@open-mercato/shared 0.6.3-develop.3525.3.cc18b8a43f → 0.6.3-develop.3574.1.f3c5dcf345

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 209 entry points
+[build:shared] found 211 entry points
 [build:shared] built successfully

package/dist/lib/crud/sync-event-runner.js

@@ -1,12 +1,6 @@
-function escapeRegex(input) {
-  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
+import { matchWildcardPattern } from "@open-mercato/shared/lib/patterns/wildcard";
 function matchesEventPattern(pattern, eventId) {
-  if (pattern === eventId) return true;
-  if (pattern === "*") return true;
-  const escaped = escapeRegex(pattern).replace(/\\\*/g, ".*");
-  const regex = new RegExp("^" + escaped + "$");
-  return regex.test(eventId);
+  return matchWildcardPattern(eventId, pattern);
 }
 function collectSyncSubscribers(allSyncSubscribers, eventId) {
   return allSyncSubscribers.filter((s) => matchesEventPattern(s.metadata.event, eventId)).sort((a, b) => (a.metadata.priority ?? 50) - (b.metadata.priority ?? 50));

package/dist/lib/crud/sync-event-runner.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/sync-event-runner.ts"],
-  "sourcesContent": ["import type { SyncCrudEventPayload } from './sync-event-types'\nimport type { SyncSubscriberEntry } from './sync-subscriber-store'\n\n// ---------------------------------------------------------------------------\n// Event pattern matching\n// ---------------------------------------------------------------------------\n\nfunction escapeRegex(input: string): string {\n  // Escape all characters with special meaning in regular expressions\n  return input.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n\nexport function matchesEventPattern(pattern: string, eventId: string): boolean {\n  if (pattern === eventId) return true\n  if (pattern === '*') return true\n  // Escape the pattern for literal use in a RegExp, then turn \"\\*\" into \".*\" for wildcard support\n  const escaped = escapeRegex(pattern).replace(/\\\\\\*/g, '.*')\n  const regex = new RegExp('^' + escaped + '$')\n  return regex.test(eventId)\n}\n\n// ---------------------------------------------------------------------------\n// Collect matching subscribers\n// ---------------------------------------------------------------------------\n\nexport function collectSyncSubscribers(\n  allSyncSubscribers: SyncSubscriberEntry[],\n  eventId: string,\n): SyncSubscriberEntry[] {\n  return allSyncSubscribers\n    .filter((s) => matchesEventPattern(s.metadata.event, eventId))\n    .sort((a, b) => (a.metadata.priority ?? 50) - (b.metadata.priority ?? 50))\n}\n\n// ---------------------------------------------------------------------------\n// Run sync before-event subscribers\n// ---------------------------------------------------------------------------\n\nexport async function runSyncBeforeEvent(\n  subscribers: SyncSubscriberEntry[],\n  payload: SyncCrudEventPayload,\n  ctx: { resolve: <T = unknown>(name: string) => T },\n): Promise<{ ok: boolean; errorBody?: Record<string, unknown>; errorStatus?: number; modifiedPayload?: Record<string, unknown> }> {\n  let currentPayload = payload.payload\n\n  for (const subscriber of subscribers) {\n    const result = await subscriber.handler({ ...payload, payload: currentPayload }, ctx)\n\n    if (result?.ok === false) {\n      const body = result.body ?? { error: result.message ?? 'Operation blocked', subscriberId: subscriber.metadata.id }\n      return { ok: false, errorBody: body, errorStatus: result.status ?? 422 }\n    }\n\n    if (result?.modifiedPayload) {\n      currentPayload = { ...currentPayload, ...result.modifiedPayload }\n    }\n  }\n\n  return { ok: true, modifiedPayload: currentPayload !== payload.payload ? currentPayload : undefined }\n}\n\n// ---------------------------------------------------------------------------\n// Run sync after-event subscribers\n// ---------------------------------------------------------------------------\n\nexport async function runSyncAfterEvent(\n  subscribers: SyncSubscriberEntry[],\n  payload: SyncCrudEventPayload,\n  ctx: { resolve: <T = unknown>(name: string) => T },\n): Promise<void> {\n  for (const subscriber of subscribers) {\n    try {\n      await subscriber.handler(payload, ctx)\n    } catch (error) {\n      console.error(`[sync-event] after-subscriber failed: ${subscriber.metadata.id}`, error)\n    }\n  }\n}\n"],
-  "mappings": "AAOA,SAAS,YAAY,OAAuB;AAE1C,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEO,SAAS,oBAAoB,SAAiB,SAA0B;AAC7E,MAAI,YAAY,QAAS,QAAO;AAChC,MAAI,YAAY,IAAK,QAAO;AAE5B,QAAM,UAAU,YAAY,OAAO,EAAE,QAAQ,SAAS,IAAI;AAC1D,QAAM,QAAQ,IAAI,OAAO,MAAM,UAAU,GAAG;AAC5C,SAAO,MAAM,KAAK,OAAO;AAC3B;AAMO,SAAS,uBACd,oBACA,SACuB;AACvB,SAAO,mBACJ,OAAO,CAAC,MAAM,oBAAoB,EAAE,SAAS,OAAO,OAAO,CAAC,EAC5D,KAAK,CAAC,GAAG,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,SAAS,YAAY,GAAG;AAC7E;AAMA,eAAsB,mBACpB,aACA,SACA,KACgI;AAChI,MAAI,iBAAiB,QAAQ;AAE7B,aAAW,cAAc,aAAa;AACpC,UAAM,SAAS,MAAM,WAAW,QAAQ,EAAE,GAAG,SAAS,SAAS,eAAe,GAAG,GAAG;AAEpF,QAAI,QAAQ,OAAO,OAAO;AACxB,YAAM,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,WAAW,qBAAqB,cAAc,WAAW,SAAS,GAAG;AACjH,aAAO,EAAE,IAAI,OAAO,WAAW,MAAM,aAAa,OAAO,UAAU,IAAI;AAAA,IACzE;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,uBAAiB,EAAE,GAAG,gBAAgB,GAAG,OAAO,gBAAgB;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,iBAAiB,mBAAmB,QAAQ,UAAU,iBAAiB,OAAU;AACtG;AAMA,eAAsB,kBACpB,aACA,SACA,KACe;AACf,aAAW,cAAc,aAAa;AACpC,QAAI;AACF,YAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,IACvC,SAAS,OAAO;AACd,cAAQ,MAAM,yCAAyC,WAAW,SAAS,EAAE,IAAI,KAAK;AAAA,IACxF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { SyncCrudEventPayload } from './sync-event-types'\nimport type { SyncSubscriberEntry } from './sync-subscriber-store'\nimport { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'\n\n// ---------------------------------------------------------------------------\n// Event pattern matching\n// ---------------------------------------------------------------------------\n\nexport function matchesEventPattern(pattern: string, eventId: string): boolean {\n  return matchWildcardPattern(eventId, pattern)\n}\n\n// ---------------------------------------------------------------------------\n// Collect matching subscribers\n// ---------------------------------------------------------------------------\n\nexport function collectSyncSubscribers(\n  allSyncSubscribers: SyncSubscriberEntry[],\n  eventId: string,\n): SyncSubscriberEntry[] {\n  return allSyncSubscribers\n    .filter((s) => matchesEventPattern(s.metadata.event, eventId))\n    .sort((a, b) => (a.metadata.priority ?? 50) - (b.metadata.priority ?? 50))\n}\n\n// ---------------------------------------------------------------------------\n// Run sync before-event subscribers\n// ---------------------------------------------------------------------------\n\nexport async function runSyncBeforeEvent(\n  subscribers: SyncSubscriberEntry[],\n  payload: SyncCrudEventPayload,\n  ctx: { resolve: <T = unknown>(name: string) => T },\n): Promise<{ ok: boolean; errorBody?: Record<string, unknown>; errorStatus?: number; modifiedPayload?: Record<string, unknown> }> {\n  let currentPayload = payload.payload\n\n  for (const subscriber of subscribers) {\n    const result = await subscriber.handler({ ...payload, payload: currentPayload }, ctx)\n\n    if (result?.ok === false) {\n      const body = result.body ?? { error: result.message ?? 'Operation blocked', subscriberId: subscriber.metadata.id }\n      return { ok: false, errorBody: body, errorStatus: result.status ?? 422 }\n    }\n\n    if (result?.modifiedPayload) {\n      currentPayload = { ...currentPayload, ...result.modifiedPayload }\n    }\n  }\n\n  return { ok: true, modifiedPayload: currentPayload !== payload.payload ? currentPayload : undefined }\n}\n\n// ---------------------------------------------------------------------------\n// Run sync after-event subscribers\n// ---------------------------------------------------------------------------\n\nexport async function runSyncAfterEvent(\n  subscribers: SyncSubscriberEntry[],\n  payload: SyncCrudEventPayload,\n  ctx: { resolve: <T = unknown>(name: string) => T },\n): Promise<void> {\n  for (const subscriber of subscribers) {\n    try {\n      await subscriber.handler(payload, ctx)\n    } catch (error) {\n      console.error(`[sync-event] after-subscriber failed: ${subscriber.metadata.id}`, error)\n    }\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,4BAA4B;AAM9B,SAAS,oBAAoB,SAAiB,SAA0B;AAC7E,SAAO,qBAAqB,SAAS,OAAO;AAC9C;AAMO,SAAS,uBACd,oBACA,SACuB;AACvB,SAAO,mBACJ,OAAO,CAAC,MAAM,oBAAoB,EAAE,SAAS,OAAO,OAAO,CAAC,EAC5D,KAAK,CAAC,GAAG,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,SAAS,YAAY,GAAG;AAC7E;AAMA,eAAsB,mBACpB,aACA,SACA,KACgI;AAChI,MAAI,iBAAiB,QAAQ;AAE7B,aAAW,cAAc,aAAa;AACpC,UAAM,SAAS,MAAM,WAAW,QAAQ,EAAE,GAAG,SAAS,SAAS,eAAe,GAAG,GAAG;AAEpF,QAAI,QAAQ,OAAO,OAAO;AACxB,YAAM,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,WAAW,qBAAqB,cAAc,WAAW,SAAS,GAAG;AACjH,aAAO,EAAE,IAAI,OAAO,WAAW,MAAM,aAAa,OAAO,UAAU,IAAI;AAAA,IACzE;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,uBAAiB,EAAE,GAAG,gBAAgB,GAAG,OAAO,gBAAgB;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,iBAAiB,mBAAmB,QAAQ,UAAU,iBAAiB,OAAU;AACtG;AAMA,eAAsB,kBACpB,aACA,SACA,KACe;AACf,aAAW,cAAc,aAAa;AACpC,QAAI;AACF,YAAM,WAAW,QAAQ,SAAS,GAAG;AAAA,IACvC,SAAS,OAAO;AACd,cAAQ,MAAM,yCAAyC,WAAW,SAAS,EAAE,IAAI,KAAK;AAAA,IACxF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/lib/events/patterns.js

@@ -1,12 +1,4 @@
-const singleSegmentPatternCache = /* @__PURE__ */ new Map();
-function getSingleSegmentPatternRegex(pattern) {
-  const existing = singleSegmentPatternCache.get(pattern);
-  if (existing) return existing;
-  const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^.]+");
-  const compiled = new RegExp(`^${regexPattern}$`);
-  singleSegmentPatternCache.set(pattern, compiled);
-  return compiled;
-}
+import { matchWildcardPattern } from "@open-mercato/shared/lib/patterns/wildcard";
 function matchEventPattern(eventName, pattern, options) {
   const mode = options?.mode ?? "single-segment";
   if (pattern === "*") return true;
@@ -23,7 +15,7 @@ function matchEventPattern(eventName, pattern, options) {
     }
     return false;
   }
-  return getSingleSegmentPatternRegex(pattern).test(eventName);
+  return matchWildcardPattern(eventName, pattern, { singleSegmentWildcard: true });
 }
 function matchAnyEventPattern(eventName, patterns, options) {
   for (const pattern of patterns) {

package/dist/lib/events/patterns.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/events/patterns.ts"],
-  "sourcesContent": ["export type EventPatternMode = 'single-segment' | 'prefix'\n\ntype MatchEventPatternOptions = {\n  mode?: EventPatternMode\n}\n\nconst singleSegmentPatternCache = new Map<string, RegExp>()\n\nfunction getSingleSegmentPatternRegex(pattern: string): RegExp {\n  const existing = singleSegmentPatternCache.get(pattern)\n  if (existing) return existing\n\n  const regexPattern = pattern\n    .replace(/[.+^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*/g, '[^.]+')\n\n  const compiled = new RegExp(`^${regexPattern}$`)\n  singleSegmentPatternCache.set(pattern, compiled)\n  return compiled\n}\n\nexport function matchEventPattern(\n  eventName: string,\n  pattern: string,\n  options?: MatchEventPatternOptions,\n): boolean {\n  const mode = options?.mode ?? 'single-segment'\n\n  if (pattern === '*') return true\n  if (pattern === eventName) return true\n  if (!pattern.includes('*')) return false\n\n  if (mode === 'prefix') {\n    if (pattern.endsWith('.*')) {\n      const prefix = pattern.slice(0, -2)\n      return eventName.startsWith(prefix + '.')\n    }\n\n    if (pattern.endsWith('*')) {\n      const prefix = pattern.slice(0, -1)\n      return eventName.startsWith(prefix)\n    }\n\n    return false\n  }\n\n  return getSingleSegmentPatternRegex(pattern).test(eventName)\n}\n\nexport function matchAnyEventPattern(\n  eventName: string,\n  patterns: Iterable<string>,\n  options?: MatchEventPatternOptions,\n): boolean {\n  for (const pattern of patterns) {\n    if (matchEventPattern(eventName, pattern, options)) {\n      return true\n    }\n  }\n\n  return false\n}\n\nexport function matchWebhookEventPattern(eventName: string, pattern: string): boolean {\n  return matchEventPattern(eventName, pattern, { mode: 'prefix' })\n}\n\nexport function matchAnyWebhookEventPattern(eventName: string, patterns: Iterable<string>): boolean {\n  return matchAnyEventPattern(eventName, patterns, { mode: 'prefix' })\n}\n"],
-  "mappings": "AAMA,MAAM,4BAA4B,oBAAI,IAAoB;AAE1D,SAAS,6BAA6B,SAAyB;AAC7D,QAAM,WAAW,0BAA0B,IAAI,OAAO;AACtD,MAAI,SAAU,QAAO;AAErB,QAAM,eAAe,QAClB,QAAQ,qBAAqB,MAAM,EACnC,QAAQ,OAAO,OAAO;AAEzB,QAAM,WAAW,IAAI,OAAO,IAAI,YAAY,GAAG;AAC/C,4BAA0B,IAAI,SAAS,QAAQ;AAC/C,SAAO;AACT;AAEO,SAAS,kBACd,WACA,SACA,SACS;AACT,QAAM,OAAO,SAAS,QAAQ;AAE9B,MAAI,YAAY,IAAK,QAAO;AAC5B,MAAI,YAAY,UAAW,QAAO;AAClC,MAAI,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAEnC,MAAI,SAAS,UAAU;AACrB,QAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,aAAO,UAAU,WAAW,SAAS,GAAG;AAAA,IAC1C;AAEA,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,aAAO,UAAU,WAAW,MAAM;AAAA,IACpC;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,6BAA6B,OAAO,EAAE,KAAK,SAAS;AAC7D;AAEO,SAAS,qBACd,WACA,UACA,SACS;AACT,aAAW,WAAW,UAAU;AAC9B,QAAI,kBAAkB,WAAW,SAAS,OAAO,GAAG;AAClD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,yBAAyB,WAAmB,SAA0B;AACpF,SAAO,kBAAkB,WAAW,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE;AAEO,SAAS,4BAA4B,WAAmB,UAAqC;AAClG,SAAO,qBAAqB,WAAW,UAAU,EAAE,MAAM,SAAS,CAAC;AACrE;",
+  "sourcesContent": ["import { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'\n\nexport type EventPatternMode = 'single-segment' | 'prefix'\n\ntype MatchEventPatternOptions = {\n  mode?: EventPatternMode\n}\n\nexport function matchEventPattern(\n  eventName: string,\n  pattern: string,\n  options?: MatchEventPatternOptions,\n): boolean {\n  const mode = options?.mode ?? 'single-segment'\n\n  if (pattern === '*') return true\n  if (pattern === eventName) return true\n  if (!pattern.includes('*')) return false\n\n  if (mode === 'prefix') {\n    if (pattern.endsWith('.*')) {\n      const prefix = pattern.slice(0, -2)\n      return eventName.startsWith(prefix + '.')\n    }\n\n    if (pattern.endsWith('*')) {\n      const prefix = pattern.slice(0, -1)\n      return eventName.startsWith(prefix)\n    }\n\n    return false\n  }\n\n  return matchWildcardPattern(eventName, pattern, { singleSegmentWildcard: true })\n}\n\nexport function matchAnyEventPattern(\n  eventName: string,\n  patterns: Iterable<string>,\n  options?: MatchEventPatternOptions,\n): boolean {\n  for (const pattern of patterns) {\n    if (matchEventPattern(eventName, pattern, options)) {\n      return true\n    }\n  }\n\n  return false\n}\n\nexport function matchWebhookEventPattern(eventName: string, pattern: string): boolean {\n  return matchEventPattern(eventName, pattern, { mode: 'prefix' })\n}\n\nexport function matchAnyWebhookEventPattern(eventName: string, patterns: Iterable<string>): boolean {\n  return matchAnyEventPattern(eventName, patterns, { mode: 'prefix' })\n}\n"],
+  "mappings": "AAAA,SAAS,4BAA4B;AAQ9B,SAAS,kBACd,WACA,SACA,SACS;AACT,QAAM,OAAO,SAAS,QAAQ;AAE9B,MAAI,YAAY,IAAK,QAAO;AAC5B,MAAI,YAAY,UAAW,QAAO;AAClC,MAAI,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAEnC,MAAI,SAAS,UAAU;AACrB,QAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,aAAO,UAAU,WAAW,SAAS,GAAG;AAAA,IAC1C;AAEA,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,YAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,aAAO,UAAU,WAAW,MAAM;AAAA,IACpC;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,qBAAqB,WAAW,SAAS,EAAE,uBAAuB,KAAK,CAAC;AACjF;AAEO,SAAS,qBACd,WACA,UACA,SACS;AACT,aAAW,WAAW,UAAU;AAC9B,QAAI,kBAAkB,WAAW,SAAS,OAAO,GAAG;AAClD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,yBAAyB,WAAmB,SAA0B;AACpF,SAAO,kBAAkB,WAAW,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE;AAEO,SAAS,4BAA4B,WAAmB,UAAqC;AAClG,SAAO,qBAAqB,WAAW,UAAU,EAAE,MAAM,SAAS,CAAC;AACrE;",
   "names": []
 }

