@open-mercato/shared 0.6.4-develop.4038.1.91ce075c8a → 0.6.4-develop.4095.1.9c790dc021

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 212 entry points
+[build:shared] found 213 entry points
 [build:shared] built successfully

package/dist/lib/encryption/tenantDataEncryptionService.js

@@ -174,6 +174,12 @@ class TenantDataEncryptionService {
       await this.cache.delete(tag);
     }
   }
+  async getEncryptedFieldNames(entityId, tenantId, organizationId) {
+    if (!this.isEnabled()) return [];
+    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null });
+    if (!map || !map.fields?.length) return [];
+    return map.fields.map((rule) => rule.field).filter((field) => typeof field === "string" && field.trim().length > 0);
+  }
   encryptFields(obj, fields, dek) {
     const clone = { ...obj };
     for (const rule of fields) {

package/dist/lib/encryption/tenantDataEncryptionService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/tenantDataEncryptionService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    // eslint-disable-next-line no-console\n    console.debug(`${event} [tenant-encryption]`, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n *\n * NOTE (issue #1810 follow-up): `decryptFields` no longer calls this helper for\n * entity-field decryption \u2014 typed string columns whose contents happen to look\n * like JSON (e.g. a display name `{\"a\":1}`) must remain raw strings to avoid\n * downstream React-render crashes. Callers that legitimately need the parse\n * (audit-log jsonb columns, custom-field rotation, encryption CLI) MUST invoke\n * `parseDecryptedFieldValue` themselves on the decrypted payload.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n\n  constructor(\n    private em: EntityManager,\n    opts?: { cache?: CacheStrategy; kms?: KmsService }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached) return cached\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async resolveDekForEncrypt(tenantId: string | null): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    const created = await this.kms.createTenantDek(tenantId)\n    if (created) this.dekCache.set(tenantId, created)\n    return created ?? null\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn: any = (this.em as any)?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length ? rows[0] : null\n    if (!row) return null\n    return {\n      entityId: row.entity_id || row.entityId || key.entityId,\n      fields: Array.isArray(row.fields_json)\n        ? (row.fields_json as EncryptedFieldRule[])\n        : Array.isArray(row.fieldsJson)\n          ? (row.fieldsJson as EncryptedFieldRule[])\n          : [],\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return resolved\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return mem\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return cached as EncryptionMapRecord\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return loaded\n    }\n    return null\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tag = cacheKey({ entityId, tenantId, organizationId })\n    this.memoryCache.delete(tag)\n    this.inflightMaps.delete(tag)\n    this.missCache.delete(tag)\n    if (this.cache && typeof (this.cache as any).delete === 'function') {\n      await (this.cache as any).delete(tag)\n    }\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n       // Avoid double-encrypting already encrypted payloads\n      if (isEncryptedPayload(value)) continue\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      // Entity fields are typed columns (string/text). Never auto-parse to an object \u2014\n      // it triggers React-render crashes when a string value happens to be valid JSON\n      // (issue #1810 follow-up). Custom field values use a separate helper that\n      // preserves their typed-JSON contract.\n      clone[key] = decrypted\n    }\n    return clone\n  }\n\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.resolveDekForEncrypt(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.encryptFields(payload, map.fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.getDek(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.decryptFields(payload, map.fields, dek)\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,mBAAmB,mBAAmB,qBAAqB;AACpE,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AAmBxE,MAAM,kBAAkB,IAAI,KAAK;AAEjC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AAEF,YAAQ,MAAM,GAAG,KAAK,wBAAwB,OAAO;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAqBO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEO,MAAM,4BAA4B;AAAA,EAYvC,YACU,IACR,MACA;AAFQ;AANV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAMvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AAAA,EAC3C;AAAA,EAjBA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EAgBzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,UAAoD;AACrF,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AACvE,UAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,QAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAa,KAAK,IAAY,gBAAgB;AACpD,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,WAAY,QAAO;AACxD,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,CAAC,IAAI;AAC3D,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,IAAI,aAAa,IAAI,YAAY,IAAI;AAAA,MAC/C,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAChC,IAAI,cACL,MAAM,QAAQ,IAAI,UAAU,IACzB,IAAI,aACL,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO;AAAA,MACvB;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO;AAChB,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,MAAM,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC;AAC3D,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,aAAa,OAAO,GAAG;AAC5B,SAAK,UAAU,OAAO,GAAG;AACzB,QAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,YAAO,KAAK,MAAc,OAAO,GAAG;AAAA,IACtC;AAAA,EACF;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAE3C,UAAI,mBAAmB,KAAK,EAAG;AAC/B,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AAKxB,YAAM,GAAG,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,qBAAqB,YAAY,IAAI;AAC5D,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,YAAY,IAAI;AAC9C,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    // eslint-disable-next-line no-console\n    console.debug(`${event} [tenant-encryption]`, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n *\n * NOTE (issue #1810 follow-up): `decryptFields` no longer calls this helper for\n * entity-field decryption \u2014 typed string columns whose contents happen to look\n * like JSON (e.g. a display name `{\"a\":1}`) must remain raw strings to avoid\n * downstream React-render crashes. Callers that legitimately need the parse\n * (audit-log jsonb columns, custom-field rotation, encryption CLI) MUST invoke\n * `parseDecryptedFieldValue` themselves on the decrypted payload.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n\n  constructor(\n    private em: EntityManager,\n    opts?: { cache?: CacheStrategy; kms?: KmsService }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached) return cached\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async resolveDekForEncrypt(tenantId: string | null): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    const created = await this.kms.createTenantDek(tenantId)\n    if (created) this.dekCache.set(tenantId, created)\n    return created ?? null\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn: any = (this.em as any)?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length ? rows[0] : null\n    if (!row) return null\n    return {\n      entityId: row.entity_id || row.entityId || key.entityId,\n      fields: Array.isArray(row.fields_json)\n        ? (row.fields_json as EncryptedFieldRule[])\n        : Array.isArray(row.fieldsJson)\n          ? (row.fieldsJson as EncryptedFieldRule[])\n          : [],\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return resolved\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return mem\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return cached as EncryptionMapRecord\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return loaded\n    }\n    return null\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tag = cacheKey({ entityId, tenantId, organizationId })\n    this.memoryCache.delete(tag)\n    this.inflightMaps.delete(tag)\n    this.missCache.delete(tag)\n    if (this.cache && typeof (this.cache as any).delete === 'function') {\n      await (this.cache as any).delete(tag)\n    }\n  }\n\n  async getEncryptedFieldNames(\n    entityId: string,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<string[]> {\n    if (!this.isEnabled()) return []\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) return []\n    return map.fields\n      .map((rule) => rule.field)\n      .filter((field): field is string => typeof field === 'string' && field.trim().length > 0)\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n       // Avoid double-encrypting already encrypted payloads\n      if (isEncryptedPayload(value)) continue\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      // Entity fields are typed columns (string/text). Never auto-parse to an object \u2014\n      // it triggers React-render crashes when a string value happens to be valid JSON\n      // (issue #1810 follow-up). Custom field values use a separate helper that\n      // preserves their typed-JSON contract.\n      clone[key] = decrypted\n    }\n    return clone\n  }\n\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.resolveDekForEncrypt(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.encryptFields(payload, map.fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.getDek(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.decryptFields(payload, map.fields, dek)\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,mBAAmB,mBAAmB,qBAAqB;AACpE,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AAmBxE,MAAM,kBAAkB,IAAI,KAAK;AAEjC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AAEF,YAAQ,MAAM,GAAG,KAAK,wBAAwB,OAAO;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAqBO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEO,MAAM,4BAA4B;AAAA,EAYvC,YACU,IACR,MACA;AAFQ;AANV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAMvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AAAA,EAC3C;AAAA,EAjBA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EAgBzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,UAAoD;AACrF,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AACvE,UAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,QAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAa,KAAK,IAAY,gBAAgB;AACpD,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,WAAY,QAAO;AACxD,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,CAAC,IAAI;AAC3D,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,IAAI,aAAa,IAAI,YAAY,IAAI;AAAA,MAC/C,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAChC,IAAI,cACL,MAAM,QAAQ,IAAI,UAAU,IACzB,IAAI,aACL,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO;AAAA,MACvB;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO;AAChB,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,MAAM,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC;AAC3D,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,aAAa,OAAO,GAAG;AAC5B,SAAK,UAAU,OAAO,GAAG;AACzB,QAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,YAAO,KAAK,MAAc,OAAO,GAAG;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,uBACJ,UACA,UACA,gBACmB;AACnB,QAAI,CAAC,KAAK,UAAU,EAAG,QAAO,CAAC;AAC/B,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,OAAQ,QAAO,CAAC;AACzC,WAAO,IAAI,OACR,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAC5F;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAE3C,UAAI,mBAAmB,KAAK,EAAG;AAC/B,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AAKxB,YAAM,GAAG,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,qBAAqB,YAAY,IAAI;AAC5D,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,YAAY,IAAI;AAC9C,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AACF;",
   "names": ["pending"]
 }

package/dist/lib/query/encrypted-sort.js

@@ -0,0 +1,64 @@
+import { SortDir } from "./types.js";
+const toSnakeCase = (value) => value.replace(/([A-Z])/g, "_$1").replace(/__/g, "_").toLowerCase();
+const toCamelCase = (value) => value.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+function fieldNameCandidates(field) {
+  const raw = String(field || "").trim();
+  if (!raw) return [];
+  const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)];
+  if (raw.startsWith("cf:")) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, "_"));
+  return Array.from(new Set(candidates));
+}
+async function resolveEncryptedSortFields(service, entity, sortFields, tenantId, organizationId) {
+  if (!service?.getEncryptedFieldNames) return /* @__PURE__ */ new Set();
+  if (service.isEnabled && !service.isEnabled()) return /* @__PURE__ */ new Set();
+  const encrypted = await service.getEncryptedFieldNames(entity, tenantId ?? null, organizationId ?? null);
+  const encryptedCandidates = /* @__PURE__ */ new Set();
+  for (const field of encrypted) {
+    for (const candidate of fieldNameCandidates(field)) encryptedCandidates.add(candidate);
+  }
+  const result = /* @__PURE__ */ new Set();
+  for (const field of sortFields) {
+    if (field.startsWith("cf:")) continue;
+    const matches = fieldNameCandidates(field).some((candidate) => encryptedCandidates.has(candidate));
+    if (matches) result.add(field);
+  }
+  return result;
+}
+function readField(row, field) {
+  for (const candidate of fieldNameCandidates(field)) {
+    if (Object.prototype.hasOwnProperty.call(row, candidate)) return row[candidate];
+  }
+  return void 0;
+}
+function compareValues(left, right) {
+  const leftMissing = left === null || left === void 0;
+  const rightMissing = right === null || right === void 0;
+  if (leftMissing && rightMissing) return 0;
+  if (leftMissing) return 1;
+  if (rightMissing) return -1;
+  if (left instanceof Date && right instanceof Date) return left.getTime() - right.getTime();
+  if (typeof left === "number" && typeof right === "number") return left - right;
+  if (typeof left === "boolean" && typeof right === "boolean") return Number(left) - Number(right);
+  return String(left).localeCompare(String(right), void 0, {
+    sensitivity: "base",
+    numeric: true
+  });
+}
+function sortRowsInMemory(rows, sorts) {
+  return [...rows].sort((left, right) => {
+    for (const sort of sorts) {
+      const direction = sort.dir === SortDir.Desc ? -1 : 1;
+      const compared = compareValues(readField(left, sort.field), readField(right, sort.field));
+      if (compared !== 0) return compared * direction;
+    }
+    const leftId = readField(left, "id");
+    const rightId = readField(right, "id");
+    return compareValues(leftId, rightId);
+  });
+}
+export {
+  fieldNameCandidates,
+  resolveEncryptedSortFields,
+  sortRowsInMemory
+};
+//# sourceMappingURL=encrypted-sort.js.map

package/dist/lib/query/encrypted-sort.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/query/encrypted-sort.ts"],
+  "sourcesContent": ["import type { EntityId } from '@open-mercato/shared/modules/entities'\nimport { SortDir, type Sort } from './types'\n\nexport type QueryEncryptionService = {\n  getEncryptedFieldNames?: (\n    entityId: EntityId,\n    tenantId?: string | null,\n    organizationId?: string | null,\n  ) => Promise<readonly string[]>\n  isEnabled?: () => boolean\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nexport function fieldNameCandidates(field: string): string[] {\n  const raw = String(field || '').trim()\n  if (!raw) return []\n  const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)]\n  if (raw.startsWith('cf:')) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, '_'))\n  return Array.from(new Set(candidates))\n}\n\nexport async function resolveEncryptedSortFields(\n  service: QueryEncryptionService | null | undefined,\n  entity: EntityId,\n  sortFields: readonly string[],\n  tenantId?: string | null,\n  organizationId?: string | null,\n): Promise<Set<string>> {\n  if (!service?.getEncryptedFieldNames) return new Set()\n  if (service.isEnabled && !service.isEnabled()) return new Set()\n  const encrypted = await service.getEncryptedFieldNames(entity, tenantId ?? null, organizationId ?? null)\n  const encryptedCandidates = new Set<string>()\n  for (const field of encrypted) {\n    for (const candidate of fieldNameCandidates(field)) encryptedCandidates.add(candidate)\n  }\n  const result = new Set<string>()\n  for (const field of sortFields) {\n    if (field.startsWith('cf:')) continue\n    const matches = fieldNameCandidates(field).some((candidate) => encryptedCandidates.has(candidate))\n    if (matches) result.add(field)\n  }\n  return result\n}\n\nfunction readField(row: Record<string, unknown>, field: string): unknown {\n  for (const candidate of fieldNameCandidates(field)) {\n    if (Object.prototype.hasOwnProperty.call(row, candidate)) return row[candidate]\n  }\n  return undefined\n}\n\nfunction compareValues(left: unknown, right: unknown): number {\n  const leftMissing = left === null || left === undefined\n  const rightMissing = right === null || right === undefined\n  if (leftMissing && rightMissing) return 0\n  if (leftMissing) return 1\n  if (rightMissing) return -1\n  if (left instanceof Date && right instanceof Date) return left.getTime() - right.getTime()\n  if (typeof left === 'number' && typeof right === 'number') return left - right\n  if (typeof left === 'boolean' && typeof right === 'boolean') return Number(left) - Number(right)\n  return String(left).localeCompare(String(right), undefined, {\n    sensitivity: 'base',\n    numeric: true,\n  })\n}\n\nexport function sortRowsInMemory<T extends Record<string, unknown>>(\n  rows: readonly T[],\n  sorts: readonly Sort[],\n): T[] {\n  return [...rows].sort((left, right) => {\n    for (const sort of sorts) {\n      const direction = sort.dir === SortDir.Desc ? -1 : 1\n      const compared = compareValues(readField(left, sort.field), readField(right, sort.field))\n      if (compared !== 0) return compared * direction\n    }\n    const leftId = readField(left, 'id')\n    const rightId = readField(right, 'id')\n    return compareValues(leftId, rightId)\n  })\n}\n"],
+  "mappings": "AACA,SAAS,eAA0B;AAWnC,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAE/C,SAAS,oBAAoB,OAAyB;AAC3D,QAAM,MAAM,OAAO,SAAS,EAAE,EAAE,KAAK;AACrC,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,MAAI,IAAI,WAAW,KAAK,EAAG,YAAW,KAAK,IAAI,QAAQ,kBAAkB,GAAG,CAAC;AAC7E,SAAO,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC;AACvC;AAEA,eAAsB,2BACpB,SACA,QACA,YACA,UACA,gBACsB;AACtB,MAAI,CAAC,SAAS,uBAAwB,QAAO,oBAAI,IAAI;AACrD,MAAI,QAAQ,aAAa,CAAC,QAAQ,UAAU,EAAG,QAAO,oBAAI,IAAI;AAC9D,QAAM,YAAY,MAAM,QAAQ,uBAAuB,QAAQ,YAAY,MAAM,kBAAkB,IAAI;AACvG,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,aAAW,SAAS,WAAW;AAC7B,eAAW,aAAa,oBAAoB,KAAK,EAAG,qBAAoB,IAAI,SAAS;AAAA,EACvF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,YAAY;AAC9B,QAAI,MAAM,WAAW,KAAK,EAAG;AAC7B,UAAM,UAAU,oBAAoB,KAAK,EAAE,KAAK,CAAC,cAAc,oBAAoB,IAAI,SAAS,CAAC;AACjG,QAAI,QAAS,QAAO,IAAI,KAAK;AAAA,EAC/B;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAA8B,OAAwB;AACvE,aAAW,aAAa,oBAAoB,KAAK,GAAG;AAClD,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO,IAAI,SAAS;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,MAAe,OAAwB;AAC5D,QAAM,cAAc,SAAS,QAAQ,SAAS;AAC9C,QAAM,eAAe,UAAU,QAAQ,UAAU;AACjD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,YAAa,QAAO;AACxB,MAAI,aAAc,QAAO;AACzB,MAAI,gBAAgB,QAAQ,iBAAiB,KAAM,QAAO,KAAK,QAAQ,IAAI,MAAM,QAAQ;AACzF,MAAI,OAAO,SAAS,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO;AACzE,MAAI,OAAO,SAAS,aAAa,OAAO,UAAU,UAAW,QAAO,OAAO,IAAI,IAAI,OAAO,KAAK;AAC/F,SAAO,OAAO,IAAI,EAAE,cAAc,OAAO,KAAK,GAAG,QAAW;AAAA,IAC1D,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACH;AAEO,SAAS,iBACd,MACA,OACK;AACL,SAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,UAAU;AACrC,eAAW,QAAQ,OAAO;AACxB,YAAM,YAAY,KAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,YAAM,WAAW,cAAc,UAAU,MAAM,KAAK,KAAK,GAAG,UAAU,OAAO,KAAK,KAAK,CAAC;AACxF,UAAI,aAAa,EAAG,QAAO,WAAW;AAAA,IACxC;AACA,UAAM,SAAS,UAAU,MAAM,IAAI;AACnC,UAAM,UAAU,UAAU,OAAO,IAAI;AACrC,WAAO,cAAc,QAAQ,OAAO;AAAA,EACtC,CAAC;AACH;",
+  "names": []
+}

package/dist/lib/query/engine.js

@@ -8,6 +8,7 @@ import {
 import { resolveSearchConfig } from "../search/config.js";
 import { tokenizeText } from "../search/tokenize.js";
 import { runBeforeQueryPipeline, runAfterQueryPipeline } from "./query-extension-runner.js";
+import { resolveEncryptedSortFields, sortRowsInMemory } from "./encrypted-sort.js";
 const entityTableCache = /* @__PURE__ */ new Map();
 const pluralizeBaseName = (name) => {
   if (!name) return name;
@@ -376,8 +377,30 @@ class BasicQueryEngine {
       applyJoinFilterOp,
       columnExists: (tbl, column) => this.columnExists(tbl, column)
     });
+    const fallbackOrgId = opts.organizationId ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null);
