.entries(rawEntries).forEach(([prefixedKey, value]) => {\n    const bareKey = prefixedKey.replace(/^cf_/, '')\n    const normalizedKey = normalizeDefinitionKey(bareKey)\n    if (!normalizedKey) return\n    const defsForKey = definitions.get(normalizedKey) ?? []\n    const resolvedDef = selectDefinitionForRecord(defsForKey, organizationId, tenantId)\n    // Skip custom field values without active definitions to prevent orphaned fields\n    if (!resolvedDef) return\n    values[bareKey] = value\n    const entry: CustomFieldDisplayEntry = {\n      key: bareKey,\n      label: resolvedDef.label ?? bareKey,\n      value,\n      kind: resolvedDef.kind ?? null,\n      multi: resolvedDef.multi ?? Array.isArray(value),\n    }\n    entries.push({\n      entry,\n      priority: resolvedDef.priority ?? Number.MAX_SAFE_INTEGER,\n      updatedAt: resolvedDef.updatedAt ?? 0,\n    })\n  })\n\n  const ordered = entries\n    .sort((a, b) => {\n      const priorityDiff = a.priority - b.priority\n      if (priorityDiff !== 0) return priorityDiff\n      const updatedDiff = b.updatedAt - a.updatedAt\n      if (updatedDiff !== 0) return updatedDiff\n      return a.entry.key.localeCompare(b.entry.key)\n    })\n    .map((item) => item.entry)\n\n  return {\n    customValues: Object.keys(values).length ? values : null,\n    customFields: ordered,\n  }\n}\n\nexport async function loadCustomFieldValues(opts: {\n  em: EntityManager\n  entityId: EntityId\n  recordIds: string[]\n  tenantIdByRecord?: Record<string, string | null | undefined>\n  organizationIdByRecord?: Record<string, string | null | undefined>\n  tenantFallbacks?: (string | null | undefined)[]\n  encryptionService?: TenantDataEncryptionService | null\n}): Promise<Record<string, Record<string, unknown>>> {\n  const { em, entityId, recordIds } = opts\n  if (!Array.isArray(recordIds) || recordIds.length === 0) return {}\n\n  const normalizedRecordIds = recordIds.map((id) => String(id))\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em, opts.encryptionService)\n    return encryptionService\n  }\n  const tenantCandidates = new Set<string | null>()\n  tenantCandidates.add(null)\n  if (opts.tenantIdByRecord) {\n    for (const val of Object.values(opts.tenantIdByRecord)) {\n      tenantCandidates.add(val ? String(val) : null)\n    }\n  }\n  if (opts.tenantFallbacks) {\n    for (const val of opts.tenantFallbacks) tenantCandidates.add(val ? String(val) : null)\n  }\n  const fallbackTenant = (opts.tenantFallbacks || []).find((t) => t != null) ?? null\n\n  const tenantList = Array.from(tenantCandidates)\n  const tenantNonNull = tenantList.filter((t): t is string => t !== null)\n  const tenantFilter = tenantNonNull.length\n    ? { tenantId: { $in: [...tenantNonNull, null] as any } }\n    : { tenantId: null }\n  const cfRows = await em.find(CustomFieldValue, {\n    entityId: entityId as any,\n    recordId: { $in: normalizedRecordIds as any },\n    deletedAt: null,\n    ...(tenantList.length ? tenantFilter : {}),\n  })\n\n  if (!cfRows.length) return {}\n\n  const allKeys = Array.from(new Set(cfRows.map((row) => String(row.fieldKey))))\n  const organizationCandidates = new Set<string | null>()\n  organizationCandidates.add(null)\n  if (opts.organizationIdByRecord) {\n    for (const val of Object.values(opts.organizationIdByRecord)) {\n      organizationCandidates.add(val ? String(val) : null)\n    }\n  }\n  for (const row of cfRows) {\n    organizationCandidates.add(row.organizationId ? String(row.organizationId) : null)\n  }\n  const orgList = Array.from(organizationCandidates)\n\n  const defs = allKeys.length\n    ? await em.find(CustomFieldDef, {\n        entityId: entityId as any,\n        key: { $in: allKeys as any },\n        deletedAt: null,\n        isActive: true,\n        ...(tenantList.length ? { tenantId: tenantFilter.tenantId } : {}),\n        organizationId: { $in: orgList as any },\n      })\n    : []\n\n  const defsByKey = new Map<string, CustomFieldDef[]>()\n  for (const def of defs) {\n    const list = defsByKey.get(def.key) || []\n    list.push(def)\n    defsByKey.set(def.key, list)\n  }\n\n  const pickDefinition = (fieldKey: string, organizationId: string | null, tenantId: string | null) => {\n    const candidates = defsByKey.get(fieldKey)\n    if (!candidates || candidates.length === 0) return null\n    const active = candidates.filter((opt) => opt.isActive !== false && !opt.deletedAt)\n    const list = active.length ? active : candidates\n    if (organizationId && tenantId) {\n      const exact = list.find((opt) => opt.organizationId === organizationId && opt.tenantId === tenantId)\n      if (exact) return exact\n    }\n    if (organizationId) {\n      const orgMatch = list.find((opt) => opt.organizationId === organizationId && (!tenantId || opt.tenantId == null || opt.tenantId === tenantId))\n      if (orgMatch) return orgMatch\n    }\n    if (tenantId) {\n      const tenantMatch = list.find((opt) => opt.organizationId == null && opt.tenantId === tenantId)\n      if (tenantMatch) return tenantMatch\n    }\n    const global = list.find((opt) => opt.organizationId == null && opt.tenantId == null)\n    return global ?? list[0]\n  }\n\n  const valueFromRow = (row: CustomFieldValue): unknown => {\n    if (row.valueMultiline !== null && row.valueMultiline !== undefined) return row.valueMultiline\n    if (row.valueText !== null && row.valueText !== undefined) return row.valueText\n    if (row.valueInt !== null && row.valueInt !== undefined) return row.valueInt\n    if (row.valueFloat !== null && row.valueFloat !== undefined) return row.valueFloat\n    if (row.valueBool !== null && row.valueBool !== undefined) return row.valueBool\n    return null\n  }\n\n  type Bucket = { orgId: string | null; tenantId: string | null; values: unknown[]; def?: CustomFieldDef | null; encrypted?: boolean }\n  const buckets = new Map<string, Bucket>()\n\n  for (const row of cfRows) {\n    const recordId = String(row.recordId)\n    const key = String(row.fieldKey)\n    const bucketKey = `${recordId}::${key}`\n    const orgId = row.organizationId ? String(row.organizationId) : null\n    const tenantId = row.tenantId ? String(row.tenantId) : null\n    const resolvedOrgId = orgId ?? (opts.organizationIdByRecord?.[recordId] ?? null)\n    const resolvedTenantId = tenantId ?? (opts.tenantIdByRecord?.[recordId] ?? fallbackTenant)\n    const def = pickDefinition(key, resolvedOrgId, resolvedTenantId)\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const value = valueFromRow(row)\n    const decrypted = encrypted\n      ? await decryptCustomFieldValue(\n          value,\n          resolvedTenantId ?? tenantId ?? null,\n          getEncryptionService(),\n          encryptionCache,\n          { kind: def?.kind ?? null },\n        )\n      : value\n    const existing = buckets.get(bucketKey)\n    if (existing) {\n      if (existing.orgId == null && resolvedOrgId) existing.orgId = resolvedOrgId\n      if (existing.tenantId == null && resolvedTenantId) existing.tenantId = resolvedTenantId\n      if (existing.def == null && def) existing.def = def\n      existing.encrypted = existing.encrypted || encrypted\n      existing.values.push(decrypted)\n    } else {\n      buckets.set(bucketKey, { orgId: resolvedOrgId, tenantId: resolvedTenantId, values: [decrypted], def: def ?? null, encrypted })\n    }\n  }\n\n  const result: Record<string, Record<string, unknown>> = {}\n  for (const [compoundKey, bucket] of buckets.entries()) {\n    const [recordId, fieldKey] = compoundKey.split('::')\n    if (!result[recordId]) result[recordId] = {}\n    const prefixed = `cf_${fieldKey}`\n    const def = bucket.def ?? pickDefinition(fieldKey, bucket.orgId ?? (opts.organizationIdByRecord?.[recordId] ?? null), bucket.tenantId ?? (opts.tenantIdByRecord?.[recordId] ?? null))\n    if (def && def.configJson && typeof def.configJson === 'object' && (def.configJson as any).multi) {\n      const cleaned = bucket.values.filter((v) => v !== undefined && v !== null)\n      result[recordId][prefixed] = cleaned\n    } else if (bucket.values.length > 1) {\n      const cleaned = bucket.values.filter((v) => v !== undefined)\n      result[recordId][prefixed] = cleaned\n    } else {\n      result[recordId][prefixed] = bucket.values[0] ?? null\n    }\n  }\n\n  return result\n}\n\nexport function summarizeCustomFields(record: Record<string, unknown>): CustomFieldSnapshot {\n  const entries = extractAllCustomFieldEntries(record)\n  const values = Object.fromEntries(\n    Object.entries(entries).map(([prefixedKey, value]) => [\n      prefixedKey.replace(/^cf_/, ''),\n      value,\n    ]),\n  )\n  const customValues = Object.keys(values).length ? values : null\n  const customFields = Object.entries(values).map(([key, value]) => ({\n    key,\n    label: key,\n    value,\n    kind: null,\n    multi: Array.isArray(value),\n  }))\n  return { entries, customValues, customFields }\n}\n"],
+  "mappings": "AAEA,SAAS,gBAAgB,wBAAwB;AAGjD,SAAS,yBAAyB,sCAAsC;AACxE,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AA8CnC,SAAS,mCAAmC,UAAoB,MAA8C;AACnH,QAAM,OAAO,MAAM,KAAK,IAAI;AAAA,KACzB,QAAQ,CAAC,GACP,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,EACnC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AAAA,EACtD,CAAC;AACD,QAAM,YAAY,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE;AAC3C,QAAM,aAAa,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE;AAC5C,SAAO,EAAE,MAAM,WAAW,WAAW;AACvC;AAEO,SAAS,0BAA0B,KAAuB;AAC/D,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC/B,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,IAAI,IAAI,KAAK;AAEnB,QAAI,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG;AACxC,YAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK;AAClC,UAAI,CAAC,MAAO,QAAO,CAAC;AACpB,aAAO,MAAM,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,4BAA4B,MAA+B,MAAyC;AAClH,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAuB;AACnD,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAuB;AACnD,UAAM,QAAQ,UAAU,SAAY,QAAQ;AAC5C,QAAI,UAAU,OAAW,KAAI,MAAM,GAAG,EAAE,IAAI,0BAA0B,KAAK;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,6BAA6B,MAAwD;AACnG,SAAO,0BAA0B,IAAI;AACvC;AAEA,SAAS,wBAAwB,OAA6D;AAC5F,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACpD,QAAM,aAAa,oBAAI,IAAmB;AAC1C,aAAW,OAAO,QAAQ;AACxB,QAAI,OAAO,KAAM;AACjB,UAAM,UAAU,OAAO,GAAG,EAAE,KAAK;AACjC,QAAI,CAAC,SAAS;AACZ,iBAAW,IAAI,IAAI;AAAA,IACrB,OAAO;AACL,iBAAW,IAAI,OAAO;AAAA,IACxB;AAAA,EACF;AACA,SAAO,WAAW,OAAO,aAAa;AACxC;AAEA,eAAsB,iCAAiC,MAOf;AACtC,QAAM,MAAkC,CAAC;AACzC,QAAM,UAAU,OAAO,QAAQ,KAAK,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC;AAC9E,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAE5B,QAAM,eAAe,MAAM,QAAQ,KAAK,SAAS,KAAK,KAAK,UAAU,SACjE,KAAK,YACL,KAAK,WACH,CAAC,KAAK,QAAQ,IACd,CAAC;AACP,MAAI,CAAC,aAAa,OAAQ,QAAO;AAGjC,QAAM,OAAO,MAAM,KAAK,GAAG,KAAK,gBAAgB;AAAA,IAC9C,UAAU,EAAE,KAAK,aAAoB;AAAA,IACrC,UAAU;AAAA,IACV,MAAM;AAAA,MACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAgB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,IACpE;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB,wBAAwB,KAAK,QAAQ;AAC5D,QAAM,QAAQ,oBAAI,IAAoB;AACtC,eAAa,IAAI,MAAM,EAAE,QAAQ,CAAC,IAAI,UAAU,MAAM,IAAI,IAAI,KAAK,CAAC;AACpE,QAAM,QAA6E,CAAC;AACpF,aAAW,KAAK,MAAM;AACpB,QAAI,gBAAgB;AAClB,YAAM,YAAY,MAAM,QAAQ,EAAE,YAAY,SAAS,IACnD,EAAE,WAAW,UACV,OAAO,CAAC,UAAoC,OAAO,UAAU,QAAQ,EACrE,IAAI,CAAC,UAAkB,MAAM,KAAK,CAAC,EACnC,OAAO,CAAC,UAAkB,MAAM,SAAS,CAAC,IAC7C,CAAC;AACL,YAAM,cAAc,OAAO,EAAE,YAAY,aAAa,WAAW,EAAE,WAAW,SAAS,KAAK,IAAI;AAChG,YAAM,qBAAqB,YAAY,SAAS,cAAc;AAC9D,YAAM,UAAU,UAAU,SAAS,IAC/B,UAAU,KAAK,CAAC,UAAkB,eAAe,IAAI,KAAK,CAAC,IAC3D,eAAe,IAAI,kBAAkB;AACzC,UAAI,CAAC,QAAS;AAAA,IAChB;AACA,UAAM,MAAM,EAAE;AACd,UAAM,WAAW,OAAO,EAAE,QAAQ;AAClC,UAAM,UAAU,MAAM,GAAG;AACzB,UAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,OAAO;AAC9C,QAAI,CAAC,SAAS;AACZ,YAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,QAAS,EAAU,YAAY,KAAK,GAAG,SAAS;AACpF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,IAAI,QAAQ,QAAQ,KAAK,OAAO;AACtD,QAAI,UAAU,SAAS;AACrB,YAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,QAAS,EAAU,YAAY,KAAK,GAAG,SAAS;AAAA,IACtF;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,MAAc,MAAe;AAC3C,QAAI,KAAK,KAAM,QAAO;AACtB,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAW,eAAO,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE;AAAA,MACpD,KAAK;AAAS,eAAO,OAAO,WAAW,OAAO,CAAC,CAAC;AAAA,MAChD,KAAK;AAAW,eAAO,kBAAkB,OAAO