package/dist/lib/patterns/wildcard.js

@@ -0,0 +1,42 @@
+function matchWildcardSegment(pattern, value, options) {
+  let patternIndex = 0;
+  let valueIndex = 0;
+  let starIndex = -1;
+  let valueRetryIndex = 0;
+  while (valueIndex < value.length) {
+    const patternChar = pattern[patternIndex];
+    const valueChar = value[valueIndex];
+    if (patternChar === "*") {
+      starIndex = patternIndex;
+      valueRetryIndex = valueIndex;
+      patternIndex += 1;
+      continue;
+    }
+    if (patternChar === valueChar) {
+      patternIndex += 1;
+      valueIndex += 1;
+      continue;
+    }
+    if (starIndex !== -1 && (!options.singleSegmentWildcard || value[valueRetryIndex] !== ".")) {
+      patternIndex = starIndex + 1;
+      valueRetryIndex += 1;
+      valueIndex = valueRetryIndex;
+      continue;
+    }
+    return false;
+  }
+  while (pattern[patternIndex] === "*") {
+    patternIndex += 1;
+  }
+  return patternIndex === pattern.length;
+}
+function matchWildcardPattern(value, pattern, options = {}) {
+  if (pattern === value) return true;
+  if (pattern === "*") return true;
+  if (!pattern.includes("*")) return false;
+  return matchWildcardSegment(pattern, value, options);
+}
+export {
+  matchWildcardPattern
+};
+//# sourceMappingURL=wildcard.js.map

package/dist/lib/patterns/wildcard.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/patterns/wildcard.ts"],
+  "sourcesContent": ["export type WildcardMatchOptions = {\n  singleSegmentWildcard?: boolean\n}\n\nfunction matchWildcardSegment(pattern: string, value: string, options: WildcardMatchOptions): boolean {\n  let patternIndex = 0\n  let valueIndex = 0\n  let starIndex = -1\n  let valueRetryIndex = 0\n\n  while (valueIndex < value.length) {\n    const patternChar = pattern[patternIndex]\n    const valueChar = value[valueIndex]\n\n    if (patternChar === '*') {\n      starIndex = patternIndex\n      valueRetryIndex = valueIndex\n      patternIndex += 1\n      continue\n    }\n\n    if (patternChar === valueChar) {\n      patternIndex += 1\n      valueIndex += 1\n      continue\n    }\n\n    if (\n      starIndex !== -1\n      && (!options.singleSegmentWildcard || value[valueRetryIndex] !== '.')\n    ) {\n      patternIndex = starIndex + 1\n      valueRetryIndex += 1\n      valueIndex = valueRetryIndex\n      continue\n    }\n\n    return false\n  }\n\n  while (pattern[patternIndex] === '*') {\n    patternIndex += 1\n  }\n\n  return patternIndex === pattern.length\n}\n\nexport function matchWildcardPattern(\n  value: string,\n  pattern: string,\n  options: WildcardMatchOptions = {},\n): boolean {\n  if (pattern === value) return true\n  if (pattern === '*') return true\n  if (!pattern.includes('*')) return false\n\n  return matchWildcardSegment(pattern, value, options)\n}\n\n"],
+  "mappings": "AAIA,SAAS,qBAAqB,SAAiB,OAAe,SAAwC;AACpG,MAAI,eAAe;AACnB,MAAI,aAAa;AACjB,MAAI,YAAY;AAChB,MAAI,kBAAkB;AAEtB,SAAO,aAAa,MAAM,QAAQ;AAChC,UAAM,cAAc,QAAQ,YAAY;AACxC,UAAM,YAAY,MAAM,UAAU;AAElC,QAAI,gBAAgB,KAAK;AACvB,kBAAY;AACZ,wBAAkB;AAClB,sBAAgB;AAChB;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW;AAC7B,sBAAgB;AAChB,oBAAc;AACd;AAAA,IACF;AAEA,QACE,cAAc,OACV,CAAC,QAAQ,yBAAyB,MAAM,eAAe,MAAM,MACjE;AACA,qBAAe,YAAY;AAC3B,yBAAmB;AACnB,mBAAa;AACb;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,YAAY,MAAM,KAAK;AACpC,oBAAgB;AAAA,EAClB;AAEA,SAAO,iBAAiB,QAAQ;AAClC;AAEO,SAAS,qBACd,OACA,SACA,UAAgC,CAAC,GACxB;AACT,MAAI,YAAY,MAAO,QAAO;AAC9B,MAAI,YAAY,IAAK,QAAO;AAC5B,MAAI,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAEnC,SAAO,qBAAqB,SAAS,OAAO,OAAO;AACrD;",
+  "names": []
+}

package/dist/lib/regex/linear.js

@@ -0,0 +1,31 @@
+import { RE2JS } from "re2js";
+const DEFAULT_MAX_PATTERN_LENGTH = 500;
+const DEFAULT_MAX_INPUT_LENGTH = 1e4;
+const MAX_REGEX_CACHE_SIZE = 256;
+const compiledRegexCache = /* @__PURE__ */ new Map();
+function getCachedRegex(pattern) {
+  const cached = compiledRegexCache.get(pattern);
+  if (cached) return cached;
+  const compiled = RE2JS.compile(pattern);
+  if (compiledRegexCache.size >= MAX_REGEX_CACHE_SIZE) {
+    const oldestKey = compiledRegexCache.keys().next().value;
+    if (oldestKey) compiledRegexCache.delete(oldestKey);
+  }
+  compiledRegexCache.set(pattern, compiled);
+  return compiled;
+}
+function testLinearRegex(pattern, input, options = {}) {
+  const maxPatternLength = options.maxPatternLength ?? DEFAULT_MAX_PATTERN_LENGTH;
+  const maxInputLength = options.maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH;
+  if (pattern.length > maxPatternLength) return { ok: false, reason: "pattern_too_long" };
+  if (input.length > maxInputLength) return { ok: false, reason: "input_too_long" };
+  try {
+    return { ok: true, matched: getCachedRegex(pattern).test(input) };
+  } catch {
+    return { ok: false, reason: "invalid_pattern" };
+  }
+}
+export {
+  testLinearRegex
+};
+//# sourceMappingURL=linear.js.map

package/dist/lib/regex/linear.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/regex/linear.ts"],
+  "sourcesContent": ["import { RE2JS } from 're2js'\n\nconst DEFAULT_MAX_PATTERN_LENGTH = 500\nconst DEFAULT_MAX_INPUT_LENGTH = 10_000\nconst MAX_REGEX_CACHE_SIZE = 256\n\nconst compiledRegexCache = new Map<string, RE2JS>()\n\nexport type LinearRegexTestOptions = {\n  maxPatternLength?: number\n  maxInputLength?: number\n}\n\nexport type LinearRegexTestResult =\n  | { ok: true; matched: boolean }\n  | { ok: false; reason: 'pattern_too_long' | 'input_too_long' | 'invalid_pattern' }\n\nfunction getCachedRegex(pattern: string): RE2JS {\n  const cached = compiledRegexCache.get(pattern)\n  if (cached) return cached\n\n  const compiled = RE2JS.compile(pattern)\n  if (compiledRegexCache.size >= MAX_REGEX_CACHE_SIZE) {\n    const oldestKey = compiledRegexCache.keys().next().value\n    if (oldestKey) compiledRegexCache.delete(oldestKey)\n  }\n  compiledRegexCache.set(pattern, compiled)\n  return compiled\n}\n\nexport function testLinearRegex(\n  pattern: string,\n  input: string,\n  options: LinearRegexTestOptions = {},\n): LinearRegexTestResult {\n  const maxPatternLength = options.maxPatternLength ?? DEFAULT_MAX_PATTERN_LENGTH\n  const maxInputLength = options.maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH\n\n  if (pattern.length > maxPatternLength) return { ok: false, reason: 'pattern_too_long' }\n  if (input.length > maxInputLength) return { ok: false, reason: 'input_too_long' }\n\n  try {\n    return { ok: true, matched: getCachedRegex(pattern).test(input) }\n  } catch {\n    return { ok: false, reason: 'invalid_pattern' }\n  }\n}\n\n"],
+  "mappings": "AAAA,SAAS,aAAa;AAEtB,MAAM,6BAA6B;AACnC,MAAM,2BAA2B;AACjC,MAAM,uBAAuB;AAE7B,MAAM,qBAAqB,oBAAI,IAAmB;AAWlD,SAAS,eAAe,SAAwB;AAC9C,QAAM,SAAS,mBAAmB,IAAI,OAAO;AAC7C,MAAI,OAAQ,QAAO;AAEnB,QAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,MAAI,mBAAmB,QAAQ,sBAAsB;AACnD,UAAM,YAAY,mBAAmB,KAAK,EAAE,KAAK,EAAE;AACnD,QAAI,UAAW,oBAAmB,OAAO,SAAS;AAAA,EACpD;AACA,qBAAmB,IAAI,SAAS,QAAQ;AACxC,SAAO;AACT;AAEO,SAAS,gBACd,SACA,OACA,UAAkC,CAAC,GACZ;AACvB,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,MAAI,QAAQ,SAAS,iBAAkB,QAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB;AACtF,MAAI,MAAM,SAAS,eAAgB,QAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAEhF,MAAI;AACF,WAAO,EAAE,IAAI,MAAM,SAAS,eAAe,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,EAClE,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;AAAA,EAChD;AACF;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.3-develop.3525.3.cc18b8a43f";
+const APP_VERSION = "0.6.3-develop.3574.1.f3c5dcf345";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.3-develop.3525.3.cc18b8a43f'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.3-develop.3574.1.f3c5dcf345'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/entities/validation.js

@@ -1,4 +1,7 @@
 import { z } from "zod";
+import { testLinearRegex } from "../../lib/regex/linear.js";
+const MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH = 500;
+const MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH = 1e4;
 const VALIDATION_RULES = [
   "required",
   "date",
@@ -23,7 +26,11 @@ const validationRuleSchema = z.discriminatedUnion("rule", [
   z.object({ rule: z.literal("gte"), param: z.number(), message: z.string().min(1) }),
   z.object({ rule: z.literal("eq"), param: z.any(), message: z.string().min(1) }),
   z.object({ rule: z.literal("ne"), param: z.any(), message: z.string().min(1) }),
-  z.object({ rule: z.literal("regex"), param: z.string().min(1), message: z.string().min(1) })
+  z.object({
+    rule: z.literal("regex"),
+    param: z.string().min(1),
+    message: z.string().min(1)
+  })
 ]);
 const validationRulesArraySchema = z.array(validationRuleSchema).max(32);
 function evalRule(rule, value, kind) {
@@ -66,12 +73,11 @@ function evalRule(rule, value, kind) {
       return value !== rule.param ? null : rule.message;
     case "regex":
       if (isEmpty(value)) return null;
-      try {
-        const re = new RegExp(rule.param);
-        return re.test(String(value)) ? null : rule.message;
-      } catch {
-        return rule.message;
-      }
+      const regexResult = testLinearRegex(String(rule.param), String(value), {
+        maxPatternLength: MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,
+        maxInputLength: MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH
+      });
+      return regexResult.ok && regexResult.matched ? null : rule.message;
     default:
       return null;
   }
@@ -94,6 +100,8 @@ function validateValuesAgainstDefs(values, defs) {
   return { ok: Object.keys(errors).length === 0, fieldErrors: errors };
 }
 export {
+  MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH,
+  MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,
   VALIDATION_RULES,
   validateValuesAgainstDefs,
   validationRuleSchema,