+    const encryptionService = this.getEncryptionService();
+    const resolvedSorts = [];
+    for (const s of opts.sort || []) {
+      if (s.field.startsWith("cf:")) {
+        resolvedSorts.push(s);
+      } else {
+        const column = await this.resolveBaseColumn(table, s.field);
+        if (column) resolvedSorts.push({ ...s, field: column });
+      }
+    }
+    const encryptedSortFields = await resolveEncryptedSortFields(
+      encryptionService,
+      entity,
+      resolvedSorts.filter((sort) => !sort.field.startsWith("cf:")).map((sort) => sort.field),
+      opts.tenantId ?? null,
+      fallbackOrgId
+    );
+    const requiresPlaintextSort = encryptedSortFields.size > 0;
     if (opts.fields && opts.fields.length) {
-      const cols = opts.fields.filter((f) => !f.startsWith("cf:"));
+      const cols = new Set(opts.fields.filter((f) => !f.startsWith("cf:")));
+      if (requiresPlaintextSort) {
+        for (const field of encryptedSortFields) cols.add(field);
+      }
       for (const c of cols) {
         q = q.select(sql.ref(qualify(c)).as(c));
       }
@@ -576,7 +599,7 @@ class BasicQueryEngine {
         );
       }
     }
-    for (const s of opts.sort || []) {
+    for (const s of resolvedSorts) {
       if (s.field.startsWith("cf:")) {
         const key = s.field.slice(3);
         const alias = sanitize(`cf:${key}`);
@@ -587,11 +610,9 @@ class BasicQueryEngine {
             cfSelectedAliases.push(alias);
           }
         }
-        q = q.orderBy(alias, s.dir ?? "asc");
+        if (!requiresPlaintextSort) q = q.orderBy(alias, s.dir ?? "asc");
       } else {
-        const column = await this.resolveBaseColumn(table, s.field);
-        if (!column) continue;
-        q = q.orderBy(qualify(column), s.dir ?? "asc");
+        if (!requiresPlaintextSort) q = q.orderBy(qualify(s.field), s.dir ?? "asc");
       }
     }
     const page = opts.page?.page ?? 1;
@@ -603,7 +624,8 @@ class BasicQueryEngine {
     const countBuilder = hasJoinedAggregates ? q.clearSelect().clearOrderBy().clearGroupBy().select(sql`count(distinct ${sql.ref(`${table}.id`)})`.as("count")) : q.clearSelect().clearOrderBy().select(sql`count(distinct ${sql.ref(`${table}.id`)})`.as("count"));
     const countRow = await countBuilder.executeTakeFirst();
     const total = Number(countRow?.count ?? 0);
-    const items = await q.limit(pageSize).offset((page - 1) * pageSize).execute();
+    const dataQuery = requiresPlaintextSort ? q : q.limit(pageSize).offset((page - 1) * pageSize);
+    const items = await dataQuery.execute();
     if (cfJsonAliases.size > 0) {
       for (const row of items) {
         for (const alias of cfJsonAliases) {
@@ -628,11 +650,10 @@ class BasicQueryEngine {
         }
       }
     }
-    const svc = this.getEncryptionService();
+    const svc = encryptionService;
     const decryptPayload = svc?.decryptEntityPayload?.bind(svc);
     let decryptedItems = items;
     if (decryptPayload) {
-      const fallbackOrgId = opts.organizationId ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null);
       decryptedItems = await Promise.all(
         items.map(async (item) => {
           try {
@@ -650,7 +671,8 @@ class BasicQueryEngine {
         })
       );
     }
-    let queryResult = { items: decryptedItems, page, pageSize, total };
+    const pagedItems = requiresPlaintextSort ? sortRowsInMemory(decryptedItems, resolvedSorts).slice((page - 1) * pageSize, page * pageSize) : decryptedItems;
+    let queryResult = { items: pagedItems, page, pageSize, total };
     if (ext && extensionCtx) {
       const diCtx = ext.resolve ? { resolve: ext.resolve } : noop;
       queryResult = await runAfterQueryPipeline(

package/dist/lib/query/engine.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/query/engine.ts"],
-  "sourcesContent": ["import type { QueryEngine, QueryOptions, QueryResult, QueryCustomFieldSource, QueryExtensionsConfig } from './types'\nimport type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { type Kysely, sql, type RawBuilder } from 'kysely'\nimport {\n  applyJoinFilters,\n  normalizeFilters,\n  partitionFilters,\n  resolveJoins,\n  type BaseFilter,\n  type NormalizedFilter,\n  type ResolvedJoin,\n} from './join-utils'\nimport { resolveSearchConfig } from '../search/config'\nimport { tokenizeText } from '../search/tokenize'\nimport { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from './query-extension-runner'\n\ntype AnyDb = Kysely<any>\ntype AnyBuilder = any\n\nconst entityTableCache = new Map<string, string>()\n\ntype EncryptionResolver = () => {\n  decryptEntityPayload?: (entityId: EntityId, payload: Record<string, unknown>, tenantId?: string | null, organizationId?: string | null) => Promise<Record<string, unknown>>\n  isEnabled?: () => boolean\n} | null\n\ntype ResolvedCustomFieldSource = {\n  entityId: EntityId\n  alias: string\n  table: string\n  recordIdExpr: RawBuilder<string>\n}\n\ntype ResultRow = Record<string, unknown>\n\nconst pluralizeBaseName = (name: string): string => {\n  if (!name) return name\n  if (name.endsWith('s')) return name\n  if (name.endsWith('y')) return `${name.slice(0, -1)}ies`\n  return `${name}s`\n}\n\nconst toPascalCase = (value: string): string => {\n  return value\n    .split(/[_\\s]+/)\n    .filter(Boolean)\n    .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))\n    .join('')\n}\n\nconst candidateClassNames = (rawName: string): string[] => {\n  const base = toPascalCase(rawName)\n  const candidates = new Set<string>()\n  if (base) candidates.add(base)\n  if (base && !base.endsWith('Entity')) candidates.add(`${base}Entity`)\n  return Array.from(candidates)\n}\n\nexport function resolveEntityTableName(em: EntityManager | undefined, entity: EntityId): string {\n  if (entityTableCache.has(entity)) {\n    return entityTableCache.get(entity)!\n  }\n  const parts = String(entity || '').split(':')\n  const rawName = (parts[1] && parts[1].trim().length > 0) ? parts[1] : (parts[0] || '').trim()\n  const metadata = (em as any)?.getMetadata?.()\n\n  if (metadata && rawName) {\n    const candidates = candidateClassNames(rawName)\n    for (const candidate of candidates) {\n      try {\n        const meta = metadata.find?.(candidate)\n        if (meta?.tableName) {\n          const tableName = String(meta.tableName)\n          entityTableCache.set(entity, tableName)\n          return tableName\n        }\n      } catch {}\n    }\n\n    // Secondary lookup: search ORM metadata by candidate table names\n    const modulePrefix = parts[0] ?? ''\n    const candidateTables = [\n      `${modulePrefix}_${rawName}`,\n      pluralizeBaseName(rawName),\n      `${modulePrefix}_${pluralizeBaseName(rawName)}`,\n    ]\n    try {\n      const allMeta: any[] = metadata.getAll?.() ?? []\n      for (const meta of allMeta) {\n        if (meta?.tableName && candidateTables.includes(String(meta.tableName))) {\n          const tableName = String(meta.tableName)\n          entityTableCache.set(entity, tableName)\n          return tableName\n        }\n      }\n    } catch {}\n  }\n\n  const fallback = pluralizeBaseName(rawName || '')\n  console.warn(\n    `[QueryEngine] Could not resolve entity \"${entity}\" via ORM metadata. ` +\n    `Falling back to table name \"${fallback}\". ` +\n    `Ensure the entity ID segment matches the class name convention.`\n  )\n  entityTableCache.set(entity, fallback)\n  return fallback\n}\n\nfunction buildFilterableCustomFieldJoins(\n  sources: QueryCustomFieldSource[] | undefined,\n): Array<{\n  alias: string\n  table?: string\n  entityId: EntityId\n  from: { field: string }\n  to: { field: string }\n  type: 'left' | 'inner'\n}> {\n  if (!sources || sources.length === 0) return []\n  return sources.flatMap((source, index) => {\n    if (!source.join) return []\n    const alias = typeof source.alias === 'string' && source.alias.trim().length > 0\n      ? source.alias.trim()\n      : `cfs_${index}`\n    return [{\n      alias,\n      table: source.table,\n      entityId: source.entityId,\n      from: { field: source.join.fromField },\n      to: { field: source.join.toField },\n      type: source.join.type === 'inner' ? 'inner' : 'left',\n    }]\n  })\n}\n\nfunction computeCustomFieldScore(cfg: Record<string, unknown>, kind: string, entityIndex: number) {\n  const listVisibleScore = cfg.listVisible === false ? 0 : 1\n  const formEditableScore = cfg.formEditable === false ? 0 : 1\n  const filterableScore = cfg.filterable ? 1 : 0\n  const kindScore = (() => {\n    switch (kind) {\n      case 'dictionary': return 8\n      case 'relation': return 6\n      case 'select': return 4\n      case 'multiline': return 3\n      case 'boolean':\n      case 'integer':\n      case 'float': return 2\n      default: return 1\n    }\n  })()\n  const optionsBonus = Array.isArray(cfg.options) && cfg.options.length ? 2 : 0\n  const dictionaryBonus = typeof cfg.dictionaryId === 'string' && (cfg.dictionaryId as string).trim().length ? 5 : 0\n  const base = (listVisibleScore * 16) + (formEditableScore * 8) + (filterableScore * 4) + kindScore + optionsBonus + dictionaryBonus\n  const penalty = typeof cfg.priority === 'number' ? cfg.priority : 0\n  return { base, penalty, entityIndex }\n}\n\n/**\n * BasicQueryEngine \u2014 Kysely-backed fallback query engine.\n *\n * Resolves base tables via MikroORM metadata, applies tenant/organization/\n * deleted_at scoping, handles custom field (cf:*) selection and filtering,\n * and performs entity-extension joins. Used as the fallback for\n * {@link HybridQueryEngine} when the query index is unavailable or incomplete.\n */\nexport class BasicQueryEngine implements QueryEngine {\n  private columnCache = new Map<string, boolean>()\n  private tableCache = new Map<string, boolean>()\n  private searchAliasSeq = 0\n\n  constructor(\n    private em: EntityManager,\n    private getDbFn?: () => AnyDb,\n    private resolveEncryptionService?: EncryptionResolver,\n  ) {}\n\n  private getEncryptionService() {\n    try {\n      return this.resolveEncryptionService?.() ?? null\n    } catch {\n      return null\n    }\n  }\n\n  private getDb(): AnyDb {\n    if (this.getDbFn) return this.getDbFn()\n    const emAny = this.em as any\n    if (typeof emAny?.getKysely === 'function') return emAny.getKysely() as AnyDb\n    throw new Error('BasicQueryEngine requires an EntityManager exposing getKysely() (MikroORM v7)')\n  }\n\n  async query<T = any>(entity: EntityId, opts: QueryOptions = {}): Promise<QueryResult<T>> {\n    // --- UMES query extension: before-query pipeline ---\n    const ext = opts.extensions\n    let effectiveOpts = opts\n    let extensionCtx: QueryExtensionContext | null = null\n    const noop = { resolve: <R = unknown>(_name: string): R => { throw new Error('No DI context') } }\n\n    if (ext) {\n      extensionCtx = {\n        entity: String(entity),\n        engine: 'basic',\n        tenantId: opts.tenantId ?? '',\n        organizationId: opts.organizationId,\n        userId: ext.userId,\n        em: this.em,\n        container: ext.container,\n        userFeatures: ext.userFeatures,\n      }\n      const diCtx = ext.resolve ? { resolve: ext.resolve } : noop\n      const beforeResult = await runBeforeQueryPipeline(opts, extensionCtx, diCtx)\n      if (beforeResult.blocked) {\n        throw new Error(beforeResult.errorMessage ?? 'Query blocked by extension subscriber')\n      }\n      effectiveOpts = beforeResult.query\n    }\n    // Strip extensions from effectiveOpts so they don't propagate to sub-queries\n    const { extensions: _ext, ...coreOpts } = effectiveOpts\n    opts = coreOpts\n\n    // Heuristic: map '<module>:user' -> table 'users'\n    const table = resolveEntityTableName(this.em, entity)\n    const db = this.getDb()\n\n    let q: AnyBuilder = db.selectFrom(table as any)\n    const qualify = (col: string) => `${table}.${col}`\n    const orgScope = this.resolveOrganizationScope(opts)\n    this.searchAliasSeq = 0\n    // Require tenant scope for all queries\n    if (!opts.tenantId) {\n      throw new Error(\n        'QueryEngine: tenantId is now required for all queries (breaking change). ' +\n        'Please provide a tenantId in QueryOptions, e.g., query(entity, { tenantId: ... }). ' +\n        'See migration guide or documentation for details.'\n      )\n    }\n    const skipAutoScope = opts.omitAutomaticTenantOrgScope === true\n    // Optional organization filter (when present in schema)\n    if (!skipAutoScope && orgScope && await this.columnExists(table, 'organization_id')) {\n      q = this.applyOrganizationScope(q, qualify('organization_id'), orgScope)\n    }\n    // Tenant guard (required) when present in schema\n    if (!skipAutoScope && await this.columnExists(table, 'tenant_id')) {\n      q = q.where(qualify('tenant_id'), '=', opts.tenantId)\n    }\n    // Default soft-delete guard: exclude rows with deleted_at when column exists\n    if (!opts.withDeleted && await this.columnExists(table, 'deleted_at')) {\n      q = q.where(qualify('deleted_at'), 'is', null)\n    }\n\n    const normalizedFilters = normalizeFilters(opts.filters)\n    const resolvedJoins = resolveJoins(\n      table,\n      [...(opts.joins ?? []), ...buildFilterableCustomFieldJoins(opts.customFieldSources)],\n      (entityId) => resolveEntityTableName(this.em, entityId as any),\n    )\n    const joinMap = new Map<string, ResolvedJoin>()\n    const aliasTables = new Map<string, string>()\n    aliasTables.set(table, table)\n    aliasTables.set('base', table)\n    for (const join of resolvedJoins) {\n      joinMap.set(join.alias, join)\n      aliasTables.set(join.alias, join.table)\n    }\n    const { baseFilters, joinFilters } = partitionFilters(table, normalizedFilters, joinMap)\n    const cfFilters = normalizedFilters.filter((filter) => String(filter.field).startsWith('cf:'))\n    const searchConfig = resolveSearchConfig()\n    const searchEnabled = searchConfig.enabled && await this.tableExists('search_tokens')\n    const hasSearchTokens = searchEnabled\n      ? await this.hasSearchTokens(String(entity), opts.tenantId ?? null, orgScope)\n      : false\n    const searchActive = searchEnabled && hasSearchTokens\n    const joinSearchAvailability = new Map<string, boolean>()\n    const searchFilters = [...baseFilters, ...cfFilters].filter((filter) => filter.op === 'like' || filter.op === 'ilike')\n    if (searchFilters.length) {\n      const fields = searchFilters.map((filter) => String(filter.field))\n      this.logSearchDebug('search:init', {\n        entity: String(entity),\n        table,\n        tenantId: opts.tenantId ?? null,\n        organizationScope: orgScope,\n        fields,\n        searchEnabled,\n        hasSearchTokens,\n        searchActive,\n        searchConfig: {\n          enabled: searchConfig.enabled,\n          minTokenLength: searchConfig.minTokenLength,\n          enablePartials: searchConfig.enablePartials,\n          hashAlgorithm: searchConfig.hashAlgorithm,\n          blocklistedFields: searchConfig.blocklistedFields,\n        },\n      })\n      if (!searchEnabled) {\n        this.logSearchDebug('search:disabled', { entity: String(entity), table })\n      } else if (!hasSearchTokens) {\n        this.logSearchDebug('search:no-search-tokens', {\n          entity: String(entity),\n          table,\n          tenantId: opts.tenantId ?? null,\n          organizationScope: orgScope,\n        })\n      }\n    }\n    const recordIdColumn = qualify('id')\n\n    const applyFilterOp = (builder: AnyBuilder, column: string | RawBuilder<unknown>, op: string, value: unknown, fieldName?: string): AnyBuilder => {\n      if (\n        (op === 'like' || op === 'ilike') &&\n        searchActive &&\n        typeof value === 'string' &&\n        fieldName &&\n        typeof column === 'string'\n      ) {\n        const tokens = tokenizeText(String(value), searchConfig)\n        const hashes = tokens.hashes\n        if (hashes.length) {\n          const result = this.applySearchTokens(builder, {\n            entity: String(entity),\n            field: fieldName,\n            hashes,\n            recordIdColumn,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n            tokens: tokens.tokens,\n          })\n          this.logSearchDebug('search:filter', {\n            entity: String(entity),\n            field: fieldName,\n            tokens: tokens.tokens,\n            hashes,\n            applied: result.applied,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n          })\n          if (result.applied) return result.builder\n        } else {\n          this.logSearchDebug('search:skip-empty-hashes', {\n            entity: String(entity),\n            field: fieldName,\n            value,\n          })\n        }\n      }\n      return this.applyColumnOp(builder, column, op, value)\n    }\n\n    // `eq` is accepted alongside `like`/`ilike` so that filters against\n    // encrypted joined columns (whose ciphertext cannot be compared for\n    // equality in SQL) can still resolve via tokenized search. Routing\n    // only applies when `searchEnabled` is true AND the joined entity has\n    // search tokens installed (`searchAvailable`); for non-searchable or\n    // non-encrypted columns the caller still falls through to exact SQL\n    // equality via `applyFilterOp`. Note that token match is approximate \u2014\n    // callers needing strict equality on encrypted fields should filter on\n    // the deterministic `*_hash` column instead.\n    const applyJoinFilterOp = async (\n      builder: AnyBuilder,\n      filter: { column: string; op: string; value?: unknown },\n      _qualified: string,\n      join: ResolvedJoin,\n    ): Promise<{ applied: boolean; builder: AnyBuilder }> => {\n      if (!searchEnabled || !join.entityId) return { applied: false, builder }\n      if (!['like', 'ilike'].includes(filter.op)) return { applied: false, builder }\n      if (typeof filter.value !== 'string' || filter.value.trim().length === 0) return { applied: false, builder }\n\n      let searchAvailable = joinSearchAvailability.get(join.entityId)\n      if (searchAvailable === undefined) {\n        searchAvailable = await this.hasSearchTokens(join.entityId, opts.tenantId ?? null, orgScope)\n        joinSearchAvailability.set(join.entityId, searchAvailable)\n      }\n      if (!searchAvailable) return { applied: false, builder }\n\n      const tokens = tokenizeText(String(filter.value), searchConfig)\n      if (!tokens.hashes.length) return { applied: false, builder }\n\n      const result = this.applySearchTokens(builder, {\n        entity: join.entityId,\n        field: filter.column,\n        hashes: tokens.hashes,\n        recordIdColumn: `${join.alias}.id`,\n        tenantId: opts.tenantId ?? null,\n        organizationScope: orgScope,\n        tokens: tokens.tokens,\n      })\n      return { applied: result.applied, builder: result.builder }\n    }\n\n    const regularBaseFilters = baseFilters.filter((f) => !f.orGroup)\n    const orGroupFilters = baseFilters.filter((f) => f.orGroup)\n\n    for (const filter of regularBaseFilters) {\n      const fieldName = String(filter.field)\n      let qualified = filter.qualified ?? null\n      if (!qualified) {\n        const column = await this.resolveBaseColumn(table, fieldName)\n        if (!column) {\n          q = this.applyIndexDocFilter(q, {\n            entity: String(entity),\n            field: fieldName,\n            op: filter.op,\n            value: filter.value,\n            recordIdColumn,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n            withDeleted: opts.withDeleted === true,\n            searchActive,\n            searchConfig,\n          })\n          continue\n        }\n        qualified = qualify(column)\n      }\n      q = applyFilterOp(q, qualified, filter.op, filter.value, fieldName)\n    }\n\n    // OR-grouped filters: AND within each group (one $or disjunct), OR between groups.