,CAAC,CAAC,MAAM;AAAA,MACxD,KAAK;AAAA,MACL,KAAK;AAAY,eAAO,OAAO,CAAC;AAAA,MAChC;AAAS,eAAO,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAEA,aAAW,CAAC,QAAQ,MAAM,KAAK,SAAS;AACtC,UAAM,OAAO,OAAO,SAAS,IAAI;AACjC,UAAM,MAAM,OAAO,OAAO,QAAQ,QAAQ,EAAE,EAAE,QAAQ,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,EAAE;AAC5F,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,UAAU,MAAM,GAAG;AACzB,QAAI,CAAC,IAAK;AACV,QAAI,MAAM;AACR,YAAM,OAAO,MAAM,QAAQ,MAAM,IAC5B,SACD,OAAO,MAAM,EACV,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACrB,UAAI,KAAK,OAAQ,KAAI,OAAO,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,MAAM,OAAO,IAAI,MAAM,CAAC,CAAC,EAAuC;AAAA,IACnH,OAAO;AACL,UAAI,OAAO,IAAI,OAAO,IAAI,MAAM,MAAM;AAAA,IACxC;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,wBAAwB,KAAuC;AAC7E,QAAM,OAAgC,CAAC;AACvC,QAAM,SAAkC,CAAC;AACzC,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,EAAE,MAAM,OAAO;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AACzE,QAAI,QAAQ,gBAAgB;AAC1B,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,QAAQ,CAAC,UAAU;AACvB,cAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,gBAAM,WAAW,OAAQ,MAAc,QAAQ,WAAY,MAAc,IAAI,KAAK,IAAI;AACtF,cAAI,CAAC,SAAU;AACf,iBAAO,QAAQ,IAAK,MAAc;AAAA,QACpC,CAAC;AACD;AAAA,MACF;AACA,UAAI,SAAS,OAAO,UAAU,UAAU;AACtC,mBAAW,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACvE,gBAAM,gBAAgB,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI;AAC3D,cAAI,CAAC,cAAe;AACpB,iBAAO,aAAa,IAAI;AAAA,QAC1B;AACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,QAAQ,kBAAkB,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzF,iBAAW,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACvE,eAAO,OAAO,EAAE,CAAC,IAAI;AAAA,MACvB;AACA;AAAA,IACF;AACA,QAAI,IAAI,WAAW,KAAK,GAAG;AACzB,aAAO,IAAI,MAAM,CAAC,CAAC,IAAI;AACvB;AAAA,IACF;AACA,QAAI,IAAI,WAAW,KAAK,GAAG;AACzB,aAAO,IAAI,MAAM,CAAC,CAAC,IAAI;AACvB;AAAA,IACF;AACA,SAAK,GAAG,IAAI;AAAA,EACd;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;AAEO,SAAS,oCAAoC,KAAuD;AACzG,SAAO,wBAAwB,GAAG,EAAE;AACtC;AAEA,SAAS,uBAAuB,KAAsB;AACpD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,QAAQ,YAAY,IAAI;AAClD;AAEA,SAAS,0BAA0B,KAAmC;AACpE,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO,EAAE,GAAI,OAA+B;AAAA,MAC9C;AACA,aAAO,CAAC;AAAA,IACV,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AAClD,WAAO,EAAE,GAAI,IAA4B;AAAA,EAC3C;AACA,SAAO,CAAC;AACV;AAEA,SAAS,oBAAoB,KAA0D;AACrF,QAAM,gBAAgB,uBAAuB,IAAI,GAAG;AACpD,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,MAAM,0BAA2B,IAAY,UAAU;AAC7D,QAAM,QACJ,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,KAAK,EAAE,SAC9C,IAAI,MAAM,KAAK,IACf,IAAI;AACV,QAAM,eACJ,OAAO,IAAI,iBAAiB,YAAY,IAAI,aAAa,KAAK,EAAE,SAC5D,IAAI,aAAa,KAAK,IACtB;AACN,QAAM,QACJ,IAAI,UAAU,SAAY,QAAQ,IAAI,KAAK,IAAI;AACjD,QAAM,WACJ,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AACpD,QAAM,YACJ,IAAI,qBAAqB,OACrB,IAAI,UAAU,QAAQ,IACtB,IAAI,KAAK,IAAI,SAAgB,EAAE,QAAQ;AAC7C,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT;AAAA,IACA,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AAAA,IAChD;AAAA,IACA;AAAA,IACA,gBAAgB,IAAI,kBAAkB;AAAA,IACtC,UAAU,IAAI,YAAY;AAAA,IAC1B;AAAA,IACA,WAAW,OAAO,MAAM,SAAS,IAAI,IAAI;AAAA,EAC3C;AACF;AAEA,SAAS,wBAAwB,MAAsE;AACrG,SAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM;AAC9B,UAAM,gBAAgB,EAAE,YAAY,MAAM,EAAE,YAAY;AACxD,QAAI,iBAAiB,EAAG,QAAO;AAC/B,UAAM,eAAe,EAAE,aAAa,MAAM,EAAE,aAAa;AACzD,QAAI,gBAAgB,EAAG,QAAO;AAC9B,WAAO,EAAE,IAAI,cAAc,EAAE,GAAG;AAAA,EAClC,CAAC;AACH;AAEA,SAAS,0BACP,MACA,gBACA,UACqC;AACrC,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,QAAM,oBAAoB,KAAK;AAAA,IAC7B,CAAC,QAAQ,IAAI,kBAAkB,kBAAkB,IAAI,mBAAmB;AAAA,EAC1E;AACA,MAAI,kBAAkB,OAAQ,QAAO,wBAAwB,iBAAiB,EAAE,CAAC;AACjF,QAAM,uBAAuB,KAAK;AAAA,IAChC,CAAC,QAAQ,IAAI,YAAY,YAAY,IAAI,aAAa,YAAY,CAAC,IAAI;AAAA,EACzE;AACA,MAAI,qBAAqB,OAAQ,QAAO,wBAAwB,oBAAoB,EAAE,CAAC;AACvF,QAAM,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,cAAc;AACvD,MAAI,OAAO,OAAQ,QAAO,wBAAwB,MAAM,EAAE,CAAC;AAC3D,SAAO,wBAAwB,IAAI,EAAE,CAAC,KAAK;AAC7C;AAEA,eAAsB,+BAA+B,MAMb;AACtC,QAAM,OAAO,MAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,YAAY,CAAC,KAAK,SAAS;AAC7E,QAAM,YAAY,KACf,IAAI,CAAC,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,OAAO,MAAM,EAAE,CAAE,EACnE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AAC/B,MAAI,CAAC,UAAU,OAAQ,QAAO,oBAAI,IAAI;AACtC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,gBAAgB,MAAM,QAAQ,KAAK,eAAe,IACpD,KAAK,gBACF,IAAI,CAAC,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,EAAG,EACrD,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,IACvE,CAAC;AACL,QAAM,eAA0C;AAAA,IAC9C,WACI,EAAE,KAAK,CAAC,EAAE,SAA0B,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE,IAC3D,EAAE,UAAU,KAAK;AAAA,EACvB;AACA,MAAI,cAAc,QAAQ;AACxB,iBAAa,KAAK;AAAA,MAChB,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,cAAqB,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC;AAAA,IACnF,CAAC;AAAA,EACH,OAAO;AACL,iBAAa,KAAK,EAAE,gBAAgB,KAAK,CAAC;AAAA,EAC5C;AACA,QAAM,QAAiC;AAAA,IACrC,UAAU,EAAE,KAAK,UAAiB;AAAA,IAClC,WAAW;AAAA,IACX,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACA,QAAM,OAAO,MAAM,KAAK,GAAG,KAAK,gBAAgB,KAAY;AAC5D,QAAM,iBAAiB,wBAAwB,KAAK,QAAQ;AAC5D,QAAM,QAAoC,oBAAI,IAAI;AAClD,OAAK,QAAQ,CAAC,QAAQ;AACpB,QAAI,gBAAgB;AAClB,YAAM,SAAS,0BAA2B,IAAY,UAAU;AAChE,YAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,IAC5C,OAAO,UACJ,OAAO,CAAC,UAAoC,OAAO,UAAU,QAAQ,EACrE,IAAI,CAAC,UAAkB,MAAM,KAAK,CAAC,EACnC,OAAO,CAAC,UAAkB,MAAM,SAAS,CAAC,IAC7C,CAAC;AACL,YAAM,WAAW,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,KAAK,EAAE,SAAS,IACpF,OAAO,SAAS,KAAK,IACrB;AACJ,YAAM,UAAU,UAAU,SAAS,IAC/B,UAAU,KAAK,CAAC,UAAkB,eAAe,IAAI,KAAK,CAAC,IAC3D,eAAe,IAAI,QAAQ;AAC/B,UAAI,CAAC,QAAS;AAAA,IAChB;AACA,UAAM,UAAU,oBAAoB,GAAG;AACvC,QAAI,CAAC,QAAS;AACd,UAAM,gBAAgB,uBAAuB,QAAQ,GAAG;AACxD,QAAI,CAAC,cAAe;AACpB,QAAI,CAAC,MAAM,IAAI,aAAa,EAAG,OAAM,IAAI,eAAe,CAAC,CAAC;AAC1D,UAAM,IAAI,aAAa,EAAG,KAAK,OAAO;AAAA,EACxC,CAAC;AACD,QAAM,QAAQ,CAAC,SAAS,QAAQ;AAC9B,UAAM,IAAI,KAAK,wBAAwB,OAAO,CAAC;AAAA,EACjD,CAAC;AACD,SAAO;AACT;AAEO,SAAS,+BACd,QACA,aACA,UAGI,CAAC,GACsB;AAC3B,QAAM,aAAa,6BAA6B,MAAM;AACtD,MAAI,CAAC,OAAO,KAAK,UAAU,EAAE,QAAQ;AACnC,WAAO,EAAE,cAAc,MAAM,cAAc,CAAC,EAAE;AAAA,EAChD;AACA,QAAM,SAAkC,CAAC;AACzC,QAAM,UAA0F,CAAC;AACjG,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,WAAW,QAAQ,YAAY;AAErC,SAAO,QAAQ,UAAU,EAAE,QAAQ,CAAC,CAAC,aAAa,KAAK,MAAM;AAC3D,UAAM,UAAU,YAAY,QAAQ,QAAQ,EAAE;AAC9C,UAAM,gBAAgB,uBAAuB,OAAO;AACpD,QAAI,CAAC,cAAe;AACpB,UAAM,aAAa,YAAY,IAAI,aAAa,KAAK,CAAC;AACtD,UAAM,cAAc,0BAA0B,YAAY,gBAAgB,QAAQ;AAElF,QAAI,CAAC,YAAa;AAClB,WAAO,OAAO,IAAI;AAClB,UAAM,QAAiC;AAAA,MACrC,KAAK;AAAA,MACL,OAAO,YAAY,SAAS;AAAA,MAC5B;AAAA,MACA,MAAM,YAAY,QAAQ;AAAA,MAC1B,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK;AAAA,IACjD;AACA,YAAQ,KAAK;AAAA,MACX;AAAA,MACA,UAAU,YAAY,YAAY,OAAO;AAAA,MACzC,WAAW,YAAY,aAAa;AAAA,IACtC,CAAC;AAAA,EACH,CAAC;AAED,QAAM,UAAU,QACb,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,eAAe,EAAE,WAAW,EAAE;AACpC,QAAI,iBAAiB,EAAG,QAAO;AAC/B,UAAM,cAAc,EAAE,YAAY,EAAE;AACpC,QAAI,gBAAgB,EAAG,QAAO;AAC9B,WAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,GAAG;AAAA,EAC9C,CAAC,EACA,IAAI,CAAC,SAAS,KAAK,KAAK;AAE3B,SAAO;AAAA,IACL,cAAc,OAAO,KAAK,MAAM,EAAE,SAAS,SAAS;AAAA,IACpD,cAAc;AAAA,EAChB;AACF;AAEA,eAAsB,sBAAsB,MAQS;AACnD,QAAM,EAAE,IAAI,UAAU,UAAU,IAAI;AACpC,MAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,WAAW,EAAG,QAAO,CAAC;AAEjE,QAAM,sBAAsB,UAAU,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC;AAC5D,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAI,KAAK,iBAAiB;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,mBAAmB,oBAAI,IAAmB;AAChD,mBAAiB,IAAI,IAAI;AACzB,MAAI,KAAK,kBAAkB;AACzB,eAAW,OAAO,OAAO,OAAO,KAAK,gBAAgB,GAAG;AACtD,uBAAiB,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI;AAAA,IAC/C;AAAA,EACF;AACA,MAAI,KAAK,iBAAiB;AACxB,eAAW,OAAO,KAAK,gBAAiB,kBAAiB,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI;AAAA,EACvF;AACA,QAAM,kBAAkB,KAAK,mBAAmB,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,KAAK;AAE9E,QAAM,aAAa,MAAM,KAAK,gBAAgB;AAC9C,QAAM,gBAAgB,WAAW,OAAO,CAAC,MAAmB,MAAM,IAAI;AACtE,QAAM,eAAe,cAAc,SAC/B,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,eAAe,IAAI,EAAS,EAAE,IACrD,EAAE,UAAU,KAAK;AACrB,QAAM,SAAS,MAAM,GAAG,KAAK,kBAAkB;AAAA,IAC7C;AAAA,IACA,UAAU,EAAE,KAAK,oBAA2B;AAAA,IAC5C,WAAW;AAAA,IACX,GAAI,WAAW,SAAS,eAAe,CAAC;AAAA,EAC1C,CAAC;AAED,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC;AAC7E,QAAM,yBAAyB,oBAAI,IAAmB;AACtD,yBAAuB,IAAI,IAAI;AAC/B,MAAI,KAAK,wBAAwB;AAC/B,eAAW,OAAO,OAAO,OAAO,KAAK,sBAAsB,GAAG;AAC5D,6BAAuB,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI;AAAA,IACrD;AAAA,EACF;AACA,aAAW,OAAO,QAAQ;AACxB,2BAAuB,IAAI,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AAAA,EACnF;AACA,QAAM,UAAU,MAAM,KAAK,sBAAsB;AAEjD,QAAM,OAAO,QAAQ,SACjB,MAAM,GAAG,KAAK,gBAAgB;AAAA,IAC5B;AAAA,IACA,KAAK,EAAE,KAAK,QAAe;AAAA,IAC3B,WAAW;AAAA,IACX,UAAU;AAAA,IACV,GAAI,WAAW,SAAS,EAAE,UAAU,aAAa,SAAS,IAAI,CAAC;AAAA,IAC/D,gBAAgB,EAAE,KAAK,QAAe;AAAA,EACxC,CAAC,IACD,CAAC;AAEL,QAAM,YAAY,oBAAI,IAA8B;AACpD,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,UAAU,IAAI,IAAI,GAAG,KAAK,CAAC;AACxC,SAAK,KAAK,GAAG;AACb,cAAU,IAAI,IAAI,KAAK,IAAI;AAAA,EAC7B;AAEA,QAAM,iBAAiB,CAAC,UAAkB,gBAA+B,aAA4B;AACnG,UAAM,aAAa,UAAU,IAAI,QAAQ;AACzC,QAAI,CAAC,cAAc,WAAW,WAAW,EAAG,QAAO;AACnD,UAAM,SAAS,WAAW,OAAO,CAAC,QAAQ,IAAI,aAAa,SAAS,CAAC,IAAI,SAAS;AAClF,UAAM,OAAO,OAAO,SAAS,SAAS;AACtC,QAAI,kBAAkB,UAAU;AAC9B,YAAM,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,mBAAmB,kBAAkB,IAAI,aAAa,QAAQ;AACnG,UAAI,MAAO,QAAO;AAAA,IACpB;AACA,QAAI,gBAAgB;AAClB,YAAM,WAAW,KAAK,KAAK,CAAC,QAAQ,IAAI,mBAAmB,mBAAmB,CAAC,YAAY,IAAI,YAAY,QAAQ,IAAI,aAAa,SAAS;AAC7I,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,QAAI,UAAU;AACZ,YAAM,cAAc,KAAK,KAAK,CAAC,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,aAAa,QAAQ;AAC9F,UAAI,YAAa,QAAO;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,YAAY,IAAI;AACpF,WAAO,UAAU,KAAK,CAAC;AAAA,EACzB;AAEA,QAAM,eAAe,CAAC,QAAmC;AACvD,QAAI,IAAI,mBAAmB,QAAQ,IAAI,mBAAmB,OAAW,QAAO,IAAI;AAChF,QAAI,IAAI,cAAc,QAAQ,IAAI,cAAc,OAAW,QAAO,IAAI;AACtE,QAAI,IAAI,aAAa,QAAQ,IAAI,aAAa,OAAW,QAAO,IAAI;AACpE,QAAI,IAAI,eAAe,QAAQ,IAAI,eAAe,OAAW,QAAO,IAAI;AACxE,QAAI,IAAI,cAAc,QAAQ,IAAI,cAAc,OAAW,QAAO,IAAI;AACtE,WAAO;AAAA,EACT;AAGA,QAAM,UAAU,oBAAI,IAAoB;AAExC,aAAW,OAAO,QAAQ;AACxB,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,UAAM,MAAM,OAAO,IAAI,QAAQ;AAC/B,UAAM,YAAY,GAAG,QAAQ,KAAK,GAAG;AACrC,UAAM,QAAQ,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI;AAChE,UAAM,WAAW,IAAI,WAAW,OAAO,IAAI,QAAQ,IAAI;AACvD,UAAM,gBAAgB,UAAU,KAAK,yBAAyB,QAAQ,KAAK;AAC3E,UAAM,mBAAmB,aAAa,KAAK,mBAAmB,QAAQ,KAAK;AAC3E,UAAM,MAAM,eAAe,KAAK,eAAe,gBAAgB;AAC/D,UAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,YAAY,YACd,MAAM;AAAA,MACJ;AAAA,MACA,oBAAoB,YAAY;AAAA,MAChC,qBAAqB;AAAA,MACrB;AAAA,MACA,EAAE,MAAM,KAAK,QAAQ,KAAK;AAAA,IAC5B,IACA;AACJ,UAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,QAAI,UAAU;AACZ,UAAI,SAAS,SAAS,QAAQ,cAAe,UAAS,QAAQ;AAC9D,UAAI,SAAS,YAAY,QAAQ,iBAAkB,UAAS,WAAW;AACvE,UAAI,SAAS,OAAO,QAAQ,IAAK,UAAS,MAAM;AAChD,eAAS,YAAY,SAAS,aAAa;AAC3C,eAAS,OAAO,KAAK,SAAS;AAAA,IAChC,OAAO;AACL,cAAQ,IAAI,WAAW,EAAE,OAAO,eAAe,UAAU,kBAAkB,QAAQ,CAAC,SAAS,GAAG,KAAK,OAAO,MAAM,UAAU,CAAC;AAAA,IAC/H;AAAA,EACF;AAEA,QAAM,SAAkD,CAAC;AACzD,aAAW,CAAC,aAAa,MAAM,KAAK,QAAQ,QAAQ,GAAG;AACrD,UAAM,CAAC,UAAU,QAAQ,IAAI,YAAY,MAAM,IAAI;AACnD,QAAI,CAAC,OAAO,QAAQ,EAAG,QAAO,QAAQ,IAAI,CAAC;AAC3C,UAAM,WAAW,MAAM,QAAQ;AAC/B,UAAM,MAAM,OAAO,OAAO,eAAe,UAAU,OAAO,UAAU,KAAK,yBAAyB,QAAQ,KAAK,OAAO,OAAO,aAAa,KAAK,mBAAmB,QAAQ,KAAK,KAAK;AACpL,QAAI,OAAO,IAAI,cAAc,OAAO,IAAI,eAAe,YAAa,IAAI,WAAmB,OAAO;AAChG,YAAM,UAAU,OAAO,OAAO,OAAO,CAAC,MAAM,MAAM,UAAa,MAAM,IAAI;AACzE,aAAO,QAAQ,EAAE,QAAQ,IAAI;AAAA,IAC/B,WAAW,OAAO,OAAO,SAAS,GAAG;AACnC,YAAM,UAAU,OAAO,OAAO,OAAO,CAAC,MAAM,MAAM,MAAS;AAC3D,aAAO,QAAQ,EAAE,QAAQ,IAAI;AAAA,IAC/B,OAAO;AACL,aAAO,QAAQ,EAAE,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK;AAAA,IACnD;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,sBAAsB,QAAsD;AAC1F,QAAM,UAAU,6BAA6B,MAAM;AACnD,QAAM,SAAS,OAAO;AAAA,IACpB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM;AAAA,MACpD,YAAY,QAAQ,QAAQ,EAAE;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,eAAe,OAAO,KAAK,MAAM,EAAE,SAAS,SAAS;AAC3D,QAAM,eAAe,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,IACjE;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,MAAM;AAAA,IACN,OAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,EAAE;AACF,SAAO,EAAE,SAAS,cAAc,aAAa;AAC/C;",
   "names": []
 }