package/dist/modules/entities/validation.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/entities/validation.ts"],
-  "sourcesContent": ["import { z } from 'zod'\n\n// Supported rule types for custom fields validation\nexport const VALIDATION_RULES = [\n  'required',\n  'date',\n  'integer',\n  'float',\n  'lt',\n  'lte',\n  'gt',\n  'gte',\n  'eq',\n  'ne',\n  'regex',\n] as const\n\nexport type ValidationRuleKind = typeof VALIDATION_RULES[number]\n\nexport const validationRuleSchema = z.discriminatedUnion('rule', [\n  z.object({ rule: z.literal('required'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('date'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('integer'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('float'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('lt'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('lte'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('gt'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('gte'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('eq'), param: z.any(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('ne'), param: z.any(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('regex'), param: z.string().min(1), message: z.string().min(1) }),\n])\n\nexport type ValidationRule = z.infer<typeof validationRuleSchema>\n\nexport const validationRulesArraySchema = z.array(validationRuleSchema).max(32)\n\nexport type CustomFieldDefLike = {\n  key: string\n  kind: string\n  configJson?: any\n}\n\n// Evaluate a single rule against a value\nfunction evalRule(rule: ValidationRule, value: any, kind: string): string | null {\n  const isEmpty = (v: any) => v == null || (typeof v === 'string' && v.trim() === '') || (Array.isArray(v) && v.length === 0)\n\n  switch (rule.rule) {\n    case 'required':\n      return isEmpty(value) ? rule.message : null\n    case 'date': {\n      if (isEmpty(value)) return null\n      const d = new Date(String(value))\n      return isNaN(d.getTime()) ? rule.message : null\n    }\n    case 'integer': {\n      if (isEmpty(value)) return null\n      const n = Number(value)\n      return Number.isInteger(n) ? null : rule.message\n    }\n    case 'float': {\n      if (isEmpty(value)) return null\n      const n = Number(value)\n      return Number.isFinite(n) ? null : rule.message\n    }\n    case 'lt':\n      if (isEmpty(value)) return null\n      return Number(value) < (rule as any).param ? null : rule.message\n    case 'lte':\n      if (isEmpty(value)) return null\n      return Number(value) <= (rule as any).param ? null : rule.message\n    case 'gt':\n      if (isEmpty(value)) return null\n      return Number(value) > (rule as any).param ? null : rule.message\n    case 'gte':\n      if (isEmpty(value)) return null\n      return Number(value) >= (rule as any).param ? null : rule.message\n    case 'eq':\n      if (isEmpty(value)) return null\n      return value === (rule as any).param ? null : rule.message\n    case 'ne':\n      if (isEmpty(value)) return null\n      return value !== (rule as any).param ? null : rule.message\n    case 'regex':\n      if (isEmpty(value)) return null\n      try {\n        const re = new RegExp((rule as any).param)\n        return re.test(String(value)) ? null : rule.message\n      } catch {\n        // Invalid regex in definition: consider it failed safe and return message\n        return rule.message\n      }\n    default:\n      return null\n  }\n}\n\nexport function validateValuesAgainstDefs(\n  values: Record<string, any>,\n  defs: CustomFieldDefLike[],\n): { ok: boolean; fieldErrors: Record<string, string> } {\n  const errors: Record<string, string> = {}\n  for (const def of defs) {\n    const cfg = def?.configJson || {}\n    const rules: ValidationRule[] = Array.isArray(cfg.validation) ? cfg.validation : []\n    if (rules.length === 0) continue\n    const value = values[def.key]\n    for (const r of rules) {\n      const msg = evalRule(r as any, value, def.kind)\n      if (msg) {\n        errors[`cf_${def.key}`] = msg\n        break\n      }\n    }\n  }\n  return { ok: Object.keys(errors).length === 0, fieldErrors: errors }\n}\n\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGX,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,MAAM,uBAAuB,EAAE,mBAAmB,QAAQ;AAAA,EAC/D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACpE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAChE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACnE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAClF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAClF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC9E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC9E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7F,CAAC;AAIM,MAAM,6BAA6B,EAAE,MAAM,oBAAoB,EAAE,IAAI,EAAE;AAS9E,SAAS,SAAS,MAAsB,OAAY,MAA6B;AAC/E,QAAM,UAAU,CAAC,MAAW,KAAK,QAAS,OAAO,MAAM,YAAY,EAAE,KAAK,MAAM,MAAQ,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW;AAEzH,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,QAAQ,KAAK,IAAI,KAAK,UAAU;AAAA,IACzC,KAAK,QAAQ;AACX,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,IAAI,IAAI,KAAK,OAAO,KAAK,CAAC;AAChC,aAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU;AAAA,IAC7C;AAAA,IACA,KAAK,WAAW;AACd,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,IAAI,OAAO,KAAK;AACtB,aAAO,OAAO,UAAU,CAAC,IAAI,OAAO,KAAK;AAAA,IAC3C;AAAA,IACA,KAAK,SAAS;AACZ,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,IAAI,OAAO,KAAK;AACtB,aAAO,OAAO,SAAS,CAAC,IAAI,OAAO,KAAK;AAAA,IAC1C;AAAA,IACA,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,IAAK,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC3D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,KAAM,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC5D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,IAAK,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC3D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,KAAM,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC5D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,UAAW,KAAa,QAAQ,OAAO,KAAK;AAAA,IACrD,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,UAAW,KAAa,QAAQ,OAAO,KAAK;AAAA,IACrD,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,UAAI;AACF,cAAM,KAAK,IAAI,OAAQ,KAAa,KAAK;AACzC,eAAO,GAAG,KAAK,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK;AAAA,MAC9C,QAAQ;AAEN,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,0BACd,QACA,MACsD;AACtD,QAAM,SAAiC,CAAC;AACxC,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,KAAK,cAAc,CAAC;AAChC,UAAM,QAA0B,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC;AAClF,QAAI,MAAM,WAAW,EAAG;AACxB,UAAM,QAAQ,OAAO,IAAI,GAAG;AAC5B,eAAW,KAAK,OAAO;AACrB,YAAM,MAAM,SAAS,GAAU,OAAO,IAAI,IAAI;AAC9C,UAAI,KAAK;AACP,eAAO,MAAM,IAAI,GAAG,EAAE,IAAI;AAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG,aAAa,OAAO;AACrE;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { testLinearRegex } from '../../lib/regex/linear'\n\nexport const MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH = 500\nexport const MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH = 10_000\n\n// Supported rule types for custom fields validation\nexport const VALIDATION_RULES = [\n  'required',\n  'date',\n  'integer',\n  'float',\n  'lt',\n  'lte',\n  'gt',\n  'gte',\n  'eq',\n  'ne',\n  'regex',\n] as const\n\nexport type ValidationRuleKind = typeof VALIDATION_RULES[number]\n\nexport const validationRuleSchema = z.discriminatedUnion('rule', [\n  z.object({ rule: z.literal('required'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('date'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('integer'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('float'), message: z.string().min(1) }),\n  z.object({ rule: z.literal('lt'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('lte'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('gt'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('gte'), param: z.number(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('eq'), param: z.any(), message: z.string().min(1) }),\n  z.object({ rule: z.literal('ne'), param: z.any(), message: z.string().min(1) }),\n  z.object({\n    rule: z.literal('regex'),\n    param: z.string().min(1),\n    message: z.string().min(1),\n  }),\n])\n\nexport type ValidationRule = z.infer<typeof validationRuleSchema>\n\nexport const validationRulesArraySchema = z.array(validationRuleSchema).max(32)\n\nexport type CustomFieldDefLike = {\n  key: string\n  kind: string\n  configJson?: any\n}\n\n// Evaluate a single rule against a value\nfunction evalRule(rule: ValidationRule, value: any, kind: string): string | null {\n  const isEmpty = (v: any) => v == null || (typeof v === 'string' && v.trim() === '') || (Array.isArray(v) && v.length === 0)\n\n  switch (rule.rule) {\n    case 'required':\n      return isEmpty(value) ? rule.message : null\n    case 'date': {\n      if (isEmpty(value)) return null\n      const d = new Date(String(value))\n      return isNaN(d.getTime()) ? rule.message : null\n    }\n    case 'integer': {\n      if (isEmpty(value)) return null\n      const n = Number(value)\n      return Number.isInteger(n) ? null : rule.message\n    }\n    case 'float': {\n      if (isEmpty(value)) return null\n      const n = Number(value)\n      return Number.isFinite(n) ? null : rule.message\n    }\n    case 'lt':\n      if (isEmpty(value)) return null\n      return Number(value) < (rule as any).param ? null : rule.message\n    case 'lte':\n      if (isEmpty(value)) return null\n      return Number(value) <= (rule as any).param ? null : rule.message\n    case 'gt':\n      if (isEmpty(value)) return null\n      return Number(value) > (rule as any).param ? null : rule.message\n    case 'gte':\n      if (isEmpty(value)) return null\n      return Number(value) >= (rule as any).param ? null : rule.message\n    case 'eq':\n      if (isEmpty(value)) return null\n      return value === (rule as any).param ? null : rule.message\n    case 'ne':\n      if (isEmpty(value)) return null\n      return value !== (rule as any).param ? null : rule.message\n    case 'regex':\n      if (isEmpty(value)) return null\n      const regexResult = testLinearRegex(String((rule as any).param), String(value), {\n        maxPatternLength: MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,\n        maxInputLength: MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH,\n      })\n      return regexResult.ok && regexResult.matched ? null : rule.message\n    default:\n      return null\n  }\n}\n\nexport function validateValuesAgainstDefs(\n  values: Record<string, any>,\n  defs: CustomFieldDefLike[],\n): { ok: boolean; fieldErrors: Record<string, string> } {\n  const errors: Record<string, string> = {}\n  for (const def of defs) {\n    const cfg = def?.configJson || {}\n    const rules: ValidationRule[] = Array.isArray(cfg.validation) ? cfg.validation : []\n    if (rules.length === 0) continue\n    const value = values[def.key]\n    for (const r of rules) {\n      const msg = evalRule(r as any, value, def.kind)\n      if (msg) {\n        errors[`cf_${def.key}`] = msg\n        break\n      }\n    }\n  }\n  return { ok: Object.keys(errors).length === 0, fieldErrors: errors }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAEzB,MAAM,wCAAwC;AAC9C,MAAM,sCAAsC;AAG5C,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,MAAM,uBAAuB,EAAE,mBAAmB,QAAQ;AAAA,EAC/D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACpE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAChE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACnE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAClF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAClF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC9E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC9E,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,CAAC;AACH,CAAC;AAIM,MAAM,6BAA6B,EAAE,MAAM,oBAAoB,EAAE,IAAI,EAAE;AAS9E,SAAS,SAAS,MAAsB,OAAY,MAA6B;AAC/E,QAAM,UAAU,CAAC,MAAW,KAAK,QAAS,OAAO,MAAM,YAAY,EAAE,KAAK,MAAM,MAAQ,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW;AAEzH,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,QAAQ,KAAK,IAAI,KAAK,UAAU;AAAA,IACzC,KAAK,QAAQ;AACX,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,IAAI,IAAI,KAAK,OAAO,KAAK,CAAC;AAChC,aAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU;AAAA,IAC7C;AAAA,IACA,KAAK,WAAW;AACd,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,IAAI,OAAO,KAAK;AACtB,aAAO,OAAO,UAAU,CAAC,IAAI,OAAO,KAAK;AAAA,IAC3C;AAAA,IACA,KAAK,SAAS;AACZ,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,IAAI,OAAO,KAAK;AACtB,aAAO,OAAO,SAAS,CAAC,IAAI,OAAO,KAAK;AAAA,IAC1C;AAAA,IACA,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,IAAK,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC3D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,KAAM,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC5D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,IAAK,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC3D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,OAAO,KAAK,KAAM,KAAa,QAAQ,OAAO,KAAK;AAAA,IAC5D,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,UAAW,KAAa,QAAQ,OAAO,KAAK;AAAA,IACrD,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,aAAO,UAAW,KAAa,QAAQ,OAAO,KAAK;AAAA,IACrD,KAAK;AACH,UAAI,QAAQ,KAAK,EAAG,QAAO;AAC3B,YAAM,cAAc,gBAAgB,OAAQ,KAAa,KAAK,GAAG,OAAO,KAAK,GAAG;AAAA,QAC9E,kBAAkB;AAAA,QAClB,gBAAgB;AAAA,MAClB,CAAC;AACD,aAAO,YAAY,MAAM,YAAY,UAAU,OAAO,KAAK;AAAA,IAC7D;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,0BACd,QACA,MACsD;AACtD,QAAM,SAAiC,CAAC;AACxC,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,KAAK,cAAc,CAAC;AAChC,UAAM,QAA0B,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC;AAClF,QAAI,MAAM,WAAW,EAAG;AACxB,UAAM,QAAQ,OAAO,IAAI,GAAG;AAC5B,eAAW,KAAK,OAAO;AACrB,YAAM,MAAM,SAAS,GAAU,OAAO,IAAI,IAAI;AAC9C,UAAI,KAAK;AACP,eAAO,MAAM,IAAI,GAAG,EAAE,IAAI;AAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG,aAAa,OAAO;AACrE;",
   "names": []
 }

package/dist/modules/widgets/injection-loader.js

@@ -1,3 +1,4 @@
+import { matchWildcardPattern } from "@open-mercato/shared/lib/patterns/wildcard";
 import {
   applyInjectionWidgetOverridesToEntries,
   applyInjectionWidgetOverridesToTables
@@ -324,8 +325,7 @@ async function getResolvedEntriesForSpot(spotId) {
   for (const [candidateSpotId, candidateEntries] of table.entries()) {
     if (candidateSpotId === spotId) continue;
     if (!candidateSpotId.includes("*")) continue;
-    const pattern = new RegExp(`^${candidateSpotId.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
-    if (!pattern.test(spotId)) continue;
+    if (!matchWildcardPattern(spotId, candidateSpotId)) continue;
     wildcardEntries.push(...candidateEntries);
   }
   const dedupedEntries = /* @__PURE__ */ new Map();