\n    if (orGroupFilters.length > 0) {\n      const groups = new Map<string, typeof orGroupFilters>()\n      for (const f of orGroupFilters) {\n        const group = groups.get(f.orGroup!) ?? []\n        group.push(f)\n        groups.set(f.orGroup!, group)\n      }\n      const resolvedGroupFilters: Array<Array<{ qualified: string; op: string; value: unknown; fieldName: string }>> = []\n      for (const [, groupFilters] of groups) {\n        const resolved: Array<{ qualified: string; op: string; value: unknown; fieldName: string }> = []\n        for (const filter of groupFilters) {\n          const column = await this.resolveBaseColumn(table, String(filter.field))\n          if (column) {\n            resolved.push({\n              qualified: qualify(column),\n              op: filter.op,\n              value: filter.value,\n              fieldName: String(filter.field),\n            })\n          }\n        }\n        if (resolved.length > 0) resolvedGroupFilters.push(resolved)\n      }\n      if (resolvedGroupFilters.length > 0) {\n        q = q.where((eb: any) => eb.or(\n          resolvedGroupFilters.map((group) => {\n            const parts = group.map((rf) => this.buildColumnOpExpression(eb, rf.qualified, rf.op, rf.value))\n            return parts.length === 1 ? parts[0] : eb.and(parts)\n          })\n        ))\n      }\n    }\n\n    const applyAliasScopes = async (builder: AnyBuilder, aliasName: string): Promise<AnyBuilder> => {\n      const targetTable = aliasTables.get(aliasName)\n      if (!targetTable) return builder\n      let next = builder\n      if (!skipAutoScope && orgScope && await this.columnExists(targetTable, 'organization_id')) {\n        next = this.applyOrganizationScope(next, `${aliasName}.organization_id`, orgScope)\n      }\n      if (!skipAutoScope && opts.tenantId && await this.columnExists(targetTable, 'tenant_id')) {\n        next = next.where(`${aliasName}.tenant_id`, '=', opts.tenantId)\n      }\n      return next\n    }\n    q = await applyJoinFilters({\n      db,\n      baseTable: table,\n      builder: q,\n      joinMap,\n      joinFilters,\n      aliasTables,\n      qualifyBase: (column) => qualify(column),\n      applyAliasScope: (builder, alias) => applyAliasScopes(builder, alias),\n      applyFilterOp: (builder, column, op, value) => applyFilterOp(builder, column, op, value),\n      applyJoinFilterOp,\n      columnExists: (tbl, column) => this.columnExists(tbl, column),\n    })\n    // Selection (base columns only here; cf:* handled later)\n    if (opts.fields && opts.fields.length) {\n      const cols = opts.fields.filter((f) => !f.startsWith('cf:'))\n      for (const c of cols) {\n        // Qualify and alias to base names to avoid ambiguity\n        q = q.select(sql.ref(qualify(c)).as(c))\n      }\n    } else {\n      // Default to selecting only base table columns to avoid ambiguity when joining\n      q = q.select(sql`${sql.ref(table)}.*`.as('__all'))\n    }\n\n    // Resolve which custom fields to include\n    const tenantId = opts.tenantId\n    const sanitize = (s: string) => s.replace(/[^a-zA-Z0-9_]/g, '_')\n    const cfSourcesResult = this.configureCustomFieldSources(q, table, entity, db, opts, qualify)\n    q = cfSourcesResult.builder\n    const cfSources = cfSourcesResult.sources\n    const entityIdToSource = new Map<string, ResolvedCustomFieldSource>()\n    for (const source of cfSources) {\n      entityIdToSource.set(String(source.entityId), source)\n    }\n    const requestedCustomFieldKeys = Array.isArray(opts.includeCustomFields)\n      ? opts.includeCustomFields.map((key) => String(key))\n      : []\n    const cfKeys = new Set<string>()\n    const keySource = new Map<string, ResolvedCustomFieldSource>()\n    // Explicit in fields/filters\n    for (const f of (opts.fields || [])) {\n      if (typeof f === 'string' && f.startsWith('cf:')) cfKeys.add(f.slice(3))\n    }\n    for (const f of cfFilters) {\n      if (typeof f.field === 'string' && f.field.startsWith('cf:')) cfKeys.add(f.field.slice(3))\n    }\n    if (opts.includeCustomFields === true) {\n      if (entityIdToSource.size > 0) {\n        const entityIdList = Array.from(entityIdToSource.keys())\n        const entityOrder = new Map<string, number>()\n        entityIdList.forEach((id, idx) => entityOrder.set(id, idx))\n        const rows = await db\n          .selectFrom('custom_field_defs' as any)\n          .select(['key' as any, 'entity_id' as any, 'config_json' as any, 'kind' as any])\n          .where('entity_id' as any, 'in', entityIdList)\n          .where('is_active' as any, '=', true)\n          .where((eb: any) => eb.or([\n            eb('tenant_id' as any, '=', tenantId),\n            eb('tenant_id' as any, 'is', null),\n          ]))\n          .execute() as Array<{ key: string; entity_id: string; config_json: unknown; kind: string }>\n        type CustomFieldDefinitionRow = {\n          key: string\n          entityId: string\n          kind: string\n          config: Record<string, unknown>\n        }\n        const sorted: CustomFieldDefinitionRow[] = rows.map((row) => {\n          const raw = row.config_json\n          let cfg: Record<string, any> = {}\n          if (raw && typeof raw === 'string') {\n            try { cfg = JSON.parse(raw) } catch { cfg = {} }\n          } else if (raw && typeof raw === 'object') {\n            cfg = raw as Record<string, any>\n          }\n          return {\n            key: String(row.key),\n            entityId: String(row.entity_id),\n            kind: String(row.kind || ''),\n            config: cfg,\n          }\n        })\n        sorted.sort((a, b) => {\n          const ai = entityOrder.get(a.entityId) ?? Number.MAX_SAFE_INTEGER\n          const bi = entityOrder.get(b.entityId) ?? Number.MAX_SAFE_INTEGER\n          if (ai !== bi) return ai - bi\n          return a.key.localeCompare(b.key)\n        })\n        const selectedSources = new Map<string, { source: ResolvedCustomFieldSource; score: number; penalty: number; entityIndex: number }>()\n        for (const row of sorted) {\n          const source = entityIdToSource.get(row.entityId)\n          if (!source) continue\n          const cfg = row.config || {}\n          const entityIndex = entityOrder.get(row.entityId) ?? Number.MAX_SAFE_INTEGER\n          const scores = computeCustomFieldScore(cfg, row.kind, entityIndex)\n          const existing = selectedSources.get(row.key)\n          if (!existing || scores.base > existing.score || (scores.base === existing.score && (scores.penalty < existing.penalty || (scores.penalty === existing.penalty && scores.entityIndex < existing.entityIndex)))) {\n            selectedSources.set(row.key, { source, score: scores.base, penalty: scores.penalty, entityIndex: scores.entityIndex })\n          }\n          cfKeys.add(row.key)\n        }\n        for (const [key, entry] of selectedSources.entries()) {\n          keySource.set(key, entry.source)\n        }\n      }\n    } else if (requestedCustomFieldKeys.length > 0) {\n      for (const key of requestedCustomFieldKeys) cfKeys.add(key)\n    }\n    const unresolvedKeys = Array.from(cfKeys).filter((key) => !keySource.has(key))\n    if (unresolvedKeys.length > 0 && entityIdToSource.size > 0) {\n      const rows = await db\n        .selectFrom('custom_field_defs' as any)\n        .select(['key' as any, 'entity_id' as any])\n        .where('entity_id' as any, 'in', Array.from(entityIdToSource.keys()))\n        .where('key' as any, 'in', unresolvedKeys)\n        .where('is_active' as any, '=', true)\n        .where((eb: any) => eb.or([\n          eb('tenant_id' as any, '=', tenantId),\n          eb('tenant_id' as any, 'is', null),\n        ]))\n        .execute() as Array<{ key: string; entity_id: string }>\n      for (const row of rows) {\n        const source = entityIdToSource.get(String(row.entity_id))\n        if (!source) continue\n        if (!keySource.has(row.key)) keySource.set(row.key, source)\n      }\n    }\n\n    const cfValueExprByKey: Record<string, RawBuilder<string | null>> = {}\n    const cfSelectedAliases: string[] = []\n    const cfJsonAliases = new Set<string>()\n    const cfMultiAliasByAlias = new Map<string, string>()\n    for (const key of cfKeys) {\n      const source = keySource.get(key)\n      if (!source) continue\n      const entityIdForKey = source.entityId\n      const recordIdExpr = source.recordIdExpr\n      const sourceAliasSafe = sanitize(source.alias || 'src')\n      const keyAliasSafe = sanitize(key)\n      const defAlias = `cfd_${sourceAliasSafe}_${keyAliasSafe}`\n      const valAlias = `cfv_${sourceAliasSafe}_${keyAliasSafe}`\n      // Join definitions for kind resolution\n      q = q.leftJoin(`custom_field_defs as ${defAlias}` as any, (jb: any) =>\n        jb.on(`${defAlias}.entity_id`, '=', String(entityIdForKey))\n          .on(`${defAlias}.key`, '=', key)\n          .on(`${defAlias}.is_active`, '=', true)\n          .on((eb: any) => eb.or([\n            eb(`${defAlias}.tenant_id`, '=', tenantId),\n            eb(`${defAlias}.tenant_id`, 'is', null),\n          ]))\n      )\n      // Join values with record match\n      q = q.leftJoin(`custom_field_values as ${valAlias}` as any, (jb: any) =>\n        jb.on(`${valAlias}.entity_id`, '=', String(entityIdForKey))\n          .on(`${valAlias}.field_key`, '=', key)\n          .onRef(`${valAlias}.record_id`, '=', recordIdExpr as any)\n          .on((eb: any) => eb.or([\n            eb(`${valAlias}.tenant_id`, '=', tenantId),\n            eb(`${valAlias}.tenant_id`, 'is', null),\n          ]))\n      )\n      // Force a common SQL type across branches to avoid Postgres CASE type conflicts\n      const caseExpr = sql<string | null>`CASE ${sql.ref(`${defAlias}.kind`)}\n           WHEN 'integer' THEN (${sql.ref(`${valAlias}.value_int`)})::text\n           WHEN 'float' THEN (${sql.ref(`${valAlias}.value_float`)})::text\n           WHEN 'boolean' THEN (${sql.ref(`${valAlias}.value_bool`)})::text\n           WHEN 'multiline' THEN (${sql.ref(`${valAlias}.value_multiline`)})::text\n           ELSE (${sql.ref(`${valAlias}.value_text`)})::text\n         END`\n      cfValueExprByKey[key] = caseExpr\n      const alias = sanitize(`cf:${key}`)\n      // Project as aggregated to avoid duplicates when multi values exist\n      if ((opts.fields || []).includes(`cf:${key}`) || opts.includeCustomFields === true || (requestedCustomFieldKeys.length > 0 && requestedCustomFieldKeys.includes(key))) {\n        const multiAlias = `${alias}__is_multi`\n        const isMultiExpr = sql<boolean>`bool_or(coalesce((${sql.ref(`${defAlias}.config_json`)}->>'multi')::boolean, false))`\n        const aggregatedArray = sql<unknown>`array_remove(array_agg(DISTINCT ${caseExpr}), NULL)`\n        const projExpr = sql<unknown>`CASE WHEN ${isMultiExpr}\n                THEN to_jsonb(${aggregatedArray})\n                ELSE to_jsonb(max(${caseExpr}))\n           END`\n        q = q.select(projExpr.as(alias))\n        q = q.select(isMultiExpr.as(multiAlias))\n        cfSelectedAliases.push(alias)\n        cfJsonAliases.add(alias)\n        cfMultiAliasByAlias.set(alias, multiAlias)\n      }\n    }\n\n    // Apply cf:* filters (on raw expressions)\n    for (const f of cfFilters) {\n      if (!f.field.startsWith('cf:')) continue\n      const key = f.field.slice(3)\n      const expr = cfValueExprByKey[key]\n      if (!expr) continue\n      if ((f.op === 'like' || f.op === 'ilike') && searchActive && typeof f.value === 'string') {\n        const tokens = tokenizeText(String(f.value), searchConfig)\n        const hashes = tokens.hashes\n        if (hashes.length) {\n          const result = this.applySearchTokens(q, {\n            entity: String(entity),\n            field: f.field,\n            hashes,\n            recordIdColumn,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n            tokens: tokens.tokens,\n          })\n          this.logSearchDebug('search:cf-filter', {\n            entity: String(entity),\n            field: f.field,\n            tokens: tokens.tokens,\n            hashes,\n            applied: result.applied,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n          })\n          if (result.applied) {\n            q = result.builder\n            continue\n          }\n        } else {\n          this.logSearchDebug('search:cf-skip-empty-hashes', {\n            entity: String(entity),\n            field: f.field,\n            value: f.value,\n          })\n        }\n      }\n      q = this.applyColumnOp(q, expr, f.op, f.value)\n    }\n\n    // Entity extensions joins (no selection yet; enables future filters/projections)\n    if (opts.includeExtensions) {\n      const { getModules } = await import('@open-mercato/shared/lib/i18n/server')\n      const allMods = getModules() as any[]\n      const allExts = allMods.flatMap((m) => (m as any).entityExtensions || [])\n      const exts = allExts.filter((e: any) => e.base === entity)\n      const chosen = Array.isArray(opts.includeExtensions)\n        ? exts.filter((e: any) => (opts.includeExtensions as string[]).includes(e.extension))\n        : exts\n      for (const e of chosen) {\n        const [, extName] = (e.extension as string).split(':')\n        const extTable = extName.endsWith('s') ? extName : `${extName}s`\n        const alias = `ext_${sanitize(extName)}`\n        q = q.leftJoin(`${extTable} as ${alias}` as any, (jb: any) =>\n          jb.onRef(`${alias}.${e.join.extensionKey}`, '=', `${table}.${e.join.baseKey}`)\n        )\n      }\n    }\n\n    // Sorting: base fields and cf:* (use aggregated alias for cf)\n    for (const s of opts.sort || []) {\n      if (s.field.startsWith('cf:')) {\n        const key = s.field.slice(3)\n        const alias = sanitize(`cf:${key}`)\n        // Ensure included in projection to sort by\n        if (!cfSelectedAliases.includes(alias)) {\n          const expr = cfValueExprByKey[key]\n          if (expr) {\n            q = q.select(sql<string | null>`max(${expr})`.as(alias))\n            cfSelectedAliases.push(alias)\n          }\n        }\n        q = q.orderBy(alias, (s.dir ?? 'asc') as any)\n      } else {\n        const column = await this.resolveBaseColumn(table, s.field)\n        if (!column) continue\n        q = q.orderBy(qualify(column), (s.dir ?? 'asc') as any)\n      }\n    }\n\n    // Pagination\n    const page = opts.page?.page ?? 1\n    const pageSize = opts.page?.pageSize ?? 20\n    // Deduplicate if we joined CFs or extensions by grouping on base id\n    const hasJoinedAggregates = (opts.includeExtensions && (Array.isArray(opts.includeExtensions) ? (opts.includeExtensions.length > 0) : true)) || Object.keys(cfValueExprByKey).length > 0\n    if (hasJoinedAggregates) {\n      q = q.groupBy(`${table}.id`)\n    }\n    const countBuilder = hasJoinedAggregates\n      ? q.clearSelect().clearOrderBy().clearGroupBy().select(sql<string>`count(distinct ${sql.ref(`${table}.id`)})`.as('count'))\n      : q.clearSelect().clearOrderBy().select(sql<string>`count(distinct ${sql.ref(`${table}.id`)})`.as('count'))\n    const countRow = await countBuilder.executeTakeFirst() as { count: unknown } | undefined\n    const total = Number((countRow as any)?.count ?? 0)\n    const items = await q.limit(pageSize).offset((page - 1) * pageSize).execute() as any[]\n\n    if (cfJsonAliases.size > 0) {\n      for (const row of items) {\n        for (const alias of cfJsonAliases) {\n          const multiAlias = cfMultiAliasByAlias.get(alias)\n          const isMulti = multiAlias ? Boolean(row[multiAlias]) : false\n          let raw = row[alias]\n          if (typeof raw === 'string') {\n            try { raw = JSON.parse(raw) } catch { /* ignore malformed json */ }\n          }\n          if (isMulti) {\n            if (raw == null) row[alias] = []\n            else if (Array.isArray(raw)) row[alias] = raw\n            else row[alias] = [raw]\n          } else {\n            if (Array.isArray(raw)) row[alias] = raw.length > 0 ? raw[0] : null\n            else row[alias] = raw\n          }\n          if (multiAlias) delete row[multiAlias]\n        }\n      }\n    }\n\n    const svc = this.getEncryptionService()\n    const decryptPayload =\n      svc?.decryptEntityPayload?.bind(svc) as\n        | ((\n            entityId: EntityId,\n            payload: Record<string, unknown>,\n            tenantId: string | null,\n            organizationId: string | null,\n          ) => Promise<Record<string, unknown>>)\n        | null\n    let decryptedItems = items\n    if (decryptPayload) {\n      const fallbackOrgId =\n        opts.organizationId\n        ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)\n      decryptedItems = await Promise.all(\n        (items as any[]).map(async (item) => {\n          try {\n            const decrypted = await decryptPayload(\n              entity,\n              item,\n              item?.tenant_id ?? item?.tenantId ?? opts.tenantId ?? null,\n              item?.organization_id ?? item?.organizationId ?? fallbackOrgId ?? null,\n            )\n            return { ...item, ...decrypted }\n          } catch (err) {\n            console.error('QueryEngine: error decrypting entity payload', err);\n            return item\n          }\n        })\n      )\n    }\n\n    let queryResult: QueryResult<T> = { items: decryptedItems, page, pageSize, total }\n\n    // --- UMES query extension: after-query pipeline ---\n    if (ext && extensionCtx) {\n      const diCtx = ext.resolve ? { resolve: ext.resolve } : noop\n      queryResult = await runAfterQueryPipeline(\n        queryResult as QueryResult<Record<string, unknown>>,\n        opts,\n        extensionCtx,\n        diCtx,\n      ) as QueryResult<T>\n    }\n\n    return queryResult\n  }\n\n  private applyColumnOp(builder: AnyBuilder, column: string | RawBuilder<unknown>, op: string, value: unknown): AnyBuilder {\n    switch (op) {\n      case 'eq':\n        return value === null\n          ? builder.where(column as any, 'is', null)\n          : builder.where(column as any, '=', value as any)\n      case 'ne':\n        return value === null\n          ? builder.where(column as any, 'is not', null)\n          : builder.where(column as any, '!=', value as any)\n      case 'gt':\n        return builder.where(column as any, '>', value as any)\n      case 'gte':\n        return builder.where(column as any, '>=', value as any)\n      case 'lt':\n        return builder.where(column as any, '<', value as any)\n      case 'lte':\n        return builder.where(column as any, '<=', value as any)\n      case 'in':\n        return builder.where(column as any, 'in', Array.isArray(value) ? value : [value])\n      case 'nin':\n        return builder.where(column as any, 'not in', Array.isArray(value) ? value : [value])\n      case 'like':\n        return builder.where(column as any, 'like', value as any)\n      case 'ilike':\n        return builder.where(column as any, 'ilike', value as any)\n      case 'exists':\n        return value\n          ? builder.where(column as any, 'is not', null)\n          : builder.where(column as any, 'is', null)\n      default:\n        return builder\n    }\n  }\n\n  private buildColumnOpExpression(eb: any, column: string, op: string, value: unknown): any {\n    switch (op) {\n      case 'eq': return value === null ? eb(column, 'is', null) : eb(column, '=', value)\n      case 'ne': return value === null ? eb(column, 'is not', null) : eb(column, '!=', value)\n      case 'gt': return eb(column, '>', value)\n      case 'gte': return eb(column, '>=', value)\n      case 'lt': return eb(column, '<', value)\n      case 'lte': return eb(column, '<=', value)\n      case 'in': return eb(column, 'in', Array.isArray(value) ? value : [value])\n      case 'nin': return eb(column, 'not in', Array.isArray(value) ? value : [value])\n      case 'like': return eb(column, 'like', value)\n      case 'ilike': return eb(column, 'ilike', value)\n      case 'exists': return value ? eb(column, 'is not', null) : eb(column, 'is', null)\n      default: return eb.val(true)\n    }\n  }\n\n  private async resolveBaseColumn(table: string, field: string): Promise<string | null> {\n    if (await this.columnExists(table, field)) return field\n    if (field === 'organization_id' && await this.columnExists(table, 'id')) return 'id'\n    return null\n  }\n\n  private async columnExists(table: string, column: string): Promise<boolean> {\n    const key = `${table}.${column}`\n    if (this.columnCache.has(key)) {\n      const cached = this.columnCache.get(key)\n      if (cached === true) return true\n      this.columnCache.delete(key)\n    }\n    const db = this.getDb()\n    const exists = await db\n      .selectFrom('information_schema.columns' as any)\n      .select(sql<number>`1`.as('one'))\n      .where('table_name' as any, '=', table)\n      .where('column_name' as any, '=', column)\n      .limit(1)\n      .executeTakeFirst()\n    const present = !!exists\n    if (present) this.columnCache.set(key, true)\n    else this.columnCache.delete(key)\n    return present\n  }\n\n  private async tableExists(table: string): Promise<boolean> {\n    if (this.tableCache.has(table)) return this.tableCache.get(table) ?? false\n    const db = this.getDb()\n    const exists = await db\n      .selectFrom('information_schema.tables' as any)\n      .select(sql<number>`1`.as('one'))\n      .where('table_name' as any, '=', table)\n      .limit(1)\n      .executeTakeFirst()\n    const present = !!exists\n    this.tableCache.set(table, present)\n    return present\n  }\n\n  private async hasSearchTokens(\n    entity: string,\n    tenantId: string | null,\n    orgScope?: { ids: string[]; includeNull: boolean } | null\n  ): Promise<boolean> {\n    try {\n      const db = this.getDb()\n      let query: AnyBuilder = db\n        .selectFrom('search_tokens' as any)\n        .select(sql<number>`1`.as('one'))\n        .where('entity_type' as any, '=', entity)\n        .limit(1)\n      if (tenantId !