package/dist/lib/encryption/customFieldValues.js

@@ -1,5 +1,19 @@
 import { encryptWithAesGcm, decryptWithAesGcm } from "./aes.js";
 import { TenantDataEncryptionService } from "./tenantDataEncryptionService.js";
+const STRING_TYPED_CUSTOM_FIELD_KINDS = /* @__PURE__ */ new Set([
+  "text",
+  "multiline",
+  "select",
+  "currency",
+  "dictionary",
+  "email",
+  "url",
+  "string"
+]);
+function shouldPreserveAsString(kind) {
+  if (!kind) return false;
+  return STRING_TYPED_CUSTOM_FIELD_KINDS.has(kind);
+}
 const serviceCache = /* @__PURE__ */ new WeakMap();
 function resolveTenantEncryptionService(em, provided) {
   if (provided) return provided;
@@ -29,12 +43,13 @@ async function encryptCustomFieldValue(value, tenantId, service, cache) {
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
   return encryptWithAesGcm(serialized, key).value;
 }
-async function decryptCustomFieldValue(value, tenantId, service, cache) {
+async function decryptCustomFieldValue(value, tenantId, service, cache, options) {
   if (value === void 0 || value === null || typeof value !== "string") return value;
   const key = await resolveDekKey(service, tenantId, cache);
   if (!key) return value;
   const decrypted = decryptWithAesGcm(value, key);
   if (decrypted === null) return value;
+  if (shouldPreserveAsString(options?.kind ?? null)) return decrypted;
   try {
     return JSON.parse(decrypted);
   } catch {