package/dist/modules/widgets/injection-loader.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/widgets/injection-loader.ts"],
-  "sourcesContent": ["import type { ModuleInjectionWidgetEntry } from '../registry'\nimport type {\n  InjectionAnyWidgetModule,\n  InjectionDataWidgetModule,\n  InjectionWidgetMetadata,\n  InjectionWidgetModule,\n  InjectionSpotId,\n  ModuleInjectionSlot,\n  ModuleInjectionTable,\n  InjectionWidgetPlacement,\n} from './injection'\nimport {\n  applyInjectionWidgetOverridesToEntries,\n  applyInjectionWidgetOverridesToTables,\n} from '../overrides'\n\ntype LoadedWidgetModule = InjectionWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }\ntype LoadedDataWidgetModule = InjectionDataWidgetModule & { metadata: InjectionWidgetMetadata }\n\nexport type LoadedInjectionWidget = LoadedWidgetModule & {\n  moduleId: string\n  key: string\n  placement?: {\n    groupId?: string\n    groupLabel?: string\n    groupDescription?: string\n    column?: 1 | 2\n    kind?: 'tab' | 'group' | 'stack'\n    [k: string]: unknown\n  }\n}\n\nexport type LoadedInjectionDataWidget = LoadedDataWidgetModule & {\n  moduleId: string\n  key: string\n  placement?: {\n    groupId?: string\n    groupLabel?: string\n    groupDescription?: string\n    column?: 1 | 2\n    kind?: 'tab' | 'group' | 'stack'\n    [k: string]: unknown\n  }\n}\n\ntype WidgetEntry = ModuleInjectionWidgetEntry & { moduleId: string }\n\n// Registration pattern for publishable packages\nlet _coreInjectionWidgetEntries: ModuleInjectionWidgetEntry[] | null = null\nlet _coreInjectionTables: Array<{ moduleId: string; table: ModuleInjectionTable }> | null = null\nlet _enabledModuleIds: ReadonlySet<string> | null = null\nlet _injectionRegistryVersion = 0\nconst GLOBAL_INJECTION_WIDGETS_KEY = '__openMercatoCoreInjectionWidgetEntries__'\nconst GLOBAL_INJECTION_TABLES_KEY = '__openMercatoCoreInjectionTables__'\nconst GLOBAL_ENABLED_MODULE_IDS_KEY = '__openMercatoEnabledModuleIds__'\nconst GLOBAL_INJECTION_REGISTRY_VERSION_KEY = '__openMercatoCoreInjectionRegistryVersion__'\nconst INJECTION_REGISTRY_CHANGED_EVENT = '__openMercatoInjectionRegistryChanged__'\n\nfunction readGlobalInjectionWidgets(): ModuleInjectionWidgetEntry[] | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY]\n    return Array.isArray(value) ? (value as ModuleInjectionWidgetEntry[]) : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInjectionWidgets(entries: ModuleInjectionWidgetEntry[]) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY] = entries\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction readGlobalEnabledModuleIds(): ReadonlySet<string> | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_ENABLED_MODULE_IDS_KEY]\n    if (value instanceof Set) return value as ReadonlySet<string>\n    return null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalEnabledModuleIds(ids: ReadonlySet<string>) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_ENABLED_MODULE_IDS_KEY] = ids\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction readGlobalInjectionTables(): Array<{ moduleId: string; table: ModuleInjectionTable }> | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_TABLES_KEY]\n    return Array.isArray(value) ? (value as Array<{ moduleId: string; table: ModuleInjectionTable }>) : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInjectionTables(tables: Array<{ moduleId: string; table: ModuleInjectionTable }>) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INJECTION_TABLES_KEY] = tables\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction readGlobalInjectionRegistryVersion(): number | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_REGISTRY_VERSION_KEY]\n    return typeof value === 'number' ? value : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInjectionRegistryVersion(version: number) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INJECTION_REGISTRY_VERSION_KEY] = version\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction notifyInjectionRegistryChanged() {\n  _injectionRegistryVersion += 1\n  writeGlobalInjectionRegistryVersion(_injectionRegistryVersion)\n  invalidateInjectionWidgetCache()\n\n  if (typeof window === 'undefined') return\n\n  window.dispatchEvent(new CustomEvent(INJECTION_REGISTRY_CHANGED_EVENT, {\n    detail: { version: _injectionRegistryVersion },\n  }))\n}\n\nexport function registerCoreInjectionWidgets(entries: ModuleInjectionWidgetEntry[]) {\n  if (_coreInjectionWidgetEntries !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Core injection widgets re-registered (this may occur during HMR)')\n  }\n  const finalEntries = applyInjectionWidgetOverridesToEntries(entries)\n  _coreInjectionWidgetEntries = finalEntries\n  writeGlobalInjectionWidgets(finalEntries)\n  notifyInjectionRegistryChanged()\n}\n\nexport function getCoreInjectionWidgets(): ModuleInjectionWidgetEntry[] {\n  const globalEntries = readGlobalInjectionWidgets()\n  if (globalEntries) return globalEntries\n  if (!_coreInjectionWidgetEntries) {\n    // On client-side, bootstrap doesn't run - return empty array gracefully\n    if (typeof window !== 'undefined') {\n      return []\n    }\n    throw new Error('[Bootstrap] Core injection widgets not registered. Call registerCoreInjectionWidgets() at bootstrap.')\n  }\n  return _coreInjectionWidgetEntries\n}\n\nexport function registerCoreInjectionTables(tables: Array<{ moduleId: string; table: ModuleInjectionTable }>) {\n  if (_coreInjectionTables !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Core injection tables re-registered (this may occur during HMR)')\n  }\n  const finalTables = applyInjectionWidgetOverridesToTables(tables)\n  _coreInjectionTables = finalTables\n  writeGlobalInjectionTables(finalTables)\n  notifyInjectionRegistryChanged()\n}\n\n/**\n * Register the canonical set of enabled module IDs for the running app.\n *\n * This is the authoritative signal used by `requiredModules` widget gating \u2014\n * deriving \"enabled\" from injection tables or widget entries is unreliable\n * because modules without injection widgets (for example `ai_assistant`) do\n * not contribute entries to either source. Bootstrap callers should pass\n * every module ID present in the app's module registry.\n */\nexport function registerEnabledModuleIds(moduleIds: Iterable<string>) {\n  const next = new Set<string>()\n  for (const moduleId of moduleIds) {\n    if (typeof moduleId === 'string' && moduleId.length > 0) next.add(moduleId)\n  }\n  if (_enabledModuleIds !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Enabled module IDs re-registered (this may occur during HMR)')\n  }\n  _enabledModuleIds = next\n  writeGlobalEnabledModuleIds(next)\n  notifyInjectionRegistryChanged()\n}\n\nexport function getEnabledModuleIds(): ReadonlySet<string> | null {\n  return readGlobalEnabledModuleIds() ?? _enabledModuleIds\n}\n\nexport function getInjectionRegistryVersion(): number {\n  const globalVersion = readGlobalInjectionRegistryVersion()\n  if (globalVersion !== null) return globalVersion\n  return _injectionRegistryVersion\n}\n\nexport function subscribeToInjectionRegistryChanges(listener: () => void): () => void {\n  if (typeof window === 'undefined') {\n    return () => {}\n  }\n\n  const handler = () => listener()\n  window.addEventListener(INJECTION_REGISTRY_CHANGED_EVENT, handler)\n  return () => {\n    window.removeEventListener(INJECTION_REGISTRY_CHANGED_EVENT, handler)\n  }\n}\n\nexport function getCoreInjectionTables(): Array<{ moduleId: string; table: ModuleInjectionTable }> {\n  const globalTables = readGlobalInjectionTables()\n  if (globalTables) return globalTables\n  if (!_coreInjectionTables) {\n    // On client-side, bootstrap doesn't run - return empty array gracefully\n    if (typeof window !== 'undefined') {\n      return []\n    }\n    throw new Error('[Bootstrap] Core injection tables not registered. Call registerCoreInjectionTables() at bootstrap.')\n  }\n  return _coreInjectionTables\n}\n\nlet widgetEntriesPromise: Promise<WidgetEntry[]> | null = null\ntype TableEntry = {\n  widgetId: string\n  moduleId: string\n  priority: number\n  placement?: ModuleInjectionSlot extends infer S\n    ? S extends { widgetId: string }\n      ? Omit<S, 'widgetId' | 'priority'>\n      : never\n    : never\n}\nlet injectionTablePromise: Promise<Map<InjectionSpotId, TableEntry[]>> | null = null\n\nfunction isInjectionSlotObject(value: ModuleInjectionSlot): value is InjectionWidgetPlacement & { widgetId: string; priority?: number } {\n  return typeof value === 'object' && value !== null && 'widgetId' in value\n}\n\n/**\n * Invalidate the widget entries and widget module cache.\n * Call this when the generated registry is updated or modules are reloaded.\n */\nexport function invalidateInjectionWidgetCache() {\n  widgetEntriesPromise = null\n  injectionTablePromise = null\n  widgetCache.clear()\n  warnedRequiredModuleSkips.clear()\n}\n\nasync function loadWidgetEntries(): Promise<WidgetEntry[]> {\n  if (!widgetEntriesPromise) {\n    const promise = Promise.resolve().then(() =>\n      getCoreInjectionWidgets().map((entry) => ({\n        ...entry,\n        moduleId: entry.moduleId || 'unknown',\n      }))\n    )\n    widgetEntriesPromise = promise.catch((err) => {\n      if (widgetEntriesPromise === promise) {\n        widgetEntriesPromise = null\n      }\n      throw err\n    })\n  }\n  return widgetEntriesPromise\n}\n\nasync function loadInjectionTable(): Promise<Map<InjectionSpotId, TableEntry[]>> {\n  if (!injectionTablePromise) {\n    const promise = Promise.resolve().then(() => {\n      const list = getCoreInjectionTables()\n      const table = new Map<InjectionSpotId, TableEntry[]>()\n\n      for (const entry of list) {\n        const injectionTable = entry.table ?? {}\n        for (const [spotId, widgetIds] of Object.entries(injectionTable)) {\n          const widgets = Array.isArray(widgetIds) ? widgetIds : [widgetIds]\n          const existing = table.get(spotId) ?? []\n          for (const widgetEntry of widgets) {\n            if (typeof widgetEntry === 'string') {\n              existing.push({ widgetId: widgetEntry, moduleId: entry.moduleId, priority: 0 })\n              continue\n            }\n            if (isInjectionSlotObject(widgetEntry)) {\n              const { widgetId, priority = 0, ...placement } = widgetEntry\n              existing.push({\n                widgetId,\n                moduleId: entry.moduleId,\n                priority: typeof priority === 'number' ? priority : 0,\n                placement,\n              })\n              continue\n            }\n          }\n          table.set(spotId, existing)\n        }\n      }\n\n      for (const [spotId, widgets] of table.entries()) {\n        table.set(spotId, widgets.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0)))\n      }\n\n      return table\n    })\n    injectionTablePromise = promise.catch((err) => {\n      if (injectionTablePromise === promise) {\n        injectionTablePromise = null\n      }\n      throw err\n    })\n  }\n  return injectionTablePromise\n}\n\nconst widgetCache = new Map<string, Promise<InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }>>()\n\nfunction isDataWidgetModule(widget: Record<string, unknown>): widget is LoadedDataWidgetModule {\n  const keys = [\n    'columns',\n    'rowActions',\n    'bulkActions',\n    'filters',\n    'fields',\n    'steps',\n    'badge',\n    'menuItems',\n  ]\n  return keys.some((key) => key in widget)\n}\n\nfunction ensureValidInjectionModule(mod: unknown, key: string, moduleId: string): (InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }) {\n  if (!mod || typeof mod !== 'object') {\n    throw new Error(`Invalid injection widget module \"${key}\" from \"${moduleId}\" (expected object export)`)\n  }\n  const widget = (mod as { default?: InjectionAnyWidgetModule<any, any> }).default ?? (mod as InjectionAnyWidgetModule<any, any>)\n  if (!widget || typeof widget !== 'object') {\n    throw new Error(`Invalid injection widget export \"${key}\" from \"${moduleId}\" (missing default export)`) \n  }\n  if (!('metadata' in widget) || !widget.metadata || typeof widget.metadata !== 'object') {\n    throw new Error(`Injection widget \"${key}\" from \"${moduleId}\" is missing metadata`)\n  }\n  const metadata = widget.metadata\n  if (typeof metadata.id !== 'string' || metadata.id.length === 0) {\n    throw new Error(`Injection widget \"${key}\" from \"${moduleId}\" metadata.id must be a non-empty string`)\n  }\n  const normalized = {\n    ...widget,\n    metadata,\n  }\n\n  if ('Widget' in normalized && typeof normalized.Widget === 'function') {\n    if (typeof metadata.title !== 'string' || metadata.title.length === 0) {\n      throw new Error(`Injection widget \"${metadata.id}\" from \"${moduleId}\" must have a title`)\n    }\n    return normalized\n  }\n\n  if (!isDataWidgetModule(normalized as Record<string, unknown>)) {\n    throw new Error(\n      `Injection widget \"${metadata.id}\" from \"${moduleId}\" must export either Widget component or a declarative data payload`\n    )\n  }\n\n  return normalized\n}\n\nfunction isLoadedInjectionWidget(\n  module: InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }\n): module is LoadedWidgetModule {\n  return 'Widget' in module && typeof module.Widget === 'function'\n}\n\nfunction isLoadedInjectionDataWidget(\n  module: InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }\n): module is LoadedDataWidgetModule {\n  return !isLoadedInjectionWidget(module)\n}\n\nasync function loadEntry(entry: WidgetEntry): Promise<InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }> {\n  if (!widgetCache.has(entry.key)) {\n    const promise = entry.loader().then((mod) => ensureValidInjectionModule(mod, entry.key, entry.moduleId))\n    widgetCache.set(entry.key, promise)\n  }\n  return widgetCache.get(entry.key)!\n}\n\nfunction getEnabledModuleIdsForInjection(): ReadonlySet<string> {\n  // Prefer the explicit enabled-modules registry populated by bootstrap.\n  // This is the only signal that includes modules without injection widgets\n  // (for example `ai_assistant`), so it is required for `requiredModules`\n  // gating to be sound.\n  const explicit = readGlobalEnabledModuleIds() ?? _enabledModuleIds\n  if (explicit) return explicit\n\n  // Fallback: derive from injection tables and widget entries. This keeps\n  // older bootstrap paths (and callers that have not yet wired\n  // `registerEnabledModuleIds`) working \u2014 at the cost of mis-classifying\n  // dependency modules that ship no widgets. New apps MUST call\n  // `registerEnabledModuleIds` to get accurate gating.\n  const enabled = new Set<string>()\n  const tables = readGlobalInjectionTables() ?? _coreInjectionTables ?? []\n  for (const entry of tables) {\n    if (entry?.moduleId) enabled.add(entry.moduleId)\n  }\n  const entries = readGlobalInjectionWidgets() ?? _coreInjectionWidgetEntries ?? []\n  for (const entry of entries) {\n    if (entry?.moduleId) enabled.add(entry.moduleId)\n  }\n  return enabled\n}\n\nfunction widgetMissingRequiredModules(\n  metadata: InjectionWidgetMetadata,\n  enabledModuleIds: ReadonlySet<string>,\n): string[] {\n  const required = metadata.requiredModules\n  if (!Array.isArray(required) || required.length === 0) return []\n  const missing: string[] = []\n  for (const moduleId of required) {\n    if (typeof moduleId !