== undefined) {\n        query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n      }\n      if (orgScope) {\n        query = this.applyOrganizationScope(query, 'search_tokens.organization_id', orgScope)\n      }\n      const row = await query.executeTakeFirst()\n      return !!row\n    } catch (err) {\n      this.logSearchDebug('search:has-tokens-error', {\n        entity,\n        tenantId,\n        organizationScope: orgScope,\n        error: err instanceof Error ? err.message : String(err),\n      })\n      return false\n    }\n  }\n\n  private applySearchTokens(\n    q: AnyBuilder,\n    opts: {\n      entity: string\n      field: string\n      hashes: string[]\n      recordIdColumn: string\n      tenantId?: string | null\n      organizationScope?: { ids: string[]; includeNull: boolean } | null\n      combineWith?: 'and' | 'or'\n      tokens?: string[]\n    }\n  ): { applied: boolean; builder: AnyBuilder } {\n    if (!opts.hashes.length) {\n      this.logSearchDebug('search:skip-no-hashes', {\n        entity: opts.entity,\n        field: opts.field,\n        tenantId: opts.tenantId ?? null,\n        organizationScope: opts.organizationScope,\n      })\n      return { applied: false, builder: q }\n    }\n    const alias = `st_${this.searchAliasSeq++}`\n    const engine = this\n    this.logSearchDebug('search:apply-search-tokens', {\n      entity: opts.entity,\n      field: opts.field,\n      alias,\n      tokenCount: opts.hashes.length,\n      tokens: opts.tokens,\n      tenantId: opts.tenantId ?? null,\n      organizationScope: opts.organizationScope,\n      combineWith: opts.combineWith ?? 'and',\n    })\n    const buildSub = (eb: any) => {\n      let sub: AnyBuilder = eb\n        .selectFrom(`search_tokens as ${alias}`)\n        .select(sql<number>`1`.as('one'))\n        .where(`${alias}.entity_type`, '=', opts.entity)\n        .where(`${alias}.field`, '=', opts.field)\n        .where(sql<boolean>`${sql.ref(`${alias}.entity_id`)} = ${sql.ref(opts.recordIdColumn)}::text`)\n        .where(`${alias}.token_hash`, 'in', opts.hashes)\n        .groupBy([`${alias}.entity_id`, `${alias}.field`])\n        .having(sql<boolean>`count(distinct ${sql.ref(`${alias}.token_hash`)}) >= ${opts.hashes.length}`)\n      if (opts.tenantId !== undefined) {\n        sub = sub.where(sql<boolean>`${sql.ref(`${alias}.tenant_id`)} is not distinct from ${opts.tenantId ?? null}`)\n      }\n      if (opts.organizationScope) {\n        sub = engine.applyOrganizationScope(sub, `${alias}.organization_id`, opts.organizationScope)\n      }\n      return sub\n    }\n    const combiner = opts.combineWith === 'or' ? 'or' : 'and'\n    if (combiner === 'or') {\n      // When OR combining, caller expects a raw predicate to include in eb.or([...]).\n      // We keep the same semantics as the previous knex orWhereExists by mutating the outer builder with a WHERE EXISTS.\n      // Return the mutated builder; callers that need per-predicate control should build the sub themselves.\n      const next = q.where((eb: any) => eb.or([eb.exists(buildSub(eb))]))\n      return { applied: true, builder: next }\n    }\n    const next = q.where((eb: any) => eb.exists(buildSub(eb)))\n    return { applied: true, builder: next }\n  }\n\n  private applyIndexDocFilter(\n    q: AnyBuilder,\n    opts: {\n      entity: string\n      field: string\n      op: NormalizedFilter['op']\n      value: unknown\n      recordIdColumn: string\n      tenantId?: string | null\n      organizationScope?: { ids: string[]; includeNull: boolean } | null\n      withDeleted: boolean\n      searchActive: boolean\n      searchConfig: ReturnType<typeof resolveSearchConfig>\n    }\n  ): AnyBuilder {\n    if ((opts.op === 'like' || opts.op === 'ilike') && opts.searchActive && typeof opts.value === 'string') {\n      const tokens = tokenizeText(String(opts.value), opts.searchConfig)\n      const hashes = tokens.hashes\n      if (hashes.length) {\n        const result = this.applySearchTokens(q, {\n          entity: opts.entity,\n          field: opts.field,\n          hashes,\n          recordIdColumn: opts.recordIdColumn,\n          tenantId: opts.tenantId ?? null,\n          organizationScope: opts.organizationScope,\n          tokens: tokens.tokens,\n        })\n        this.logSearchDebug('search:index-doc-filter', {\n          entity: opts.entity,\n          field: opts.field,\n          tokens: tokens.tokens,\n          hashes,\n          applied: result.applied,\n          tenantId: opts.tenantId ?? null,\n          organizationScope: opts.organizationScope,\n        })\n        if (result.applied) return result.builder\n      } else {\n        this.logSearchDebug('search:index-doc-skip-empty-hashes', {\n          entity: opts.entity,\n          field: opts.field,\n          value: opts.value,\n        })\n      }\n      return q\n    }\n\n    const alias = `ei_${this.searchAliasSeq++}`\n    const engine = this\n    return q.where((eb: any) => eb.exists((() => {\n      let sub: AnyBuilder = eb\n        .selectFrom(`entity_indexes as ${alias}`)\n        .select(sql<number>`1`.as('one'))\n        .where(`${alias}.entity_type`, '=', opts.entity)\n        .where(sql<boolean>`${sql.ref(`${alias}.entity_id`)} = ${sql.ref(opts.recordIdColumn)}::text`)\n      if (opts.tenantId !== undefined) {\n        sub = sub.where(sql<boolean>`${sql.ref(`${alias}.tenant_id`)} is not distinct from ${opts.tenantId ?? null}`)\n      }\n      if (opts.organizationScope) {\n        sub = engine.applyOrganizationScope(sub, `${alias}.organization_id`, opts.organizationScope)\n      }\n      if (!opts.withDeleted) {\n        sub = sub.where(`${alias}.deleted_at`, 'is', null)\n      }\n\n      const textExpr = sql<string | null>`(${sql.ref(`${alias}.doc`)} ->> ${opts.field})`\n      switch (opts.op) {\n        case 'eq':\n          sub = sub.where(sql<boolean>`${textExpr} = ${opts.value}`); break\n        case 'ne':\n          sub = sub.where(sql<boolean>`${textExpr} <> ${opts.value}`); break\n        case 'gt':\n        case 'gte':\n        case 'lt':\n        case 'lte': {\n          const operator = sql.raw(opts.op === 'gt' ? '>' : opts.op === 'gte' ? '>=' : opts.op === 'lt' ? '<' : '<=')\n          sub = sub.where(sql<boolean>`${textExpr} ${operator} ${opts.value}`)\n          break\n        }\n        case 'in': {\n          const vals = Array.isArray(opts.value) ? opts.value : [opts.value]\n          sub = sub.where(sql<boolean>`${textExpr} in (${sql.join(vals.map((v) => sql`${v}`), sql`, `)})`)\n          break\n        }\n        case 'nin': {\n          const vals = Array.isArray(opts.value) ? opts.value : [opts.value]\n          sub = sub.where(sql<boolean>`${textExpr} not in (${sql.join(vals.map((v) => sql`${v}`), sql`, `)})`)\n          break\n        }\n        case 'like':\n          sub = sub.where(sql<boolean>`${textExpr} like ${opts.value}`); break\n        case 'ilike':\n          sub = sub.where(sql<boolean>`${textExpr} ilike ${opts.value}`); break\n        case 'exists':\n          sub = opts.value\n            ? sub.where(sql<boolean>`${textExpr} is not null`)\n            : sub.where(sql<boolean>`${textExpr} is null`)\n          break\n        default:\n          break\n      }\n      return sub\n    })()))\n  }\n\n  private configureCustomFieldSources(\n    q: AnyBuilder,\n    baseTable: string,\n    baseEntity: EntityId,\n    db: AnyDb,\n    opts: QueryOptions,\n    qualify: (column: string) => string,\n  ): { builder: AnyBuilder; sources: ResolvedCustomFieldSource[] } {\n    const sources: ResolvedCustomFieldSource[] = [\n      {\n        entityId: baseEntity,\n        alias: 'base',\n        table: baseTable,\n        recordIdExpr: sql<string>`${sql.ref(`${baseTable}.id`)}::text`,\n      },\n    ]\n    const extras: QueryCustomFieldSource[] = opts.customFieldSources ?? []\n    let next = q\n    extras.forEach((srcOpt, index) => {\n      const joinTable = srcOpt.table ?? resolveEntityTableName(this.em, srcOpt.entityId)\n      const alias = srcOpt.alias ?? `cfs_${index}`\n      const join = srcOpt.join\n      if (!join) {\n        throw new Error(`QueryEngine: customFieldSources entry for ${String(srcOpt.entityId)} requires a join configuration`)\n      }\n      const joinFn = (join.type ?? 'left') === 'inner' ? 'innerJoin' : 'leftJoin'\n      next = (next as any)[joinFn](`${joinTable} as ${alias}`, (jb: any) =>\n        jb.onRef(`${alias}.${join.toField}`, '=', qualify(join.fromField)))\n      const recordColumn = srcOpt.recordIdColumn ?? 'id'\n      sources.push({\n        entityId: srcOpt.entityId,\n        alias,\n        table: joinTable,\n        recordIdExpr: sql<string>`${sql.ref(`${alias}.${recordColumn}`)}::text`,\n      })\n    })\n    return { builder: next, sources }\n  }\n\n  private logSearchDebug(event: string, payload: Record<string, unknown>) {\n    try {\n      console.info('[query:search]', event, JSON.stringify(payload))\n    } catch {\n      console.info('[query:search]', event, payload)\n    }\n  }\n\n  private resolveOrganizationScope(opts: QueryOptions): { ids: string[]; includeNull: boolean } | null {\n    if (opts.organizationIds !== undefined) {\n      const raw = (opts.organizationIds ?? []).map((id) => (typeof id === 'string' ? id.trim() : id))\n      const includeNull = raw.some((id) => id == null || id === '')\n      const ids = raw.filter((id): id is string => typeof id === 'string' && id.length > 0)\n      return { ids: Array.from(new Set(ids)), includeNull }\n    }\n    if (typeof opts.organizationId === 'string' && opts.organizationId.trim().length > 0) {\n      return { ids: [opts.organizationId], includeNull: false }\n    }\n    return null\n  }\n\n  private applyOrganizationScope(q: AnyBuilder, column: string, scope: { ids: string[]; includeNull: boolean }): AnyBuilder {\n    if (!scope) return q\n    if (scope.ids.length === 0 && !scope.includeNull) {\n      return q.where(sql<boolean>`1 = 0`)\n    }\n    return q.where((eb: any) => {\n      const parts: any[] = []\n      if (scope.ids.length > 0) parts.push(eb(column, 'in', scope.ids))\n      if (scope.includeNull) parts.push(eb(column, 'is', null))\n      if (parts.length === 1) return parts[0]\n      return eb.or(parts)\n    })\n  }\n}\n"],
-  "mappings": "AAGA,SAAsB,WAA4B;AAClD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,6BAAyD;AAK1F,MAAM,mBAAmB,oBAAI,IAAoB;AAgBjD,MAAM,oBAAoB,CAAC,SAAyB;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO;AAC/B,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC;AACnD,SAAO,GAAG,IAAI;AAChB;AAEA,MAAM,eAAe,CAAC,UAA0B;AAC9C,SAAO,MACJ,MAAM,QAAQ,EACd,OAAO,OAAO,EACd,IAAI,CAAC,YAAY,QAAQ,OAAO,CAAC,EAAE,YAAY,IAAI,QAAQ,MAAM,CAAC,CAAC,EACnE,KAAK,EAAE;AACZ;AAEA,MAAM,sBAAsB,CAAC,YAA8B;AACzD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,aAAa,oBAAI,IAAY;AACnC,MAAI,KAAM,YAAW,IAAI,IAAI;AAC7B,MAAI,QAAQ,CAAC,KAAK,SAAS,QAAQ,EAAG,YAAW,IAAI,GAAG,IAAI,QAAQ;AACpE,SAAO,MAAM,KAAK,UAAU;AAC9B;AAEO,SAAS,uBAAuB,IAA+B,QAA0B;AAC9F,MAAI,iBAAiB,IAAI,MAAM,GAAG;AAChC,WAAO,iBAAiB,IAAI,MAAM;AAAA,EACpC;AACA,QAAM,QAAQ,OAAO,UAAU,EAAE,EAAE,MAAM,GAAG;AAC5C,QAAM,UAAW,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,IAAK,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,IAAI,KAAK;AAC5F,QAAM,WAAY,IAAY,cAAc;AAE5C,MAAI,YAAY,SAAS;AACvB,UAAM,aAAa,oBAAoB,OAAO;AAC9C,eAAW,aAAa,YAAY;AAClC,UAAI;AACF,cAAM,OAAO,SAAS,OAAO,SAAS;AACtC,YAAI,MAAM,WAAW;AACnB,gBAAM,YAAY,OAAO,KAAK,SAAS;AACvC,2BAAiB,IAAI,QAAQ,SAAS;AACtC,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAAC;AAAA,IACX;AAGA,UAAM,eAAe,MAAM,CAAC,KAAK;AACjC,UAAM,kBAAkB;AAAA,MACtB,GAAG,YAAY,IAAI,OAAO;AAAA,MAC1B,kBAAkB,OAAO;AAAA,MACzB,GAAG,YAAY,IAAI,kBAAkB,OAAO,CAAC;AAAA,IAC/C;AACA,QAAI;AACF,YAAM,UAAiB,SAAS,SAAS,KAAK,CAAC;AAC/C,iBAAW,QAAQ,SAAS;AAC1B,YAAI,MAAM,aAAa,gBAAgB,SAAS,OAAO,KAAK,SAAS,CAAC,GAAG;AACvE,gBAAM,YAAY,OAAO,KAAK,SAAS;AACvC,2BAAiB,IAAI,QAAQ,SAAS;AACtC,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,WAAW,kBAAkB,WAAW,EAAE;AAChD,UAAQ;AAAA,IACN,2CAA2C,MAAM,mDAClB,QAAQ;AAAA,EAEzC;AACA,mBAAiB,IAAI,QAAQ,QAAQ;AACrC,SAAO;AACT;AAEA,SAAS,gCACP,SAQC;AACD,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO,CAAC;AAC9C,SAAO,QAAQ,QAAQ,CAAC,QAAQ,UAAU;AACxC,QAAI,CAAC,OAAO,KAAM,QAAO,CAAC;AAC1B,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,SAAS,IAC3E,OAAO,MAAM,KAAK,IAClB,OAAO,KAAK;AAChB,WAAO,CAAC;AAAA,MACN;AAAA,MACA,OAAO,OAAO;AAAA,MACd,UAAU,OAAO;AAAA,MACjB,MAAM,EAAE,OAAO,OAAO,KAAK,UAAU;AAAA,MACrC,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ;AAAA,MACjC,MAAM,OAAO,KAAK,SAAS,UAAU,UAAU;AAAA,IACjD,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,wBAAwB,KAA8B,MAAc,aAAqB;AAChG,QAAM,mBAAmB,IAAI,gBAAgB,QAAQ,IAAI;AACzD,QAAM,oBAAoB,IAAI,iBAAiB,QAAQ,IAAI;AAC3D,QAAM,kBAAkB,IAAI,aAAa,IAAI;AAC7C,QAAM,aAAa,MAAM;AACvB,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAc,eAAO;AAAA,MAC1B,KAAK;AAAY,eAAO;AAAA,MACxB,KAAK;AAAU,eAAO;AAAA,MACtB,KAAK;AAAa,eAAO;AAAA,MACzB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAS,eAAO;AAAA,MACrB;AAAS,eAAO;AAAA,IAClB;AAAA,EACF,GAAG;AACH,QAAM,eAAe,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,IAAI;AAC5E,QAAM,kBAAkB,OAAO,IAAI,iBAAiB,YAAa,IAAI,aAAwB,KAAK,EAAE,SAAS,IAAI;AACjH,QAAM,OAAQ,mBAAmB,KAAO,oBAAoB,IAAM,kBAAkB,IAAK,YAAY,eAAe;AACpH,QAAM,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAClE,SAAO,EAAE,MAAM,SAAS,YAAY;AACtC;AAUO,MAAM,iBAAwC;AAAA,EAKnD,YACU,IACA,SACA,0BACR;AAHQ;AACA;AACA;AAPV,SAAQ,cAAc,oBAAI,IAAqB;AAC/C,SAAQ,aAAa,oBAAI,IAAqB;AAC9C,SAAQ,iBAAiB;AAAA,EAMtB;AAAA,EAEK,uBAAuB;AAC7B,QAAI;AACF,aAAO,KAAK,2BAA2B,KAAK;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,QAAe;AACrB,QAAI,KAAK,QAAS,QAAO,KAAK,QAAQ;AACtC,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,OAAO,cAAc,WAAY,QAAO,MAAM,UAAU;AACnE,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AAAA,EAEA,MAAM,MAAe,QAAkB,OAAqB,CAAC,GAA4B;AAEvF,UAAM,MAAM,KAAK;AACjB,QAAI,gBAAgB;AACpB,QAAI,eAA6C;AACjD,UAAM,OAAO,EAAE,SAAS,CAAc,UAAqB;AAAE,YAAM,IAAI,MAAM,eAAe;AAAA,IAAE,EAAE;AAEhG,QAAI,KAAK;AACP,qBAAe;AAAA,QACb,QAAQ,OAAO,MAAM;AAAA,QACrB,QAAQ;AAAA,QACR,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK;AAAA,QACrB,QAAQ,IAAI;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,MACpB;AACA,YAAM,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI;AACvD,YAAM,eAAe,MAAM,uBAAuB,MAAM,cAAc,KAAK;AAC3E,UAAI,aAAa,SAAS;AACxB,cAAM,IAAI,MAAM,aAAa,gBAAgB,uCAAuC;AAAA,MACtF;AACA,sBAAgB,aAAa;AAAA,IAC/B;AAEA,UAAM,EAAE,YAAY,MAAM,GAAG,SAAS,IAAI;AAC1C,WAAO;AAGP,UAAM,QAAQ,uBAAuB,KAAK,IAAI,MAAM;AACpD,UAAM,KAAK,KAAK,MAAM;AAEtB,QAAI,IAAgB,GAAG,WAAW,KAAY;AAC9C,UAAM,UAAU,CAAC,QAAgB,GAAG,KAAK,IAAI,GAAG;AAChD,UAAM,WAAW,KAAK,yBAAyB,IAAI;AACnD,SAAK,iBAAiB;AAEtB,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,gBAAgB,KAAK,gCAAgC;AAE3D,QAAI,CAAC,iBAAiB,YAAY,MAAM,KAAK,aAAa,OAAO,iBAAiB,GAAG;AACnF,UAAI,KAAK,uBAAuB,GAAG,QAAQ,iBAAiB,GAAG,QAAQ;AAAA,IACzE;AAEA,QAAI,CAAC,iBAAiB,MAAM,KAAK,aAAa,OAAO,WAAW,GAAG;AACjE,UAAI,EAAE,MAAM,QAAQ,WAAW,GAAG,KAAK,KAAK,QAAQ;AAAA,IACtD;AAEA,QAAI,CAAC,KAAK,eAAe,MAAM,KAAK,aAAa,OAAO,YAAY,GAAG;AACrE,UAAI,EAAE,MAAM,QAAQ,YAAY,GAAG,MAAM,IAAI;AAAA,IAC/C;AAEA,UAAM,oBAAoB,iBAAiB,KAAK,OAAO;AACvD,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,CAAC,GAAI,KAAK,SAAS,CAAC,GAAI,GAAG,gCAAgC,KAAK,kBAAkB,CAAC;AAAA,MACnF,CAAC,aAAa,uBAAuB,KAAK,IAAI,QAAe;AAAA,IAC/D;AACA,UAAM,UAAU,oBAAI,IAA0B;AAC9C,UAAM,cAAc,oBAAI,IAAoB;AAC5C,gBAAY,IAAI,OAAO,KAAK;AAC5B,gBAAY,IAAI,QAAQ,KAAK;AAC7B,eAAW,QAAQ,eAAe;AAChC,cAAQ,IAAI,KAAK,OAAO,IAAI;AAC5B,kBAAY,IAAI,KAAK,OAAO,KAAK,KAAK;AAAA,IACxC;AACA,UAAM,EAAE,aAAa,YAAY,IAAI,iBAAiB,OAAO,mBAAmB,OAAO;AACvF,UAAM,YAAY,kBAAkB,OAAO,CAAC,WAAW,OAAO,OAAO,KAAK,EAAE,WAAW,KAAK,CAAC;AAC7F,UAAM,eAAe,oBAAoB;AACzC,UAAM,gBAAgB,aAAa,WAAW,MAAM,KAAK,YAAY,eAAe;AACpF,UAAM,kBAAkB,gBACpB,MAAM,KAAK,gBAAgB,OAAO,MAAM,GAAG,KAAK,YAAY,MAAM,QAAQ,IAC1E;AACJ,UAAM,eAAe,iBAAiB;AACtC,UAAM,yBAAyB,oBAAI,IAAqB;AACxD,UAAM,gBAAgB,CAAC,GAAG,aAAa,GAAG,SAAS,EAAE,OAAO,CAAC,WAAW,OAAO,OAAO,UAAU,OAAO,OAAO,OAAO;AACrH,QAAI,cAAc,QAAQ;AACxB,YAAM,SAAS,cAAc,IAAI,CAAC,WAAW,OAAO,OAAO,KAAK,CAAC;AACjE,WAAK,eAAe,eAAe;AAAA,QACjC,QAAQ,OAAO,MAAM;AAAA,QACrB;AAAA,QACA,UAAU,KAAK,YAAY;AAAA,QAC3B,mBAAmB;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,UACZ,SAAS,aAAa;AAAA,UACtB,gBAAgB,aAAa;AAAA,UAC7B,gBAAgB,aAAa;AAAA,UAC7B,eAAe,aAAa;AAAA,UAC5B,mBAAmB,aAAa;AAAA,QAClC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,eAAe;AAClB,aAAK,eAAe,mBAAmB,EAAE,QAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,MAC1E,WAAW,CAAC,iBAAiB;AAC3B,aAAK,eAAe,2BAA2B;AAAA,UAC7C,QAAQ,OAAO,MAAM;AAAA,UACrB;AAAA,UACA,UAAU,KAAK,YAAY;AAAA,UAC3B,mBAAmB;AAAA,QACrB,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,iBAAiB,QAAQ,IAAI;AAEnC,UAAM,gBAAgB,CAAC,SAAqB,QAAsC,IAAY,OAAgB,cAAmC;AAC/I,WACG,OAAO,UAAU,OAAO,YACzB,gBACA,OAAO,UAAU,YACjB,aACA,OAAO,WAAW,UAClB;AACA,cAAM,SAAS,aAAa,OAAO,KAAK,GAAG,YAAY;AACvD,cAAM,SAAS,OAAO;AACtB,YAAI,OAAO,QAAQ;AACjB,gBAAM,SAAS,KAAK,kBAAkB,SAAS;AAAA,YAC7C,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP;AAAA,YACA;AAAA,YACA,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,YACnB,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD,eAAK,eAAe,iBAAiB;AAAA,YACnC,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP,QAAQ,OAAO;AAAA,YACf;AAAA,YACA,SAAS,OAAO;AAAA,YAChB,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,UACrB,CAAC;AACD,cAAI,OAAO,QAAS,QAAO,OAAO;AAAA,QACpC,OAAO;AACL,eAAK,eAAe,4BAA4B;AAAA,YAC9C,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO,KAAK,cAAc,SAAS,QAAQ,IAAI,KAAK;AAAA,IACtD;AAWA,UAAM,oBAAoB,OACxB,SACA,QACA,YACA,SACuD;AACvD,UAAI,CAAC,iBAAiB,CAAC,KAAK,SAAU,QAAO,EAAE,SAAS,OAAO,QAAQ;AACvE,UAAI,CAAC,CAAC,QAAQ,OAAO,EAAE,SAAS,OAAO,EAAE,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ;AAC7E,UAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ;AAE3G,UAAI,kBAAkB,uBAAuB,IAAI,KAAK,QAAQ;AAC9D,UAAI,oBAAoB,QAAW;AACjC,0BAAkB,MAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK,YAAY,MAAM,QAAQ;AAC3F,+BAAuB,IAAI,KAAK,UAAU,eAAe;AAAA,MAC3D;AACA,UAAI,CAAC,gBAAiB,QAAO,EAAE,SAAS,OAAO,QAAQ;AAEvD,YAAM,SAAS,aAAa,OAAO,OAAO,KAAK,GAAG,YAAY;AAC9D,UAAI,CAAC,OAAO,OAAO,OAAQ,QAAO,EAAE,SAAS,OAAO,QAAQ;AAE5D,YAAM,SAAS,KAAK,kBAAkB,SAAS;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb,OAAO,OAAO;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,gBAAgB,GAAG,KAAK,KAAK;AAAA,QAC7B,UAAU,KAAK,YAAY;AAAA,QAC3B,mBAAmB;AAAA,QACnB,QAAQ,OAAO;AAAA,MACjB,CAAC;AACD,aAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,IAC5D;AAEA,UAAM,qBAAqB,YAAY,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO;AAC/D,UAAM,iBAAiB,YAAY,OAAO,CAAC,MAAM,EAAE,OAAO;AAE1D,eAAW,UAAU,oBAAoB;AACvC,YAAM,YAAY,OAAO,OAAO,KAAK;AACrC,UAAI,YAAY,OAAO,aAAa;AACpC,UAAI,CAAC,WAAW;AACd,cAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,SAAS;AAC5D,YAAI,CAAC,QAAQ;AACX,cAAI,KAAK,oBAAoB,GAAG;AAAA,YAC9B,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP,IAAI,OAAO;AAAA,YACX,OAAO,OAAO;AAAA,YACd;AAAA,YACA,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,YACnB,aAAa,KAAK,gBAAgB;AAAA,YAClC;AAAA,YACA;AAAA,UACF,CAAC;AACD;AAAA,QACF;AACA,oBAAY,QAAQ,MAAM;AAAA,MAC5B;AACA,UAAI,cAAc,GAAG,WAAW,OAAO,IAAI,OAAO,OAAO,SAAS;AAAA,IACpE;AAGA,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,SAAS,oBAAI,IAAmC;AACtD,iBAAW,KAAK,gBAAgB;AAC9B,cAAM,QAAQ,OAAO,IAAI,EAAE,OAAQ,KAAK,CAAC;AACzC,cAAM,KAAK,CAAC;AACZ,eAAO,IAAI,EAAE,SAAU,KAAK;AAAA,MAC9B;AACA,YAAM,uBAA2G,CAAC;AAClH,iBAAW,CAAC,EAAE,YAAY,KAAK,QAAQ;AACrC,cAAM,WAAwF,CAAC;AAC/F,mBAAW,UAAU,cAAc;AACjC,gBAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,OAAO,OAAO,KAAK,CAAC;AACvE,cAAI,QAAQ;AACV,qBAAS,KAAK;AAAA,cACZ,WAAW,QAAQ,MAAM;AAAA,cACzB,IAAI,OAAO;AAAA,cACX,OAAO,OAAO;AAAA,cACd,WAAW,OAAO,OAAO,KAAK;AAAA,YAChC,CAAC;AAAA,UACH;AAAA,QACF;AACA,YAAI,SAAS,SAAS,EAAG,sBAAqB,KAAK,QAAQ;AAAA,MAC7D;AACA,UAAI,qBAAqB,SAAS,GAAG;AACnC,YAAI,EAAE,MAAM,CAAC,OAAY,GAAG;AAAA,UAC1B,qBAAqB,IAAI,CAAC,UAAU;AAClC,kBAAM,QAAQ,MAAM,IAAI,CAAC,OAAO,KAAK,wBAAwB,IAAI,GAAG,WAAW,GAAG,IAAI,GAAG,KAAK,CAAC;AAC/F,mBAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,KAAK;AAAA,UACrD,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,mBAAmB,OAAO,SAAqB,cAA2C;AAC9F,YAAM,cAAc,YAAY,IAAI,SAAS;AAC7C,UAAI,CAAC,YAAa,QAAO;AACzB,UAAI,OAAO;AACX,UAAI,CAAC,iBAAiB,YAAY,MAAM,KAAK,aAAa,aAAa,iBAAiB,GAAG;AACzF,eAAO,KAAK,uBAAuB,MAAM,GAAG,SAAS,oBAAoB,QAAQ;AAAA,MACnF;AACA,UAAI,CAAC,iBAAiB,KAAK,YAAY,MAAM,KAAK,aAAa,aAAa,WAAW,GAAG;AACxF,eAAO,KAAK,MAAM,GAAG,SAAS,cAAc,KAAK,KAAK,QAAQ;AAAA,MAChE;AACA,aAAO;AAAA,IACT;AACA,QAAI,MAAM,iBAAiB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,CAAC,WAAW,QAAQ,MAAM;AAAA,MACvC,iBAAiB,CAAC,SAAS,UAAU,iBAAiB,SAAS,KAAK;AAAA,MACpE,eAAe,CAAC,SAAS,QAAQ,IAAI,UAAU,cAAc,SAAS,QAAQ,IAAI,KAAK;AAAA,MACvF;AAAA,MACA,cAAc,CAAC,KAAK,WAAW,KAAK,aAAa,KAAK,MAAM;AAAA,IAC9D,CAAC;AAED,QAAI,KAAK,UAAU,KAAK,OAAO,QAAQ;AACrC,YAAM,OAAO,KAAK,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,CAAC;AAC3D,iBAAW,KAAK,MAAM;AAEpB,YAAI,EAAE,OAAO,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAAA,MACxC;AAAA,IACF,OAAO;AAEL,UAAI,EAAE,OAAO,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;AAAA,IACnD;AAGA,UAAM,WAAW,KAAK;AACtB,UAAM,WAAW,CAAC,MAAc,EAAE,QAAQ,kBAAkB,GAAG;AAC/D,UAAM,kBAAkB,KAAK,4BAA4B,GAAG,OAAO,QAAQ,IAAI,MAAM,OAAO;AAC5F,QAAI,gBAAgB;AACpB,UAAM,YAAY,gBAAgB;AAClC,UAAM,mBAAmB,oBAAI,IAAuC;AACpE,eAAW,UAAU,WAAW;AAC9B,uBAAiB,IAAI,OAAO,OAAO,QAAQ,GAAG,MAAM;AAAA,IACtD;AACA,UAAM,2BAA2B,MAAM,QAAQ,KAAK,mBAAmB,IACnE,KAAK,oBAAoB,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC,IACjD,CAAC;AACL,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