package/dist/lib/encryption/customFieldValues.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/customFieldValues.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport { encryptWithAesGcm, decryptWithAesGcm } from './aes'\nimport { TenantDataEncryptionService } from './tenantDataEncryptionService'\n\nconst serviceCache = new WeakMap<EntityManager, TenantDataEncryptionService>()\n\nexport function resolveTenantEncryptionService(\n  em: EntityManager,\n  provided?: TenantDataEncryptionService | null,\n): TenantDataEncryptionService | null {\n  if (provided) return provided\n  const cached = serviceCache.get(em)\n  if (cached) return cached\n  const service = new TenantDataEncryptionService(em as any)\n  serviceCache.set(em, service)\n  return service\n}\n\nasync function resolveDekKey(\n  service: TenantDataEncryptionService | null,\n  tenantId: string | null | undefined,\n  cache?: Map<string | null, string | null>,\n  opts?: { createIfMissing?: boolean },\n): Promise<string | null> {\n  const scopedTenantId = tenantId ?? null\n  if (!service || !service.isEnabled() || !scopedTenantId) return null\n  if (cache?.has(scopedTenantId)) return cache.get(scopedTenantId) ?? null\n  const dek = await service.getDek(scopedTenantId)\n  let key = dek?.key ?? null\n  if (!key && opts?.createIfMissing && typeof service.createDek === 'function') {\n    const created = await service.createDek(scopedTenantId)\n    key = created?.key ?? null\n  }\n  cache?.set(scopedTenantId, key)\n  return key\n}\n\nexport async function encryptCustomFieldValue(\n  value: unknown,\n  tenantId: string | null | undefined,\n  service: TenantDataEncryptionService | null,\n  cache?: Map<string | null, string | null>,\n): Promise<unknown> {\n  if (value === undefined || value === null) return value\n  const key = await resolveDekKey(service, tenantId, cache, { createIfMissing: true })\n  if (!key) return value\n  const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n  return encryptWithAesGcm(serialized, key).value\n}\n\nexport async function decryptCustomFieldValue(\n  value: unknown,\n  tenantId: string | null | undefined,\n  service: TenantDataEncryptionService | null,\n  cache?: Map<string | null, string | null>,\n): Promise<unknown> {\n  if (value === undefined || value === null || typeof value !== 'string') return value\n  const key = await resolveDekKey(service, tenantId, cache)\n  if (!key) return value\n  const decrypted = decryptWithAesGcm(value, key)\n  if (decrypted === null) return value\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n"],
-  "mappings": "AACA,SAAS,mBAAmB,yBAAyB;AACrD,SAAS,mCAAmC;AAE5C,MAAM,eAAe,oBAAI,QAAoD;AAEtE,SAAS,+BACd,IACA,UACoC;AACpC,MAAI,SAAU,QAAO;AACrB,QAAM,SAAS,aAAa,IAAI,EAAE;AAClC,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,IAAI,4BAA4B,EAAS;AACzD,eAAa,IAAI,IAAI,OAAO;AAC5B,SAAO;AACT;AAEA,eAAe,cACb,SACA,UACA,OACA,MACwB;AACxB,QAAM,iBAAiB,YAAY;AACnC,MAAI,CAAC,WAAW,CAAC,QAAQ,UAAU,KAAK,CAAC,eAAgB,QAAO;AAChE,MAAI,OAAO,IAAI,cAAc,EAAG,QAAO,MAAM,IAAI,cAAc,KAAK;AACpE,QAAM,MAAM,MAAM,QAAQ,OAAO,cAAc;AAC/C,MAAI,MAAM,KAAK,OAAO;AACtB,MAAI,CAAC,OAAO,MAAM,mBAAmB,OAAO,QAAQ,cAAc,YAAY;AAC5E,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc;AACtD,UAAM,SAAS,OAAO;AAAA,EACxB;AACA,SAAO,IAAI,gBAAgB,GAAG;AAC9B,SAAO;AACT;AAEA,eAAsB,wBACpB,OACA,UACA,SACA,OACkB;AAClB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,MAAM,MAAM,cAAc,SAAS,UAAU,OAAO,EAAE,iBAAiB,KAAK,CAAC;AACnF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,SAAO,kBAAkB,YAAY,GAAG,EAAE;AAC5C;AAEA,eAAsB,wBACpB,OACA,UACA,SACA,OACkB;AAClB,MAAI,UAAU,UAAa,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAC/E,QAAM,MAAM,MAAM,cAAc,SAAS,UAAU,KAAK;AACxD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,YAAY,kBAAkB,OAAO,GAAG;AAC9C,MAAI,cAAc,KAAM,QAAO;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport { encryptWithAesGcm, decryptWithAesGcm } from './aes'\nimport { TenantDataEncryptionService } from './tenantDataEncryptionService'\n\n/**\n * Custom field kinds that ALWAYS round-trip as a string. The encrypt path\n * stores raw strings unwrapped, so blindly running `JSON.parse` on the\n * decrypted payload coerces text values like `\"123\"` or `\"true\"` back into\n * numbers/booleans (issue #1734). For these kinds, callers MUST pass the\n * `kind` option so we keep the decrypted value as a string.\n *\n * Numeric (`integer`/`float`) and `boolean` kinds rely on JSON round-trip\n * because the encrypt path JSON-stringifies the typed value before storage.\n * Omitting the kind preserves legacy round-trip behavior for backward\n * compatibility.\n */\nconst STRING_TYPED_CUSTOM_FIELD_KINDS = new Set([\n  'text',\n  'multiline',\n  'select',\n  'currency',\n  'dictionary',\n  'email',\n  'url',\n  'string',\n])\n\nexport type DecryptCustomFieldOptions = {\n  /** Field kind, e.g. from `CustomFieldDef.kind`. When string-typed, the helper preserves the decrypted string verbatim. */\n  kind?: string | null\n}\n\nfunction shouldPreserveAsString(kind: string | null | undefined): boolean {\n  if (!kind) return false\n  return STRING_TYPED_CUSTOM_FIELD_KINDS.has(kind)\n}\n\nconst serviceCache = new WeakMap<EntityManager, TenantDataEncryptionService>()\n\nexport function resolveTenantEncryptionService(\n  em: EntityManager,\n  provided?: TenantDataEncryptionService | null,\n): TenantDataEncryptionService | null {\n  if (provided) return provided\n  const cached = serviceCache.get(em)\n  if (cached) return cached\n  const service = new TenantDataEncryptionService(em as any)\n  serviceCache.set(em, service)\n  return service\n}\n\nasync function resolveDekKey(\n  service: TenantDataEncryptionService | null,\n  tenantId: string | null | undefined,\n  cache?: Map<string | null, string | null>,\n  opts?: { createIfMissing?: boolean },\n): Promise<string | null> {\n  const scopedTenantId = tenantId ?? null\n  if (!service || !service.isEnabled() || !scopedTenantId) return null\n  if (cache?.has(scopedTenantId)) return cache.get(scopedTenantId) ?? null\n  const dek = await service.getDek(scopedTenantId)\n  let key = dek?.key ?? null\n  if (!key && opts?.createIfMissing && typeof service.createDek === 'function') {\n    const created = await service.createDek(scopedTenantId)\n    key = created?.key ?? null\n  }\n  cache?.set(scopedTenantId, key)\n  return key\n}\n\nexport async function encryptCustomFieldValue(\n  value: unknown,\n  tenantId: string | null | undefined,\n  service: TenantDataEncryptionService | null,\n  cache?: Map<string | null, string | null>,\n): Promise<unknown> {\n  if (value === undefined || value === null) return value\n  const key = await resolveDekKey(service, tenantId, cache, { createIfMissing: true })\n  if (!key) return value\n  const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n  return encryptWithAesGcm(serialized, key).value\n}\n\nexport async function decryptCustomFieldValue(\n  value: unknown,\n  tenantId: string | null | undefined,\n  service: TenantDataEncryptionService | null,\n  cache?: Map<string | null, string | null>,\n  options?: DecryptCustomFieldOptions,\n): Promise<unknown> {\n  if (value === undefined || value === null || typeof value !== 'string') return value\n  const key = await resolveDekKey(service, tenantId, cache)\n  if (!key) return value\n  const decrypted = decryptWithAesGcm(value, key)\n  if (decrypted === null) return value\n  if (shouldPreserveAsString(options?.kind ?? null)) return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n"],
+  "mappings": "AACA,SAAS,mBAAmB,yBAAyB;AACrD,SAAS,mCAAmC;AAc5C,MAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,uBAAuB,MAA0C;AACxE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gCAAgC,IAAI,IAAI;AACjD;AAEA,MAAM,eAAe,oBAAI,QAAoD;AAEtE,SAAS,+BACd,IACA,UACoC;AACpC,MAAI,SAAU,QAAO;AACrB,QAAM,SAAS,aAAa,IAAI,EAAE;AAClC,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,IAAI,4BAA4B,EAAS;AACzD,eAAa,IAAI,IAAI,OAAO;AAC5B,SAAO;AACT;AAEA,eAAe,cACb,SACA,UACA,OACA,MACwB;AACxB,QAAM,iBAAiB,YAAY;AACnC,MAAI,CAAC,WAAW,CAAC,QAAQ,UAAU,KAAK,CAAC,eAAgB,QAAO;AAChE,MAAI,OAAO,IAAI,cAAc,EAAG,QAAO,MAAM,IAAI,cAAc,KAAK;AACpE,QAAM,MAAM,MAAM,QAAQ,OAAO,cAAc;AAC/C,MAAI,MAAM,KAAK,OAAO;AACtB,MAAI,CAAC,OAAO,MAAM,mBAAmB,OAAO,QAAQ,cAAc,YAAY;AAC5E,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc;AACtD,UAAM,SAAS,OAAO;AAAA,EACxB;AACA,SAAO,IAAI,gBAAgB,GAAG;AAC9B,SAAO;AACT;AAEA,eAAsB,wBACpB,OACA,UACA,SACA,OACkB;AAClB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,MAAM,MAAM,cAAc,SAAS,UAAU,OAAO,EAAE,iBAAiB,KAAK,CAAC;AACnF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,SAAO,kBAAkB,YAAY,GAAG,EAAE;AAC5C;AAEA,eAAsB,wBACpB,OACA,UACA,SACA,OACA,SACkB;AAClB,MAAI,UAAU,UAAa,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAC/E,QAAM,MAAM,MAAM,cAAc,SAAS,UAAU,KAAK;AACxD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,YAAY,kBAAkB,OAAO,GAAG;AAC9C,MAAI,cAAc,KAAM,QAAO;AAC/B,MAAI,uBAAuB,SAAS,QAAQ,IAAI,EAAG,QAAO;AAC1D,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/lib/encryption/tenantDataEncryptionService.js

@@ -26,6 +26,16 @@ function findKey(obj, key) {
   }
   return null;
 }
+function parseDecryptedFieldValue(decrypted) {
+  if (decrypted.length === 0) return decrypted;
+  const first = decrypted[0];
+  if (first !== "{" && first !== "[") return decrypted;
+  try {
+    return JSON.parse(decrypted);
+  } catch {
+    return decrypted;
+  }
+}
 function isEncryptedPayload(value) {
   if (typeof value !== "string") return false;
   const parts = value.split(":");
@@ -201,11 +211,7 @@ class TenantDataEncryptionService {
       if (typeof value !== "string") continue;
       const decrypted = maybeDecrypt(value);
       if (decrypted === null) continue;
-      try {
-        clone[key] = JSON.parse(decrypted);
-      } catch {
-        clone[key] = decrypted;
-      }
+      clone[key] = parseDecryptedFieldValue(decrypted);
     }
     return clone;
   }
@@ -247,6 +253,7 @@ class TenantDataEncryptionService {
   }
 }
 export {
-  TenantDataEncryptionService
+  TenantDataEncryptionService,
+  parseDecryptedFieldValue
 };
 //# sourceMappingURL=tenantDataEncryptionService.js.map