== 'string' || moduleId.length === 0) continue\n    if (!enabledModuleIds.has(moduleId)) missing.push(moduleId)\n  }\n  return missing\n}\n\nconst warnedRequiredModuleSkips = new Set<string>()\n\nfunction warnSkippedWidget(metadataId: string, missingModules: string[]) {\n  const key = `${metadataId}:${missingModules.join(',')}`\n  if (warnedRequiredModuleSkips.has(key)) return\n  warnedRequiredModuleSkips.add(key)\n  if (process.env.NODE_ENV === 'development') {\n    console.debug(\n      `[InjectionLoader] Skipping widget \"${metadataId}\" \u2014 required module(s) not enabled: ${missingModules.join(', ')}`,\n    )\n  }\n}\n\nasync function getResolvedEntriesForSpot(spotId: InjectionSpotId): Promise<TableEntry[]> {\n  const table = await loadInjectionTable()\n  const exactEntries = table.get(spotId) ?? []\n  const wildcardEntries: TableEntry[] = []\n\n  for (const [candidateSpotId, candidateEntries] of table.entries()) {\n    if (candidateSpotId === spotId) continue\n    if (!candidateSpotId.includes('*')) continue\n    const pattern = new RegExp(`^${candidateSpotId.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&').replace(/\\*/g, '.*')}$`)\n    if (!pattern.test(spotId)) continue\n    wildcardEntries.push(...candidateEntries)\n  }\n\n  const dedupedEntries = new Map<string, TableEntry>()\n  for (const entry of [...exactEntries, ...wildcardEntries]) {\n    const cacheKey = `${entry.moduleId}:${entry.widgetId}`\n    const previous = dedupedEntries.get(cacheKey)\n    if (!previous || (entry.priority ?? 0) > (previous.priority ?? 0)) {\n      dedupedEntries.set(cacheKey, entry)\n    }\n  }\n\n  return Array.from(dedupedEntries.values()).sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))\n}\n\nexport async function loadAllInjectionWidgets(): Promise<LoadedInjectionWidget[]> {\n  const widgetEntries = await loadWidgetEntries()\n  const enabledModuleIds = getEnabledModuleIdsForInjection()\n  const loaded = await Promise.all(\n    widgetEntries.map(async (entry) => {\n      const module = await loadEntry(entry)\n      if (!isLoadedInjectionWidget(module)) return null\n      const missing = widgetMissingRequiredModules(module.metadata, enabledModuleIds)\n      if (missing.length > 0) {\n        warnSkippedWidget(module.metadata.id, missing)\n        return null\n      }\n      return { ...module, moduleId: entry.moduleId, key: entry.key }\n    })\n  )\n  const byId = new Map<string, LoadedInjectionWidget>()\n  for (const widget of loaded) {\n    if (!widget) continue\n    if (!byId.has(widget.metadata.id)) {\n      byId.set(widget.metadata.id, widget)\n    }\n  }\n  return Array.from(byId.values())\n}\n\nexport async function loadInjectionWidgetById(widgetId: string): Promise<LoadedInjectionWidget | null> {\n  const widgetEntries = await loadWidgetEntries()\n  const enabledModuleIds = getEnabledModuleIdsForInjection()\n  for (const entry of widgetEntries) {\n    const module = await loadEntry(entry)\n    if (!isLoadedInjectionWidget(module)) continue\n    if (module.metadata.id === widgetId) {\n      const missing = widgetMissingRequiredModules(module.metadata, enabledModuleIds)\n      if (missing.length > 0) {\n        warnSkippedWidget(module.metadata.id, missing)\n        return null\n      }\n      return { ...module, moduleId: entry.moduleId, key: entry.key }\n    }\n  }\n  return null\n}\n\nexport async function loadInjectionDataWidgetById(widgetId: string): Promise<LoadedInjectionDataWidget | null> {\n  const widgetEntries = await loadWidgetEntries()\n  const enabledModuleIds = getEnabledModuleIdsForInjection()\n  for (const entry of widgetEntries) {\n    const module = await loadEntry(entry)\n    if (!isLoadedInjectionDataWidget(module)) continue\n    if (module.metadata.id === widgetId) {\n      const missing = widgetMissingRequiredModules(module.metadata, enabledModuleIds)\n      if (missing.length > 0) {\n        warnSkippedWidget(module.metadata.id, missing)\n        return null\n      }\n      return { ...module, moduleId: entry.moduleId, key: entry.key }\n    }\n  }\n  return null\n}\n\nexport async function loadInjectionWidgetsForSpot(spotId: InjectionSpotId): Promise<LoadedInjectionWidget[]> {\n  const entries = await getResolvedEntriesForSpot(spotId)\n  const widgets: LoadedInjectionWidget[] = []\n  for (const { widgetId, placement, priority } of entries) {\n    const widget = await loadInjectionWidgetById(widgetId)\n    if (!widget) continue\n    const combinedPlacement = placement\n      ? { ...placement, priority: typeof priority === 'number' ? priority : 0 }\n      : { priority: typeof priority === 'number' ? priority : 0 }\n    widgets.push({ ...widget, placement: combinedPlacement })\n  }\n  return widgets\n}\n\nexport async function loadInjectionDataWidgetsForSpot(spotId: InjectionSpotId): Promise<LoadedInjectionDataWidget[]> {\n  const entries = await getResolvedEntriesForSpot(spotId)\n  const widgets: LoadedInjectionDataWidget[] = []\n  for (const { widgetId, placement, priority } of entries) {\n    const widget = await loadInjectionDataWidgetById(widgetId)\n    if (!widget) continue\n    const combinedPlacement = placement\n      ? { ...placement, priority: typeof priority === 'number' ? priority : 0 }\n      : { priority: typeof priority === 'number' ? priority : 0 }\n    widgets.push({ ...widget, placement: combinedPlacement })\n  }\n  return widgets\n}\n"],
-  "mappings": "AAWA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAkCP,IAAI,8BAAmE;AACvE,IAAI,uBAAwF;AAC5F,IAAI,oBAAgD;AACpD,IAAI,4BAA4B;AAChC,MAAM,+BAA+B;AACrC,MAAM,8BAA8B;AACpC,MAAM,gCAAgC;AACtC,MAAM,wCAAwC;AAC9C,MAAM,mCAAmC;AAEzC,SAAS,6BAAkE;AACzE,MAAI;AACF,UAAM,QAAS,WAAuC,4BAA4B;AAClF,WAAO,MAAM,QAAQ,KAAK,IAAK,QAAyC;AAAA,EAC1E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA4B,SAAuC;AAC1E,MAAI;AACF;AAAC,IAAC,WAAuC,4BAA4B,IAAI;AAAA,EAC3E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,6BAAyD;AAChE,MAAI;AACF,UAAM,QAAS,WAAuC,6BAA6B;AACnF,QAAI,iBAAiB,IAAK,QAAO;AACjC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA4B,KAA0B;AAC7D,MAAI;AACF;AAAC,IAAC,WAAuC,6BAA6B,IAAI;AAAA,EAC5E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,4BAA6F;AACpG,MAAI;AACF,UAAM,QAAS,WAAuC,2BAA2B;AACjF,WAAO,MAAM,QAAQ,KAAK,IAAK,QAAqE;AAAA,EACtG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BAA2B,QAAkE;AACpG,MAAI;AACF;AAAC,IAAC,WAAuC,2BAA2B,IAAI;AAAA,EAC1E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,qCAAoD;AAC3D,MAAI;AACF,UAAM,QAAS,WAAuC,qCAAqC;AAC3F,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oCAAoC,SAAiB;AAC5D,MAAI;AACF;AAAC,IAAC,WAAuC,qCAAqC,IAAI;AAAA,EACpF,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,iCAAiC;AACxC,+BAA6B;AAC7B,sCAAoC,yBAAyB;AAC7D,iCAA+B;AAE/B,MAAI,OAAO,WAAW,YAAa;AAEnC,SAAO,cAAc,IAAI,YAAY,kCAAkC;AAAA,IACrE,QAAQ,EAAE,SAAS,0BAA0B;AAAA,EAC/C,CAAC,CAAC;AACJ;AAEO,SAAS,6BAA6B,SAAuC;AAClF,MAAI,gCAAgC,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAClF,YAAQ,MAAM,8EAA8E;AAAA,EAC9F;AACA,QAAM,eAAe,uCAAuC,OAAO;AACnE,gCAA8B;AAC9B,8BAA4B,YAAY;AACxC,iCAA+B;AACjC;AAEO,SAAS,0BAAwD;AACtE,QAAM,gBAAgB,2BAA2B;AACjD,MAAI,cAAe,QAAO;AAC1B,MAAI,CAAC,6BAA6B;AAEhC,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,CAAC;AAAA,IACV;AACA,UAAM,IAAI,MAAM,sGAAsG;AAAA,EACxH;AACA,SAAO;AACT;AAEO,SAAS,4BAA4B,QAAkE;AAC5G,MAAI,yBAAyB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC3E,YAAQ,MAAM,6EAA6E;AAAA,EAC7F;AACA,QAAM,cAAc,sCAAsC,MAAM;AAChE,yBAAuB;AACvB,6BAA2B,WAAW;AACtC,iCAA+B;AACjC;AAWO,SAAS,yBAAyB,WAA6B;AACpE,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,YAAY,WAAW;AAChC,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,MAAK,IAAI,QAAQ;AAAA,EAC5E;AACA,MAAI,sBAAsB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AACxE,YAAQ,MAAM,0EAA0E;AAAA,EAC1F;AACA,sBAAoB;AACpB,8BAA4B,IAAI;AAChC,iCAA+B;AACjC;AAEO,SAAS,sBAAkD;AAChE,SAAO,2BAA2B,KAAK;AACzC;AAEO,SAAS,8BAAsC;AACpD,QAAM,gBAAgB,mCAAmC;AACzD,MAAI,kBAAkB,KAAM,QAAO;AACnC,SAAO;AACT;AAEO,SAAS,oCAAoC,UAAkC;AACpF,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,MAAM;AAAA,IAAC;AAAA,EAChB;AAEA,QAAM,UAAU,MAAM,SAAS;AAC/B,SAAO,iBAAiB,kCAAkC,OAAO;AACjE,SAAO,MAAM;AACX,WAAO,oBAAoB,kCAAkC,OAAO;AAAA,EACtE;AACF;AAEO,SAAS,yBAAmF;AACjG,QAAM,eAAe,0BAA0B;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,CAAC,sBAAsB;AAEzB,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,CAAC;AAAA,IACV;AACA,UAAM,IAAI,MAAM,oGAAoG;AAAA,EACtH;AACA,SAAO;AACT;AAEA,IAAI,uBAAsD;AAW1D,IAAI,wBAA4E;AAEhF,SAAS,sBAAsB,OAAyG;AACtI,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc;AACtE;AAMO,SAAS,iCAAiC;AAC/C,yBAAuB;AACvB,0BAAwB;AACxB,cAAY,MAAM;AAClB,4BAA0B,MAAM;AAClC;AAEA,eAAe,oBAA4C;AACzD,MAAI,CAAC,sBAAsB;AACzB,UAAM,UAAU,QAAQ,QAAQ,EAAE;AAAA,MAAK,MACrC,wBAAwB,EAAE,IAAI,CAAC,WAAW;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,MAAM,YAAY;AAAA,MAC9B,EAAE;AAAA,IACJ;AACA,2BAAuB,QAAQ,MAAM,CAAC,QAAQ;AAC5C,UAAI,yBAAyB,SAAS;AACpC,+BAAuB;AAAA,MACzB;AACA,YAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,qBAAkE;AAC/E,MAAI,CAAC,uBAAuB;AAC1B,UAAM,UAAU,QAAQ,QAAQ,EAAE,KAAK,MAAM;AAC3C,YAAM,OAAO,uBAAuB;AACpC,YAAM,QAAQ,oBAAI,IAAmC;AAErD,iBAAW,SAAS,MAAM;AACxB,cAAM,iBAAiB,MAAM,SAAS,CAAC;AACvC,mBAAW,CAAC,QAAQ,SAAS,KAAK,OAAO,QAAQ,cAAc,GAAG;AAChE,gBAAM,UAAU,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC,SAAS;AACjE,gBAAM,WAAW,MAAM,IAAI,MAAM,KAAK,CAAC;AACvC,qBAAW,eAAe,SAAS;AACjC,gBAAI,OAAO,gBAAgB,UAAU;AACnC,uBAAS,KAAK,EAAE,UAAU,aAAa,UAAU,MAAM,UAAU,UAAU,EAAE,CAAC;AAC9E;AAAA,YACF;AACA,gBAAI,sBAAsB,WAAW,GAAG;AACtC,oBAAM,EAAE,UAAU,WAAW,GAAG,GAAG,UAAU,IAAI;AACjD,uBAAS,KAAK;AAAA,gBACZ;AAAA,gBACA,UAAU,MAAM;AAAA,gBAChB,UAAU,OAAO,aAAa,WAAW,WAAW;AAAA,gBACpD;AAAA,cACF,CAAC;AACD;AAAA,YACF;AAAA,UACF;AACA,gBAAM,IAAI,QAAQ,QAAQ;AAAA,QAC5B;AAAA,MACF;AAEA,iBAAW,CAAC,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG;AAC/C,cAAM,IAAI,QAAQ,QAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE,CAAC;AAAA,MACjF;AAEA,aAAO;AAAA,IACT,CAAC;AACD,4BAAwB,QAAQ,MAAM,CAAC,QAAQ;AAC7C,UAAI,0BAA0B,SAAS;AACrC,gCAAwB;AAAA,MAC1B;AACA,YAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,MAAM,cAAc,oBAAI,IAAiG;AAEzH,SAAS,mBAAmB,QAAmE;AAC7F,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,KAAK,KAAK,CAAC,QAAQ,OAAO,MAAM;AACzC;AAEA,SAAS,2BAA2B,KAAc,KAAa,UAAgG;AAC7J,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,QAAM,SAAU,IAAyD,WAAY;AACrF,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,MAAI,EAAE,cAAc,WAAW,CAAC,OAAO,YAAY,OAAO,OAAO,aAAa,UAAU;AACtF,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,uBAAuB;AAAA,EACpF;AACA,QAAM,WAAW,OAAO;AACxB,MAAI,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,0CAA0C;AAAA,EACvG;AACA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH;AAAA,EACF;AAEA,MAAI,YAAY,cAAc,OAAO,WAAW,WAAW,YAAY;AACrE,QAAI,OAAO,SAAS,UAAU,YAAY,SAAS,MAAM,WAAW,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,WAAW,QAAQ,qBAAqB;AAAA,IAC1F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,mBAAmB,UAAqC,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,qBAAqB,SAAS,EAAE,WAAW,QAAQ;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,wBACP,QAC8B;AAC9B,SAAO,YAAY,UAAU,OAAO,OAAO,WAAW;AACxD;AAEA,SAAS,4BACP,QACkC;AAClC,SAAO,CAAC,wBAAwB,MAAM;AACxC;AAEA,eAAe,UAAU,OAAyG;AAChI,MAAI,CAAC,YAAY,IAAI,MAAM,GAAG,GAAG;AAC/B,UAAM,UAAU,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,2BAA2B,KAAK,MAAM,KAAK,MAAM,QAAQ,CAAC;AACvG,gBAAY,IAAI,MAAM,KAAK,OAAO;AAAA,EACpC;AACA,SAAO,YAAY,IAAI,MAAM,GAAG;AAClC;AAEA,SAAS,kCAAuD;AAK9D,QAAM,WAAW,2BAA2B,KAAK;AACjD,MAAI,SAAU,QAAO;AAOrB,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,SAAS,0BAA0B,KAAK,wBAAwB,CAAC;AACvE,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,SAAU,SAAQ,IAAI,MAAM,QAAQ;AAAA,EACjD;AACA,QAAM,UAAU,2BAA2B,KAAK,+BAA+B,CAAC;AAChF,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,SAAU,SAAQ,IAAI,MAAM,QAAQ;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,6BACP,UACA,kBACU;AACV,QAAM,WAAW,SAAS;AAC1B,MAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,EAAG,QAAO,CAAC;AAC/D,QAAM,UAAoB,CAAC;AAC3B,aAAW,YAAY,UAAU;AAC/B,QAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG;AAC3D,QAAI,CAAC,iBAAiB,IAAI,QAAQ,EAAG,SAAQ,KAAK,QAAQ;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,MAAM,4BAA4B,oBAAI,IAAY;AAElD,SAAS,kBAAkB,YAAoB,gBAA0B;AACvE,QAAM,MAAM,GAAG,UAAU,IAAI,eAAe,KAAK,GAAG,CAAC;AACrD,MAAI,0BAA0B,IAAI,GAAG,EAAG;AACxC,4BAA0B,IAAI,GAAG;AACjC,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,YAAQ;AAAA,MACN,sCAAsC,UAAU,4CAAuC,eAAe,KAAK,IAAI,CAAC;AAAA,IAClH;AAAA,EACF;AACF;AAEA,eAAe,0BAA0B,QAAgD;AACvF,QAAM,QAAQ,MAAM,mBAAmB;AACvC,QAAM,eAAe,MAAM,IAAI,MAAM,KAAK,CAAC;AAC3C,QAAM,kBAAgC,CAAC;AAEvC,aAAW,CAAC,iBAAiB,gBAAgB,KAAK,MAAM,QAAQ,GAAG;AACjE,QAAI,oBAAoB,OAAQ;AAChC,QAAI,CAAC,gBAAgB,SAAS,GAAG,EAAG;AACpC,UAAM,UAAU,IAAI,OAAO,IAAI,gBAAgB,QAAQ,sBAAsB,MAAM,EAAE,QAAQ,OAAO,IAAI,CAAC,GAAG;AAC5G,QAAI,CAAC,QAAQ,KAAK,MAAM,EAAG;AAC3B,oBAAgB,KAAK,GAAG,gBAAgB;AAAA,EAC1C;AAEA,QAAM,iBAAiB,oBAAI,IAAwB;AACnD,aAAW,SAAS,CAAC,GAAG,cAAc,GAAG,eAAe,GAAG;AACzD,UAAM,WAAW,GAAG,MAAM,QAAQ,IAAI,MAAM,QAAQ;AACpD,UAAM,WAAW,eAAe,IAAI,QAAQ;AAC5C,QAAI,CAAC,aAAa,MAAM,YAAY,MAAM,SAAS,YAAY,IAAI;AACjE,qBAAe,IAAI,UAAU,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,eAAe,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;AACjG;AAEA,eAAsB,0BAA4D;AAChF,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,mBAAmB,gCAAgC;AACzD,QAAM,SAAS,MAAM,QAAQ;AAAA,IAC3B,cAAc,IAAI,OAAO,UAAU;AACjC,YAAM,SAAS,MAAM,UAAU,KAAK;AACpC,UAAI,CAAC,wBAAwB,MAAM,EAAG,QAAO;AAC7C,YAAM,UAAU,6BAA6B,OAAO,UAAU,gBAAgB;AAC9E,UAAI,QAAQ,SAAS,GAAG;AACtB,0BAAkB,OAAO,SAAS,IAAI,OAAO;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,QAAM,OAAO,oBAAI,IAAmC;AACpD,aAAW,UAAU,QAAQ;AAC3B,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,KAAK,IAAI,OAAO,SAAS,EAAE,GAAG;AACjC,WAAK,IAAI,OAAO,SAAS,IAAI,MAAM;AAAA,IACrC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AACjC;AAEA,eAAsB,wBAAwB,UAAyD;AACrG,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,mBAAmB,gCAAgC;AACzD,aAAW,SAAS,eAAe;AACjC,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,QAAI,CAAC,wBAAwB,MAAM,EAAG;AACtC,QAAI,OAAO,SAAS,OAAO,UAAU;AACnC,YAAM,UAAU,6BAA6B,OAAO,UAAU,gBAAgB;AAC9E,UAAI,QAAQ,SAAS,GAAG;AACtB,0BAAkB,OAAO,SAAS,IAAI,OAAO;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,4BAA4B,UAA6D;AAC7G,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,mBAAmB,gCAAgC;AACzD,aAAW,SAAS,eAAe;AACjC,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,QAAI,CAAC,4BAA4B,MAAM,EAAG;AAC1C,QAAI,OAAO,SAAS,OAAO,UAAU;AACnC,YAAM,UAAU,6BAA6B,OAAO,UAAU,gBAAgB;AAC9E,UAAI,QAAQ,SAAS,GAAG;AACtB,0BAAkB,OAAO,SAAS,IAAI,OAAO;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,4BAA4B,QAA2D;AAC3G,QAAM,UAAU,MAAM,0BAA0B,MAAM;AACtD,QAAM,UAAmC,CAAC;AAC1C,aAAW,EAAE,UAAU,WAAW,SAAS,KAAK,SAAS;AACvD,UAAM,SAAS,MAAM,wBAAwB,QAAQ;AACrD,QAAI,CAAC,OAAQ;AACb,UAAM,oBAAoB,YACtB,EAAE,GAAG,WAAW,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE,IACtE,EAAE,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE;AAC5D,YAAQ,KAAK,EAAE,GAAG,QAAQ,WAAW,kBAAkB,CAAC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,eAAsB,gCAAgC,QAA+D;AACnH,QAAM,UAAU,MAAM,0BAA0B,MAAM;AACtD,QAAM,UAAuC,CAAC;AAC9C,aAAW,EAAE,UAAU,WAAW,SAAS,KAAK,SAAS;AACvD,UAAM,SAAS,MAAM,4BAA4B,QAAQ;AACzD,QAAI,CAAC,OAAQ;AACb,UAAM,oBAAoB,YACtB,EAAE,GAAG,WAAW,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE,IACtE,EAAE,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE;AAC5D,YAAQ,KAAK,EAAE,GAAG,QAAQ,WAAW,kBAAkB,CAAC;AAAA,EAC1D;AACA,SAAO;AACT;",