,YAAY,oBAAI,IAAuC;AAE7D,eAAW,KAAM,KAAK,UAAU,CAAC,GAAI;AACnC,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,KAAK,EAAG,QAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAAA,IACzE;AACA,eAAW,KAAK,WAAW;AACzB,UAAI,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,KAAK,EAAG,QAAO,IAAI,EAAE,MAAM,MAAM,CAAC,CAAC;AAAA,IAC3F;AACA,QAAI,KAAK,wBAAwB,MAAM;AACrC,UAAI,iBAAiB,OAAO,GAAG;AAC7B,cAAM,eAAe,MAAM,KAAK,iBAAiB,KAAK,CAAC;AACvD,cAAM,cAAc,oBAAI,IAAoB;AAC5C,qBAAa,QAAQ,CAAC,IAAI,QAAQ,YAAY,IAAI,IAAI,GAAG,CAAC;AAC1D,cAAM,OAAO,MAAM,GAChB,WAAW,mBAA0B,EACrC,OAAO,CAAC,OAAc,aAAoB,eAAsB,MAAa,CAAC,EAC9E,MAAM,aAAoB,MAAM,YAAY,EAC5C,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UACxB,GAAG,aAAoB,KAAK,QAAQ;AAAA,UACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,QACnC,CAAC,CAAC,EACD,QAAQ;AAOX,cAAM,SAAqC,KAAK,IAAI,CAAC,QAAQ;AAC3D,gBAAM,MAAM,IAAI;AAChB,cAAI,MAA2B,CAAC;AAChC,cAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,gBAAI;AAAE,oBAAM,KAAK,MAAM,GAAG;AAAA,YAAE,QAAQ;AAAE,oBAAM,CAAC;AAAA,YAAE;AAAA,UACjD,WAAW,OAAO,OAAO,QAAQ,UAAU;AACzC,kBAAM;AAAA,UACR;AACA,iBAAO;AAAA,YACL,KAAK,OAAO,IAAI,GAAG;AAAA,YACnB,UAAU,OAAO,IAAI,SAAS;AAAA,YAC9B,MAAM,OAAO,IAAI,QAAQ,EAAE;AAAA,YAC3B,QAAQ;AAAA,UACV;AAAA,QACF,CAAC;AACD,eAAO,KAAK,CAAC,GAAG,MAAM;AACpB,gBAAM,KAAK,YAAY,IAAI,EAAE,QAAQ,KAAK,OAAO;AACjD,gBAAM,KAAK,YAAY,IAAI,EAAE,QAAQ,KAAK,OAAO;AACjD,cAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,iBAAO,EAAE,IAAI,cAAc,EAAE,GAAG;AAAA,QAClC,CAAC;AACD,cAAM,kBAAkB,oBAAI,IAAwG;AACpI,mBAAW,OAAO,QAAQ;AACxB,gBAAM,SAAS,iBAAiB,IAAI,IAAI,QAAQ;AAChD,cAAI,CAAC,OAAQ;AACb,gBAAM,MAAM,IAAI,UAAU,CAAC;AAC3B,gBAAM,cAAc,YAAY,IAAI,IAAI,QAAQ,KAAK,OAAO;AAC5D,gBAAM,SAAS,wBAAwB,KAAK,IAAI,MAAM,WAAW;AACjE,gBAAM,WAAW,gBAAgB,IAAI,IAAI,GAAG;AAC5C,cAAI,CAAC,YAAY,OAAO,OAAO,SAAS,SAAU,OAAO,SAAS,SAAS,UAAU,OAAO,UAAU,SAAS,WAAY,OAAO,YAAY,SAAS,WAAW,OAAO,cAAc,SAAS,cAAgB;AAC9M,4BAAgB,IAAI,IAAI,KAAK,EAAE,QAAQ,OAAO,OAAO,MAAM,SAAS,OAAO,SAAS,aAAa,OAAO,YAAY,CAAC;AAAA,UACvH;AACA,iBAAO,IAAI,IAAI,GAAG;AAAA,QACpB;AACA,mBAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACpD,oBAAU,IAAI,KAAK,MAAM,MAAM;AAAA,QACjC;AAAA,MACF;AAAA,IACF,WAAW,yBAAyB,SAAS,GAAG;AAC9C,iBAAW,OAAO,yBAA0B,QAAO,IAAI,GAAG;AAAA,IAC5D;AACA,UAAM,iBAAiB,MAAM,KAAK,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;AAC7E,QAAI,eAAe,SAAS,KAAK,iBAAiB,OAAO,GAAG;AAC1D,YAAM,OAAO,MAAM,GAChB,WAAW,mBAA0B,EACrC,OAAO,CAAC,OAAc,WAAkB,CAAC,EACzC,MAAM,aAAoB,MAAM,MAAM,KAAK,iBAAiB,KAAK,CAAC,CAAC,EACnE,MAAM,OAAc,MAAM,cAAc,EACxC,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QACxB,GAAG,aAAoB,KAAK,QAAQ;AAAA,QACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,MACnC,CAAC,CAAC,EACD,QAAQ;AACX,iBAAW,OAAO,MAAM;AACtB,cAAM,SAAS,iBAAiB,IAAI,OAAO,IAAI,SAAS,CAAC;AACzD,YAAI,CAAC,OAAQ;AACb,YAAI,CAAC,UAAU,IAAI,IAAI,GAAG,EAAG,WAAU,IAAI,IAAI,KAAK,MAAM;AAAA,MAC5D;AAAA,IACF;AAEA,UAAM,mBAA8D,CAAC;AACrE,UAAM,oBAA8B,CAAC;AACrC,UAAM,gBAAgB,oBAAI,IAAY;AACtC,UAAM,sBAAsB,oBAAI,IAAoB;AACpD,eAAW,OAAO,QAAQ;AACxB,YAAM,SAAS,UAAU,IAAI,GAAG;AAChC,UAAI,CAAC,OAAQ;AACb,YAAM,iBAAiB,OAAO;AAC9B,YAAM,eAAe,OAAO;AAC5B,YAAM,kBAAkB,SAAS,OAAO,SAAS,KAAK;AACtD,YAAM,eAAe,SAAS,GAAG;AACjC,YAAM,WAAW,OAAO,eAAe,IAAI,YAAY;AACvD,YAAM,WAAW,OAAO,eAAe,IAAI,YAAY;AAEvD,UAAI,EAAE;AAAA,QAAS,wBAAwB,QAAQ;AAAA,QAAW,CAAC,OACzD,GAAG,GAAG,GAAG,QAAQ,cAAc,KAAK,OAAO,cAAc,CAAC,EACvD,GAAG,GAAG,QAAQ,QAAQ,KAAK,GAAG,EAC9B,GAAG,GAAG,QAAQ,cAAc,KAAK,IAAI,EACrC,GAAG,CAAC,OAAY,GAAG,GAAG;AAAA,UACrB,GAAG,GAAG,QAAQ,cAAc,KAAK,QAAQ;AAAA,UACzC,GAAG,GAAG,QAAQ,cAAc,MAAM,IAAI;AAAA,QACxC,CAAC,CAAC;AAAA,MACN;AAEA,UAAI,EAAE;AAAA,QAAS,0BAA0B,QAAQ;AAAA,QAAW,CAAC,OAC3D,GAAG,GAAG,GAAG,QAAQ,cAAc,KAAK,OAAO,cAAc,CAAC,EACvD,GAAG,GAAG,QAAQ,cAAc,KAAK,GAAG,EACpC,MAAM,GAAG,QAAQ,cAAc,KAAK,YAAmB,EACvD,GAAG,CAAC,OAAY,GAAG,GAAG;AAAA,UACrB,GAAG,GAAG,QAAQ,cAAc,KAAK,QAAQ;AAAA,UACzC,GAAG,GAAG,QAAQ,cAAc,MAAM,IAAI;AAAA,QACxC,CAAC,CAAC;AAAA,MACN;AAEA,YAAM,WAAW,WAA0B,IAAI,IAAI,GAAG,QAAQ,OAAO,CAAC;AAAA,kCAC1C,IAAI,IAAI,GAAG,QAAQ,YAAY,CAAC;AAAA,gCAClC,IAAI,IAAI,GAAG,QAAQ,cAAc,CAAC;AAAA,kCAChC,IAAI,IAAI,GAAG,QAAQ,aAAa,CAAC;AAAA,oCAC/B,IAAI,IAAI,GAAG,QAAQ,kBAAkB,CAAC;AAAA,mBACvD,IAAI,IAAI,GAAG,QAAQ,aAAa,CAAC;AAAA;AAE9C,uBAAiB,GAAG,IAAI;AACxB,YAAM,QAAQ,SAAS,MAAM,GAAG,EAAE;AAElC,WAAK,KAAK,UAAU,CAAC,GAAG,SAAS,MAAM,GAAG,EAAE,KAAK,KAAK,wBAAwB,QAAS,yBAAyB,SAAS,KAAK,yBAAyB,SAAS,GAAG,GAAI;AACrK,cAAM,aAAa,GAAG,KAAK;AAC3B,cAAM,cAAc,wBAAiC,IAAI,IAAI,GAAG,QAAQ,cAAc,CAAC;AACvF,cAAM,kBAAkB,sCAA+C,QAAQ;AAC/E,cAAM,WAAW,gBAAyB,WAAW;AAAA,gCAC7B,eAAe;AAAA,oCACX,QAAQ;AAAA;AAEpC,YAAI,EAAE,OAAO,SAAS,GAAG,KAAK,CAAC;AAC/B,YAAI,EAAE,OAAO,YAAY,GAAG,UAAU,CAAC;AACvC,0BAAkB,KAAK,KAAK;AAC5B,sBAAc,IAAI,KAAK;AACvB,4BAAoB,IAAI,OAAO,UAAU;AAAA,MAC3C;AAAA,IACF;AAGA,eAAW,KAAK,WAAW;AACzB,UAAI,CAAC,EAAE,MAAM,WAAW,KAAK,EAAG;AAChC,YAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,YAAM,OAAO,iBAAiB,GAAG;AACjC,UAAI,CAAC,KAAM;AACX,WAAK,EAAE,OAAO,UAAU,EAAE,OAAO,YAAY,gBAAgB,OAAO,EAAE,UAAU,UAAU;AACxF,cAAM,SAAS,aAAa,OAAO,EAAE,KAAK,GAAG,YAAY;AACzD,cAAM,SAAS,OAAO;AACtB,YAAI,OAAO,QAAQ;AACjB,gBAAM,SAAS,KAAK,kBAAkB,GAAG;AAAA,YACvC,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO,EAAE;AAAA,YACT;AAAA,YACA;AAAA,YACA,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,YACnB,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD,eAAK,eAAe,oBAAoB;AAAA,YACtC,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO,EAAE;AAAA,YACT,QAAQ,OAAO;AAAA,YACf;AAAA,YACA,SAAS,OAAO;AAAA,YAChB,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,UACrB,CAAC;AACD,cAAI,OAAO,SAAS;AAClB,gBAAI,OAAO;AACX;AAAA,UACF;AAAA,QACF,OAAO;AACL,eAAK,eAAe,+BAA+B;AAAA,YACjD,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO,EAAE;AAAA,YACT,OAAO,EAAE;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,KAAK,cAAc,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,mBAAmB;AAC1B,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,sCAAsC;AAC1E,YAAM,UAAU,WAAW;AAC3B,YAAM,UAAU,QAAQ,QAAQ,CAAC,MAAO,EAAU,oBAAoB,CAAC,CAAC;AACxE,YAAM,OAAO,QAAQ,OAAO,CAAC,MAAW,EAAE,SAAS,MAAM;AACzD,YAAM,SAAS,MAAM,QAAQ,KAAK,iBAAiB,IAC/C,KAAK,OAAO,CAAC,MAAY,KAAK,kBAA+B,SAAS,EAAE,SAAS,CAAC,IAClF;AACJ,iBAAW,KAAK,QAAQ;AACtB,cAAM,CAAC,EAAE,OAAO,IAAK,EAAE,UAAqB,MAAM,GAAG;AACrD,cAAM,WAAW,QAAQ,SAAS,GAAG,IAAI,UAAU,GAAG,OAAO;AAC7D,cAAM,QAAQ,OAAO,SAAS,OAAO,CAAC;AACtC,YAAI,EAAE;AAAA,UAAS,GAAG,QAAQ,OAAO,KAAK;AAAA,UAAW,CAAC,OAChD,GAAG,MAAM,GAAG,KAAK,IAAI,EAAE,KAAK,YAAY,IAAI,KAAK,GAAG,KAAK,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAGA,eAAW,KAAK,KAAK,QAAQ,CAAC,GAAG;AAC/B,UAAI,EAAE,MAAM,WAAW,KAAK,GAAG;AAC7B,cAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,cAAM,QAAQ,SAAS,MAAM,GAAG,EAAE;AAElC,YAAI,CAAC,kBAAkB,SAAS,KAAK,GAAG;AACtC,gBAAM,OAAO,iBAAiB,GAAG;AACjC,cAAI,MAAM;AACR,gBAAI,EAAE,OAAO,UAAyB,IAAI,IAAI,GAAG,KAAK,CAAC;AACvD,8BAAkB,KAAK,KAAK;AAAA,UAC9B;AAAA,QACF;AACA,YAAI,EAAE,QAAQ,OAAQ,EAAE,OAAO,KAAa;AAAA,MAC9C,OAAO;AACL,cAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,EAAE,KAAK;AAC1D,YAAI,CAAC,OAAQ;AACb,YAAI,EAAE,QAAQ,QAAQ,MAAM,GAAI,EAAE,OAAO,KAAa;AAAA,MACxD;AAAA,IACF;AAGA,UAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,UAAM,WAAW,KAAK,MAAM,YAAY;AAExC,UAAM,sBAAuB,KAAK,sBAAsB,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,kBAAkB,SAAS,IAAK,SAAU,OAAO,KAAK,gBAAgB,EAAE,SAAS;AACvL,QAAI,qBAAqB;AACvB,UAAI,EAAE,QAAQ,GAAG,KAAK,KAAK;AAAA,IAC7B;AACA,UAAM,eAAe,sBACjB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,qBAA6B,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IACvH,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,qBAA6B,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;AAC5G,UAAM,WAAW,MAAM,aAAa,iBAAiB;AACrD,UAAM,QAAQ,OAAQ,UAAkB,SAAS,CAAC;AAClD,UAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ,EAAE,QAAQ;AAE5E,QAAI,cAAc,OAAO,GAAG;AAC1B,iBAAW,OAAO,OAAO;AACvB,mBAAW,SAAS,eAAe;AACjC,gBAAM,aAAa,oBAAoB,IAAI,KAAK;AAChD,gBAAM,UAAU,aAAa,QAAQ,IAAI,UAAU,CAAC,IAAI;AACxD,cAAI,MAAM,IAAI,KAAK;AACnB,cAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAI;AAAE,oBAAM,KAAK,MAAM,GAAG;AAAA,YAAE,QAAQ;AAAA,YAA8B;AAAA,UACpE;AACA,cAAI,SAAS;AACX,gBAAI,OAAO,KAAM,KAAI,KAAK,IAAI,CAAC;AAAA,qBACtB,MAAM,QAAQ,GAAG,EAAG,KAAI,KAAK,IAAI;AAAA,gBACrC,KAAI,KAAK,IAAI,CAAC,GAAG;AAAA,UACxB,OAAO;AACL,gBAAI,MAAM,QAAQ,GAAG,EAAG,KAAI,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI;AAAA,gBAC1D,KAAI,KAAK,IAAI;AAAA,UACpB;AACA,cAAI,WAAY,QAAO,IAAI,UAAU;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,qBAAqB;AACtC,UAAM,iBACJ,KAAK,sBAAsB,KAAK,GAAG;AAQrC,QAAI,iBAAiB;AACrB,QAAI,gBAAgB;AAClB,YAAM,gBACJ,KAAK,mBACD,MAAM,QAAQ,KAAK,eAAe,KAAK,KAAK,gBAAgB,WAAW,IAAI,KAAK,gBAAgB,CAAC,IAAI;AAC3G,uBAAiB,MAAM,QAAQ;AAAA,QAC5B,MAAgB,IAAI,OAAO,SAAS;AACnC,cAAI;AACF,kBAAM,YAAY,MAAM;AAAA,cACtB;AAAA,cACA;AAAA,cACA,MAAM,aAAa,MAAM,YAAY,KAAK,YAAY;AAAA,cACtD,MAAM,mBAAmB,MAAM,kBAAkB,iBAAiB;AAAA,YACpE;AACA,mBAAO,EAAE,GAAG,MAAM,GAAG,UAAU;AAAA,UACjC,SAAS,KAAK;AACZ,oBAAQ,MAAM,gDAAgD,GAAG;AACjE,mBAAO;AAAA,UACT;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,cAA8B,EAAE,OAAO,gBAAgB,MAAM,UAAU,MAAM;AAGjF,QAAI,OAAO,cAAc;AACvB,YAAM,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI;AACvD,oBAAc,MAAM;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,SAAqB,QAAsC,IAAY,OAA4B;AACvH,YAAQ,IAAI;AAAA,MACV,KAAK;AACH,eAAO,UAAU,OACb,QAAQ,MAAM,QAAe,MAAM,IAAI,IACvC,QAAQ,MAAM,QAAe,KAAK,KAAY;AAAA,MACpD,KAAK;AACH,eAAO,UAAU,OACb,QAAQ,MAAM,QAAe,UAAU,IAAI,IAC3C,QAAQ,MAAM,QAAe,MAAM,KAAY;AAAA,MACrD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,KAAK,KAAY;AAAA,MACvD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,MAAM,KAAY;AAAA,MACxD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,KAAK,KAAY;AAAA,MACvD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,MAAM,KAAY;AAAA,MACxD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MAClF,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MACtF,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,QAAQ,KAAY;AAAA,MAC1D,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,SAAS,KAAY;AAAA,MAC3D,KAAK;AACH,eAAO,QACH,QAAQ,MAAM,QAAe,UAAU,IAAI,IAC3C,QAAQ,MAAM,QAAe,MAAM,IAAI;AAAA,MAC7C;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAAA,EAEQ,wBAAwB,IAAS,QAAgB,IAAY,OAAqB;AACxF,YAAQ,IAAI;AAAA,MACV,KAAK;AAAM,eAAO,UAAU,OAAO,GAAG,QAAQ,MAAM,IAAI,IAAI,GAAG,QAAQ,KAAK,KAAK;AAAA,MACjF,KAAK;AAAM,eAAO,UAAU,OAAO,GAAG,QAAQ,UAAU,IAAI,IAAI,GAAG,QAAQ,MAAM,KAAK;AAAA,MACtF,KAAK;AAAM,eAAO,GAAG,QAAQ,KAAK,KAAK;AAAA,MACvC,KAAK;AAAO,eAAO,GAAG,QAAQ,MAAM,KAAK;AAAA,MACzC,KAAK;AAAM,eAAO,GAAG,QAAQ,KAAK,KAAK;AAAA,MACvC,KAAK;AAAO,eAAO,GAAG,QAAQ,MAAM,KAAK;AAAA,MACzC,KAAK;AAAM,eAAO,GAAG,QAAQ,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MACzE,KAAK;AAAO,eAAO,GAAG,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MAC9E,KAAK;AAAQ,eAAO,GAAG,QAAQ,QAAQ,KAAK;AAAA,MAC5C,KAAK;AAAS,eAAO,GAAG,QAAQ,SAAS,KAAK;AAAA,MAC9C,KAAK;AAAU,eAAO,QAAQ,GAAG,QAAQ,UAAU,IAAI,IAAI,GAAG,QAAQ,MAAM,IAAI;AAAA,MAChF;AAAS,eAAO,GAAG,IAAI,IAAI;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAc,kBAAkB,OAAe,OAAuC;AACpF,QAAI,MAAM,KAAK,aAAa,OAAO,KAAK,EAAG,QAAO;AAClD,QAAI,UAAU,qBAAqB,MAAM,KAAK,aAAa,OAAO,IAAI,EAAG,QAAO;AAChF,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,aAAa,OAAe,QAAkC;AAC1E,UAAM,MAAM,GAAG,KAAK,IAAI,MAAM;AAC9B,QAAI,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7B,YAAM,SAAS,KAAK,YAAY,IAAI,GAAG;AACvC,UAAI,WAAW,KAAM,QAAO;AAC5B,WAAK,YAAY,OAAO,GAAG;AAAA,IAC7B;AACA,UAAM,KAAK,KAAK,MAAM;AACtB,UAAM,SAAS,MAAM,GAClB,WAAW,4BAAmC,EAC9C,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,cAAqB,KAAK,KAAK,EACrC,MAAM,eAAsB,KAAK,MAAM,EACvC,MAAM,CAAC,EACP,iBAAiB;AACpB,UAAM,UAAU,CAAC,CAAC;AAClB,QAAI,QAAS,MAAK,YAAY,IAAI,KAAK,IAAI;AAAA,QACtC,MAAK,YAAY,OAAO,GAAG;AAChC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,YAAY,OAAiC;AACzD,QAAI,KAAK,WAAW,IAAI,KAAK,EAAG,QAAO,KAAK,WAAW,IAAI,KAAK,KAAK;AACrE,UAAM,KAAK,KAAK,MAAM;AACtB,UAAM,SAAS,MAAM,GAClB,WAAW,2BAAkC,EAC7C,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,cAAqB,KAAK,KAAK,EACrC,MAAM,CAAC,EACP,iBAAiB;AACpB,UAAM,UAAU,CAAC,CAAC;AAClB,SAAK,WAAW,IAAI,OAAO,OAAO;AAClC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,gBACZ,QACA,UACA,UACkB;AAClB,QAAI;AACF,YAAM,KAAK,KAAK,MAAM;AACtB,UAAI,QAAoB,GACrB,WAAW,eAAsB,EACjC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,eAAsB,KAAK,MAAM,EACvC,MAAM,CAAC;AACV,UAAI,aAAa,QAAW;AAC1B,gBAAQ,MAAM,MAAM,qCAA8C,QAAQ,EAAE;AAAA,MAC9E;AACA,UAAI,UAAU;AACZ,gBAAQ,KAAK,uBAAuB,OAAO,iCAAiC,QAAQ;AAAA,MACtF;AACA,YAAM,MAAM,MAAM,MAAM,iBAAiB;AACzC,aAAO,CAAC,CAAC;AAAA,IACX,SAAS,KAAK;AACZ,WAAK,eAAe,2BAA2B;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,kBACN,GACA,MAU2C;AAC3C,QAAI,CAAC,KAAK,OAAO,QAAQ;AACvB,WAAK,eAAe,yBAAyB;AAAA,QAC3C,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK,YAAY;AAAA,QAC3B,mBAAmB,KAAK;AAAA,MAC1B,CAAC;AACD,aAAO,EAAE,SAAS,OAAO,SAAS,EAAE;AAAA,IACtC;AACA,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS;AACf,SAAK,eAAe,8BAA8B;AAAA,MAChD,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ;AAAA,MACA,YAAY,KAAK,OAAO;AAAA,MACxB,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK,YAAY;AAAA,MAC3B,mBAAmB,KAAK;AAAA,MACxB,aAAa,KAAK,eAAe;AAAA,IACnC,CAAC;AACD,UAAM,WAAW,CAAC,OAAY;AAC5B,UAAI,MAAkB,GACnB,WAAW,oBAAoB,KAAK,EAAE,EACtC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,GAAG,KAAK,gBAAgB,KAAK,KAAK,MAAM,EAC9C,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,KAAK,EACvC,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,KAAK,cAAc,CAAC,QAAQ,EAC5F,MAAM,GAAG,KAAK,eAAe,MAAM,KAAK,MAAM,EAC9C,QAAQ,CAAC,GAAG,KAAK,cAAc,GAAG,KAAK,QAAQ,CAAC,EAChD,OAAO,qBAA8B,IAAI,IAAI,GAAG,KAAK,aAAa,CAAC,QAAQ,KAAK,OAAO,MAAM,EAAE;AAClG,UAAI,KAAK,aAAa,QAAW;AAC/B,cAAM,IAAI,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,yBAAyB,KAAK,YAAY,IAAI,EAAE;AAAA,MAC9G;AACA,UAAI,KAAK,mBAAmB;AAC1B,cAAM,OAAO,uBAAuB,KAAK,GAAG,KAAK,oBAAoB,KAAK,iBAAiB;AAAA,MAC7F;AACA,aAAO;AAAA,IACT;AACA,UAAM,WAAW,KAAK,gBAAgB,OAAO,OAAO;AACpD,QAAI,aAAa,MAAM;AAIrB,YAAMA,QAAO,EAAE,MAAM,CAAC,OAAY,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,aAAO,EAAE,SAAS,MAAM,SAASA,MAAK;AAAA,IACxC;AACA,UAAM,OAAO,EAAE,MAAM,CAAC,OAAY,GAAG,OAAO,SAAS,EAAE,CAAC,CAAC;AACzD,WAAO,EAAE,SAAS,MAAM,SAAS,KAAK;AAAA,EACxC;AAAA,EAEQ,oBACN,GACA,MAYY;AACZ,SAAK,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY,KAAK,gBAAgB,OAAO,KAAK,UAAU,UAAU;AACtG,YAAM,SAAS,aAAa,OAAO,KAAK,KAAK,GAAG,KAAK,YAAY;AACjE,YAAM,SAAS,OAAO;AACtB,UAAI,OAAO,QAAQ;AACjB,cAAM,SAAS,KAAK,kBAAkB,GAAG;AAAA,UACvC,QAAQ,KAAK;AAAA,UACb,OAAO,KAAK;AAAA,UACZ;AAAA,UACA,gBAAgB,KAAK;AAAA,UACrB,UAAU,KAAK,YAAY;AAAA,UAC3B,mBAAmB,KAAK;AAAA,UACxB,QAAQ,OAAO;AAAA,QACjB,CAAC;AACD,aAAK,eAAe,2BAA2B;AAAA,UAC7C,QAAQ,KAAK;AAAA,UACb,OAAO,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,UACf;AAAA,UACA,SAAS,OAAO;AAAA,UAChB,UAAU,KAAK,YAAY;AAAA,UAC3B,mBAAmB,KAAK;AAAA,QAC1B,CAAC;AACD,YAAI,OAAO,QAAS,QAAO,OAAO;AAAA,MACpC,OAAO;AACL,aAAK,eAAe,sCAAsC;AAAA,UACxD,QAAQ,KAAK;AAAA,UACb,OAAO,KAAK;AAAA,UACZ,OAAO,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS;AACf,WAAO,EAAE,MAAM,CAAC,OAAY,GAAG,QAAQ,MAAM;AAC3C,UAAI,MAAkB,GACnB,WAAW,qBAAqB,KAAK,EAAE,EACvC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,GAAG,KAAK,gBAAgB,KAAK,KAAK,MAAM,EAC9C,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,KAAK,cAAc,CAAC,QAAQ;AAC/F,UAAI,KAAK,aAAa,QAAW;AAC/B,cAAM,IAAI,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,yBAAyB,KAAK,YAAY,IAAI,EAAE;AAAA,MAC9G;AACA,UAAI,KAAK,mBAAmB;AAC1B,cAAM,OAAO,uBAAuB,KAAK,GAAG,KAAK,oBAAoB,KAAK,iBAAiB;AAAA,MAC7F;AACA,UAAI,CAAC,KAAK,aAAa;AACrB,cAAM,IAAI,MAAM,GAAG,KAAK,eAAe,MAAM,IAAI;AAAA,MACnD;AAEA,YAAM,WAAW,OAAsB,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC,QAAQ,KAAK,KAAK;AAChF,cAAQ,KAAK,IAAI;AAAA,QACf,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,MAAM,KAAK,KAAK,EAAE;AAAG;AAAA,QAC9D,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,OAAO,KAAK,KAAK,EAAE;AAAG;AAAA,QAC/D,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,OAAO;AACV,gBAAM,WAAW,IAAI,IAAI,KAAK,OAAO,OAAO,MAAM,KAAK,OAAO,QAAQ,OAAO,KAAK,OAAO,OAAO,MAAM,IAAI;AAC1G,gBAAM,IAAI,MAAM,MAAe,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,EAAE;AACnE;AAAA,QACF;AAAA,QACA,KAAK,MAAM;AACT,gBAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;AACjE,gBAAM,IAAI,MAAM,MAAe,QAAQ,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG;AAC/F;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AACV,gBAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;AACjE,gBAAM,IAAI,MAAM,MAAe,QAAQ,YAAY,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG;AACnG;AAAA,QACF;AAAA,QACA,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,SAAS,KAAK,KAAK,EAAE;AAAG;AAAA,QACjE,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,UAAU,KAAK,KAAK,EAAE;AAAG;AAAA,QAClE,KAAK;AACH,gBAAM,KAAK,QACP,IAAI,MAAM,MAAe,QAAQ,cAAc,IAC/C,IAAI,MAAM,MAAe,QAAQ,UAAU;AAC/C;AAAA,QACF;AACE;AAAA,MACJ;AACA,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AAAA,EAEQ,4BACN,GACA,WACA,YACA,IACA,MACA,SAC+D;AAC/D,UAAM,UAAuC;AAAA,MAC3C;AAAA,QACE,UAAU;AAAA,QACV,OAAO;AAAA,QACP,OAAO;AAAA,QACP,cAAc,MAAc,IAAI,IAAI,GAAG,SAAS,KAAK,CAAC;AAAA,MACxD;AAAA,IACF;AACA,UAAM,SAAmC,KAAK,sBAAsB,CAAC;AACrE,QAAI,OAAO;AACX,WAAO,QAAQ,CAAC,QAAQ,UAAU;AAChC,YAAM,YAAY,OAAO,SAAS,uBAAuB,KAAK,IAAI,OAAO,QAAQ;AACjF,YAAM,QAAQ,OAAO,SAAS,OAAO,KAAK;AAC1C,YAAM,OAAO,OAAO;AACpB,UAAI,CAAC,MAAM;AACT,cAAM,IAAI,MAAM,6CAA6C,OAAO,OAAO,QAAQ,CAAC,gCAAgC;AAAA,MACtH;AACA,YAAM,UAAU,KAAK,QAAQ,YAAY,UAAU,cAAc;AACjE,aAAQ,KAAa,MAAM,EAAE,GAAG,SAAS,OAAO,KAAK,IAAI,CAAC,OACxD,GAAG,MAAM,GAAG,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC;AACpE,YAAM,eAAe,OAAO,kBAAkB;AAC9C,cAAQ,KAAK;AAAA,QACX,UAAU,OAAO;AAAA,QACjB;AAAA,QACA,OAAO;AAAA,QACP,cAAc,MAAc,IAAI,IAAI,GAAG,KAAK,IAAI,YAAY,EAAE,CAAC;AAAA,MACjE,CAAC;AAAA,IACH,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClC;AAAA,EAEQ,eAAe,OAAe,SAAkC;AACtE,QAAI;AACF,cAAQ,KAAK,kBAAkB,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,IAC/D,QAAQ;AACN,cAAQ,KAAK,kBAAkB,OAAO,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,yBAAyB,MAAoE;AACnG,QAAI,KAAK,oBAAoB,QAAW;AACtC,YAAM,OAAO,KAAK,mBAAmB,CAAC,GAAG,IAAI,CAAC,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,EAAG;AAC9F,YAAM,cAAc,IAAI,KAAK,CAAC,OAAO,MAAM,QAAQ,OAAO,EAAE;AAC5D,YAAM,MAAM,IAAI,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACpF,aAAO,EAAE,KAAK,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,YAAY;AAAA,IACtD;AACA,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,aAAO,EAAE,KAAK,CAAC,KAAK,cAAc,GAAG,aAAa,MAAM;AAAA,IAC1D;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuB,GAAe,QAAgB,OAA4D;AACxH,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,MAAM,IAAI,WAAW,KAAK,CAAC,MAAM,aAAa;AAChD,aAAO,EAAE,MAAM,UAAmB;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,CAAC,OAAY;AAC1B,YAAM,QAAe,CAAC;AACtB,UAAI,MAAM,IAAI,SAAS,EAAG,OAAM,KAAK,GAAG,QAAQ,MAAM,MAAM,GAAG,CAAC;AAChE,UAAI,MAAM,YAAa,OAAM,KAAK,GAAG,QAAQ,MAAM,IAAI,CAAC;AACxD,UAAI,MAAM,WAAW,EAAG,QAAO,MAAM,CAAC;AACtC,aAAO,GAAG,GAAG,KAAK;AAAA,IACpB,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import type { QueryEngine, QueryOptions, QueryResult, QueryCustomFieldSource, QueryExtensionsConfig, Sort } from './types'\nimport type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { type Kysely, sql, type RawBuilder } from 'kysely'\nimport {\n  applyJoinFilters,\n  normalizeFilters,\n  partitionFilters,\n  resolveJoins,\n  type BaseFilter,\n  type NormalizedFilter,\n  type ResolvedJoin,\n} from './join-utils'\nimport { resolveSearchConfig } from '../search/config'\nimport { tokenizeText } from '../search/tokenize'\nimport { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from './query-extension-runner'\nimport { resolveEncryptedSortFields, sortRowsInMemory } from './encrypted-sort'\n\ntype AnyDb = Kysely<any>\ntype AnyBuilder = any\n\nconst entityTableCache = new Map<string, string>()\n\ntype EncryptionResolver = () => {\n  decryptEntityPayload?: (entityId: EntityId, payload: Record<string, unknown>, tenantId?: string | null, organizationId?: string | null) => Promise<Record<string, unknown>>\n  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null) => Promise<readonly string[]>\n  isEnabled?: () => boolean\n} | null\n\ntype ResolvedCustomFieldSource = {\n  entityId: EntityId\n  alias: string\n  table: string\n  recordIdExpr: RawBuilder<string>\n}\n\ntype ResultRow = Record<string, unknown>\n\nconst pluralizeBaseName = (name: string): string => {\n  if (!name) return name\n  if (name.endsWith('s')) return name\n  if (name.endsWith('y')) return `${name.slice(0, -1)}ies`\n  return `${name}s`\n}\n\nconst toPascalCase = (value: string): string => {\n  return value\n    .split(/[_\\s]+/)\n    .filter(Boolean)\n    .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))\n    .join('')\n}\n\nconst candidateClassNames = (rawName: string): string[] => {\n  const base = toPascalCase(rawName)\n  const candidates = new Set<string>()\n  if (base) candidates.add(base)\n  if (base && !base.endsWith('Entity')) candidates.add(`${base}Entity`)\n  return Array.from(candidates)\n}\n\nexport function resolveEntityTableName(em: EntityManager | undefined, entity: EntityId): string {\n  if (entityTableCache.has(entity)) {\n    return entityTableCache.get(entity)!\n  }\n  const parts = String(entity || '').split(':')\n  const rawName = (parts[1] && parts[1].trim().length > 0) ? parts[1] : (parts[0] || '').trim()\n  const metadata = (em as any)?.getMetadata?.