package/dist/lib/encryption/tenantDataEncryptionService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/tenantDataEncryptionService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    // eslint-disable-next-line no-console\n    console.debug(`${event} [tenant-encryption]`, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n\n  constructor(\n    private em: EntityManager,\n    opts?: { cache?: CacheStrategy; kms?: KmsService }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached) return cached\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async resolveDekForEncrypt(tenantId: string | null): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    const created = await this.kms.createTenantDek(tenantId)\n    if (created) this.dekCache.set(tenantId, created)\n    return created ?? null\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn: any = (this.em as any)?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length ? rows[0] : null\n    if (!row) return null\n    return {\n      entityId: row.entity_id || row.entityId || key.entityId,\n      fields: Array.isArray(row.fields_json)\n        ? (row.fields_json as EncryptedFieldRule[])\n        : Array.isArray(row.fieldsJson)\n          ? (row.fieldsJson as EncryptedFieldRule[])\n          : [],\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return resolved\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return mem\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return cached as EncryptionMapRecord\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return loaded\n    }\n    return null\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tag = cacheKey({ entityId, tenantId, organizationId })\n    this.memoryCache.delete(tag)\n    this.inflightMaps.delete(tag)\n    this.missCache.delete(tag)\n    if (this.cache && typeof (this.cache as any).delete === 'function') {\n      await (this.cache as any).delete(tag)\n    }\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n       // Avoid double-encrypting already encrypted payloads\n      if (isEncryptedPayload(value)) continue\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      try {\n        clone[key] = JSON.parse(decrypted)\n      } catch {\n        clone[key] = decrypted\n      }\n    }\n    return clone\n  }\n\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.resolveDekForEncrypt(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.encryptFields(payload, map.fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.getDek(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.decryptFields(payload, map.fields, dek)\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,mBAAmB,mBAAmB,qBAAqB;AACpE,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AAmBxE,MAAM,kBAAkB,IAAI,KAAK;AAEjC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AAEF,YAAQ,MAAM,GAAG,KAAK,wBAAwB,OAAO;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEO,MAAM,4BAA4B;AAAA,EAYvC,YACU,IACR,MACA;AAFQ;AANV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAMvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AAAA,EAC3C;AAAA,EAjBA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EAgBzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,UAAoD;AACrF,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AACvE,UAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,QAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAa,KAAK,IAAY,gBAAgB;AACpD,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,WAAY,QAAO;AACxD,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,CAAC,IAAI;AAC3D,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,IAAI,aAAa,IAAI,YAAY,IAAI;AAAA,MAC/C,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAChC,IAAI,cACL,MAAM,QAAQ,IAAI,UAAU,IACzB,IAAI,aACL,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO;AAAA,MACvB;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO;AAChB,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,MAAM,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC;AAC3D,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,aAAa,OAAO,GAAG;AAC5B,SAAK,UAAU,OAAO,GAAG;AACzB,QAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,YAAO,KAAK,MAAc,OAAO,GAAG;AAAA,IACtC;AAAA,EACF;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAE3C,UAAI,mBAAmB,KAAK,EAAG;AAC/B,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AACxB,UAAI;AACF,cAAM,GAAG,IAAI,KAAK,MAAM,SAAS;AAAA,MACnC,QAAQ;AACN,cAAM,GAAG,IAAI;AAAA,MACf;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,qBAAqB,YAAY,IAAI;AAC5D,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,YAAY,IAAI;AAC9C,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    // eslint-disable-next-line no-console\n    console.debug(`${event} [tenant-encryption]`, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n\n  constructor(\n    private em: EntityManager,\n    opts?: { cache?: CacheStrategy; kms?: KmsService }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached) return cached\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async resolveDekForEncrypt(tenantId: string | null): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    const created = await this.kms.createTenantDek(tenantId)\n    if (created) this.dekCache.set(tenantId, created)\n    return created ?? null\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn: any = (this.em as any)?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length ? rows[0] : null\n    if (!row) return null\n    return {\n      entityId: row.entity_id || row.entityId || key.entityId,\n      fields: Array.isArray(row.fields_json)\n        ? (row.fields_json as EncryptedFieldRule[])\n        : Array.isArray(row.fieldsJson)\n          ? (row.fieldsJson as EncryptedFieldRule[])\n          : [],\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return resolved\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return mem\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return cached as EncryptionMapRecord\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return loaded\n    }\n    return null\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tag = cacheKey({ entityId, tenantId, organizationId })\n    this.memoryCache.delete(tag)\n    this.inflightMaps.delete(tag)\n    this.missCache.delete(tag)\n    if (this.cache && typeof (this.cache as any).delete === 'function') {\n      await (this.cache as any).delete(tag)\n    }\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n       // Avoid double-encrypting already encrypted payloads\n      if (isEncryptedPayload(value)) continue\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      clone[key] = parseDecryptedFieldValue(decrypted)\n    }\n    return clone\n  }\n\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.resolveDekForEncrypt(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.encryptFields(payload, map.fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.getDek(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.decryptFields(payload, map.fields, dek)\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,mBAAmB,mBAAmB,qBAAqB;AACpE,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AAmBxE,MAAM,kBAAkB,IAAI,KAAK;AAEjC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AAEF,YAAQ,MAAM,GAAG,KAAK,wBAAwB,OAAO;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAcO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEO,MAAM,4BAA4B;AAAA,EAYvC,YACU,IACR,MACA;AAFQ;AANV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAMvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AAAA,EAC3C;AAAA,EAjBA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EAgBzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,UAAoD;AACrF,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AACvE,UAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,QAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAa,KAAK,IAAY,gBAAgB;AACpD,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,WAAY,QAAO;AACxD,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,CAAC,IAAI;AAC3D,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,IAAI,aAAa,IAAI,YAAY,IAAI;AAAA,MAC/C,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAChC,IAAI,cACL,MAAM,QAAQ,IAAI,UAAU,IACzB,IAAI,aACL,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO;AAAA,MACvB;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO;AAChB,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,MAAM,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC;AAC3D,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,aAAa,OAAO,GAAG;AAC5B,SAAK,UAAU,OAAO,GAAG;AACzB,QAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,YAAO,KAAK,MAAc,OAAO,GAAG;AAAA,IACtC;AAAA,EACF;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAE3C,UAAI,mBAAmB,KAAK,EAAG;AAC/B,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AACxB,YAAM,GAAG,IAAI,yBAAyB,SAAS;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,qBAAqB,YAAY,IAAI;AAC5D,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,YAAY,IAAI;AAC9C,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AACF;",
   "names": ["pending"]
 }

package/dist/lib/search/config.js

@@ -1,4 +1,5 @@
 import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
+const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3;
 const DEFAULT_BLOCKLIST = ["password", "token", "secret", "hash"];
 function parseBoolean(raw, fallback) {
   return parseBooleanWithDefault(raw, fallback);
@@ -19,14 +20,19 @@ function parseHashAlgorithm(raw) {
 function resolveSearchConfig() {
   return {
     enabled: parseBoolean(process.env.OM_SEARCH_ENABLED, true),
-    minTokenLength: parseNumber(process.env.OM_SEARCH_MIN_LEN, 3, 1),
+    minTokenLength: resolveSearchMinTokenLength(),
     enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),
     hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),
     storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),
     blocklistedFields: (process.env.OM_SEARCH_FIELD_BLOCKLIST ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0).filter((value, index, arr) => arr.indexOf(value) === index).map((entry) => entry.toLowerCase()).concat(DEFAULT_BLOCKLIST).filter((value, index, arr) => arr.indexOf(value) === index)
   };
 }
+function resolveSearchMinTokenLength() {
+  return parseNumber(process.env.OM_SEARCH_MIN_LEN, DEFAULT_SEARCH_MIN_TOKEN_LENGTH, 1);
+}
 export {
-  resolveSearchConfig
+  DEFAULT_SEARCH_MIN_TOKEN_LENGTH,
+  resolveSearchConfig,
+  resolveSearchMinTokenLength
 };
 //# sourceMappingURL=config.js.map

package/dist/lib/search/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/search/config.ts"],
-  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\n\nexport type SearchConfig = {\n  enabled: boolean\n  minTokenLength: number\n  enablePartials: boolean\n  hashAlgorithm: 'sha256' | 'sha1' | 'md5'\n  storeRawTokens: boolean\n  blocklistedFields: string[]\n}\n\nconst DEFAULT_BLOCKLIST = ['password', 'token', 'secret', 'hash']\n\nfunction parseBoolean(raw: string | undefined, fallback: boolean): boolean {\n  return parseBooleanWithDefault(raw, fallback)\n}\n\nfunction parseNumber(raw: string | undefined, fallback: number, min = 1): number {\n  if (raw == null) return fallback\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value)) return fallback\n  if (value < min) return fallback\n  return value\n}\n\nfunction parseHashAlgorithm(raw: string | undefined): 'sha256' | 'sha1' | 'md5' {\n  const value = (raw ?? '').trim().toLowerCase()\n  if (value === 'sha1') return 'sha1'\n  if (value === 'md5') return 'md5'\n  return 'sha256'\n}\n\nexport function resolveSearchConfig(): SearchConfig {\n  return {\n    enabled: parseBoolean(process.env.OM_SEARCH_ENABLED, true),\n    minTokenLength: parseNumber(process.env.OM_SEARCH_MIN_LEN, 3, 1),\n    enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),\n    hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),\n    storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),\n    blocklistedFields: (process.env.OM_SEARCH_FIELD_BLOCKLIST ?? '')\n      .split(',')\n      .map((entry) => entry.trim())\n      .filter((entry) => entry.length > 0)\n      .filter((value, index, arr) => arr.indexOf(value) === index)\n      .map((entry) => entry.toLowerCase())\n      .concat(DEFAULT_BLOCKLIST)\n      .filter((value, index, arr) => arr.indexOf(value) === index),\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,+BAA+B;AAWxC,MAAM,oBAAoB,CAAC,YAAY,SAAS,UAAU,MAAM;AAEhE,SAAS,aAAa,KAAyB,UAA4B;AACzE,SAAO,wBAAwB,KAAK,QAAQ;AAC9C;AAEA,SAAS,YAAY,KAAyB,UAAkB,MAAM,GAAW;AAC/E,MAAI,OAAO,KAAM,QAAO;AACxB,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,MAAI,QAAQ,IAAK,QAAO;AACxB,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAoD;AAC9E,QAAM,SAAS,OAAO,IAAI,KAAK,EAAE,YAAY;AAC7C,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,MAAO,QAAO;AAC5B,SAAO;AACT;AAEO,SAAS,sBAAoC;AAClD,SAAO;AAAA,IACL,SAAS,aAAa,QAAQ,IAAI,mBAAmB,IAAI;AAAA,IACzD,gBAAgB,YAAY,QAAQ,IAAI,mBAAmB,GAAG,CAAC;AAAA,IAC/D,gBAAgB,aAAa,QAAQ,IAAI,0BAA0B,IAAI;AAAA,IACvE,eAAe,mBAAmB,QAAQ,IAAI,mBAAmB;AAAA,IACjE,gBAAgB,aAAa,QAAQ,IAAI,4BAA4B,KAAK;AAAA,IAC1E,oBAAoB,QAAQ,IAAI,6BAA6B,IAC1D,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,EAClC,OAAO,CAAC,OAAO,OAAO,QAAQ,IAAI,QAAQ,KAAK,MAAM,KAAK,EAC1D,IAAI,CAAC,UAAU,MAAM,YAAY,CAAC,EAClC,OAAO,iBAAiB,EACxB,OAAO,CAAC,OAAO,OAAO,QAAQ,IAAI,QAAQ,KAAK,MAAM,KAAK;AAAA,EAC/D;AACF;",
+  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\n\nexport type SearchConfig = {\n  enabled: boolean\n  minTokenLength: number\n  enablePartials: boolean\n  hashAlgorithm: 'sha256' | 'sha1' | 'md5'\n  storeRawTokens: boolean\n  blocklistedFields: string[]\n}\n\nexport const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3\n\nconst DEFAULT_BLOCKLIST = ['password', 'token', 'secret', 'hash']\n\nfunction parseBoolean(raw: string | undefined, fallback: boolean): boolean {\n  return parseBooleanWithDefault(raw, fallback)\n}\n\nfunction parseNumber(raw: string | undefined, fallback: number, min = 1): number {\n  if (raw == null) return fallback\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value)) return fallback\n  if (value < min) return fallback\n  return value\n}\n\nfunction parseHashAlgorithm(raw: string | undefined): 'sha256' | 'sha1' | 'md5' {\n  const value = (raw ?? '').trim().toLowerCase()\n  if (value === 'sha1') return 'sha1'\n  if (value === 'md5') return 'md5'\n  return 'sha256'\n}\n\nexport function resolveSearchConfig(): SearchConfig {\n  return {\n    enabled: parseBoolean(process.env.OM_SEARCH_ENABLED, true),\n    minTokenLength: resolveSearchMinTokenLength(),\n    enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),\n    hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),\n    storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),\n    blocklistedFields: (process.env.OM_SEARCH_FIELD_BLOCKLIST ?? '')\n      .split(',')\n      .map((entry) => entry.trim())\n      .filter((entry) => entry.length > 0)\n      .filter((value, index, arr) => arr.indexOf(value) === index)\n      .map((entry) => entry.toLowerCase())\n      .concat(DEFAULT_BLOCKLIST)\n      .filter((value, index, arr) => arr.indexOf(value) === index),\n  }\n}\n\n/**\n * Browser-safe accessor for the minimum search token length.\n *\n * Why: client components (e.g. global search dialog) must mirror the server-side\n * tokenizer's `minTokenLength` so the UI gates the request before hitting an\n * empty result set. Pulling the value through this single helper keeps the env\n * contract (`OM_SEARCH_MIN_LEN`) authoritative on both sides.\n *\n * How to apply: call from anywhere \u2014 server, client (when the host app exposes\n * `OM_SEARCH_MIN_LEN` through `next.config.ts`'s `env` block), or tests.\n */\nexport function resolveSearchMinTokenLength(): number {\n  return parseNumber(process.env.OM_SEARCH_MIN_LEN, DEFAULT_SEARCH_MIN_TOKEN_LENGTH, 1)\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B;AAWjC,MAAM,kCAAkC;AAE/C,MAAM,oBAAoB,CAAC,YAAY,SAAS,UAAU,MAAM;AAEhE,SAAS,aAAa,KAAyB,UAA4B;AACzE,SAAO,wBAAwB,KAAK,QAAQ;AAC9C;AAEA,SAAS,YAAY,KAAyB,UAAkB,MAAM,GAAW;AAC/E,MAAI,OAAO,KAAM,QAAO;AACxB,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,MAAI,QAAQ,IAAK,QAAO;AACxB,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAoD;AAC9E,QAAM,SAAS,OAAO,IAAI,KAAK,EAAE,YAAY;AAC7C,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,MAAO,QAAO;AAC5B,SAAO;AACT;AAEO,SAAS,sBAAoC;AAClD,SAAO;AAAA,IACL,SAAS,aAAa,QAAQ,IAAI,mBAAmB,IAAI;AAAA,IACzD,gBAAgB,4BAA4B;AAAA,IAC5C,gBAAgB,aAAa,QAAQ,IAAI,0BAA0B,IAAI;AAAA,IACvE,eAAe,mBAAmB,QAAQ,IAAI,mBAAmB;AAAA,IACjE,gBAAgB,aAAa,QAAQ,IAAI,4BAA4B,KAAK;AAAA,IAC1E,oBAAoB,QAAQ,IAAI,6BAA6B,IAC1D,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,EAClC,OAAO,CAAC,OAAO,OAAO,QAAQ,IAAI,QAAQ,KAAK,MAAM,KAAK,EAC1D,IAAI,CAAC,UAAU,MAAM,YAAY,CAAC,EAClC,OAAO,iBAAiB,EACxB,OAAO,CAAC,OAAO,OAAO,QAAQ,IAAI,QAAQ,KAAK,MAAM,KAAK;AAAA,EAC/D;AACF;AAaO,SAAS,8BAAsC;AACpD,SAAO,YAAY,QAAQ,IAAI,mBAAmB,iCAAiC,CAAC;AACtF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.5.1-develop.2975.ccbadc8198";
+const APP_VERSION = "0.5.1-develop.2996.ce62fd491c";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.5.1-develop.2975.ccbadc8198'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.5.1-develop.2996.ce62fd491c'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/navigation/sidebarPreferences.js