+  "sourcesContent": ["import type { ModuleInjectionWidgetEntry } from '../registry'\nimport { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'\nimport type {\n  InjectionAnyWidgetModule,\n  InjectionDataWidgetModule,\n  InjectionWidgetMetadata,\n  InjectionWidgetModule,\n  InjectionSpotId,\n  ModuleInjectionSlot,\n  ModuleInjectionTable,\n  InjectionWidgetPlacement,\n} from './injection'\nimport {\n  applyInjectionWidgetOverridesToEntries,\n  applyInjectionWidgetOverridesToTables,\n} from '../overrides'\n\ntype LoadedWidgetModule = InjectionWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }\ntype LoadedDataWidgetModule = InjectionDataWidgetModule & { metadata: InjectionWidgetMetadata }\n\nexport type LoadedInjectionWidget = LoadedWidgetModule & {\n  moduleId: string\n  key: string\n  placement?: {\n    groupId?: string\n    groupLabel?: string\n    groupDescription?: string\n    column?: 1 | 2\n    kind?: 'tab' | 'group' | 'stack'\n    [k: string]: unknown\n  }\n}\n\nexport type LoadedInjectionDataWidget = LoadedDataWidgetModule & {\n  moduleId: string\n  key: string\n  placement?: {\n    groupId?: string\n    groupLabel?: string\n    groupDescription?: string\n    column?: 1 | 2\n    kind?: 'tab' | 'group' | 'stack'\n    [k: string]: unknown\n  }\n}\n\ntype WidgetEntry = ModuleInjectionWidgetEntry & { moduleId: string }\n\n// Registration pattern for publishable packages\nlet _coreInjectionWidgetEntries: ModuleInjectionWidgetEntry[] | null = null\nlet _coreInjectionTables: Array<{ moduleId: string; table: ModuleInjectionTable }> | null = null\nlet _enabledModuleIds: ReadonlySet<string> | null = null\nlet _injectionRegistryVersion = 0\nconst GLOBAL_INJECTION_WIDGETS_KEY = '__openMercatoCoreInjectionWidgetEntries__'\nconst GLOBAL_INJECTION_TABLES_KEY = '__openMercatoCoreInjectionTables__'\nconst GLOBAL_ENABLED_MODULE_IDS_KEY = '__openMercatoEnabledModuleIds__'\nconst GLOBAL_INJECTION_REGISTRY_VERSION_KEY = '__openMercatoCoreInjectionRegistryVersion__'\nconst INJECTION_REGISTRY_CHANGED_EVENT = '__openMercatoInjectionRegistryChanged__'\n\nfunction readGlobalInjectionWidgets(): ModuleInjectionWidgetEntry[] | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY]\n    return Array.isArray(value) ? (value as ModuleInjectionWidgetEntry[]) : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInjectionWidgets(entries: ModuleInjectionWidgetEntry[]) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY] = entries\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction readGlobalEnabledModuleIds(): ReadonlySet<string> | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_ENABLED_MODULE_IDS_KEY]\n    if (value instanceof Set) return value as ReadonlySet<string>\n    return null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalEnabledModuleIds(ids: ReadonlySet<string>) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_ENABLED_MODULE_IDS_KEY] = ids\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction readGlobalInjectionTables(): Array<{ moduleId: string; table: ModuleInjectionTable }> | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_TABLES_KEY]\n    return Array.isArray(value) ? (value as Array<{ moduleId: string; table: ModuleInjectionTable }>) : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInjectionTables(tables: Array<{ moduleId: string; table: ModuleInjectionTable }>) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INJECTION_TABLES_KEY] = tables\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction readGlobalInjectionRegistryVersion(): number | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_REGISTRY_VERSION_KEY]\n    return typeof value === 'number' ? value : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInjectionRegistryVersion(version: number) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INJECTION_REGISTRY_VERSION_KEY] = version\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nfunction notifyInjectionRegistryChanged() {\n  _injectionRegistryVersion += 1\n  writeGlobalInjectionRegistryVersion(_injectionRegistryVersion)\n  invalidateInjectionWidgetCache()\n\n  if (typeof window === 'undefined') return\n\n  window.dispatchEvent(new CustomEvent(INJECTION_REGISTRY_CHANGED_EVENT, {\n    detail: { version: _injectionRegistryVersion },\n  }))\n}\n\nexport function registerCoreInjectionWidgets(entries: ModuleInjectionWidgetEntry[]) {\n  if (_coreInjectionWidgetEntries !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Core injection widgets re-registered (this may occur during HMR)')\n  }\n  const finalEntries = applyInjectionWidgetOverridesToEntries(entries)\n  _coreInjectionWidgetEntries = finalEntries\n  writeGlobalInjectionWidgets(finalEntries)\n  notifyInjectionRegistryChanged()\n}\n\nexport function getCoreInjectionWidgets(): ModuleInjectionWidgetEntry[] {\n  const globalEntries = readGlobalInjectionWidgets()\n  if (globalEntries) return globalEntries\n  if (!_coreInjectionWidgetEntries) {\n    // On client-side, bootstrap doesn't run - return empty array gracefully\n    if (typeof window !== 'undefined') {\n      return []\n    }\n    throw new Error('[Bootstrap] Core injection widgets not registered. Call registerCoreInjectionWidgets() at bootstrap.')\n  }\n  return _coreInjectionWidgetEntries\n}\n\nexport function registerCoreInjectionTables(tables: Array<{ moduleId: string; table: ModuleInjectionTable }>) {\n  if (_coreInjectionTables !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Core injection tables re-registered (this may occur during HMR)')\n  }\n  const finalTables = applyInjectionWidgetOverridesToTables(tables)\n  _coreInjectionTables = finalTables\n  writeGlobalInjectionTables(finalTables)\n  notifyInjectionRegistryChanged()\n}\n\n/**\n * Register the canonical set of enabled module IDs for the running app.\n *\n * This is the authoritative signal used by `requiredModules` widget gating \u2014\n * deriving \"enabled\" from injection tables or widget entries is unreliable\n * because modules without injection widgets (for example `ai_assistant`) do\n * not contribute entries to either source. Bootstrap callers should pass\n * every module ID present in the app's module registry.\n */\nexport function registerEnabledModuleIds(moduleIds: Iterable<string>) {\n  const next = new Set<string>()\n  for (const moduleId of moduleIds) {\n    if (typeof moduleId === 'string' && moduleId.length > 0) next.add(moduleId)\n  }\n  if (_enabledModuleIds !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Enabled module IDs re-registered (this may occur during HMR)')\n  }\n  _enabledModuleIds = next\n  writeGlobalEnabledModuleIds(next)\n  notifyInjectionRegistryChanged()\n}\n\nexport function getEnabledModuleIds(): ReadonlySet<string> | null {\n  return readGlobalEnabledModuleIds() ?? _enabledModuleIds\n}\n\nexport function getInjectionRegistryVersion(): number {\n  const globalVersion = readGlobalInjectionRegistryVersion()\n  if (globalVersion !== null) return globalVersion\n  return _injectionRegistryVersion\n}\n\nexport function subscribeToInjectionRegistryChanges(listener: () => void): () => void {\n  if (typeof window === 'undefined') {\n    return () => {}\n  }\n\n  const handler = () => listener()\n  window.addEventListener(INJECTION_REGISTRY_CHANGED_EVENT, handler)\n  return () => {\n    window.removeEventListener(INJECTION_REGISTRY_CHANGED_EVENT, handler)\n  }\n}\n\nexport function getCoreInjectionTables(): Array<{ moduleId: string; table: ModuleInjectionTable }> {\n  const globalTables = readGlobalInjectionTables()\n  if (globalTables) return globalTables\n  if (!_coreInjectionTables) {\n    // On client-side, bootstrap doesn't run - return empty array gracefully\n    if (typeof window !== 'undefined') {\n      return []\n    }\n    throw new Error('[Bootstrap] Core injection tables not registered. Call registerCoreInjectionTables() at bootstrap.')\n  }\n  return _coreInjectionTables\n}\n\nlet widgetEntriesPromise: Promise<WidgetEntry[]> | null = null\ntype TableEntry = {\n  widgetId: string\n  moduleId: string\n  priority: number\n  placement?: ModuleInjectionSlot extends infer S\n    ? S extends { widgetId: string }\n      ? Omit<S, 'widgetId' | 'priority'>\n      : never\n    : never\n}\nlet injectionTablePromise: Promise<Map<InjectionSpotId, TableEntry[]>> | null = null\n\nfunction isInjectionSlotObject(value: ModuleInjectionSlot): value is InjectionWidgetPlacement & { widgetId: string; priority?: number } {\n  return typeof value === 'object' && value !== null && 'widgetId' in value\n}\n\n/**\n * Invalidate the widget entries and widget module cache.\n * Call this when the generated registry is updated or modules are reloaded.\n */\nexport function invalidateInjectionWidgetCache() {\n  widgetEntriesPromise = null\n  injectionTablePromise = null\n  widgetCache.clear()\n  warnedRequiredModuleSkips.clear()\n}\n\nasync function loadWidgetEntries(): Promise<WidgetEntry[]> {\n  if (!widgetEntriesPromise) {\n    const promise = Promise.resolve().then(() =>\n      getCoreInjectionWidgets().map((entry) => ({\n        ...entry,\n        moduleId: entry.moduleId || 'unknown',\n      }))\n    )\n    widgetEntriesPromise = promise.catch((err) => {\n      if (widgetEntriesPromise === promise) {\n        widgetEntriesPromise = null\n      }\n      throw err\n    })\n  }\n  return widgetEntriesPromise\n}\n\nasync function loadInjectionTable(): Promise<Map<InjectionSpotId, TableEntry[]>> {\n  if (!injectionTablePromise) {\n    const promise = Promise.resolve().then(() => {\n      const list = getCoreInjectionTables()\n      const table = new Map<InjectionSpotId, TableEntry[]>()\n\n      for (const entry of list) {\n        const injectionTable = entry.table ?? {}\n        for (const [spotId, widgetIds] of Object.entries(injectionTable)) {\n          const widgets = Array.isArray(widgetIds) ? widgetIds : [widgetIds]\n          const existing = table.get(spotId) ?? []\n          for (const widgetEntry of widgets) {\n            if (typeof widgetEntry === 'string') {\n              existing.push({ widgetId: widgetEntry, moduleId: entry.moduleId, priority: 0 })\n              continue\n            }\n            if (isInjectionSlotObject(widgetEntry)) {\n              const { widgetId, priority = 0, ...placement } = widgetEntry\n              existing.push({\n                widgetId,\n                moduleId: entry.moduleId,\n                priority: typeof priority === 'number' ? priority : 0,\n                placement,\n              })\n              continue\n            }\n          }\n          table.set(spotId, existing)\n        }\n      }\n\n      for (const [spotId, widgets] of table.entries()) {\n        table.set(spotId, widgets.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0)))\n      }\n\n      return table\n    })\n    injectionTablePromise = promise.catch((err) => {\n      if (injectionTablePromise === promise) {\n        injectionTablePromise = null\n      }\n      throw err\n    })\n  }\n  return injectionTablePromise\n}\n\nconst widgetCache = new Map<string, Promise<InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }>>()\n\nfunction isDataWidgetModule(widget: Record<string, unknown>): widget is LoadedDataWidgetModule {\n  const keys = [\n    'columns',\n    'rowActions',\n    'bulkActions',\n    'filters',\n    'fields',\n    'steps',\n    'badge',\n    'menuItems',\n  ]\n  return keys.some((key) => key in widget)\n}\n\nfunction ensureValidInjectionModule(mod: unknown, key: string, moduleId: string): (InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }) {\n  if (!mod || typeof mod !== 'object') {\n    throw new Error(`Invalid injection widget module \"${key}\" from \"${moduleId}\" (expected object export)`)\n  }\n  const widget = (mod as { default?: InjectionAnyWidgetModule<any, any> }).default ?? (mod as InjectionAnyWidgetModule<any, any>)\n  if (!widget || typeof widget !== 'object') {\n    throw new Error(`Invalid injection widget export \"${key}\" from \"${moduleId}\" (missing default export)`) \n  }\n  if (!('metadata' in widget) || !widget.metadata || typeof widget.metadata !== 'object') {\n    throw new Error(`Injection widget \"${key}\" from \"${moduleId}\" is missing metadata`)\n  }\n  const metadata = widget.metadata\n  if (typeof metadata.id !== 'string' || metadata.id.length === 0) {\n    throw new Error(`Injection widget \"${key}\" from \"${moduleId}\" metadata.id must be a non-empty string`)\n  }\n  const normalized = {\n    ...widget,\n    metadata,\n  }\n\n  if ('Widget' in normalized && typeof normalized.Widget === 'function') {\n    if (typeof metadata.title !== 'string' || metadata.title.length === 0) {\n      throw new Error(`Injection widget \"${metadata.id}\" from \"${moduleId}\" must have a title`)\n    }\n    return normalized\n  }\n\n  if (!isDataWidgetModule(normalized as Record<string, unknown>)) {\n    throw new Error(\n      `Injection widget \"${metadata.id}\" from \"${moduleId}\" must export either Widget component or a declarative data payload`\n    )\n  }\n\n  return normalized\n}\n\nfunction isLoadedInjectionWidget(\n  module: InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }\n): module is LoadedWidgetModule {\n  return 'Widget' in module && typeof module.Widget === 'function'\n}\n\nfunction isLoadedInjectionDataWidget(\n  module: InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }\n): module is LoadedDataWidgetModule {\n  return !isLoadedInjectionWidget(module)\n}\n\nasync function loadEntry(entry: WidgetEntry): Promise<InjectionAnyWidgetModule<any, any> & { metadata: InjectionWidgetMetadata }> {\n  if (!widgetCache.has(entry.key)) {\n    const promise = entry.loader().then((mod) => ensureValidInjectionModule(mod, entry.key, entry.moduleId))\n    widgetCache.set(entry.key, promise)\n  }\n  return widgetCache.get(entry.key)!\n}\n\nfunction getEnabledModuleIdsForInjection(): ReadonlySet<string> {\n  // Prefer the explicit enabled-modules registry populated by bootstrap.\n  // This is the only signal that includes modules without injection widgets\n  // (for example `ai_assistant`), so it is required for `requiredModules`\n  // gating to be sound.\n  const explicit = readGlobalEnabledModuleIds() ?? _enabledModuleIds\n  if (explicit) return explicit\n\n  // Fallback: derive from injection tables and widget entries. This keeps\n  // older bootstrap paths (and callers that have not yet wired\n  // `registerEnabledModuleIds`) working \u2014 at the cost of mis-classifying\n  // dependency modules that ship no widgets. New apps MUST call\n  // `registerEnabledModuleIds` to get accurate gating.\n  const enabled = new Set<string>()\n  const tables = readGlobalInjectionTables() ?? _coreInjectionTables ?? []\n  for (const entry of tables) {\n    if (entry?.moduleId) enabled.add(entry.moduleId)\n  }\n  const entries = readGlobalInjectionWidgets() ?? _coreInjectionWidgetEntries ?? []\n  for (const entry of entries) {\n    if (entry?.moduleId) enabled.add(entry.moduleId)\n  }\n  return enabled\n}\n\nfunction widgetMissingRequiredModules(\n  metadata: InjectionWidgetMetadata,\n  enabledModuleIds: ReadonlySet<string>,\n): string[] {\n  const required = metadata.requiredModules\n  if (!Array.isArray(required) || required.length === 0) return []\n  const missing: string[] = []\n  for (const moduleId of required) {\n    if (typeof moduleId !