()\n\n  if (metadata && rawName) {\n    const candidates = candidateClassNames(rawName)\n    for (const candidate of candidates) {\n      try {\n        const meta = metadata.find?.(candidate)\n        if (meta?.tableName) {\n          const tableName = String(meta.tableName)\n          entityTableCache.set(entity, tableName)\n          return tableName\n        }\n      } catch {}\n    }\n\n    // Secondary lookup: search ORM metadata by candidate table names\n    const modulePrefix = parts[0] ?? ''\n    const candidateTables = [\n      `${modulePrefix}_${rawName}`,\n      pluralizeBaseName(rawName),\n      `${modulePrefix}_${pluralizeBaseName(rawName)}`,\n    ]\n    try {\n      const allMeta: any[] = metadata.getAll?.() ?? []\n      for (const meta of allMeta) {\n        if (meta?.tableName && candidateTables.includes(String(meta.tableName))) {\n          const tableName = String(meta.tableName)\n          entityTableCache.set(entity, tableName)\n          return tableName\n        }\n      }\n    } catch {}\n  }\n\n  const fallback = pluralizeBaseName(rawName || '')\n  console.warn(\n    `[QueryEngine] Could not resolve entity \"${entity}\" via ORM metadata. ` +\n    `Falling back to table name \"${fallback}\". ` +\n    `Ensure the entity ID segment matches the class name convention.`\n  )\n  entityTableCache.set(entity, fallback)\n  return fallback\n}\n\nfunction buildFilterableCustomFieldJoins(\n  sources: QueryCustomFieldSource[] | undefined,\n): Array<{\n  alias: string\n  table?: string\n  entityId: EntityId\n  from: { field: string }\n  to: { field: string }\n  type: 'left' | 'inner'\n}> {\n  if (!sources || sources.length === 0) return []\n  return sources.flatMap((source, index) => {\n    if (!source.join) return []\n    const alias = typeof source.alias === 'string' && source.alias.trim().length > 0\n      ? source.alias.trim()\n      : `cfs_${index}`\n    return [{\n      alias,\n      table: source.table,\n      entityId: source.entityId,\n      from: { field: source.join.fromField },\n      to: { field: source.join.toField },\n      type: source.join.type === 'inner' ? 'inner' : 'left',\n    }]\n  })\n}\n\nfunction computeCustomFieldScore(cfg: Record<string, unknown>, kind: string, entityIndex: number) {\n  const listVisibleScore = cfg.listVisible === false ? 0 : 1\n  const formEditableScore = cfg.formEditable === false ? 0 : 1\n  const filterableScore = cfg.filterable ? 1 : 0\n  const kindScore = (() => {\n    switch (kind) {\n      case 'dictionary': return 8\n      case 'relation': return 6\n      case 'select': return 4\n      case 'multiline': return 3\n      case 'boolean':\n      case 'integer':\n      case 'float': return 2\n      default: return 1\n    }\n  })()\n  const optionsBonus = Array.isArray(cfg.options) && cfg.options.length ? 2 : 0\n  const dictionaryBonus = typeof cfg.dictionaryId === 'string' && (cfg.dictionaryId as string).trim().length ? 5 : 0\n  const base = (listVisibleScore * 16) + (formEditableScore * 8) + (filterableScore * 4) + kindScore + optionsBonus + dictionaryBonus\n  const penalty = typeof cfg.priority === 'number' ? cfg.priority : 0\n  return { base, penalty, entityIndex }\n}\n\n/**\n * BasicQueryEngine \u2014 Kysely-backed fallback query engine.\n *\n * Resolves base tables via MikroORM metadata, applies tenant/organization/\n * deleted_at scoping, handles custom field (cf:*) selection and filtering,\n * and performs entity-extension joins. Used as the fallback for\n * {@link HybridQueryEngine} when the query index is unavailable or incomplete.\n */\nexport class BasicQueryEngine implements QueryEngine {\n  private columnCache = new Map<string, boolean>()\n  private tableCache = new Map<string, boolean>()\n  private searchAliasSeq = 0\n\n  constructor(\n    private em: EntityManager,\n    private getDbFn?: () => AnyDb,\n    private resolveEncryptionService?: EncryptionResolver,\n  ) {}\n\n  private getEncryptionService() {\n    try {\n      return this.resolveEncryptionService?.() ?? null\n    } catch {\n      return null\n    }\n  }\n\n  private getDb(): AnyDb {\n    if (this.getDbFn) return this.getDbFn()\n    const emAny = this.em as any\n    if (typeof emAny?.getKysely === 'function') return emAny.getKysely() as AnyDb\n    throw new Error('BasicQueryEngine requires an EntityManager exposing getKysely() (MikroORM v7)')\n  }\n\n  async query<T = any>(entity: EntityId, opts: QueryOptions = {}): Promise<QueryResult<T>> {\n    // --- UMES query extension: before-query pipeline ---\n    const ext = opts.extensions\n    let effectiveOpts = opts\n    let extensionCtx: QueryExtensionContext | null = null\n    const noop = { resolve: <R = unknown>(_name: string): R => { throw new Error('No DI context') } }\n\n    if (ext) {\n      extensionCtx = {\n        entity: String(entity),\n        engine: 'basic',\n        tenantId: opts.tenantId ?? '',\n        organizationId: opts.organizationId,\n        userId: ext.userId,\n        em: this.em,\n        container: ext.container,\n        userFeatures: ext.userFeatures,\n      }\n      const diCtx = ext.resolve ? { resolve: ext.resolve } : noop\n      const beforeResult = await runBeforeQueryPipeline(opts, extensionCtx, diCtx)\n      if (beforeResult.blocked) {\n        throw new Error(beforeResult.errorMessage ?? 'Query blocked by extension subscriber')\n      }\n      effectiveOpts = beforeResult.query\n    }\n    // Strip extensions from effectiveOpts so they don't propagate to sub-queries\n    const { extensions: _ext, ...coreOpts } = effectiveOpts\n    opts = coreOpts\n\n    // Heuristic: map '<module>:user' -> table 'users'\n    const table = resolveEntityTableName(this.em, entity)\n    const db = this.getDb()\n\n    let q: AnyBuilder = db.selectFrom(table as any)\n    const qualify = (col: string) => `${table}.${col}`\n    const orgScope = this.resolveOrganizationScope(opts)\n    this.searchAliasSeq = 0\n    // Require tenant scope for all queries\n    if (!opts.tenantId) {\n      throw new Error(\n        'QueryEngine: tenantId is now required for all queries (breaking change). ' +\n        'Please provide a tenantId in QueryOptions, e.g., query(entity, { tenantId: ... }). ' +\n        'See migration guide or documentation for details.'\n      )\n    }\n    const skipAutoScope = opts.omitAutomaticTenantOrgScope === true\n    // Optional organization filter (when present in schema)\n    if (!skipAutoScope && orgScope && await this.columnExists(table, 'organization_id')) {\n      q = this.applyOrganizationScope(q, qualify('organization_id'), orgScope)\n    }\n    // Tenant guard (required) when present in schema\n    if (!skipAutoScope && await this.columnExists(table, 'tenant_id')) {\n      q = q.where(qualify('tenant_id'), '=', opts.tenantId)\n    }\n    // Default soft-delete guard: exclude rows with deleted_at when column exists\n    if (!opts.withDeleted && await this.columnExists(table, 'deleted_at')) {\n      q = q.where(qualify('deleted_at'), 'is', null)\n    }\n\n    const normalizedFilters = normalizeFilters(opts.filters)\n    const resolvedJoins = resolveJoins(\n      table,\n      [...(opts.joins ?? []), ...buildFilterableCustomFieldJoins(opts.customFieldSources)],\n      (entityId) => resolveEntityTableName(this.em, entityId as any),\n    )\n    const joinMap = new Map<string, ResolvedJoin>()\n    const aliasTables = new Map<string, string>()\n    aliasTables.set(table, table)\n    aliasTables.set('base', table)\n    for (const join of resolvedJoins) {\n      joinMap.set(join.alias, join)\n      aliasTables.set(join.alias, join.table)\n    }\n    const { baseFilters, joinFilters } = partitionFilters(table, normalizedFilters, joinMap)\n    const cfFilters = normalizedFilters.filter((filter) => String(filter.field).startsWith('cf:'))\n    const searchConfig = resolveSearchConfig()\n    const searchEnabled = searchConfig.enabled && await this.tableExists('search_tokens')\n    const hasSearchTokens = searchEnabled\n      ? await this.hasSearchTokens(String(entity), opts.tenantId ?? null, orgScope)\n      : false\n    const searchActive = searchEnabled && hasSearchTokens\n    const joinSearchAvailability = new Map<string, boolean>()\n    const searchFilters = [...baseFilters, ...cfFilters].filter((filter) => filter.op === 'like' || filter.op === 'ilike')\n    if (searchFilters.length) {\n      const fields = searchFilters.map((filter) => String(filter.field))\n      this.logSearchDebug('search:init', {\n        entity: String(entity),\n        table,\n        tenantId: opts.tenantId ?? null,\n        organizationScope: orgScope,\n        fields,\n        searchEnabled,\n        hasSearchTokens,\n        searchActive,\n        searchConfig: {\n          enabled: searchConfig.enabled,\n          minTokenLength: searchConfig.minTokenLength,\n          enablePartials: searchConfig.enablePartials,\n          hashAlgorithm: searchConfig.hashAlgorithm,\n          blocklistedFields: searchConfig.blocklistedFields,\n        },\n      })\n      if (!searchEnabled) {\n        this.logSearchDebug('search:disabled', { entity: String(entity), table })\n      } else if (!hasSearchTokens) {\n        this.logSearchDebug('search:no-search-tokens', {\n          entity: String(entity),\n          table,\n          tenantId: opts.tenantId ?? null,\n          organizationScope: orgScope,\n        })\n      }\n    }\n    const recordIdColumn = qualify('id')\n\n    const applyFilterOp = (builder: AnyBuilder, column: string | RawBuilder<unknown>, op: string, value: unknown, fieldName?: string): AnyBuilder => {\n      if (\n        (op === 'like' || op === 'ilike') &&\n        searchActive &&\n        typeof value === 'string' &&\n        fieldName &&\n        typeof column === 'string'\n      ) {\n        const tokens = tokenizeText(String(value), searchConfig)\n        const hashes = tokens.hashes\n        if (hashes.length) {\n          const result = this.applySearchTokens(builder, {\n            entity: String(entity),\n            field: fieldName,\n            hashes,\n            recordIdColumn,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n            tokens: tokens.tokens,\n          })\n          this.logSearchDebug('search:filter', {\n            entity: String(entity),\n            field: fieldName,\n            tokens: tokens.tokens,\n            hashes,\n            applied: result.applied,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n          })\n          if (result.applied) return result.builder\n        } else {\n          this.logSearchDebug('search:skip-empty-hashes', {\n            entity: String(entity),\n            field: fieldName,\n            value,\n          })\n        }\n      }\n      return this.applyColumnOp(builder, column, op, value)\n    }\n\n    // `eq` is accepted alongside `like`/`ilike` so that filters against\n    // encrypted joined columns (whose ciphertext cannot be compared for\n    // equality in SQL) can still resolve via tokenized search. Routing\n    // only applies when `searchEnabled` is true AND the joined entity has\n    // search tokens installed (`searchAvailable`); for non-searchable or\n    // non-encrypted columns the caller still falls through to exact SQL\n    // equality via `applyFilterOp`. Note that token match is approximate \u2014\n    // callers needing strict equality on encrypted fields should filter on\n    // the deterministic `*_hash` column instead.\n    const applyJoinFilterOp = async (\n      builder: AnyBuilder,\n      filter: { column: string; op: string; value?: unknown },\n      _qualified: string,\n      join: ResolvedJoin,\n    ): Promise<{ applied: boolean; builder: AnyBuilder }> => {\n      if (!searchEnabled || !join.entityId) return { applied: false, builder }\n      if (!['like', 'ilike'].includes(filter.op)) return { applied: false, builder }\n      if (typeof filter.value !== 'string' || filter.value.trim().length === 0) return { applied: false, builder }\n\n      let searchAvailable = joinSearchAvailability.get(join.entityId)\n      if (searchAvailable === undefined) {\n        searchAvailable = await this.hasSearchTokens(join.entityId, opts.tenantId ?? null, orgScope)\n        joinSearchAvailability.set(join.entityId, searchAvailable)\n      }\n      if (!searchAvailable) return { applied: false, builder }\n\n      const tokens = tokenizeText(String(filter.value), searchConfig)\n      if (!tokens.hashes.length) return { applied: false, builder }\n\n      const result = this.applySearchTokens(builder, {\n        entity: join.entityId,\n        field: filter.column,\n        hashes: tokens.hashes,\n        recordIdColumn: `${join.alias}.id`,\n        tenantId: opts.tenantId ?? null,\n        organizationScope: orgScope,\n        tokens: tokens.tokens,\n      })\n      return { applied: result.applied, builder: result.builder }\n    }\n\n    const regularBaseFilters = baseFilters.filter((f) => !f.orGroup)\n    const orGroupFilters = baseFilters.filter((f) => f.orGroup)\n\n    for (const filter of regularBaseFilters) {\n      const fieldName = String(filter.field)\n      let qualified = filter.qualified ?? null\n      if (!qualified) {\n        const column = await this.resolveBaseColumn(table, fieldName)\n        if (!column) {\n          q = this.applyIndexDocFilter(q, {\n            entity: String(entity),\n            field: fieldName,\n            op: filter.op,\n            value: filter.value,\n            recordIdColumn,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n            withDeleted: opts.withDeleted === true,\n            searchActive,\n            searchConfig,\n          })\n          continue\n        }\n        qualified = qualify(column)\n      }\n      q = applyFilterOp(q, qualified, filter.op, filter.value, fieldName)\n    }\n\n    // OR-grouped filters: AND within each group (one $or disjunct), OR between groups.\n    if (orGroupFilters.length > 0) {\n      const groups = new Map<string, typeof orGroupFilters>()\n      for (const f of orGroupFilters) {\n        const group = groups.get(f.orGroup!) ?? []\n        group.push(f)\n        groups.set(f.orGroup!, group)\n      }\n      const resolvedGroupFilters: Array<Array<{ qualified: string; op: string; value: unknown; fieldName: string }>> = []\n      for (const [, groupFilters] of groups) {\n        const resolved: Array<{ qualified: string; op: string; value: unknown; fieldName: string }> = []\n        for (const filter of groupFilters) {\n          const column = await this.resolveBaseColumn(table, String(filter.field))\n          if (column) {\n            resolved.push({\n              qualified: qualify(column),\n              op: filter.op,\n              value: filter.value,\n              fieldName: String(filter.field),\n            })\n          }\n        }\n        if (resolved.length > 0) resolvedGroupFilters.push(resolved)\n      }\n      if (resolvedGroupFilters.length > 0) {\n        q = q.where((eb: any) => eb.or(\n          resolvedGroupFilters.map((group) => {\n            const parts = group.map((rf) => this.buildColumnOpExpression(eb, rf.qualified, rf.op, rf.value))\n            return parts.length === 1 ? parts[0] : eb.and(parts)\n          })\n        ))\n      }\n    }\n\n    const applyAliasScopes = async (builder: AnyBuilder, aliasName: string): Promise<AnyBuilder> => {\n      const targetTable = aliasTables.get(aliasName)\n      if (!targetTable) return builder\n      let next = builder\n      if (!skipAutoScope && orgScope && await this.columnExists(targetTable, 'organization_id')) {\n        next = this.applyOrganizationScope(next, `${aliasName}.organization_id`, orgScope)\n      }\n      if (!skipAutoScope && opts.tenantId && await this.columnExists(targetTable, 'tenant_id')) {\n        next = next.where(`${aliasName}.tenant_id`, '=', opts.tenantId)\n      }\n      return next\n    }\n    q = await applyJoinFilters({\n      db,\n      baseTable: table,\n      builder: q,\n      joinMap,\n      joinFilters,\n      aliasTables,\n      qualifyBase: (column) => qualify(column),\n      applyAliasScope: (builder, alias) => applyAliasScopes(builder, alias),\n      applyFilterOp: (builder, column, op, value) => applyFilterOp(builder, column, op, value),\n      applyJoinFilterOp,\n      columnExists: (tbl, column) => this.columnExists(tbl, column),\n    })\n\n    const fallbackOrgId =\n      opts.organizationId\n      ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)\n    const encryptionService = this.getEncryptionService()\n    const resolvedSorts: Sort[] = []\n    for (const s of opts.sort || []) {\n      if (s.field.startsWith('cf:')) {\n        resolvedSorts.push(s)\n      } else {\n        const column = await this.resolveBaseColumn(table, s.field)\n        if (column) resolvedSorts.push({ ...s, field: column })\n      }\n    }\n    const encryptedSortFields = await resolveEncryptedSortFields(\n      encryptionService,\n      entity,\n      resolvedSorts.filter((sort) => !sort.field.startsWith('cf:')).map((sort) => sort.field),\n      opts.tenantId ?? null,\n      fallbackOrgId,\n    )\n    const requiresPlaintextSort = encryptedSortFields.size > 0\n\n    // Selection (base columns only here; cf:* handled later)\n    if (opts.fields && opts.fields.length) {\n      const cols = new Set(opts.fields.filter((f) => !f.startsWith('cf:')))\n      if (requiresPlaintextSort) {\n        for (const field of encryptedSortFields) cols.add(field)\n      }\n      for (const c of cols) {\n        // Qualify and alias to base names to avoid ambiguity\n        q = q.select(sql.ref(qualify(c)).as(c))\n      }\n    } else {\n      // Default to selecting only base table columns to avoid ambiguity when joining\n      q = q.select(sql`${sql.ref(table)}.*`.as('__all'))\n    }\n\n    // Resolve which custom fields to include\n    const tenantId = opts.tenantId\n    const sanitize = (s: string) => s.replace(/[^a-zA-Z0-9_]/g, '_')\n    const cfSourcesResult = this.configureCustomFieldSources(q, table, entity, db, opts, qualify)\n    q = cfSourcesResult.builder\n    const cfSources = cfSourcesResult.sources\n    const entityIdToSource = new Map<string, ResolvedCustomFieldSource>()\n    for (const source of cfSources) {\n      entityIdToSource.set(String(source.entityId), source)\n    }\n    const requestedCustomFieldKeys = Array.isArray(opts.includeCustomFields)\n      ? opts.includeCustomFields.map((key) => String(key))\n      : []\n    const cfKeys = new Set<string>()\n    const keySource = new Map<string, ResolvedCustomFieldSource>()\n    // Explicit in fields/filters\n    for (const f of (opts.fields || [])) {\n      if (typeof f === 'string' && f.startsWith('cf:')) cfKeys.add(f.slice(3))\n    }\n    for (const f of cfFilters) {\n      if (typeof f.field === 'string' && f.field.startsWith('cf:')) cfKeys.add(f.field.slice(3))\n    }\n    if (opts.includeCustomFields === true) {\n      if (entityIdToSource.size > 0) {\n        const entityIdList = Array.from(entityIdToSource.keys())\n        const entityOrder = new Map<string, number>()\n        entityIdList.forEach((id, idx) => entityOrder.set(id, idx))\n        const rows = await db\n          .selectFrom('custom_field_defs' as any)\n          .select(['key' as any, 'entity_id' as any, 'config_json' as any, 'kind' as any])\n          .where('entity_id' as any, 'in', entityIdList)\n          .where('is_active' as any, '=', true)\n          .where((eb: any) => eb.or([\n            eb('tenant_id' as any, '=', tenantId),\n            eb('tenant_id' as any, 'is', null),\n          ]))\n          .execute() as Array<{ key: string; entity_id: string; config_json: unknown; kind: string }>\n        type CustomFieldDefinitionRow = {\n          key: string\n          entityId: string\n          kind: string\n          config: Record<string, unknown>\n        }\n        const sorted: CustomFieldDefinitionRow[] = rows.map((row) => {\n          const raw = row.config_json\n          let cfg: Record<string, any> = {}\n          if (raw && typeof raw === 'string') {\n            try { cfg = JSON.parse(raw) } catch { cfg = {} }\n          } else if (raw && typeof raw === 'object') {\n            cfg = raw as Record<string, any>\n          }\n          return {\n            key: String(row.key),\n            entityId: String(row.entity_id),\n            kind: String(row.kind || ''),\n            config: cfg,\n          }\n        })\n        sorted.sort((a, b) => {\n          const ai = entityOrder.get(a.entityId) ?? Number.MAX_SAFE_INTEGER\n          const bi = entityOrder.get(b.entityId) ?? Number.MAX_SAFE_INTEGER\n          if (ai !