@@ -2,19 +2,21 @@ import { slugify } from "../../lib/slugify.js";
 const SIDEBAR_PREFERENCES_VERSION = 2;
 function normalizeSidebarSettings(settings) {
   if (!settings || typeof settings !== "object") {
-    return { version: SIDEBAR_PREFERENCES_VERSION, groupOrder: [], groupLabels: {}, itemLabels: {}, hiddenItems: [] };
+    return { version: SIDEBAR_PREFERENCES_VERSION, groupOrder: [], groupLabels: {}, itemLabels: {}, hiddenItems: [], itemOrder: {} };
   }
   const version = typeof settings.version === "number" ? settings.version : SIDEBAR_PREFERENCES_VERSION;
   const groupOrder = Array.isArray(settings.groupOrder) ? settings.groupOrder.filter((v) => typeof v === "string") : [];
   const groupLabels = normalizeRecord(settings.groupLabels);
   const itemLabels = normalizeRecord(settings.itemLabels);
   const hiddenItems = normalizeStringArray(settings.hiddenItems);
+  const itemOrder = normalizeStringArrayRecord(settings.itemOrder);
   return {
     version,
     groupOrder,
     groupLabels,
     itemLabels,
-    hiddenItems
+    hiddenItems,
+    itemOrder
   };
 }
 function normalizeRecord(record) {
@@ -26,6 +28,15 @@ function normalizeRecord(record) {
   }
   return out;
 }
+function normalizeStringArrayRecord(record) {
+  if (!record || typeof record !== "object") return {};
+  const out = {};
+  for (const [key, value] of Object.entries(record)) {
+    const arr = normalizeStringArray(value);
+    if (arr.length > 0) out[key] = arr;
+  }
+  return out;
+}
 function normalizeStringArray(values) {
   if (!Array.isArray(values)) return [];
   const seen = /* @__PURE__ */ new Set();

package/dist/modules/navigation/sidebarPreferences.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/navigation/sidebarPreferences.ts"],
-  "sourcesContent": ["import { slugify } from '../../lib/slugify'\n\nexport const SIDEBAR_PREFERENCES_VERSION = 2\n\nexport type SidebarPreferencesSettings = {\n  version: number\n  groupOrder?: string[]\n  groupLabels?: Record<string, string>\n  itemLabels?: Record<string, string>\n  hiddenItems?: string[]\n}\n\nexport type SidebarPreferencesPayload = {\n  locale: string\n  settings: SidebarPreferencesSettings\n}\n\nexport function normalizeSidebarSettings(settings?: SidebarPreferencesSettings | null): SidebarPreferencesSettings {\n  if (!settings || typeof settings !== 'object') {\n    return { version: SIDEBAR_PREFERENCES_VERSION, groupOrder: [], groupLabels: {}, itemLabels: {}, hiddenItems: [] }\n  }\n  const version = typeof settings.version === 'number' ? settings.version : SIDEBAR_PREFERENCES_VERSION\n  const groupOrder = Array.isArray(settings.groupOrder) ? settings.groupOrder.filter((v): v is string => typeof v === 'string') : []\n  const groupLabels = normalizeRecord(settings.groupLabels)\n  const itemLabels = normalizeRecord(settings.itemLabels)\n  const hiddenItems = normalizeStringArray(settings.hiddenItems)\n  return {\n    version,\n    groupOrder,\n    groupLabels,\n    itemLabels,\n    hiddenItems,\n  }\n}\n\nfunction normalizeRecord(record: Record<string, unknown> | undefined): Record<string, string> {\n  if (!record || typeof record !== 'object') return {}\n  const out: Record<string, string> = {}\n  for (const [key, value] of Object.entries(record)) {\n    if (typeof value !== 'string') continue\n    out[key] = value\n  }\n  return out\n}\n\nfunction normalizeStringArray(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const seen = new Set<string>()\n  const out: string[] = []\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed || seen.has(trimmed)) continue\n    seen.add(trimmed)\n    out.push(trimmed)\n  }\n  return out\n}\n\nexport function slugifySidebarId(source: string): string {\n  return slugify(source, { allowedChars: '' }) || 'group'\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAEjB,MAAM,8BAA8B;AAepC,SAAS,yBAAyB,UAA0E;AACjH,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,WAAO,EAAE,SAAS,6BAA6B,YAAY,CAAC,GAAG,aAAa,CAAC,GAAG,YAAY,CAAC,GAAG,aAAa,CAAC,EAAE;AAAA,EAClH;AACA,QAAM,UAAU,OAAO,SAAS,YAAY,WAAW,SAAS,UAAU;AAC1E,QAAM,aAAa,MAAM,QAAQ,SAAS,UAAU,IAAI,SAAS,WAAW,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;AACjI,QAAM,cAAc,gBAAgB,SAAS,WAAW;AACxD,QAAM,aAAa,gBAAgB,SAAS,UAAU;AACtD,QAAM,cAAc,qBAAqB,SAAS,WAAW;AAC7D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAqE;AAC5F,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,OAAO,UAAU,SAAU;AAC/B,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,QAA2B;AACvD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,KAAK,IAAI,OAAO,EAAG;AACnC,SAAK,IAAI,OAAO;AAChB,QAAI,KAAK,OAAO;AAAA,EAClB;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAAwB;AACvD,SAAO,QAAQ,QAAQ,EAAE,cAAc,GAAG,CAAC,KAAK;AAClD;",
+  "sourcesContent": ["import { slugify } from '../../lib/slugify'\n\nexport const SIDEBAR_PREFERENCES_VERSION = 2\n\nexport type SidebarPreferencesSettings = {\n  version: number\n  groupOrder?: string[]\n  groupLabels?: Record<string, string>\n  itemLabels?: Record<string, string>\n  hiddenItems?: string[]\n  /** Per-group ordered list of item keys. Missing items keep their natural position. */\n  itemOrder?: Record<string, string[]>\n}\n\nexport type SidebarPreferencesPayload = {\n  locale: string\n  settings: SidebarPreferencesSettings\n}\n\nexport function normalizeSidebarSettings(settings?: SidebarPreferencesSettings | null): SidebarPreferencesSettings {\n  if (!settings || typeof settings !== 'object') {\n    return { version: SIDEBAR_PREFERENCES_VERSION, groupOrder: [], groupLabels: {}, itemLabels: {}, hiddenItems: [], itemOrder: {} }\n  }\n  const version = typeof settings.version === 'number' ? settings.version : SIDEBAR_PREFERENCES_VERSION\n  const groupOrder = Array.isArray(settings.groupOrder) ? settings.groupOrder.filter((v): v is string => typeof v === 'string') : []\n  const groupLabels = normalizeRecord(settings.groupLabels)\n  const itemLabels = normalizeRecord(settings.itemLabels)\n  const hiddenItems = normalizeStringArray(settings.hiddenItems)\n  const itemOrder = normalizeStringArrayRecord(settings.itemOrder)\n  return {\n    version,\n    groupOrder,\n    groupLabels,\n    itemLabels,\n    hiddenItems,\n    itemOrder,\n  }\n}\n\nfunction normalizeRecord(record: Record<string, unknown> | undefined): Record<string, string> {\n  if (!record || typeof record !== 'object') return {}\n  const out: Record<string, string> = {}\n  for (const [key, value] of Object.entries(record)) {\n    if (typeof value !== 'string') continue\n    out[key] = value\n  }\n  return out\n}\n\nfunction normalizeStringArrayRecord(record: Record<string, unknown> | undefined): Record<string, string[]> {\n  if (!record || typeof record !== 'object') return {}\n  const out: Record<string, string[]> = {}\n  for (const [key, value] of Object.entries(record)) {\n    const arr = normalizeStringArray(value)\n    if (arr.length > 0) out[key] = arr\n  }\n  return out\n}\n\nfunction normalizeStringArray(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const seen = new Set<string>()\n  const out: string[] = []\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed || seen.has(trimmed)) continue\n    seen.add(trimmed)\n    out.push(trimmed)\n  }\n  return out\n}\n\nexport function slugifySidebarId(source: string): string {\n  return slugify(source, { allowedChars: '' }) || 'group'\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAEjB,MAAM,8BAA8B;AAiBpC,SAAS,yBAAyB,UAA0E;AACjH,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,WAAO,EAAE,SAAS,6BAA6B,YAAY,CAAC,GAAG,aAAa,CAAC,GAAG,YAAY,CAAC,GAAG,aAAa,CAAC,GAAG,WAAW,CAAC,EAAE;AAAA,EACjI;AACA,QAAM,UAAU,OAAO,SAAS,YAAY,WAAW,SAAS,UAAU;AAC1E,QAAM,aAAa,MAAM,QAAQ,SAAS,UAAU,IAAI,SAAS,WAAW,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;AACjI,QAAM,cAAc,gBAAgB,SAAS,WAAW;AACxD,QAAM,aAAa,gBAAgB,SAAS,UAAU;AACtD,QAAM,cAAc,qBAAqB,SAAS,WAAW;AAC7D,QAAM,YAAY,2BAA2B,SAAS,SAAS;AAC/D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,QAAqE;AAC5F,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,OAAO,UAAU,SAAU;AAC/B,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAuE;AACzG,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,MAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,MAAM,qBAAqB,KAAK;AACtC,QAAI,IAAI,SAAS,EAAG,KAAI,GAAG,IAAI;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,QAA2B;AACvD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,KAAK,IAAI,OAAO,EAAG;AACnC,SAAK,IAAI,OAAO;AAChB,QAAI,KAAK,OAAO;AAAA,EAClB;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAAwB;AACvD,SAAO,QAAQ,QAAQ,EAAE,cAAc,GAAG,CAAC,KAAK;AAClD;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.5.1-develop.2975.ccbadc8198",
+  "version": "0.5.1-develop.2996.ce62fd491c",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -89,10 +89,10 @@
     }
   },
   "dependencies": {
-    "@mikro-orm/core": "^7.0.10",
-    "@mikro-orm/decorators": "^7.0.10",
-    "@mikro-orm/postgresql": "^7.0.10",
-    "@open-mercato/cache": "0.5.1-develop.2975.ccbadc8198",
+    "@mikro-orm/core": "^7.0.13",
+    "@mikro-orm/decorators": "^7.0.13",
+    "@mikro-orm/postgresql": "^7.0.13",
+    "@open-mercato/cache": "0.5.1-develop.2996.ce62fd491c",
     "dotenv": "^17.4.2",
     "rate-limiter-flexible": "^11.0.1",
     "reflect-metadata": "^0.2.2",

package/src/lib/crud/__tests__/custom-fields.test.ts

@@ -1,10 +1,12 @@
 import {
   buildCustomFieldFiltersFromQuery,
+  decorateRecordWithCustomFields,
   extractAllCustomFieldEntries,
   loadCustomFieldDefinitionIndex,
   loadCustomFieldValues,
   splitCustomFieldPayload,
 } from '../custom-fields'
+import type { CustomFieldDefinitionIndex, CustomFieldDefinitionSummary } from '../custom-fields'
 import { encryptWithAesGcm } from '../../encryption/aes'
 