== 'string' || moduleId.length === 0) continue\n    if (!enabledModuleIds.has(moduleId)) missing.push(moduleId)\n  }\n  return missing\n}\n\nconst warnedRequiredModuleSkips = new Set<string>()\n\nfunction warnSkippedWidget(metadataId: string, missingModules: string[]) {\n  const key = `${metadataId}:${missingModules.join(',')}`\n  if (warnedRequiredModuleSkips.has(key)) return\n  warnedRequiredModuleSkips.add(key)\n  if (process.env.NODE_ENV === 'development') {\n    console.debug(\n      `[InjectionLoader] Skipping widget \"${metadataId}\" \u2014 required module(s) not enabled: ${missingModules.join(', ')}`,\n    )\n  }\n}\n\nasync function getResolvedEntriesForSpot(spotId: InjectionSpotId): Promise<TableEntry[]> {\n  const table = await loadInjectionTable()\n  const exactEntries = table.get(spotId) ?? []\n  const wildcardEntries: TableEntry[] = []\n\n  for (const [candidateSpotId, candidateEntries] of table.entries()) {\n    if (candidateSpotId === spotId) continue\n    if (!candidateSpotId.includes('*')) continue\n    if (!matchWildcardPattern(spotId, candidateSpotId)) continue\n    wildcardEntries.push(...candidateEntries)\n  }\n\n  const dedupedEntries = new Map<string, TableEntry>()\n  for (const entry of [...exactEntries, ...wildcardEntries]) {\n    const cacheKey = `${entry.moduleId}:${entry.widgetId}`\n    const previous = dedupedEntries.get(cacheKey)\n    if (!previous || (entry.priority ?? 0) > (previous.priority ?? 0)) {\n      dedupedEntries.set(cacheKey, entry)\n    }\n  }\n\n  return Array.from(dedupedEntries.values()).sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))\n}\n\nexport async function loadAllInjectionWidgets(): Promise<LoadedInjectionWidget[]> {\n  const widgetEntries = await loadWidgetEntries()\n  const enabledModuleIds = getEnabledModuleIdsForInjection()\n  const loaded = await Promise.all(\n    widgetEntries.map(async (entry) => {\n      const module = await loadEntry(entry)\n      if (!isLoadedInjectionWidget(module)) return null\n      const missing = widgetMissingRequiredModules(module.metadata, enabledModuleIds)\n      if (missing.length > 0) {\n        warnSkippedWidget(module.metadata.id, missing)\n        return null\n      }\n      return { ...module, moduleId: entry.moduleId, key: entry.key }\n    })\n  )\n  const byId = new Map<string, LoadedInjectionWidget>()\n  for (const widget of loaded) {\n    if (!widget) continue\n    if (!byId.has(widget.metadata.id)) {\n      byId.set(widget.metadata.id, widget)\n    }\n  }\n  return Array.from(byId.values())\n}\n\nexport async function loadInjectionWidgetById(widgetId: string): Promise<LoadedInjectionWidget | null> {\n  const widgetEntries = await loadWidgetEntries()\n  const enabledModuleIds = getEnabledModuleIdsForInjection()\n  for (const entry of widgetEntries) {\n    const module = await loadEntry(entry)\n    if (!isLoadedInjectionWidget(module)) continue\n    if (module.metadata.id === widgetId) {\n      const missing = widgetMissingRequiredModules(module.metadata, enabledModuleIds)\n      if (missing.length > 0) {\n        warnSkippedWidget(module.metadata.id, missing)\n        return null\n      }\n      return { ...module, moduleId: entry.moduleId, key: entry.key }\n    }\n  }\n  return null\n}\n\nexport async function loadInjectionDataWidgetById(widgetId: string): Promise<LoadedInjectionDataWidget | null> {\n  const widgetEntries = await loadWidgetEntries()\n  const enabledModuleIds = getEnabledModuleIdsForInjection()\n  for (const entry of widgetEntries) {\n    const module = await loadEntry(entry)\n    if (!isLoadedInjectionDataWidget(module)) continue\n    if (module.metadata.id === widgetId) {\n      const missing = widgetMissingRequiredModules(module.metadata, enabledModuleIds)\n      if (missing.length > 0) {\n        warnSkippedWidget(module.metadata.id, missing)\n        return null\n      }\n      return { ...module, moduleId: entry.moduleId, key: entry.key }\n    }\n  }\n  return null\n}\n\nexport async function loadInjectionWidgetsForSpot(spotId: InjectionSpotId): Promise<LoadedInjectionWidget[]> {\n  const entries = await getResolvedEntriesForSpot(spotId)\n  const widgets: LoadedInjectionWidget[] = []\n  for (const { widgetId, placement, priority } of entries) {\n    const widget = await loadInjectionWidgetById(widgetId)\n    if (!widget) continue\n    const combinedPlacement = placement\n      ? { ...placement, priority: typeof priority === 'number' ? priority : 0 }\n      : { priority: typeof priority === 'number' ? priority : 0 }\n    widgets.push({ ...widget, placement: combinedPlacement })\n  }\n  return widgets\n}\n\nexport async function loadInjectionDataWidgetsForSpot(spotId: InjectionSpotId): Promise<LoadedInjectionDataWidget[]> {\n  const entries = await getResolvedEntriesForSpot(spotId)\n  const widgets: LoadedInjectionDataWidget[] = []\n  for (const { widgetId, placement, priority } of entries) {\n    const widget = await loadInjectionDataWidgetById(widgetId)\n    if (!widget) continue\n    const combinedPlacement = placement\n      ? { ...placement, priority: typeof priority === 'number' ? priority : 0 }\n      : { priority: typeof priority === 'number' ? priority : 0 }\n    widgets.push({ ...widget, placement: combinedPlacement })\n  }\n  return widgets\n}\n"],
+  "mappings": "AACA,SAAS,4BAA4B;AAWrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAkCP,IAAI,8BAAmE;AACvE,IAAI,uBAAwF;AAC5F,IAAI,oBAAgD;AACpD,IAAI,4BAA4B;AAChC,MAAM,+BAA+B;AACrC,MAAM,8BAA8B;AACpC,MAAM,gCAAgC;AACtC,MAAM,wCAAwC;AAC9C,MAAM,mCAAmC;AAEzC,SAAS,6BAAkE;AACzE,MAAI;AACF,UAAM,QAAS,WAAuC,4BAA4B;AAClF,WAAO,MAAM,QAAQ,KAAK,IAAK,QAAyC;AAAA,EAC1E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA4B,SAAuC;AAC1E,MAAI;AACF;AAAC,IAAC,WAAuC,4BAA4B,IAAI;AAAA,EAC3E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,6BAAyD;AAChE,MAAI;AACF,UAAM,QAAS,WAAuC,6BAA6B;AACnF,QAAI,iBAAiB,IAAK,QAAO;AACjC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA4B,KAA0B;AAC7D,MAAI;AACF;AAAC,IAAC,WAAuC,6BAA6B,IAAI;AAAA,EAC5E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,4BAA6F;AACpG,MAAI;AACF,UAAM,QAAS,WAAuC,2BAA2B;AACjF,WAAO,MAAM,QAAQ,KAAK,IAAK,QAAqE;AAAA,EACtG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BAA2B,QAAkE;AACpG,MAAI;AACF;AAAC,IAAC,WAAuC,2BAA2B,IAAI;AAAA,EAC1E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,qCAAoD;AAC3D,MAAI;AACF,UAAM,QAAS,WAAuC,qCAAqC;AAC3F,WAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oCAAoC,SAAiB;AAC5D,MAAI;AACF;AAAC,IAAC,WAAuC,qCAAqC,IAAI;AAAA,EACpF,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,iCAAiC;AACxC,+BAA6B;AAC7B,sCAAoC,yBAAyB;AAC7D,iCAA+B;AAE/B,MAAI,OAAO,WAAW,YAAa;AAEnC,SAAO,cAAc,IAAI,YAAY,kCAAkC;AAAA,IACrE,QAAQ,EAAE,SAAS,0BAA0B;AAAA,EAC/C,CAAC,CAAC;AACJ;AAEO,SAAS,6BAA6B,SAAuC;AAClF,MAAI,gCAAgC,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAClF,YAAQ,MAAM,8EAA8E;AAAA,EAC9F;AACA,QAAM,eAAe,uCAAuC,OAAO;AACnE,gCAA8B;AAC9B,8BAA4B,YAAY;AACxC,iCAA+B;AACjC;AAEO,SAAS,0BAAwD;AACtE,QAAM,gBAAgB,2BAA2B;AACjD,MAAI,cAAe,QAAO;AAC1B,MAAI,CAAC,6BAA6B;AAEhC,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,CAAC;AAAA,IACV;AACA,UAAM,IAAI,MAAM,sGAAsG;AAAA,EACxH;AACA,SAAO;AACT;AAEO,SAAS,4BAA4B,QAAkE;AAC5G,MAAI,yBAAyB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC3E,YAAQ,MAAM,6EAA6E;AAAA,EAC7F;AACA,QAAM,cAAc,sCAAsC,MAAM;AAChE,yBAAuB;AACvB,6BAA2B,WAAW;AACtC,iCAA+B;AACjC;AAWO,SAAS,yBAAyB,WAA6B;AACpE,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,YAAY,WAAW;AAChC,QAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,MAAK,IAAI,QAAQ;AAAA,EAC5E;AACA,MAAI,sBAAsB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AACxE,YAAQ,MAAM,0EAA0E;AAAA,EAC1F;AACA,sBAAoB;AACpB,8BAA4B,IAAI;AAChC,iCAA+B;AACjC;AAEO,SAAS,sBAAkD;AAChE,SAAO,2BAA2B,KAAK;AACzC;AAEO,SAAS,8BAAsC;AACpD,QAAM,gBAAgB,mCAAmC;AACzD,MAAI,kBAAkB,KAAM,QAAO;AACnC,SAAO;AACT;AAEO,SAAS,oCAAoC,UAAkC;AACpF,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,MAAM;AAAA,IAAC;AAAA,EAChB;AAEA,QAAM,UAAU,MAAM,SAAS;AAC/B,SAAO,iBAAiB,kCAAkC,OAAO;AACjE,SAAO,MAAM;AACX,WAAO,oBAAoB,kCAAkC,OAAO;AAAA,EACtE;AACF;AAEO,SAAS,yBAAmF;AACjG,QAAM,eAAe,0BAA0B;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,CAAC,sBAAsB;AAEzB,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,CAAC;AAAA,IACV;AACA,UAAM,IAAI,MAAM,oGAAoG;AAAA,EACtH;AACA,SAAO;AACT;AAEA,IAAI,uBAAsD;AAW1D,IAAI,wBAA4E;AAEhF,SAAS,sBAAsB,OAAyG;AACtI,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc;AACtE;AAMO,SAAS,iCAAiC;AAC/C,yBAAuB;AACvB,0BAAwB;AACxB,cAAY,MAAM;AAClB,4BAA0B,MAAM;AAClC;AAEA,eAAe,oBAA4C;AACzD,MAAI,CAAC,sBAAsB;AACzB,UAAM,UAAU,QAAQ,QAAQ,EAAE;AAAA,MAAK,MACrC,wBAAwB,EAAE,IAAI,CAAC,WAAW;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,MAAM,YAAY;AAAA,MAC9B,EAAE;AAAA,IACJ;AACA,2BAAuB,QAAQ,MAAM,CAAC,QAAQ;AAC5C,UAAI,yBAAyB,SAAS;AACpC,+BAAuB;AAAA,MACzB;AACA,YAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,qBAAkE;AAC/E,MAAI,CAAC,uBAAuB;AAC1B,UAAM,UAAU,QAAQ,QAAQ,EAAE,KAAK,MAAM;AAC3C,YAAM,OAAO,uBAAuB;AACpC,YAAM,QAAQ,oBAAI,IAAmC;AAErD,iBAAW,SAAS,MAAM;AACxB,cAAM,iBAAiB,MAAM,SAAS,CAAC;AACvC,mBAAW,CAAC,QAAQ,SAAS,KAAK,OAAO,QAAQ,cAAc,GAAG;AAChE,gBAAM,UAAU,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC,SAAS;AACjE,gBAAM,WAAW,MAAM,IAAI,MAAM,KAAK,CAAC;AACvC,qBAAW,eAAe,SAAS;AACjC,gBAAI,OAAO,gBAAgB,UAAU;AACnC,uBAAS,KAAK,EAAE,UAAU,aAAa,UAAU,MAAM,UAAU,UAAU,EAAE,CAAC;AAC9E;AAAA,YACF;AACA,gBAAI,sBAAsB,WAAW,GAAG;AACtC,oBAAM,EAAE,UAAU,WAAW,GAAG,GAAG,UAAU,IAAI;AACjD,uBAAS,KAAK;AAAA,gBACZ;AAAA,gBACA,UAAU,MAAM;AAAA,gBAChB,UAAU,OAAO,aAAa,WAAW,WAAW;AAAA,gBACpD;AAAA,cACF,CAAC;AACD;AAAA,YACF;AAAA,UACF;AACA,gBAAM,IAAI,QAAQ,QAAQ;AAAA,QAC5B;AAAA,MACF;AAEA,iBAAW,CAAC,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG;AAC/C,cAAM,IAAI,QAAQ,QAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE,CAAC;AAAA,MACjF;AAEA,aAAO;AAAA,IACT,CAAC;AACD,4BAAwB,QAAQ,MAAM,CAAC,QAAQ;AAC7C,UAAI,0BAA0B,SAAS;AACrC,gCAAwB;AAAA,MAC1B;AACA,YAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,MAAM,cAAc,oBAAI,IAAiG;AAEzH,SAAS,mBAAmB,QAAmE;AAC7F,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,KAAK,KAAK,CAAC,QAAQ,OAAO,MAAM;AACzC;AAEA,SAAS,2BAA2B,KAAc,KAAa,UAAgG;AAC7J,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,QAAM,SAAU,IAAyD,WAAY;AACrF,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,MAAI,EAAE,cAAc,WAAW,CAAC,OAAO,YAAY,OAAO,OAAO,aAAa,UAAU;AACtF,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,uBAAuB;AAAA,EACpF;AACA,QAAM,WAAW,OAAO;AACxB,MAAI,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,0CAA0C;AAAA,EACvG;AACA,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH;AAAA,EACF;AAEA,MAAI,YAAY,cAAc,OAAO,WAAW,WAAW,YAAY;AACrE,QAAI,OAAO,SAAS,UAAU,YAAY,SAAS,MAAM,WAAW,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,WAAW,QAAQ,qBAAqB;AAAA,IAC1F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,mBAAmB,UAAqC,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,qBAAqB,SAAS,EAAE,WAAW,QAAQ;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,wBACP,QAC8B;AAC9B,SAAO,YAAY,UAAU,OAAO,OAAO,WAAW;AACxD;AAEA,SAAS,4BACP,QACkC;AAClC,SAAO,CAAC,wBAAwB,MAAM;AACxC;AAEA,eAAe,UAAU,OAAyG;AAChI,MAAI,CAAC,YAAY,IAAI,MAAM,GAAG,GAAG;AAC/B,UAAM,UAAU,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,2BAA2B,KAAK,MAAM,KAAK,MAAM,QAAQ,CAAC;AACvG,gBAAY,IAAI,MAAM,KAAK,OAAO;AAAA,EACpC;AACA,SAAO,YAAY,IAAI,MAAM,GAAG;AAClC;AAEA,SAAS,kCAAuD;AAK9D,QAAM,WAAW,2BAA2B,KAAK;AACjD,MAAI,SAAU,QAAO;AAOrB,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,SAAS,0BAA0B,KAAK,wBAAwB,CAAC;AACvE,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,SAAU,SAAQ,IAAI,MAAM,QAAQ;AAAA,EACjD;AACA,QAAM,UAAU,2BAA2B,KAAK,+BAA+B,CAAC;AAChF,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,SAAU,SAAQ,IAAI,MAAM,QAAQ;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,6BACP,UACA,kBACU;AACV,QAAM,WAAW,SAAS;AAC1B,MAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,EAAG,QAAO,CAAC;AAC/D,QAAM,UAAoB,CAAC;AAC3B,aAAW,YAAY,UAAU;AAC/B,QAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG;AAC3D,QAAI,CAAC,iBAAiB,IAAI,QAAQ,EAAG,SAAQ,KAAK,QAAQ;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,MAAM,4BAA4B,oBAAI,IAAY;AAElD,SAAS,kBAAkB,YAAoB,gBAA0B;AACvE,QAAM,MAAM,GAAG,UAAU,IAAI,eAAe,KAAK,GAAG,CAAC;AACrD,MAAI,0BAA0B,IAAI,GAAG,EAAG;AACxC,4BAA0B,IAAI,GAAG;AACjC,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,YAAQ;AAAA,MACN,sCAAsC,UAAU,4CAAuC,eAAe,KAAK,IAAI,CAAC;AAAA,IAClH;AAAA,EACF;AACF;AAEA,eAAe,0BAA0B,QAAgD;AACvF,QAAM,QAAQ,MAAM,mBAAmB;AACvC,QAAM,eAAe,MAAM,IAAI,MAAM,KAAK,CAAC;AAC3C,QAAM,kBAAgC,CAAC;AAEvC,aAAW,CAAC,iBAAiB,gBAAgB,KAAK,MAAM,QAAQ,GAAG;AACjE,QAAI,oBAAoB,OAAQ;AAChC,QAAI,CAAC,gBAAgB,SAAS,GAAG,EAAG;AACpC,QAAI,CAAC,qBAAqB,QAAQ,eAAe,EAAG;AACpD,oBAAgB,KAAK,GAAG,gBAAgB;AAAA,EAC1C;AAEA,QAAM,iBAAiB,oBAAI,IAAwB;AACnD,aAAW,SAAS,CAAC,GAAG,cAAc,GAAG,eAAe,GAAG;AACzD,UAAM,WAAW,GAAG,MAAM,QAAQ,IAAI,MAAM,QAAQ;AACpD,UAAM,WAAW,eAAe,IAAI,QAAQ;AAC5C,QAAI,CAAC,aAAa,MAAM,YAAY,MAAM,SAAS,YAAY,IAAI;AACjE,qBAAe,IAAI,UAAU,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,eAAe,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;AACjG;AAEA,eAAsB,0BAA4D;AAChF,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,mBAAmB,gCAAgC;AACzD,QAAM,SAAS,MAAM,QAAQ;AAAA,IAC3B,cAAc,IAAI,OAAO,UAAU;AACjC,YAAM,SAAS,MAAM,UAAU,KAAK;AACpC,UAAI,CAAC,wBAAwB,MAAM,EAAG,QAAO;AAC7C,YAAM,UAAU,6BAA6B,OAAO,UAAU,gBAAgB;AAC9E,UAAI,QAAQ,SAAS,GAAG;AACtB,0BAAkB,OAAO,SAAS,IAAI,OAAO;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,QAAM,OAAO,oBAAI,IAAmC;AACpD,aAAW,UAAU,QAAQ;AAC3B,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,KAAK,IAAI,OAAO,SAAS,EAAE,GAAG;AACjC,WAAK,IAAI,OAAO,SAAS,IAAI,MAAM;AAAA,IACrC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AACjC;AAEA,eAAsB,wBAAwB,UAAyD;AACrG,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,mBAAmB,gCAAgC;AACzD,aAAW,SAAS,eAAe;AACjC,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,QAAI,CAAC,wBAAwB,MAAM,EAAG;AACtC,QAAI,OAAO,SAAS,OAAO,UAAU;AACnC,YAAM,UAAU,6BAA6B,OAAO,UAAU,gBAAgB;AAC9E,UAAI,QAAQ,SAAS,GAAG;AACtB,0BAAkB,OAAO,SAAS,IAAI,OAAO;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,4BAA4B,UAA6D;AAC7G,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,mBAAmB,gCAAgC;AACzD,aAAW,SAAS,eAAe;AACjC,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,QAAI,CAAC,4BAA4B,MAAM,EAAG;AAC1C,QAAI,OAAO,SAAS,OAAO,UAAU;AACnC,YAAM,UAAU,6BAA6B,OAAO,UAAU,gBAAgB;AAC9E,UAAI,QAAQ,SAAS,GAAG;AACtB,0BAAkB,OAAO,SAAS,IAAI,OAAO;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,4BAA4B,QAA2D;AAC3G,QAAM,UAAU,MAAM,0BAA0B,MAAM;AACtD,QAAM,UAAmC,CAAC;AAC1C,aAAW,EAAE,UAAU,WAAW,SAAS,KAAK,SAAS;AACvD,UAAM,SAAS,MAAM,wBAAwB,QAAQ;AACrD,QAAI,CAAC,OAAQ;AACb,UAAM,oBAAoB,YACtB,EAAE,GAAG,WAAW,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE,IACtE,EAAE,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE;AAC5D,YAAQ,KAAK,EAAE,GAAG,QAAQ,WAAW,kBAAkB,CAAC;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,eAAsB,gCAAgC,QAA+D;AACnH,QAAM,UAAU,MAAM,0BAA0B,MAAM;AACtD,QAAM,UAAuC,CAAC;AAC9C,aAAW,EAAE,UAAU,WAAW,SAAS,KAAK,SAAS;AACvD,UAAM,SAAS,MAAM,4BAA4B,QAAQ;AACzD,QAAI,CAAC,OAAQ;AACb,UAAM,oBAAoB,YACtB,EAAE,GAAG,WAAW,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE,IACtE,EAAE,UAAU,OAAO,aAAa,WAAW,WAAW,EAAE;AAC5D,YAAQ,KAAK,EAAE,GAAG,QAAQ,WAAW,kBAAkB,CAAC;AAAA,EAC1D;AACA,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.3-develop.3525.3.cc18b8a43f",
+  "version": "0.6.3-develop.3574.1.f3c5dcf345",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -92,9 +92,10 @@
     "@mikro-orm/core": "^7.0.17",
     "@mikro-orm/decorators": "^7.0.17",
     "@mikro-orm/postgresql": "^7.0.17",
-    "@open-mercato/cache": "0.6.3-develop.3525.3.cc18b8a43f",
+    "@open-mercato/cache": "0.6.3-develop.3574.1.f3c5dcf345",
     "dotenv": "^17.4.2",
     "rate-limiter-flexible": "^11.1.0",
+    "re2js": "2.8.2",
     "reflect-metadata": "^0.2.2",
     "sanitize-html": "^2.17.4",
     "undici": "^8.3.0"