== bi) return ai - bi\n          return a.key.localeCompare(b.key)\n        })\n        const selectedSources = new Map<string, { source: ResolvedCustomFieldSource; score: number; penalty: number; entityIndex: number }>()\n        for (const row of sorted) {\n          const source = entityIdToSource.get(row.entityId)\n          if (!source) continue\n          const cfg = row.config || {}\n          const entityIndex = entityOrder.get(row.entityId) ?? Number.MAX_SAFE_INTEGER\n          const scores = computeCustomFieldScore(cfg, row.kind, entityIndex)\n          const existing = selectedSources.get(row.key)\n          if (!existing || scores.base > existing.score || (scores.base === existing.score && (scores.penalty < existing.penalty || (scores.penalty === existing.penalty && scores.entityIndex < existing.entityIndex)))) {\n            selectedSources.set(row.key, { source, score: scores.base, penalty: scores.penalty, entityIndex: scores.entityIndex })\n          }\n          cfKeys.add(row.key)\n        }\n        for (const [key, entry] of selectedSources.entries()) {\n          keySource.set(key, entry.source)\n        }\n      }\n    } else if (requestedCustomFieldKeys.length > 0) {\n      for (const key of requestedCustomFieldKeys) cfKeys.add(key)\n    }\n    const unresolvedKeys = Array.from(cfKeys).filter((key) => !keySource.has(key))\n    if (unresolvedKeys.length > 0 && entityIdToSource.size > 0) {\n      const rows = await db\n        .selectFrom('custom_field_defs' as any)\n        .select(['key' as any, 'entity_id' as any])\n        .where('entity_id' as any, 'in', Array.from(entityIdToSource.keys()))\n        .where('key' as any, 'in', unresolvedKeys)\n        .where('is_active' as any, '=', true)\n        .where((eb: any) => eb.or([\n          eb('tenant_id' as any, '=', tenantId),\n          eb('tenant_id' as any, 'is', null),\n        ]))\n        .execute() as Array<{ key: string; entity_id: string }>\n      for (const row of rows) {\n        const source = entityIdToSource.get(String(row.entity_id))\n        if (!source) continue\n        if (!keySource.has(row.key)) keySource.set(row.key, source)\n      }\n    }\n\n    const cfValueExprByKey: Record<string, RawBuilder<string | null>> = {}\n    const cfSelectedAliases: string[] = []\n    const cfJsonAliases = new Set<string>()\n    const cfMultiAliasByAlias = new Map<string, string>()\n    for (const key of cfKeys) {\n      const source = keySource.get(key)\n      if (!source) continue\n      const entityIdForKey = source.entityId\n      const recordIdExpr = source.recordIdExpr\n      const sourceAliasSafe = sanitize(source.alias || 'src')\n      const keyAliasSafe = sanitize(key)\n      const defAlias = `cfd_${sourceAliasSafe}_${keyAliasSafe}`\n      const valAlias = `cfv_${sourceAliasSafe}_${keyAliasSafe}`\n      // Join definitions for kind resolution\n      q = q.leftJoin(`custom_field_defs as ${defAlias}` as any, (jb: any) =>\n        jb.on(`${defAlias}.entity_id`, '=', String(entityIdForKey))\n          .on(`${defAlias}.key`, '=', key)\n          .on(`${defAlias}.is_active`, '=', true)\n          .on((eb: any) => eb.or([\n            eb(`${defAlias}.tenant_id`, '=', tenantId),\n            eb(`${defAlias}.tenant_id`, 'is', null),\n          ]))\n      )\n      // Join values with record match\n      q = q.leftJoin(`custom_field_values as ${valAlias}` as any, (jb: any) =>\n        jb.on(`${valAlias}.entity_id`, '=', String(entityIdForKey))\n          .on(`${valAlias}.field_key`, '=', key)\n          .onRef(`${valAlias}.record_id`, '=', recordIdExpr as any)\n          .on((eb: any) => eb.or([\n            eb(`${valAlias}.tenant_id`, '=', tenantId),\n            eb(`${valAlias}.tenant_id`, 'is', null),\n          ]))\n      )\n      // Force a common SQL type across branches to avoid Postgres CASE type conflicts\n      const caseExpr = sql<string | null>`CASE ${sql.ref(`${defAlias}.kind`)}\n           WHEN 'integer' THEN (${sql.ref(`${valAlias}.value_int`)})::text\n           WHEN 'float' THEN (${sql.ref(`${valAlias}.value_float`)})::text\n           WHEN 'boolean' THEN (${sql.ref(`${valAlias}.value_bool`)})::text\n           WHEN 'multiline' THEN (${sql.ref(`${valAlias}.value_multiline`)})::text\n           ELSE (${sql.ref(`${valAlias}.value_text`)})::text\n         END`\n      cfValueExprByKey[key] = caseExpr\n      const alias = sanitize(`cf:${key}`)\n      // Project as aggregated to avoid duplicates when multi values exist\n      if ((opts.fields || []).includes(`cf:${key}`) || opts.includeCustomFields === true || (requestedCustomFieldKeys.length > 0 && requestedCustomFieldKeys.includes(key))) {\n        const multiAlias = `${alias}__is_multi`\n        const isMultiExpr = sql<boolean>`bool_or(coalesce((${sql.ref(`${defAlias}.config_json`)}->>'multi')::boolean, false))`\n        const aggregatedArray = sql<unknown>`array_remove(array_agg(DISTINCT ${caseExpr}), NULL)`\n        const projExpr = sql<unknown>`CASE WHEN ${isMultiExpr}\n                THEN to_jsonb(${aggregatedArray})\n                ELSE to_jsonb(max(${caseExpr}))\n           END`\n        q = q.select(projExpr.as(alias))\n        q = q.select(isMultiExpr.as(multiAlias))\n        cfSelectedAliases.push(alias)\n        cfJsonAliases.add(alias)\n        cfMultiAliasByAlias.set(alias, multiAlias)\n      }\n    }\n\n    // Apply cf:* filters (on raw expressions)\n    for (const f of cfFilters) {\n      if (!f.field.startsWith('cf:')) continue\n      const key = f.field.slice(3)\n      const expr = cfValueExprByKey[key]\n      if (!expr) continue\n      if ((f.op === 'like' || f.op === 'ilike') && searchActive && typeof f.value === 'string') {\n        const tokens = tokenizeText(String(f.value), searchConfig)\n        const hashes = tokens.hashes\n        if (hashes.length) {\n          const result = this.applySearchTokens(q, {\n            entity: String(entity),\n            field: f.field,\n            hashes,\n            recordIdColumn,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n            tokens: tokens.tokens,\n          })\n          this.logSearchDebug('search:cf-filter', {\n            entity: String(entity),\n            field: f.field,\n            tokens: tokens.tokens,\n            hashes,\n            applied: result.applied,\n            tenantId: opts.tenantId ?? null,\n            organizationScope: orgScope,\n          })\n          if (result.applied) {\n            q = result.builder\n            continue\n          }\n        } else {\n          this.logSearchDebug('search:cf-skip-empty-hashes', {\n            entity: String(entity),\n            field: f.field,\n            value: f.value,\n          })\n        }\n      }\n      q = this.applyColumnOp(q, expr, f.op, f.value)\n    }\n\n    // Entity extensions joins (no selection yet; enables future filters/projections)\n    if (opts.includeExtensions) {\n      const { getModules } = await import('@open-mercato/shared/lib/i18n/server')\n      const allMods = getModules() as any[]\n      const allExts = allMods.flatMap((m) => (m as any).entityExtensions || [])\n      const exts = allExts.filter((e: any) => e.base === entity)\n      const chosen = Array.isArray(opts.includeExtensions)\n        ? exts.filter((e: any) => (opts.includeExtensions as string[]).includes(e.extension))\n        : exts\n      for (const e of chosen) {\n        const [, extName] = (e.extension as string).split(':')\n        const extTable = extName.endsWith('s') ? extName : `${extName}s`\n        const alias = `ext_${sanitize(extName)}`\n        q = q.leftJoin(`${extTable} as ${alias}` as any, (jb: any) =>\n          jb.onRef(`${alias}.${e.join.extensionKey}`, '=', `${table}.${e.join.baseKey}`)\n        )\n      }\n    }\n\n    // Sorting: base fields and cf:* (use aggregated alias for cf)\n    for (const s of resolvedSorts) {\n      if (s.field.startsWith('cf:')) {\n        const key = s.field.slice(3)\n        const alias = sanitize(`cf:${key}`)\n        // Ensure included in projection to sort by\n        if (!cfSelectedAliases.includes(alias)) {\n          const expr = cfValueExprByKey[key]\n          if (expr) {\n            q = q.select(sql<string | null>`max(${expr})`.as(alias))\n            cfSelectedAliases.push(alias)\n          }\n        }\n        if (!requiresPlaintextSort) q = q.orderBy(alias, (s.dir ?? 'asc') as any)\n      } else {\n        if (!requiresPlaintextSort) q = q.orderBy(qualify(s.field), (s.dir ?? 'asc') as any)\n      }\n    }\n\n    // Pagination\n    const page = opts.page?.page ?? 1\n    const pageSize = opts.page?.pageSize ?? 20\n    // Deduplicate if we joined CFs or extensions by grouping on base id\n    const hasJoinedAggregates = (opts.includeExtensions && (Array.isArray(opts.includeExtensions) ? (opts.includeExtensions.length > 0) : true)) || Object.keys(cfValueExprByKey).length > 0\n    if (hasJoinedAggregates) {\n      q = q.groupBy(`${table}.id`)\n    }\n    const countBuilder = hasJoinedAggregates\n      ? q.clearSelect().clearOrderBy().clearGroupBy().select(sql<string>`count(distinct ${sql.ref(`${table}.id`)})`.as('count'))\n      : q.clearSelect().clearOrderBy().select(sql<string>`count(distinct ${sql.ref(`${table}.id`)})`.as('count'))\n    const countRow = await countBuilder.executeTakeFirst() as { count: unknown } | undefined\n    const total = Number((countRow as any)?.count ?? 0)\n    const dataQuery = requiresPlaintextSort\n      ? q\n      : q.limit(pageSize).offset((page - 1) * pageSize)\n    const items = await dataQuery.execute() as any[]\n\n    if (cfJsonAliases.size > 0) {\n      for (const row of items) {\n        for (const alias of cfJsonAliases) {\n          const multiAlias = cfMultiAliasByAlias.get(alias)\n          const isMulti = multiAlias ? Boolean(row[multiAlias]) : false\n          let raw = row[alias]\n          if (typeof raw === 'string') {\n            try { raw = JSON.parse(raw) } catch { /* ignore malformed json */ }\n          }\n          if (isMulti) {\n            if (raw == null) row[alias] = []\n            else if (Array.isArray(raw)) row[alias] = raw\n            else row[alias] = [raw]\n          } else {\n            if (Array.isArray(raw)) row[alias] = raw.length > 0 ? raw[0] : null\n            else row[alias] = raw\n          }\n          if (multiAlias) delete row[multiAlias]\n        }\n      }\n    }\n\n    const svc = encryptionService\n    const decryptPayload =\n      svc?.decryptEntityPayload?.bind(svc) as\n        | ((\n            entityId: EntityId,\n            payload: Record<string, unknown>,\n            tenantId: string | null,\n            organizationId: string | null,\n          ) => Promise<Record<string, unknown>>)\n        | null\n    let decryptedItems = items\n    if (decryptPayload) {\n      decryptedItems = await Promise.all(\n        (items as any[]).map(async (item) => {\n          try {\n            const decrypted = await decryptPayload(\n              entity,\n              item,\n              item?.tenant_id ?? item?.tenantId ?? opts.tenantId ?? null,\n              item?.organization_id ?? item?.organizationId ?? fallbackOrgId ?? null,\n            )\n            return { ...item, ...decrypted }\n          } catch (err) {\n            console.error('QueryEngine: error decrypting entity payload', err);\n            return item\n          }\n        })\n      )\n    }\n\n    const pagedItems = requiresPlaintextSort\n      ? sortRowsInMemory(decryptedItems as Record<string, unknown>[], resolvedSorts)\n          .slice((page - 1) * pageSize, page * pageSize)\n      : decryptedItems\n\n    let queryResult: QueryResult<T> = { items: pagedItems, page, pageSize, total }\n\n    // --- UMES query extension: after-query pipeline ---\n    if (ext && extensionCtx) {\n      const diCtx = ext.resolve ? { resolve: ext.resolve } : noop\n      queryResult = await runAfterQueryPipeline(\n        queryResult as QueryResult<Record<string, unknown>>,\n        opts,\n        extensionCtx,\n        diCtx,\n      ) as QueryResult<T>\n    }\n\n    return queryResult\n  }\n\n  private applyColumnOp(builder: AnyBuilder, column: string | RawBuilder<unknown>, op: string, value: unknown): AnyBuilder {\n    switch (op) {\n      case 'eq':\n        return value === null\n          ? builder.where(column as any, 'is', null)\n          : builder.where(column as any, '=', value as any)\n      case 'ne':\n        return value === null\n          ? builder.where(column as any, 'is not', null)\n          : builder.where(column as any, '!=', value as any)\n      case 'gt':\n        return builder.where(column as any, '>', value as any)\n      case 'gte':\n        return builder.where(column as any, '>=', value as any)\n      case 'lt':\n        return builder.where(column as any, '<', value as any)\n      case 'lte':\n        return builder.where(column as any, '<=', value as any)\n      case 'in':\n        return builder.where(column as any, 'in', Array.isArray(value) ? value : [value])\n      case 'nin':\n        return builder.where(column as any, 'not in', Array.isArray(value) ? value : [value])\n      case 'like':\n        return builder.where(column as any, 'like', value as any)\n      case 'ilike':\n        return builder.where(column as any, 'ilike', value as any)\n      case 'exists':\n        return value\n          ? builder.where(column as any, 'is not', null)\n          : builder.where(column as any, 'is', null)\n      default:\n        return builder\n    }\n  }\n\n  private buildColumnOpExpression(eb: any, column: string, op: string, value: unknown): any {\n    switch (op) {\n      case 'eq': return value === null ? eb(column, 'is', null) : eb(column, '=', value)\n      case 'ne': return value === null ? eb(column, 'is not', null) : eb(column, '!=', value)\n      case 'gt': return eb(column, '>', value)\n      case 'gte': return eb(column, '>=', value)\n      case 'lt': return eb(column, '<', value)\n      case 'lte': return eb(column, '<=', value)\n      case 'in': return eb(column, 'in', Array.isArray(value) ? value : [value])\n      case 'nin': return eb(column, 'not in', Array.isArray(value) ? value : [value])\n      case 'like': return eb(column, 'like', value)\n      case 'ilike': return eb(column, 'ilike', value)\n      case 'exists': return value ? eb(column, 'is not', null) : eb(column, 'is', null)\n      default: return eb.val(true)\n    }\n  }\n\n  private async resolveBaseColumn(table: string, field: string): Promise<string | null> {\n    if (await this.columnExists(table, field)) return field\n    if (field === 'organization_id' && await this.columnExists(table, 'id')) return 'id'\n    return null\n  }\n\n  private async columnExists(table: string, column: string): Promise<boolean> {\n    const key = `${table}.${column}`\n    if (this.columnCache.has(key)) {\n      const cached = this.columnCache.get(key)\n      if (cached === true) return true\n      this.columnCache.delete(key)\n    }\n    const db = this.getDb()\n    const exists = await db\n      .selectFrom('information_schema.columns' as any)\n      .select(sql<number>`1`.as('one'))\n      .where('table_name' as any, '=', table)\n      .where('column_name' as any, '=', column)\n      .limit(1)\n      .executeTakeFirst()\n    const present = !!exists\n    if (present) this.columnCache.set(key, true)\n    else this.columnCache.delete(key)\n    return present\n  }\n\n  private async tableExists(table: string): Promise<boolean> {\n    if (this.tableCache.has(table)) return this.tableCache.get(table) ?? false\n    const db = this.getDb()\n    const exists = await db\n      .selectFrom('information_schema.tables' as any)\n      .select(sql<number>`1`.as('one'))\n      .where('table_name' as any, '=', table)\n      .limit(1)\n      .executeTakeFirst()\n    const present = !!exists\n    this.tableCache.set(table, present)\n    return present\n  }\n\n  private async hasSearchTokens(\n    entity: string,\n    tenantId: string | null,\n    orgScope?: { ids: string[]; includeNull: boolean } | null\n  ): Promise<boolean> {\n    try {\n      const db = this.getDb()\n      let query: AnyBuilder = db\n        .selectFrom('search_tokens' as any)\n        .select(sql<number>`1`.as('one'))\n        .where('entity_type' as any, '=', entity)\n        .limit(1)\n      if (tenantId !== undefined) {\n        query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n      }\n      if (orgScope) {\n        query = this.applyOrganizationScope(query, 'search_tokens.organization_id', orgScope)\n      }\n      const row = await query.executeTakeFirst()\n      return !!row\n    } catch (err) {\n      this.logSearchDebug('search:has-tokens-error', {\n        entity,\n        tenantId,\n        organizationScope: orgScope,\n        error: err instanceof Error ? err.message : String(err),\n      })\n      return false\n    }\n  }\n\n  private applySearchTokens(\n    q: AnyBuilder,\n    opts: {\n      entity: string\n      field: string\n      hashes: string[]\n      recordIdColumn: string\n      tenantId?: string | null\n      organizationScope?: { ids: string[]; includeNull: boolean } | null\n      combineWith?: 'and' | 'or'\n      tokens?: string[]\n    }\n  ): { applied: boolean; builder: AnyBuilder } {\n    if (!opts.hashes.length) {\n      this.logSearchDebug('search:skip-no-hashes', {\n        entity: opts.entity,\n        field: opts.field,\n        tenantId: opts.tenantId ?? null,\n        organizationScope: opts.organizationScope,\n      })\n      return { applied: false, builder: q }\n    }\n    const alias = `st_${this.searchAliasSeq++}`\n    const engine = this\n    this.logSearchDebug('search:apply-search-tokens', {\n      entity: opts.entity,\n      field: opts.field,\n      alias,\n      tokenCount: opts.hashes.length,\n      tokens: opts.tokens,\n      tenantId: opts.tenantId ?? null,\n      organizationScope: opts.organizationScope,\n      combineWith: opts.combineWith ?? 'and',\n    })\n    const buildSub = (eb: any) => {\n      let sub: AnyBuilder = eb\n        .selectFrom(`search_tokens as ${alias}`)\n        .select(sql<number>`1`.as('one'))\n        .where(`${alias}.entity_type`, '=', opts.entity)\n        .where(`${alias}.field`, '=', opts.field)\n        .where(sql<boolean>`${sql.ref(`${alias}.entity_id`)} = ${sql.ref(opts.recordIdColumn)}::text`)\n        .where(`${alias}.token_hash`, 'in', opts.hashes)\n        .groupBy([`${alias}.entity_id`, `${alias}.field`])\n        .having(sql<boolean>`count(distinct ${sql.ref(`${alias}.token_hash`)}) >= ${opts.hashes.length}`)\n      if (opts.tenantId !== undefined) {\n        sub = sub.where(sql<boolean>`${sql.ref(`${alias}.tenant_id`)} is not distinct from ${opts.tenantId ?? null}`)\n      }\n      if (opts.organizationScope) {\n        sub = engine.applyOrganizationScope(sub, `${alias}.organization_id`, opts.organizationScope)\n      }\n      return sub\n    }\n    const combiner = opts.combineWith === 'or' ? 'or' : 'and'\n    if (combiner === 'or') {\n      // When OR combining, caller expects a raw predicate to include in eb.or([...]).\n      // We keep the same semantics as the previous knex orWhereExists by mutating the outer builder with a WHERE EXISTS.\n      // Return the mutated builder; callers that need per-predicate control should build the sub themselves.\n      const next = q.where((eb: any) => eb.or([eb.exists(buildSub(eb))]))\n      return { applied: true, builder: next }\n    }\n    const next = q.where((eb: any) => eb.exists(buildSub(eb)))\n    return { applied: true, builder: next }\n  }\n\n  private applyIndexDocFilter(\n    q: AnyBuilder,\n    opts: {\n      entity: string\n      field: string\n      op: NormalizedFilter['op']\n      value: unknown\n      recordIdColumn: string\n      tenantId?: string | null\n      organizationScope?: { ids: string[]; includeNull: boolean } | null\n      withDeleted: boolean\n      searchActive: boolean\n      searchConfig: ReturnType<typeof resolveSearchConfig>\n    }\n  ): AnyBuilder {\n    if ((opts.op === 'like' || opts.op === 'ilike') && opts.searchActive && typeof opts.value === 'string') {\n      const tokens = tokenizeText(String(opts.value), opts.searchConfig)\n      const hashes = tokens.hashes\n      if (hashes.length) {\n        const result = this.applySearchTokens(q, {\n          entity: opts.entity,\n          field: opts.field,\n          hashes,\n          recordIdColumn: opts.recordIdColumn,\n          tenantId: opts.tenantId ?? null,\n          organizationScope: opts.organizationScope,\n          tokens: tokens.tokens,\n        })\n        this.logSearchDebug('search:index-doc-filter', {\n          entity: opts.entity,\n          field: opts.field,\n          tokens: tokens.tokens,\n          hashes,\n          applied: result.applied,\n          tenantId: opts.tenantId ?? null,\n          organizationScope: opts.organizationScope,\n        })\n        if (result.applied) return result.builder\n      } else {\n        this.logSearchDebug('search:index-doc-skip-empty-hashes', {\n          entity: opts.entity,\n          field: opts.field,\n          value: opts.value,\n        })\n      }\n      return q\n    }\n\n    const alias = `ei_${this.searchAliasSeq++}`\n    const engine = this\n    return q.where((eb: any) => eb.exists((() => {\n      let sub: AnyBuilder = eb\n        .selectFrom(`entity_indexes as ${alias}`)\n        .select(sql<number>`1`.as('one'))\n        .where(`${alias}.entity_type`, '=', opts.entity)\n        .where(sql<boolean>`${sql.ref(`${alias}.entity_id`)} = ${sql.ref(opts.recordIdColumn)}::text`)\n      if (opts.tenantId !