 const mockEntityManager = (defs: any[]) => ({
@@ -145,9 +147,10 @@ describe('extractAllCustomFieldEntries', () => {
 })
 
 describe('loadCustomFieldValues (encryption)', () => {
-  it('decrypts encrypted custom field payloads when definitions mark them encrypted', async () => {
+  it('decrypts encrypted text custom field payloads as strings', async () => {
     const dek = Buffer.alloc(32, 2).toString('base64')
-    const encrypted = encryptWithAesGcm(JSON.stringify('secret-note'), dek).value
+    // Mirrors production encrypt path: strings stored unwrapped, non-strings JSON-stringified.
+    const encrypted = encryptWithAesGcm('secret-note', dek).value
     const em = {
       find: jest.fn().mockImplementation((_, where) => {
         if ((where as any).recordId) {
@@ -170,6 +173,129 @@ describe('loadCustomFieldValues (encryption)', () => {
     })
     expect(values['rec-1'].cf_note).toBe('secret-note')
   })
+
+  it('preserves numeric-looking text values as strings (regression: issue #1734)', async () => {
+    const dek = Buffer.alloc(32, 2).toString('base64')
+    const encrypted = encryptWithAesGcm('123', dek).value
+    const em = {
+      find: jest.fn().mockImplementation((_, where) => {
+        if ((where as any).recordId) {
+          return Promise.resolve([
+            { recordId: 'rec-1', fieldKey: 'note', organizationId: null, tenantId: 'tenant-1', valueText: encrypted, valueMultiline: null, valueInt: null, valueFloat: null, valueBool: null, deletedAt: null },
+          ])
+        }
+        return Promise.resolve([
+          { key: 'note', entityId: 'demo:entity', organizationId: null, tenantId: 'tenant-1', kind: 'text', configJson: { encrypted: true }, isActive: true },
+        ])
+      }),
+    }
+    const mockService = { isEnabled: () => true, getDek: async () => ({ key: dek }) }
+    const values = await loadCustomFieldValues({
+      em: em as any,
+      entityId: 'demo:entity',
+      recordIds: ['rec-1'],
+      tenantIdByRecord: { 'rec-1': 'tenant-1' },
+      encryptionService: mockService as any,
+    })
+    expect(values['rec-1'].cf_note).toBe('123')
+    expect(typeof values['rec-1'].cf_note).toBe('string')
+  })
+
+  it('still parses typed integer custom field payloads back to numbers', async () => {
+    const dek = Buffer.alloc(32, 2).toString('base64')
+    // Numeric kinds are JSON-stringified by encryptCustomFieldValue in production.
+    const encrypted = encryptWithAesGcm(JSON.stringify(42), dek).value
+    const em = {
+      find: jest.fn().mockImplementation((_, where) => {
+        if ((where as any).recordId) {
+          return Promise.resolve([
+            { recordId: 'rec-1', fieldKey: 'priority', organizationId: null, tenantId: 'tenant-1', valueText: encrypted, valueMultiline: null, valueInt: null, valueFloat: null, valueBool: null, deletedAt: null },
+          ])
+        }
+        return Promise.resolve([
+          { key: 'priority', entityId: 'demo:entity', organizationId: null, tenantId: 'tenant-1', kind: 'integer', configJson: { encrypted: true }, isActive: true },
+        ])
+      }),
+    }
+    const mockService = { isEnabled: () => true, getDek: async () => ({ key: dek }) }
+    const values = await loadCustomFieldValues({
+      em: em as any,
+      entityId: 'demo:entity',
+      recordIds: ['rec-1'],
+      tenantIdByRecord: { 'rec-1': 'tenant-1' },
+      encryptionService: mockService as any,
+    })
+    expect(values['rec-1'].cf_priority).toBe(42)
+  })
+})
+
+describe('decorateRecordWithCustomFields', () => {
+  const buildDefinition = (
+    overrides: Partial<CustomFieldDefinitionSummary> = {},
+  ): CustomFieldDefinitionSummary => ({
+    key: 'priority',
+    label: 'Priority',
+    kind: 'integer',
+    multi: false,
+    organizationId: null,
+    tenantId: null,
+    priority: 0,
+    updatedAt: 1,
+    ...overrides,
+  })
+
+  const buildIndex = (
+    entries: Array<[string, CustomFieldDefinitionSummary[]]>,
+  ): CustomFieldDefinitionIndex => new Map(entries)
+
+  it('returns the value in customValues and customFields when an active definition exists', () => {
+    const index = buildIndex([
+      ['priority', [buildDefinition()]],
+    ])
+
+    const result = decorateRecordWithCustomFields(
+      { cf_priority: 3 },
+      index,
+      { tenantId: 'tenant-1', organizationId: 'org-1' },
+    )
+
+    expect(result.customValues).toEqual({ priority: 3 })
+    expect(result.customFields).toEqual([
+      { key: 'priority', label: 'Priority', value: 3, kind: 'integer', multi: false },
+    ])
+  })
+
+  it('skips orphaned custom field values whose definition was deleted (regression for #1749)', () => {
+    const result = decorateRecordWithCustomFields(
+      { cf_my_test_key: 'leftover' },
+      buildIndex([]),
+      { tenantId: 'tenant-1', organizationId: 'org-1' },
+    )
+
+    expect(result.customValues).toBeNull()
+    expect(result.customFields).toEqual([])
+  })
+
+  it('keeps active fields and drops orphaned ones in mixed payloads', () => {
+    const index = buildIndex([
+      ['priority', [buildDefinition({ key: 'priority', label: 'Priority' })]],
+      ['severity', [buildDefinition({ key: 'severity', label: 'Severity', kind: 'text', priority: 1 })]],
+    ])
+
+    const result = decorateRecordWithCustomFields(
+      {
+        cf_priority: 5,
+        cf_severity: 'high',
+        cf_my_test_key: 'should-not-leak',
+      },
+      index,
+      { tenantId: 'tenant-1', organizationId: 'org-1' },
+    )
+
+    expect(result.customValues).toEqual({ priority: 5, severity: 'high' })
+    expect(result.customFields.map((entry) => entry.key)).toEqual(['priority', 'severity'])
+    expect(result.customFields.find((entry) => entry.key === 'my_test_key')).toBeUndefined()
+  })
 })
 
 describe('loadCustomFieldDefinitionIndex', () => {

package/src/lib/crud/custom-fields.ts

@@ -427,20 +427,22 @@ export function decorateRecordWithCustomFields(
     const bareKey = prefixedKey.replace(/^cf_/, '')
     const normalizedKey = normalizeDefinitionKey(bareKey)
     if (!normalizedKey) return
-    values[bareKey] = value
     const defsForKey = definitions.get(normalizedKey) ?? []
     const resolvedDef = selectDefinitionForRecord(defsForKey, organizationId, tenantId)
+    // Skip custom field values without active definitions to prevent orphaned fields
+    if (!resolvedDef) return
+    values[bareKey] = value
     const entry: CustomFieldDisplayEntry = {
       key: bareKey,
-      label: resolvedDef?.label ?? bareKey,
+      label: resolvedDef.label ?? bareKey,
       value,
-      kind: resolvedDef?.kind ?? null,
-      multi: resolvedDef?.multi ?? Array.isArray(value),
+      kind: resolvedDef.kind ?? null,
+      multi: resolvedDef.multi ?? Array.isArray(value),
     }
     entries.push({
       entry,
-      priority: resolvedDef?.priority ?? Number.MAX_SAFE_INTEGER,
-      updatedAt: resolvedDef?.updatedAt ?? 0,
+      priority: resolvedDef.priority ?? Number.MAX_SAFE_INTEGER,
+      updatedAt: resolvedDef.updatedAt ?? 0,
     })
   })
 
@@ -582,7 +584,13 @@ export async function loadCustomFieldValues(opts: {
     const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)
     const value = valueFromRow(row)
     const decrypted = encrypted
-      ? await decryptCustomFieldValue(value, resolvedTenantId ?? tenantId ?? null, getEncryptionService(), encryptionCache)
+      ? await decryptCustomFieldValue(
+          value,
+          resolvedTenantId ?? tenantId ?? null,
+          getEncryptionService(),
+          encryptionCache,
+          { kind: def?.kind ?? null },
+        )
       : value
     const existing = buckets.get(bucketKey)
     if (existing) {

package/src/lib/encryption/__tests__/customFieldValues.test.ts

@@ -60,4 +60,41 @@ describe('customFieldValues encryption helpers', () => {
     expect(await decryptCustomFieldValue('plain', 'tenant-1', disabledService)).toBe('plain')
     expect(await encryptCustomFieldValue('plain', null, disabledService)).toBe('plain')
   })
+
+  it('preserves text-typed values verbatim when kind is provided (regression: issue #1734)', async () => {
+    const service = {
+      isEnabled: () => true,
+      getDek: async () => ({ key: fixedKey }),
+    } as any
+    const cache = new Map<string | null, string | null>()
+
+    const numericText = await encryptCustomFieldValue('123', 'tenant-1', service, cache)
+    const decryptedAsText = await decryptCustomFieldValue(numericText, 'tenant-1', service, cache, { kind: 'text' })
+    expect(decryptedAsText).toBe('123')
+    expect(typeof decryptedAsText).toBe('string')
+
+    const booleanText = await encryptCustomFieldValue('true', 'tenant-1', service, cache)
+    expect(await decryptCustomFieldValue(booleanText, 'tenant-1', service, cache, { kind: 'multiline' })).toBe('true')
+    expect(await decryptCustomFieldValue(booleanText, 'tenant-1', service, cache, { kind: 'select' })).toBe('true')
+    expect(await decryptCustomFieldValue(booleanText, 'tenant-1', service, cache, { kind: 'currency' })).toBe('true')
+    expect(await decryptCustomFieldValue(booleanText, 'tenant-1', service, cache, { kind: 'dictionary' })).toBe('true')
+    expect(await decryptCustomFieldValue(booleanText, 'tenant-1', service, cache, { kind: 'email' })).toBe('true')
+  })
+
+  it('still parses typed kinds (integer/float/boolean) so legacy round-trip stays correct', async () => {
+    const service = {
+      isEnabled: () => true,
+      getDek: async () => ({ key: fixedKey }),
+    } as any
+    const cache = new Map<string | null, string | null>()
+
+    const encryptedInt = await encryptCustomFieldValue(42, 'tenant-1', service, cache)
+    expect(await decryptCustomFieldValue(encryptedInt, 'tenant-1', service, cache, { kind: 'integer' })).toBe(42)
+
+    const encryptedFloat = await encryptCustomFieldValue(3.14, 'tenant-1', service, cache)
+    expect(await decryptCustomFieldValue(encryptedFloat, 'tenant-1', service, cache, { kind: 'float' })).toBe(3.14)
+
+    const encryptedBool = await encryptCustomFieldValue(true, 'tenant-1', service, cache)
+    expect(await decryptCustomFieldValue(encryptedBool, 'tenant-1', service, cache, { kind: 'boolean' })).toBe(true)
+  })
 })