package/src/lib/crud/__tests__/sync-event-runner.test.ts

@@ -22,6 +22,11 @@ describe('matchesEventPattern', () => {
     expect(matchesEventPattern('example.*', 'example.todo.created')).toBe(true)
     expect(matchesEventPattern('example.*', 'example.item.updated')).toBe(true)
   })
+
+  it('treats regex metacharacters as literals', () => {
+    expect(matchesEventPattern('example.(todo).*', 'example.(todo).created')).toBe(true)
+    expect(matchesEventPattern('example.+.*', 'example.todo.created')).toBe(false)
+  })
 })
 
 describe('collectSyncSubscribers', () => {

package/src/lib/crud/sync-event-runner.ts

@@ -1,22 +1,13 @@
 import type { SyncCrudEventPayload } from './sync-event-types'
 import type { SyncSubscriberEntry } from './sync-subscriber-store'
+import { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'
 
 // ---------------------------------------------------------------------------
 // Event pattern matching
 // ---------------------------------------------------------------------------
 
-function escapeRegex(input: string): string {
-  // Escape all characters with special meaning in regular expressions
-  return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-}
-
 export function matchesEventPattern(pattern: string, eventId: string): boolean {
-  if (pattern === eventId) return true
-  if (pattern === '*') return true
-  // Escape the pattern for literal use in a RegExp, then turn "\*" into ".*" for wildcard support
-  const escaped = escapeRegex(pattern).replace(/\\\*/g, '.*')
-  const regex = new RegExp('^' + escaped + '$')
-  return regex.test(eventId)
+  return matchWildcardPattern(eventId, pattern)
 }
 
 // ---------------------------------------------------------------------------

package/src/lib/events/__tests__/patterns.test.ts

@@ -19,6 +19,11 @@ describe('matchEventPattern', () => {
       expect(matchEventPattern('customers.person', 'customers.*')).toBe(true)
       expect(matchEventPattern('customers.person.deleted', 'customers.*')).toBe(false)
     })
+
+    it('treats regex metacharacters as literal pattern characters', () => {
+      expect(matchEventPattern('customers.(person).created', 'customers.(person).*')).toBe(true)
+      expect(matchEventPattern('customers.person.created', 'customers.+.*')).toBe(false)
+    })
   })
 
   describe('prefix mode', () => {

package/src/lib/events/patterns.ts

@@ -1,24 +1,11 @@
+import { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'
+
 export type EventPatternMode = 'single-segment' | 'prefix'
 
 type MatchEventPatternOptions = {
   mode?: EventPatternMode
 }
 
-const singleSegmentPatternCache = new Map<string, RegExp>()
-
-function getSingleSegmentPatternRegex(pattern: string): RegExp {
-  const existing = singleSegmentPatternCache.get(pattern)
-  if (existing) return existing
-
-  const regexPattern = pattern
-    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-    .replace(/\*/g, '[^.]+')
-
-  const compiled = new RegExp(`^${regexPattern}$`)
-  singleSegmentPatternCache.set(pattern, compiled)
-  return compiled
-}
-
 export function matchEventPattern(
   eventName: string,
   pattern: string,
@@ -44,7 +31,7 @@ export function matchEventPattern(
     return false
   }
 
-  return getSingleSegmentPatternRegex(pattern).test(eventName)
+  return matchWildcardPattern(eventName, pattern, { singleSegmentWildcard: true })
 }
 
 export function matchAnyEventPattern(

package/src/lib/patterns/__tests__/wildcard.test.ts

@@ -0,0 +1,27 @@
+import { matchWildcardPattern } from '../wildcard'
+
+describe('matchWildcardPattern', () => {
+  it('matches exact values and the global wildcard', () => {
+    expect(matchWildcardPattern('customers.person.created', 'customers.person.created')).toBe(true)
+    expect(matchWildcardPattern('customers.person.created', '*')).toBe(true)
+    expect(matchWildcardPattern('customers.person.created', 'sales.order.created')).toBe(false)
+  })
+
+  it('matches multi-segment wildcard patterns without regex execution', () => {
+    expect(matchWildcardPattern('example.todo.created', 'example.*')).toBe(true)
+    expect(matchWildcardPattern('example.todo.created', 'example.*.created')).toBe(true)
+    expect(matchWildcardPattern('example.todo.created', '*.todo.*')).toBe(true)
+    expect(matchWildcardPattern('example.todo.created', 'customers.*')).toBe(false)
+  })
+
+  it('can restrict wildcards to a single dotted segment', () => {
+    expect(matchWildcardPattern('customers.person', 'customers.*', { singleSegmentWildcard: true })).toBe(true)
+    expect(matchWildcardPattern('customers.person.deleted', 'customers.*', { singleSegmentWildcard: true })).toBe(false)
+  })
+
+  it('treats regex metacharacters as literals', () => {
+    expect(matchWildcardPattern('cache:(tenant)[1]', 'cache:(tenant)[*]')).toBe(true)
+    expect(matchWildcardPattern('cache:(tenant)[1]', 'cache:.+')).toBe(false)
+  })
+})
+

package/src/lib/patterns/wildcard.ts

@@ -0,0 +1,59 @@
+export type WildcardMatchOptions = {
+  singleSegmentWildcard?: boolean
+}
+
+function matchWildcardSegment(pattern: string, value: string, options: WildcardMatchOptions): boolean {
+  let patternIndex = 0
+  let valueIndex = 0
+  let starIndex = -1
+  let valueRetryIndex = 0
+
+  while (valueIndex < value.length) {
+    const patternChar = pattern[patternIndex]
+    const valueChar = value[valueIndex]
+
+    if (patternChar === '*') {
+      starIndex = patternIndex
+      valueRetryIndex = valueIndex
+      patternIndex += 1
+      continue
+    }
+
+    if (patternChar === valueChar) {
+      patternIndex += 1
+      valueIndex += 1
+      continue
+    }
+
+    if (
+      starIndex !== -1
+      && (!options.singleSegmentWildcard || value[valueRetryIndex] !== '.')
+    ) {
+      patternIndex = starIndex + 1
+      valueRetryIndex += 1
+      valueIndex = valueRetryIndex
+      continue
+    }
+
+    return false
+  }
+
+  while (pattern[patternIndex] === '*') {
+    patternIndex += 1
+  }
+
+  return patternIndex === pattern.length
+}
+
+export function matchWildcardPattern(
+  value: string,
+  pattern: string,
+  options: WildcardMatchOptions = {},
+): boolean {
+  if (pattern === value) return true
+  if (pattern === '*') return true
+  if (!pattern.includes('*')) return false
+
+  return matchWildcardSegment(pattern, value, options)
+}
+

package/src/lib/regex/linear.ts

@@ -0,0 +1,48 @@
+import { RE2JS } from 're2js'
+
+const DEFAULT_MAX_PATTERN_LENGTH = 500
+const DEFAULT_MAX_INPUT_LENGTH = 10_000
+const MAX_REGEX_CACHE_SIZE = 256
+
+const compiledRegexCache = new Map<string, RE2JS>()
+
+export type LinearRegexTestOptions = {
+  maxPatternLength?: number
+  maxInputLength?: number
+}
+
+export type LinearRegexTestResult =
+  | { ok: true; matched: boolean }
+  | { ok: false; reason: 'pattern_too_long' | 'input_too_long' | 'invalid_pattern' }
+
+function getCachedRegex(pattern: string): RE2JS {
+  const cached = compiledRegexCache.get(pattern)
+  if (cached) return cached
+
+  const compiled = RE2JS.compile(pattern)
+  if (compiledRegexCache.size >= MAX_REGEX_CACHE_SIZE) {
+    const oldestKey = compiledRegexCache.keys().next().value
+    if (oldestKey) compiledRegexCache.delete(oldestKey)
+  }
+  compiledRegexCache.set(pattern, compiled)
+  return compiled
+}
+
+export function testLinearRegex(
+  pattern: string,
+  input: string,
+  options: LinearRegexTestOptions = {},
+): LinearRegexTestResult {
+  const maxPatternLength = options.maxPatternLength ?? DEFAULT_MAX_PATTERN_LENGTH
+  const maxInputLength = options.maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH
+
+  if (pattern.length > maxPatternLength) return { ok: false, reason: 'pattern_too_long' }
+  if (input.length > maxInputLength) return { ok: false, reason: 'input_too_long' }
+
+  try {
+    return { ok: true, matched: getCachedRegex(pattern).test(input) }
+  } catch {
+    return { ok: false, reason: 'invalid_pattern' }
+  }
+}
+

package/src/modules/entities/__tests__/validation.test.ts

@@ -1,5 +1,9 @@
 /** @jest-environment node */
-import { validateValuesAgainstDefs } from '../validation'
+import {
+  MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,
+  MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH,
+  validateValuesAgainstDefs,
+} from '../validation'
 
 describe('validateValuesAgainstDefs', () => {
   it('validates required and integer/float comparisons', () => {
@@ -48,5 +52,96 @@ describe('validateValuesAgainstDefs', () => {
     r = validateValuesAgainstDefs({ code: 'ok', status: 'open' }, defs as any)
     expect(r.ok).toBe(true)
   })
-})
 
+  it('evaluates dangerous backtracking regex rules in bounded time', () => {
+    const defs = [
+      {
+        key: 'eu_vat_number',
+        kind: 'text',
+        configJson: {
+          validation: [
+            {
+              rule: 'regex',
+              param: '^(GB|FR|DE|IT|ES|PL|NL|BE|SE|AT|DK|FI|PT|IE|GR|CZ|RO|HU|SK|BG|HR|SI|LT|LV|EE|LU|MT|CY)?([0-9A-Za-z]+)*$',
+              message: 'bad vat',
+            },
+          ],
+        },
+      },
+    ]
+
+    const startedAt = Date.now()
+    const result = validateValuesAgainstDefs(
+      { eu_vat_number: `${'A'.repeat(64)}!` },
+      defs as any,
+    )
+
+    expect(Date.now() - startedAt).toBeLessThan(2_000)
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_eu_vat_number']).toBe('bad vat')
+  })
+
+  it('fails closed for unsupported regex syntax', () => {
+    const defs = [
+      {
+        key: 'code',
+        kind: 'text',
+        configJson: {
+          validation: [
+            { rule: 'regex', param: '(?=safe)safe', message: 'unsupported regex' },
+          ],
+        },
+      },
+    ]
+
+    const result = validateValuesAgainstDefs({ code: 'safe' }, defs as any)
+
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_code']).toBe('unsupported regex')
+  })
+
+  it('fails closed before testing oversized regex input values', () => {
+    const defs = [
+      {
+        key: 'body',
+        kind: 'multiline',
+        configJson: {
+          validation: [
+            { rule: 'regex', param: '^a+$', message: 'body too large' },
+          ],
+        },
+      },
+    ]
+
+    const result = validateValuesAgainstDefs(
+      { body: 'a'.repeat(MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH + 1) },
+      defs as any,
+    )
+
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_body']).toBe('body too large')
+  })
+
+  it('fails closed before testing oversized regex patterns', () => {
+    const defs = [
+      {
+        key: 'code',
+        kind: 'text',
+        configJson: {
+          validation: [
+            {
+              rule: 'regex',
+              param: `^${'a'.repeat(MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH)}$`,
+              message: 'pattern too large',
+            },
+          ],
+        },
+      },
+    ]
+
+    const result = validateValuesAgainstDefs({ code: 'a' }, defs as any)
+
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_code']).toBe('pattern too large')
+  })
+})

package/src/modules/entities/validation.ts

@@ -1,4 +1,8 @@
 import { z } from 'zod'
+import { testLinearRegex } from '../../lib/regex/linear'
+
+export const MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH = 500
+export const MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH = 10_000
 
 // Supported rule types for custom fields validation
 export const VALIDATION_RULES = [
@@ -28,7 +32,11 @@ export const validationRuleSchema = z.discriminatedUnion('rule', [
   z.object({ rule: z.literal('gte'), param: z.number(), message: z.string().min(1) }),
   z.object({ rule: z.literal('eq'), param: z.any(), message: z.string().min(1) }),
   z.object({ rule: z.literal('ne'), param: z.any(), message: z.string().min(1) }),
-  z.object({ rule: z.literal('regex'), param: z.string().min(1), message: z.string().min(1) }),
+  z.object({
+    rule: z.literal('regex'),
+    param: z.string().min(1),
+    message: z.string().min(1),
+  }),
 ])
 
 export type ValidationRule = z.infer<typeof validationRuleSchema>
@@ -83,13 +91,11 @@ function evalRule(rule: ValidationRule, value: any, kind: string): string | null
       return value !== (rule as any).param ? null : rule.message
     case 'regex':
       if (isEmpty(value)) return null
-      try {
-        const re = new RegExp((rule as any).param)
-        return re.test(String(value)) ? null : rule.message
-      } catch {
-        // Invalid regex in definition: consider it failed safe and return message
-        return rule.message
-      }
+      const regexResult = testLinearRegex(String((rule as any).param), String(value), {
+        maxPatternLength: MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,
+        maxInputLength: MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH,
+      })
+      return regexResult.ok && regexResult.matched ? null : rule.message
     default:
       return null
   }
@@ -115,4 +121,3 @@ export function validateValuesAgainstDefs(
   }
   return { ok: Object.keys(errors).length === 0, fieldErrors: errors }
 }
-

package/src/modules/widgets/__tests__/injection-loader.required-modules.test.ts

@@ -173,4 +173,25 @@ describe('Injection loader — requiredModules gating (#1849)', () => {
     expect(ids).toContain(ALWAYS_AVAILABLE_WIDGET_ID)
     expect(ids).not.toContain(REQUIRES_AI_WIDGET_ID)
   })
+
+  it('loads wildcard spot entries without regex pattern execution', async () => {
+    invalidateInjectionWidgetCache()
+    registerCoreInjectionWidgets([
+      makeWidgetEntry('host', 'host/widgets/injection/always-available/widget.ts', async () => alwaysAvailableWidget),
+    ])
+    registerCoreInjectionTables([
+      {
+        moduleId: 'host',
+        table: {
+          'data-table:host.*:search-trailing': [
+            { widgetId: ALWAYS_AVAILABLE_WIDGET_ID, priority: 50 },
+          ],
+        },
+      },
+    ])
+    registerEnabledModuleIds(['host'])
+
+    const loaded = await loadInjectionWidgetsForSpot(HOST_SPOT_ID)
+    expect(loaded.map((widget) => widget.metadata.id)).toEqual([ALWAYS_AVAILABLE_WIDGET_ID])
+  })
 })

package/src/modules/widgets/injection-loader.ts

@@ -1,4 +1,5 @@
 import type { ModuleInjectionWidgetEntry } from '../registry'
+import { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'
 import type {
   InjectionAnyWidgetModule,
   InjectionDataWidgetModule,
@@ -452,8 +453,7 @@ async function getResolvedEntriesForSpot(spotId: InjectionSpotId): Promise<Table
   for (const [candidateSpotId, candidateEntries] of table.entries()) {
     if (candidateSpotId === spotId) continue
     if (!candidateSpotId.includes('*')) continue
-    const pattern = new RegExp(`^${candidateSpotId.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')}$`)
-    if (!pattern.test(spotId)) continue
+    if (!matchWildcardPattern(spotId, candidateSpotId)) continue
     wildcardEntries.push(...candidateEntries)
   }