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -0,0 +1,109 @@
+import { encryptWithAesGcm } from '../aes'
+import {
+  TenantDataEncryptionService,
+  parseDecryptedFieldValue,
+} from '../tenantDataEncryptionService'
+
+const fixedKey = Buffer.alloc(32, 1).toString('base64')
+
+describe('parseDecryptedFieldValue', () => {
+  it('keeps purely-numeric strings as strings (regression: issue #1734)', () => {
+    expect(parseDecryptedFieldValue('123')).toBe('123')
+    expect(parseDecryptedFieldValue('00042')).toBe('00042')
+    expect(parseDecryptedFieldValue('-9.5')).toBe('-9.5')
+  })
+
+  it('keeps boolean-like and null-like text as strings', () => {
+    expect(parseDecryptedFieldValue('true')).toBe('true')
+    expect(parseDecryptedFieldValue('false')).toBe('false')
+    expect(parseDecryptedFieldValue('null')).toBe('null')
+  })
+
+  it('keeps ordinary text untouched', () => {
+    expect(parseDecryptedFieldValue('Acme Corp')).toBe('Acme Corp')
+    expect(parseDecryptedFieldValue('')).toBe('')
+  })
+
+  it('parses JSON objects and arrays back to structured values', () => {
+    expect(parseDecryptedFieldValue('{"a":1,"b":"x"}')).toEqual({ a: 1, b: 'x' })
+    expect(parseDecryptedFieldValue('[1,2,3]')).toEqual([1, 2, 3])
+    expect(parseDecryptedFieldValue('[]')).toEqual([])
+  })
+
+  it('returns the raw text when the JSON-looking payload fails to parse', () => {
+    expect(parseDecryptedFieldValue('{not json')).toBe('{not json')
+    expect(parseDecryptedFieldValue('[broken')).toBe('[broken')
+  })
+})
+
+describe('TenantDataEncryptionService.decryptFields (issue #1734)', () => {
+  function makeService() {
+    type Anything = Record<string, unknown>
+    const service = new TenantDataEncryptionService({} as never) as unknown as {
+      decryptFields: (
+        obj: Anything,
+        fields: { field: string }[],
+        dek: { key: string },
+      ) => Anything
+    }
+    return service
+  }
+
+  function encrypt(value: string): string {
+    return encryptWithAesGcm(value, fixedKey).value as string
+  }
+
+  it('preserves a numeric-string display name through encrypt/decrypt round-trip', () => {
+    const service = makeService()
+    const obj = { display_name: encrypt('123') }
+    const out = service.decryptFields(obj, [{ field: 'display_name' }], { key: fixedKey } as never)
+    expect(out.display_name).toBe('123')
+    expect(typeof out.display_name).toBe('string')
+  })
+
+  it('preserves arbitrary text values through encrypt/decrypt round-trip', () => {
+    const service = makeService()
+    const obj = {
+      display_name: encrypt('Acme Corp'),
+      primary_email: encrypt('mail@example.com'),
+    }
+    const out = service.decryptFields(
+      obj,
+      [{ field: 'display_name' }, { field: 'primary_email' }],
+      { key: fixedKey } as never,
+    )
+    expect(out.display_name).toBe('Acme Corp')
+    expect(out.primary_email).toBe('mail@example.com')
+  })
+
+  it('still recovers JSON object payloads (audit_logs use case)', () => {
+    const service = makeService()
+    const payload = { actor: 'user-1', changes: { name: 'old → new' } }
+    const obj = { context_json: encrypt(JSON.stringify(payload)) }
+    const out = service.decryptFields(obj, [{ field: 'context_json' }], { key: fixedKey } as never)
+    expect(out.context_json).toEqual(payload)
+  })
+
+  it('still recovers JSON array payloads', () => {
+    const service = makeService()
+    const arr = [{ id: 1 }, { id: 2 }]
+    const obj = { thread_messages: encrypt(JSON.stringify(arr)) }
+    const out = service.decryptFields(obj, [{ field: 'thread_messages' }], { key: fixedKey } as never)
+    expect(out.thread_messages).toEqual(arr)
+  })
+
+  it('keeps boolean-like and null-like text strings as strings', () => {
+    const service = makeService()
+    const obj = {
+      display_name: encrypt('true'),
+      description: encrypt('null'),
+    }
+    const out = service.decryptFields(
+      obj,
+      [{ field: 'display_name' }, { field: 'description' }],
+      { key: fixedKey } as never,
+    )
+    expect(out.display_name).toBe('true')
+    expect(out.description).toBe('null')
+  })
+})

package/src/lib/encryption/customFieldValues.ts

@@ -2,6 +2,39 @@ import type { EntityManager } from '@mikro-orm/core'
 import { encryptWithAesGcm, decryptWithAesGcm } from './aes'
 import { TenantDataEncryptionService } from './tenantDataEncryptionService'
 
+/**
+ * Custom field kinds that ALWAYS round-trip as a string. The encrypt path
+ * stores raw strings unwrapped, so blindly running `JSON.parse` on the
+ * decrypted payload coerces text values like `"123"` or `"true"` back into
+ * numbers/booleans (issue #1734). For these kinds, callers MUST pass the
+ * `kind` option so we keep the decrypted value as a string.
+ *
+ * Numeric (`integer`/`float`) and `boolean` kinds rely on JSON round-trip
+ * because the encrypt path JSON-stringifies the typed value before storage.
+ * Omitting the kind preserves legacy round-trip behavior for backward
+ * compatibility.
+ */
+const STRING_TYPED_CUSTOM_FIELD_KINDS = new Set([
+  'text',
+  'multiline',
+  'select',
+  'currency',
+  'dictionary',
+  'email',
+  'url',
+  'string',
+])
+
+export type DecryptCustomFieldOptions = {
+  /** Field kind, e.g. from `CustomFieldDef.kind`. When string-typed, the helper preserves the decrypted string verbatim. */
+  kind?: string | null
+}
+
+function shouldPreserveAsString(kind: string | null | undefined): boolean {
+  if (!kind) return false
+  return STRING_TYPED_CUSTOM_FIELD_KINDS.has(kind)
+}
+
 const serviceCache = new WeakMap<EntityManager, TenantDataEncryptionService>()
 
 export function resolveTenantEncryptionService(
@@ -53,12 +86,14 @@ export async function decryptCustomFieldValue(
   tenantId: string | null | undefined,
   service: TenantDataEncryptionService | null,
   cache?: Map<string | null, string | null>,
+  options?: DecryptCustomFieldOptions,
 ): Promise<unknown> {
   if (value === undefined || value === null || typeof value !== 'string') return value
   const key = await resolveDekKey(service, tenantId, cache)
   if (!key) return value
   const decrypted = decryptWithAesGcm(value, key)
   if (decrypted === null) return value
+  if (shouldPreserveAsString(options?.kind ?? null)) return decrypted
   try {
     return JSON.parse(decrypted)
   } catch {

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -56,6 +56,29 @@ function findKey(obj: Record<string, unknown>, key: string): string | null {
   return null
 }
 
+/**
+ * Decode a decrypted entity-field payload back into its original value.
+ *
+ * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string
+ * values. Blindly running `JSON.parse` on every decrypted value would coerce
+ * text columns whose contents happen to be valid JSON primitives — e.g. the
+ * string `"123"` — back into numbers/booleans, which then breaks string-typed
+ * consumers (see issue #1734). Only restructure the value when the decrypted
+ * payload is unambiguously a JSON object or array; otherwise return the raw
+ * decrypted string. Numeric/boolean entity columns are not in any current
+ * encryption map, so this is backward-compatible.
+ */
+export function parseDecryptedFieldValue(decrypted: string): unknown {
+  if (decrypted.length === 0) return decrypted
+  const first = decrypted[0]
+  if (first !== '{' && first !== '[') return decrypted
+  try {
+    return JSON.parse(decrypted)
+  } catch {
+    return decrypted
+  }
+}
+
 function isEncryptedPayload(value: unknown): boolean {
   if (typeof value !== 'string') return false
   const parts = value.split(':')
@@ -254,11 +277,7 @@ export class TenantDataEncryptionService {
       if (typeof value !== 'string') continue
       const decrypted = maybeDecrypt(value)
       if (decrypted === null) continue
-      try {
-        clone[key] = JSON.parse(decrypted)
-      } catch {
-        clone[key] = decrypted
-      }
+      clone[key] = parseDecryptedFieldValue(decrypted)
     }
     return clone
   }

package/src/lib/search/__tests__/config.test.ts

@@ -0,0 +1,42 @@
+import {
+  DEFAULT_SEARCH_MIN_TOKEN_LENGTH,
+  resolveSearchConfig,
+  resolveSearchMinTokenLength,
+} from '../config'
+
+describe('resolveSearchMinTokenLength', () => {
+  const originalValue = process.env.OM_SEARCH_MIN_LEN
+
+  afterEach(() => {
+    if (originalValue === undefined) {
+      delete process.env.OM_SEARCH_MIN_LEN
+    } else {
+      process.env.OM_SEARCH_MIN_LEN = originalValue
+    }
+  })
+
+  it('returns the default when OM_SEARCH_MIN_LEN is unset', () => {
+    delete process.env.OM_SEARCH_MIN_LEN
+    expect(resolveSearchMinTokenLength()).toBe(DEFAULT_SEARCH_MIN_TOKEN_LENGTH)
+  })
+
+  it('parses a positive integer', () => {
+    process.env.OM_SEARCH_MIN_LEN = '4'
+    expect(resolveSearchMinTokenLength()).toBe(4)
+  })
+
+  it('falls back to the default for non-numeric values', () => {
+    process.env.OM_SEARCH_MIN_LEN = 'abc'
+    expect(resolveSearchMinTokenLength()).toBe(DEFAULT_SEARCH_MIN_TOKEN_LENGTH)
+  })
+
+  it('falls back to the default for values below the floor', () => {
+    process.env.OM_SEARCH_MIN_LEN = '0'
+    expect(resolveSearchMinTokenLength()).toBe(DEFAULT_SEARCH_MIN_TOKEN_LENGTH)
+  })
+
+  it('keeps resolveSearchConfig().minTokenLength in sync', () => {
+    process.env.OM_SEARCH_MIN_LEN = '5'
+    expect(resolveSearchConfig().minTokenLength).toBe(resolveSearchMinTokenLength())
+  })
+})

package/src/lib/search/config.ts

@@ -9,6 +9,8 @@ export type SearchConfig = {
   blocklistedFields: string[]
 }
 
+export const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3
+
 const DEFAULT_BLOCKLIST = ['password', 'token', 'secret', 'hash']
 
 function parseBoolean(raw: string | undefined, fallback: boolean): boolean {
@@ -33,7 +35,7 @@ function parseHashAlgorithm(raw: string | undefined): 'sha256' | 'sha1' | 'md5'
 export function resolveSearchConfig(): SearchConfig {
   return {
     enabled: parseBoolean(process.env.OM_SEARCH_ENABLED, true),
-    minTokenLength: parseNumber(process.env.OM_SEARCH_MIN_LEN, 3, 1),
+    minTokenLength: resolveSearchMinTokenLength(),
     enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),
     hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),
     storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),
@@ -47,3 +49,18 @@ export function resolveSearchConfig(): SearchConfig {
       .filter((value, index, arr) => arr.indexOf(value) === index),
   }
 }
+
+/**
+ * Browser-safe accessor for the minimum search token length.
+ *
+ * Why: client components (e.g. global search dialog) must mirror the server-side
+ * tokenizer's `minTokenLength` so the UI gates the request before hitting an
+ * empty result set. Pulling the value through this single helper keeps the env
+ * contract (`OM_SEARCH_MIN_LEN`) authoritative on both sides.
+ *
+ * How to apply: call from anywhere — server, client (when the host app exposes
+ * `OM_SEARCH_MIN_LEN` through `next.config.ts`'s `env` block), or tests.
+ */
+export function resolveSearchMinTokenLength(): number {
+  return parseNumber(process.env.OM_SEARCH_MIN_LEN, DEFAULT_SEARCH_MIN_TOKEN_LENGTH, 1)
+}

package/src/modules/navigation/sidebarPreferences.ts

@@ -8,6 +8,8 @@ export type SidebarPreferencesSettings = {
   groupLabels?: Record<string, string>
   itemLabels?: Record<string, string>
   hiddenItems?: string[]
+  /** Per-group ordered list of item keys. Missing items keep their natural position. */
+  itemOrder?: Record<string, string[]>
 }
 
 export type SidebarPreferencesPayload = {
@@ -17,19 +19,21 @@ export type SidebarPreferencesPayload = {
 
 export function normalizeSidebarSettings(settings?: SidebarPreferencesSettings | null): SidebarPreferencesSettings {
   if (!settings || typeof settings !== 'object') {
-    return { version: SIDEBAR_PREFERENCES_VERSION, groupOrder: [], groupLabels: {}, itemLabels: {}, hiddenItems: [] }
+    return { version: SIDEBAR_PREFERENCES_VERSION, groupOrder: [], groupLabels: {}, itemLabels: {}, hiddenItems: [], itemOrder: {} }
   }
   const version = typeof settings.version === 'number' ? settings.version : SIDEBAR_PREFERENCES_VERSION
   const groupOrder = Array.isArray(settings.groupOrder) ? settings.groupOrder.filter((v): v is string => typeof v === 'string') : []
   const groupLabels = normalizeRecord(settings.groupLabels)
   const itemLabels = normalizeRecord(settings.itemLabels)
   const hiddenItems = normalizeStringArray(settings.hiddenItems)
+  const itemOrder = normalizeStringArrayRecord(settings.itemOrder)
   return {
     version,
     groupOrder,
     groupLabels,
     itemLabels,
     hiddenItems,
+    itemOrder,
   }
 }
 
@@ -43,6 +47,16 @@ function normalizeRecord(record: Record<string, unknown> | undefined): Record<st
   return out
 }
 
+function normalizeStringArrayRecord(record: Record<string, unknown> | undefined): Record<string, string[]> {
+  if (!record || typeof record !== 'object') return {}
+  const out: Record<string, string[]> = {}
+  for (const [key, value] of Object.entries(record)) {
+    const arr = normalizeStringArray(value)
+    if (arr.length > 0) out[key] = arr
+  }
+  return out
+}
+
 function normalizeStringArray(values: unknown): string[] {
   if (!Array.isArray(values)) return []
   const seen = new Set<string>()