== undefined) {\n        sub = sub.where(sql<boolean>`${sql.ref(`${alias}.tenant_id`)} is not distinct from ${opts.tenantId ?? null}`)\n      }\n      if (opts.organizationScope) {\n        sub = engine.applyOrganizationScope(sub, `${alias}.organization_id`, opts.organizationScope)\n      }\n      if (!opts.withDeleted) {\n        sub = sub.where(`${alias}.deleted_at`, 'is', null)\n      }\n\n      const textExpr = sql<string | null>`(${sql.ref(`${alias}.doc`)} ->> ${opts.field})`\n      switch (opts.op) {\n        case 'eq':\n          sub = sub.where(sql<boolean>`${textExpr} = ${opts.value}`); break\n        case 'ne':\n          sub = sub.where(sql<boolean>`${textExpr} <> ${opts.value}`); break\n        case 'gt':\n        case 'gte':\n        case 'lt':\n        case 'lte': {\n          const operator = sql.raw(opts.op === 'gt' ? '>' : opts.op === 'gte' ? '>=' : opts.op === 'lt' ? '<' : '<=')\n          sub = sub.where(sql<boolean>`${textExpr} ${operator} ${opts.value}`)\n          break\n        }\n        case 'in': {\n          const vals = Array.isArray(opts.value) ? opts.value : [opts.value]\n          sub = sub.where(sql<boolean>`${textExpr} in (${sql.join(vals.map((v) => sql`${v}`), sql`, `)})`)\n          break\n        }\n        case 'nin': {\n          const vals = Array.isArray(opts.value) ? opts.value : [opts.value]\n          sub = sub.where(sql<boolean>`${textExpr} not in (${sql.join(vals.map((v) => sql`${v}`), sql`, `)})`)\n          break\n        }\n        case 'like':\n          sub = sub.where(sql<boolean>`${textExpr} like ${opts.value}`); break\n        case 'ilike':\n          sub = sub.where(sql<boolean>`${textExpr} ilike ${opts.value}`); break\n        case 'exists':\n          sub = opts.value\n            ? sub.where(sql<boolean>`${textExpr} is not null`)\n            : sub.where(sql<boolean>`${textExpr} is null`)\n          break\n        default:\n          break\n      }\n      return sub\n    })()))\n  }\n\n  private configureCustomFieldSources(\n    q: AnyBuilder,\n    baseTable: string,\n    baseEntity: EntityId,\n    db: AnyDb,\n    opts: QueryOptions,\n    qualify: (column: string) => string,\n  ): { builder: AnyBuilder; sources: ResolvedCustomFieldSource[] } {\n    const sources: ResolvedCustomFieldSource[] = [\n      {\n        entityId: baseEntity,\n        alias: 'base',\n        table: baseTable,\n        recordIdExpr: sql<string>`${sql.ref(`${baseTable}.id`)}::text`,\n      },\n    ]\n    const extras: QueryCustomFieldSource[] = opts.customFieldSources ?? []\n    let next = q\n    extras.forEach((srcOpt, index) => {\n      const joinTable = srcOpt.table ?? resolveEntityTableName(this.em, srcOpt.entityId)\n      const alias = srcOpt.alias ?? `cfs_${index}`\n      const join = srcOpt.join\n      if (!join) {\n        throw new Error(`QueryEngine: customFieldSources entry for ${String(srcOpt.entityId)} requires a join configuration`)\n      }\n      const joinFn = (join.type ?? 'left') === 'inner' ? 'innerJoin' : 'leftJoin'\n      next = (next as any)[joinFn](`${joinTable} as ${alias}`, (jb: any) =>\n        jb.onRef(`${alias}.${join.toField}`, '=', qualify(join.fromField)))\n      const recordColumn = srcOpt.recordIdColumn ?? 'id'\n      sources.push({\n        entityId: srcOpt.entityId,\n        alias,\n        table: joinTable,\n        recordIdExpr: sql<string>`${sql.ref(`${alias}.${recordColumn}`)}::text`,\n      })\n    })\n    return { builder: next, sources }\n  }\n\n  private logSearchDebug(event: string, payload: Record<string, unknown>) {\n    try {\n      console.info('[query:search]', event, JSON.stringify(payload))\n    } catch {\n      console.info('[query:search]', event, payload)\n    }\n  }\n\n  private resolveOrganizationScope(opts: QueryOptions): { ids: string[]; includeNull: boolean } | null {\n    if (opts.organizationIds !== undefined) {\n      const raw = (opts.organizationIds ?? []).map((id) => (typeof id === 'string' ? id.trim() : id))\n      const includeNull = raw.some((id) => id == null || id === '')\n      const ids = raw.filter((id): id is string => typeof id === 'string' && id.length > 0)\n      return { ids: Array.from(new Set(ids)), includeNull }\n    }\n    if (typeof opts.organizationId === 'string' && opts.organizationId.trim().length > 0) {\n      return { ids: [opts.organizationId], includeNull: false }\n    }\n    return null\n  }\n\n  private applyOrganizationScope(q: AnyBuilder, column: string, scope: { ids: string[]; includeNull: boolean }): AnyBuilder {\n    if (!scope) return q\n    if (scope.ids.length === 0 && !scope.includeNull) {\n      return q.where(sql<boolean>`1 = 0`)\n    }\n    return q.where((eb: any) => {\n      const parts: any[] = []\n      if (scope.ids.length > 0) parts.push(eb(column, 'in', scope.ids))\n      if (scope.includeNull) parts.push(eb(column, 'is', null))\n      if (parts.length === 1) return parts[0]\n      return eb.or(parts)\n    })\n  }\n}\n"],
+  "mappings": "AAGA,SAAsB,WAA4B;AAClD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,6BAAyD;AAC1F,SAAS,4BAA4B,wBAAwB;AAK7D,MAAM,mBAAmB,oBAAI,IAAoB;AAiBjD,MAAM,oBAAoB,CAAC,SAAyB;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO;AAC/B,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC;AACnD,SAAO,GAAG,IAAI;AAChB;AAEA,MAAM,eAAe,CAAC,UAA0B;AAC9C,SAAO,MACJ,MAAM,QAAQ,EACd,OAAO,OAAO,EACd,IAAI,CAAC,YAAY,QAAQ,OAAO,CAAC,EAAE,YAAY,IAAI,QAAQ,MAAM,CAAC,CAAC,EACnE,KAAK,EAAE;AACZ;AAEA,MAAM,sBAAsB,CAAC,YAA8B;AACzD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,aAAa,oBAAI,IAAY;AACnC,MAAI,KAAM,YAAW,IAAI,IAAI;AAC7B,MAAI,QAAQ,CAAC,KAAK,SAAS,QAAQ,EAAG,YAAW,IAAI,GAAG,IAAI,QAAQ;AACpE,SAAO,MAAM,KAAK,UAAU;AAC9B;AAEO,SAAS,uBAAuB,IAA+B,QAA0B;AAC9F,MAAI,iBAAiB,IAAI,MAAM,GAAG;AAChC,WAAO,iBAAiB,IAAI,MAAM;AAAA,EACpC;AACA,QAAM,QAAQ,OAAO,UAAU,EAAE,EAAE,MAAM,GAAG;AAC5C,QAAM,UAAW,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,IAAK,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,IAAI,KAAK;AAC5F,QAAM,WAAY,IAAY,cAAc;AAE5C,MAAI,YAAY,SAAS;AACvB,UAAM,aAAa,oBAAoB,OAAO;AAC9C,eAAW,aAAa,YAAY;AAClC,UAAI;AACF,cAAM,OAAO,SAAS,OAAO,SAAS;AACtC,YAAI,MAAM,WAAW;AACnB,gBAAM,YAAY,OAAO,KAAK,SAAS;AACvC,2BAAiB,IAAI,QAAQ,SAAS;AACtC,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAAC;AAAA,IACX;AAGA,UAAM,eAAe,MAAM,CAAC,KAAK;AACjC,UAAM,kBAAkB;AAAA,MACtB,GAAG,YAAY,IAAI,OAAO;AAAA,MAC1B,kBAAkB,OAAO;AAAA,MACzB,GAAG,YAAY,IAAI,kBAAkB,OAAO,CAAC;AAAA,IAC/C;AACA,QAAI;AACF,YAAM,UAAiB,SAAS,SAAS,KAAK,CAAC;AAC/C,iBAAW,QAAQ,SAAS;AAC1B,YAAI,MAAM,aAAa,gBAAgB,SAAS,OAAO,KAAK,SAAS,CAAC,GAAG;AACvE,gBAAM,YAAY,OAAO,KAAK,SAAS;AACvC,2BAAiB,IAAI,QAAQ,SAAS;AACtC,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,WAAW,kBAAkB,WAAW,EAAE;AAChD,UAAQ;AAAA,IACN,2CAA2C,MAAM,mDAClB,QAAQ;AAAA,EAEzC;AACA,mBAAiB,IAAI,QAAQ,QAAQ;AACrC,SAAO;AACT;AAEA,SAAS,gCACP,SAQC;AACD,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO,CAAC;AAC9C,SAAO,QAAQ,QAAQ,CAAC,QAAQ,UAAU;AACxC,QAAI,CAAC,OAAO,KAAM,QAAO,CAAC;AAC1B,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,SAAS,IAC3E,OAAO,MAAM,KAAK,IAClB,OAAO,KAAK;AAChB,WAAO,CAAC;AAAA,MACN;AAAA,MACA,OAAO,OAAO;AAAA,MACd,UAAU,OAAO;AAAA,MACjB,MAAM,EAAE,OAAO,OAAO,KAAK,UAAU;AAAA,MACrC,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ;AAAA,MACjC,MAAM,OAAO,KAAK,SAAS,UAAU,UAAU;AAAA,IACjD,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,wBAAwB,KAA8B,MAAc,aAAqB;AAChG,QAAM,mBAAmB,IAAI,gBAAgB,QAAQ,IAAI;AACzD,QAAM,oBAAoB,IAAI,iBAAiB,QAAQ,IAAI;AAC3D,QAAM,kBAAkB,IAAI,aAAa,IAAI;AAC7C,QAAM,aAAa,MAAM;AACvB,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAc,eAAO;AAAA,MAC1B,KAAK;AAAY,eAAO;AAAA,MACxB,KAAK;AAAU,eAAO;AAAA,MACtB,KAAK;AAAa,eAAO;AAAA,MACzB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAS,eAAO;AAAA,MACrB;AAAS,eAAO;AAAA,IAClB;AAAA,EACF,GAAG;AACH,QAAM,eAAe,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,IAAI;AAC5E,QAAM,kBAAkB,OAAO,IAAI,iBAAiB,YAAa,IAAI,aAAwB,KAAK,EAAE,SAAS,IAAI;AACjH,QAAM,OAAQ,mBAAmB,KAAO,oBAAoB,IAAM,kBAAkB,IAAK,YAAY,eAAe;AACpH,QAAM,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAClE,SAAO,EAAE,MAAM,SAAS,YAAY;AACtC;AAUO,MAAM,iBAAwC;AAAA,EAKnD,YACU,IACA,SACA,0BACR;AAHQ;AACA;AACA;AAPV,SAAQ,cAAc,oBAAI,IAAqB;AAC/C,SAAQ,aAAa,oBAAI,IAAqB;AAC9C,SAAQ,iBAAiB;AAAA,EAMtB;AAAA,EAEK,uBAAuB;AAC7B,QAAI;AACF,aAAO,KAAK,2BAA2B,KAAK;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,QAAe;AACrB,QAAI,KAAK,QAAS,QAAO,KAAK,QAAQ;AACtC,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,OAAO,cAAc,WAAY,QAAO,MAAM,UAAU;AACnE,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AAAA,EAEA,MAAM,MAAe,QAAkB,OAAqB,CAAC,GAA4B;AAEvF,UAAM,MAAM,KAAK;AACjB,QAAI,gBAAgB;AACpB,QAAI,eAA6C;AACjD,UAAM,OAAO,EAAE,SAAS,CAAc,UAAqB;AAAE,YAAM,IAAI,MAAM,eAAe;AAAA,IAAE,EAAE;AAEhG,QAAI,KAAK;AACP,qBAAe;AAAA,QACb,QAAQ,OAAO,MAAM;AAAA,QACrB,QAAQ;AAAA,QACR,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK;AAAA,QACrB,QAAQ,IAAI;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,MACpB;AACA,YAAM,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI;AACvD,YAAM,eAAe,MAAM,uBAAuB,MAAM,cAAc,KAAK;AAC3E,UAAI,aAAa,SAAS;AACxB,cAAM,IAAI,MAAM,aAAa,gBAAgB,uCAAuC;AAAA,MACtF;AACA,sBAAgB,aAAa;AAAA,IAC/B;AAEA,UAAM,EAAE,YAAY,MAAM,GAAG,SAAS,IAAI;AAC1C,WAAO;AAGP,UAAM,QAAQ,uBAAuB,KAAK,IAAI,MAAM;AACpD,UAAM,KAAK,KAAK,MAAM;AAEtB,QAAI,IAAgB,GAAG,WAAW,KAAY;AAC9C,UAAM,UAAU,CAAC,QAAgB,GAAG,KAAK,IAAI,GAAG;AAChD,UAAM,WAAW,KAAK,yBAAyB,IAAI;AACnD,SAAK,iBAAiB;AAEtB,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,gBAAgB,KAAK,gCAAgC;AAE3D,QAAI,CAAC,iBAAiB,YAAY,MAAM,KAAK,aAAa,OAAO,iBAAiB,GAAG;AACnF,UAAI,KAAK,uBAAuB,GAAG,QAAQ,iBAAiB,GAAG,QAAQ;AAAA,IACzE;AAEA,QAAI,CAAC,iBAAiB,MAAM,KAAK,aAAa,OAAO,WAAW,GAAG;AACjE,UAAI,EAAE,MAAM,QAAQ,WAAW,GAAG,KAAK,KAAK,QAAQ;AAAA,IACtD;AAEA,QAAI,CAAC,KAAK,eAAe,MAAM,KAAK,aAAa,OAAO,YAAY,GAAG;AACrE,UAAI,EAAE,MAAM,QAAQ,YAAY,GAAG,MAAM,IAAI;AAAA,IAC/C;AAEA,UAAM,oBAAoB,iBAAiB,KAAK,OAAO;AACvD,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,CAAC,GAAI,KAAK,SAAS,CAAC,GAAI,GAAG,gCAAgC,KAAK,kBAAkB,CAAC;AAAA,MACnF,CAAC,aAAa,uBAAuB,KAAK,IAAI,QAAe;AAAA,IAC/D;AACA,UAAM,UAAU,oBAAI,IAA0B;AAC9C,UAAM,cAAc,oBAAI,IAAoB;AAC5C,gBAAY,IAAI,OAAO,KAAK;AAC5B,gBAAY,IAAI,QAAQ,KAAK;AAC7B,eAAW,QAAQ,eAAe;AAChC,cAAQ,IAAI,KAAK,OAAO,IAAI;AAC5B,kBAAY,IAAI,KAAK,OAAO,KAAK,KAAK;AAAA,IACxC;AACA,UAAM,EAAE,aAAa,YAAY,IAAI,iBAAiB,OAAO,mBAAmB,OAAO;AACvF,UAAM,YAAY,kBAAkB,OAAO,CAAC,WAAW,OAAO,OAAO,KAAK,EAAE,WAAW,KAAK,CAAC;AAC7F,UAAM,eAAe,oBAAoB;AACzC,UAAM,gBAAgB,aAAa,WAAW,MAAM,KAAK,YAAY,eAAe;AACpF,UAAM,kBAAkB,gBACpB,MAAM,KAAK,gBAAgB,OAAO,MAAM,GAAG,KAAK,YAAY,MAAM,QAAQ,IAC1E;AACJ,UAAM,eAAe,iBAAiB;AACtC,UAAM,yBAAyB,oBAAI,IAAqB;AACxD,UAAM,gBAAgB,CAAC,GAAG,aAAa,GAAG,SAAS,EAAE,OAAO,CAAC,WAAW,OAAO,OAAO,UAAU,OAAO,OAAO,OAAO;AACrH,QAAI,cAAc,QAAQ;AACxB,YAAM,SAAS,cAAc,IAAI,CAAC,WAAW,OAAO,OAAO,KAAK,CAAC;AACjE,WAAK,eAAe,eAAe;AAAA,QACjC,QAAQ,OAAO,MAAM;AAAA,QACrB;AAAA,QACA,UAAU,KAAK,YAAY;AAAA,QAC3B,mBAAmB;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,UACZ,SAAS,aAAa;AAAA,UACtB,gBAAgB,aAAa;AAAA,UAC7B,gBAAgB,aAAa;AAAA,UAC7B,eAAe,aAAa;AAAA,UAC5B,mBAAmB,aAAa;AAAA,QAClC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,eAAe;AAClB,aAAK,eAAe,mBAAmB,EAAE,QAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,MAC1E,WAAW,CAAC,iBAAiB;AAC3B,aAAK,eAAe,2BAA2B;AAAA,UAC7C,QAAQ,OAAO,MAAM;AAAA,UACrB;AAAA,UACA,UAAU,KAAK,YAAY;AAAA,UAC3B,mBAAmB;AAAA,QACrB,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,iBAAiB,QAAQ,IAAI;AAEnC,UAAM,gBAAgB,CAAC,SAAqB,QAAsC,IAAY,OAAgB,cAAmC;AAC/I,WACG,OAAO,UAAU,OAAO,YACzB,gBACA,OAAO,UAAU,YACjB,aACA,OAAO,WAAW,UAClB;AACA,cAAM,SAAS,aAAa,OAAO,KAAK,GAAG,YAAY;AACvD,cAAM,SAAS,OAAO;AACtB,YAAI,OAAO,QAAQ;AACjB,gBAAM,SAAS,KAAK,kBAAkB,SAAS;AAAA,YAC7C,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP;AAAA,YACA;AAAA,YACA,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,YACnB,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD,eAAK,eAAe,iBAAiB;AAAA,YACnC,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP,QAAQ,OAAO;AAAA,YACf;AAAA,YACA,SAAS,OAAO;AAAA,YAChB,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,UACrB,CAAC;AACD,cAAI,OAAO,QAAS,QAAO,OAAO;AAAA,QACpC,OAAO;AACL,eAAK,eAAe,4BAA4B;AAAA,YAC9C,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO,KAAK,cAAc,SAAS,QAAQ,IAAI,KAAK;AAAA,IACtD;AAWA,UAAM,oBAAoB,OACxB,SACA,QACA,YACA,SACuD;AACvD,UAAI,CAAC,iBAAiB,CAAC,KAAK,SAAU,QAAO,EAAE,SAAS,OAAO,QAAQ;AACvE,UAAI,CAAC,CAAC,QAAQ,OAAO,EAAE,SAAS,OAAO,EAAE,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ;AAC7E,UAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ;AAE3G,UAAI,kBAAkB,uBAAuB,IAAI,KAAK,QAAQ;AAC9D,UAAI,oBAAoB,QAAW;AACjC,0BAAkB,MAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK,YAAY,MAAM,QAAQ;AAC3F,+BAAuB,IAAI,KAAK,UAAU,eAAe;AAAA,MAC3D;AACA,UAAI,CAAC,gBAAiB,QAAO,EAAE,SAAS,OAAO,QAAQ;AAEvD,YAAM,SAAS,aAAa,OAAO,OAAO,KAAK,GAAG,YAAY;AAC9D,UAAI,CAAC,OAAO,OAAO,OAAQ,QAAO,EAAE,SAAS,OAAO,QAAQ;AAE5D,YAAM,SAAS,KAAK,kBAAkB,SAAS;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb,OAAO,OAAO;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,gBAAgB,GAAG,KAAK,KAAK;AAAA,QAC7B,UAAU,KAAK,YAAY;AAAA,QAC3B,mBAAmB;AAAA,QACnB,QAAQ,OAAO;AAAA,MACjB,CAAC;AACD,aAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,IAC5D;AAEA,UAAM,qBAAqB,YAAY,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO;AAC/D,UAAM,iBAAiB,YAAY,OAAO,CAAC,MAAM,EAAE,OAAO;AAE1D,eAAW,UAAU,oBAAoB;AACvC,YAAM,YAAY,OAAO,OAAO,KAAK;AACrC,UAAI,YAAY,OAAO,aAAa;AACpC,UAAI,CAAC,WAAW;AACd,cAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,SAAS;AAC5D,YAAI,CAAC,QAAQ;AACX,cAAI,KAAK,oBAAoB,GAAG;AAAA,YAC9B,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO;AAAA,YACP,IAAI,OAAO;AAAA,YACX,OAAO,OAAO;AAAA,YACd;AAAA,YACA,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,YACnB,aAAa,KAAK,gBAAgB;AAAA,YAClC;AAAA,YACA;AAAA,UACF,CAAC;AACD;AAAA,QACF;AACA,oBAAY,QAAQ,MAAM;AAAA,MAC5B;AACA,UAAI,cAAc,GAAG,WAAW,OAAO,IAAI,OAAO,OAAO,SAAS;AAAA,IACpE;AAGA,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,SAAS,oBAAI,IAAmC;AACtD,iBAAW,KAAK,gBAAgB;AAC9B,cAAM,QAAQ,OAAO,IAAI,EAAE,OAAQ,KAAK,CAAC;AACzC,cAAM,KAAK,CAAC;AACZ,eAAO,IAAI,EAAE,SAAU,KAAK;AAAA,MAC9B;AACA,YAAM,uBAA2G,CAAC;AAClH,iBAAW,CAAC,EAAE,YAAY,KAAK,QAAQ;AACrC,cAAM,WAAwF,CAAC;AAC/F,mBAAW,UAAU,cAAc;AACjC,gBAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,OAAO,OAAO,KAAK,CAAC;AACvE,cAAI,QAAQ;AACV,qBAAS,KAAK;AAAA,cACZ,WAAW,QAAQ,MAAM;AAAA,cACzB,IAAI,OAAO;AAAA,cACX,OAAO,OAAO;AAAA,cACd,WAAW,OAAO,OAAO,KAAK;AAAA,YAChC,CAAC;AAAA,UACH;AAAA,QACF;AACA,YAAI,SAAS,SAAS,EAAG,sBAAqB,KAAK,QAAQ;AAAA,MAC7D;AACA,UAAI,qBAAqB,SAAS,GAAG;AACnC,YAAI,EAAE,MAAM,CAAC,OAAY,GAAG;AAAA,UAC1B,qBAAqB,IAAI,CAAC,UAAU;AAClC,kBAAM,QAAQ,MAAM,IAAI,CAAC,OAAO,KAAK,wBAAwB,IAAI,GAAG,WAAW,GAAG,IAAI,GAAG,KAAK,CAAC;AAC/F,mBAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,KAAK;AAAA,UACrD,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,mBAAmB,OAAO,SAAqB,cAA2C;AAC9F,YAAM,cAAc,YAAY,IAAI,SAAS;AAC7C,UAAI,CAAC,YAAa,QAAO;AACzB,UAAI,OAAO;AACX,UAAI,CAAC,iBAAiB,YAAY,MAAM,KAAK,aAAa,aAAa,iBAAiB,GAAG;AACzF,eAAO,KAAK,uBAAuB,MAAM,GAAG,SAAS,oBAAoB,QAAQ;AAAA,MACnF;AACA,UAAI,CAAC,iBAAiB,KAAK,YAAY,MAAM,KAAK,aAAa,aAAa,WAAW,GAAG;AACxF,eAAO,KAAK,MAAM,GAAG,SAAS,cAAc,KAAK,KAAK,QAAQ;AAAA,MAChE;AACA,aAAO;AAAA,IACT;AACA,QAAI,MAAM,iBAAiB;AAAA,MACzB;AAAA,MACA,WAAW;AAAA,MACX,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,CAAC,WAAW,QAAQ,MAAM;AAAA,MACvC,iBAAiB,CAAC,SAAS,UAAU,iBAAiB,SAAS,KAAK;AAAA,MACpE,eAAe,CAAC,SAAS,QAAQ,IAAI,UAAU,cAAc,SAAS,QAAQ,IAAI,KAAK;AAAA,MACvF;AAAA,MACA,cAAc,CAAC,KAAK,WAAW,KAAK,aAAa,KAAK,MAAM;AAAA,IAC9D,CAAC;AAED,UAAM,gBACJ,KAAK,mBACD,MAAM,QAAQ,KAAK,eAAe,KAAK,KAAK,gBAAgB,WAAW,IAAI,KAAK,gBAAgB,CAAC,IAAI;AAC3G,UAAM,oBAAoB,KAAK,qBAAqB;AACpD,UAAM,gBAAwB,CAAC;AAC/B,eAAW,KAAK,KAAK,QAAQ,CAAC,GAAG;AAC/B,UAAI,EAAE,MAAM,WAAW,KAAK,GAAG;AAC7B,sBAAc,KAAK,CAAC;AAAA,MACtB,OAAO;AACL,cAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,EAAE,KAAK;AAC1D,YAAI,OAAQ,eAAc,KAAK,EAAE,GAAG,GAAG,OAAO,OAAO,CAAC;AAAA,MACxD;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM;AAAA,MAChC;AAAA,MACA;AAAA,MACA,cAAc,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM,WAAW,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;AAAA,MACtF,KAAK,YAAY;AAAA,MACjB;AAAA,IACF;AACA,UAAM,wBAAwB,oBAAoB,OAAO;AAGzD,QAAI,KAAK,UAAU,KAAK,OAAO,QAAQ;AACrC,YAAM,OAAO,IAAI,IAAI,KAAK,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,CAAC,CAAC;AACpE,UAAI,uBAAuB;AACzB,mBAAW,SAAS,oBAAqB,MAAK,IAAI,KAAK;AAAA,MACzD;AACA,iBAAW,KAAK,MAAM;AAEpB,YAAI,EAAE,OAAO,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAAA,MACxC;AAAA,IACF,OAAO;AAEL,UAAI,EAAE,OAAO,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;AAAA,IACnD;AAGA,UAAM,WAAW,KAAK;AACtB,UAAM,WAAW,CAAC,MAAc,EAAE,QAAQ,kBAAkB,GAAG;AAC/D,UAAM,kBAAkB,KAAK,4BAA4B,GAAG,OAAO,QAAQ,IAAI,MAAM,OAAO;AAC5F,QAAI,gBAAgB;AACpB,UAAM,YAAY,gBAAgB;AAClC,UAAM,mBAAmB,oBAAI,IAAuC;AACpE,eAAW,UAAU,WAAW;AAC9B,uBAAiB,IAAI,OAAO,OAAO,QAAQ,GAAG,MAAM;AAAA,IACtD;AACA,UAAM,2BAA2B,MAAM,QAAQ,KAAK,mBAAmB,IACnE,KAAK,oBAAoB,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC,IACjD,CAAC;AACL,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,YAAY,oBAAI,IAAuC;AAE7D,eAAW,KAAM,KAAK,UAAU,CAAC,GAAI;AACnC,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,KAAK,EAAG,QAAO,IAAI,EAAE,MAAM,CAAC,CAAC;AAAA,IACzE;AACA,eAAW,KAAK,WAAW;AACzB,UAAI,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,KAAK,EAAG,QAAO,IAAI,EAAE,MAAM,MAAM,CAAC,CAAC;AAAA,IAC3F;AACA,QAAI,KAAK,wBAAwB,MAAM;AACrC,UAAI,iBAAiB,OAAO,GAAG;AAC7B,cAAM,eAAe,MAAM,KAAK,iBAAiB,KAAK,CAAC;AACvD,cAAM,cAAc,oBAAI,IAAoB;AAC5C,qBAAa,QAAQ,CAAC,IAAI,QAAQ,YAAY,IAAI,IAAI,GAAG,CAAC;AAC1D,cAAM,OAAO,MAAM,GAChB,WAAW,mBAA0B,EACrC,OAAO,CAAC,OAAc,aAAoB,eAAsB,MAAa,CAAC,EAC9E,MAAM,aAAoB,MAAM,YAAY,EAC5C,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UACxB,GAAG,aAAoB,KAAK,QAAQ;AAAA,UACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,QACnC,CAAC,CAAC,EACD,QAAQ;AAOX,cAAM,SAAqC,KAAK,IAAI,CAAC,QAAQ;AAC3D,gBAAM,MAAM,IAAI;AAChB,cAAI,MAA2B,CAAC;AAChC,cAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,gBAAI;AAAE,oBAAM,KAAK,MAAM,GAAG;AAAA,YAAE,QAAQ;AAAE,oBAAM,CAAC;AAAA,YAAE;AAAA,UACjD,WAAW,OAAO,OAAO,QAAQ,UAAU;AACzC,kBAAM;AAAA,UACR;AACA,iBAAO;AAAA,YACL,KAAK,OAAO,IAAI,GAAG;AAAA,YACnB,UAAU,OAAO,IAAI,SAAS;AAAA,YAC9B,MAAM,OAAO,IAAI,QAAQ,EAAE;AAAA,YAC3B,QAAQ;AAAA,UACV;AAAA,QACF,CAAC;AACD,eAAO,KAAK,CAAC,GAAG,MAAM;AACpB,gBAAM,KAAK,YAAY,IAAI,EAAE,QAAQ,KAAK,OAAO;AACjD,gBAAM,KAAK,YAAY,IAAI,EAAE,QAAQ,KAAK,OAAO;AACjD,cAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,iBAAO,EAAE,IAAI,cAAc,EAAE,GAAG;AAAA,QAClC,CAAC;AACD,cAAM,kBAAkB,oBAAI,IAAwG;AACpI,mBAAW,OAAO,QAAQ;AACxB,gBAAM,SAAS,iBAAiB,IAAI,IAAI,QAAQ;AAChD,cAAI,CAAC,OAAQ;AACb,gBAAM,MAAM,IAAI,UAAU,CAAC;AAC3B,gBAAM,cAAc,YAAY,IAAI,IAAI,QAAQ,KAAK,OAAO;AAC5D,gBAAM,SAAS,wBAAwB,KAAK,IAAI,MAAM,WAAW;AACjE,gBAAM,WAAW,gBAAgB,IAAI,IAAI,GAAG;AAC5C,cAAI,CAAC,YAAY,OAAO,OAAO,SAAS,SAAU,OAAO,SAAS,SAAS,UAAU,OAAO,UAAU,SAAS,WAAY,OAAO,YAAY,SAAS,WAAW,OAAO,cAAc,SAAS,cAAgB;AAC9M,4BAAgB,IAAI,IAAI,KAAK,EAAE,QAAQ,OAAO,OAAO,MAAM,SAAS,OAAO,SAAS,aAAa,OAAO,YAAY,CAAC;AAAA,UACvH;AACA,iBAAO,IAAI,IAAI,GAAG;AAAA,QACpB;AACA,mBAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACpD,oBAAU,IAAI,KAAK,MAAM,MAAM;AAAA,QACjC;AAAA,MACF;AAAA,IACF,WAAW,yBAAyB,SAAS,GAAG;AAC9C,iBAAW,OAAO,yBAA0B,QAAO,IAAI,GAAG;AAAA,IAC5D;AACA,UAAM,iBAAiB,MAAM,KAAK,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;AAC7E,QAAI,eAAe,SAAS,KAAK,iBAAiB,OAAO,GAAG;AAC1D,YAAM,OAAO,MAAM,GAChB,WAAW,mBAA0B,EACrC,OAAO,CAAC,OAAc,WAAkB,CAAC,EACzC,MAAM,aAAoB,MAAM,MAAM,KAAK,iBAAiB,KAAK,CAAC,CAAC,EACnE,MAAM,OAAc,MAAM,cAAc,EACxC,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QACxB,GAAG,aAAoB,KAAK,QAAQ;AAAA,QACpC,GAAG,aAAoB,MAAM,IAAI;AAAA,MACnC,CAAC,CAAC,EACD,QAAQ;AACX,iBAAW,OAAO,MAAM;AACtB,cAAM,SAAS,iBAAiB,IAAI,OAAO,IAAI,SAAS,CAAC;AACzD,YAAI,CAAC,OAAQ;AACb,YAAI,CAAC,UAAU,IAAI,IAAI,GAAG,EAAG,WAAU,IAAI,IAAI,KAAK,MAAM;AAAA,MAC5D;AAAA,IACF;AAEA,UAAM,mBAA8D,CAAC;AACrE,UAAM,oBAA8B,CAAC;AACrC,UAAM,gBAAgB,oBAAI,IAAY;AACtC,UAAM,sBAAsB,oBAAI,IAAoB;AACpD,eAAW,OAAO,QAAQ;AACxB,YAAM,SAAS,UAAU,IAAI,GAAG;AAChC,UAAI,CAAC,OAAQ;AACb,YAAM,iBAAiB,OAAO;AAC9B,YAAM,eAAe,OAAO;AAC5B,YAAM,kBAAkB,SAAS,OAAO,SAAS,KAAK;AACtD,YAAM,eAAe,SAAS,GAAG;AACjC,YAAM,WAAW,OAAO,eAAe,IAAI,YAAY;AACvD,YAAM,WAAW,OAAO,eAAe,IAAI,YAAY;AAEvD,UAAI,EAAE;AAAA,QAAS,wBAAwB,QAAQ;AAAA,QAAW,CAAC,OACzD,GAAG,GAAG,GAAG,QAAQ,cAAc,KAAK,OAAO,cAAc,CAAC,EACvD,GAAG,GAAG,QAAQ,QAAQ,KAAK,GAAG,EAC9B,GAAG,GAAG,QAAQ,cAAc,KAAK,IAAI,EACrC,GAAG,CAAC,OAAY,GAAG,GAAG;AAAA,UACrB,GAAG,GAAG,QAAQ,cAAc,KAAK,QAAQ;AAAA,UACzC,GAAG,GAAG,QAAQ,cAAc,MAAM,IAAI;AAAA,QACxC,CAAC,CAAC;AAAA,MACN;AAEA,UAAI,EAAE;AAAA,QAAS,0BAA0B,QAAQ;AAAA,QAAW,CAAC,OAC3D,GAAG,GAAG,GAAG,QAAQ,cAAc,KAAK,OAAO,cAAc,CAAC,EACvD,GAAG,GAAG,QAAQ,cAAc,KAAK,GAAG,EACpC,MAAM,GAAG,QAAQ,cAAc,KAAK,YAAmB,EACvD,GAAG,CAAC,OAAY,GAAG,GAAG;AAAA,UACrB,GAAG,GAAG,QAAQ,cAAc,KAAK,QAAQ;AAAA,UACzC,GAAG,GAAG,QAAQ,cAAc,MAAM,IAAI;AAAA,QACxC,CAAC,CAAC;AAAA,MACN;AAEA,YAAM,WAAW,WAA0B,IAAI,IAAI,GAAG,QAAQ,OAAO,CAAC;AAAA,kCAC1C,IAAI,IAAI,GAAG,QAAQ,YAAY,CAAC;AAAA,gCAClC,IAAI,IAAI,GAAG,QAAQ,cAAc,CAAC;AAAA,kCAChC,IAAI,IAAI,GAAG,QAAQ,aAAa,CAAC;AAAA,oCAC/B,IAAI,IAAI,GAAG,QAAQ,kBAAkB,CAAC;AAAA,mBACvD,IAAI,IAAI,GAAG,QAAQ,aAAa,CAAC;AAAA;AAE9C,uBAAiB,GAAG,IAAI;AACxB,YAAM,QAAQ,SAAS,MAAM,GAAG,EAAE;AAElC,WAAK,KAAK,UAAU,CAAC,GAAG,SAAS,MAAM,GAAG,EAAE,KAAK,KAAK,wBAAwB,QAAS,yBAAyB,SAAS,KAAK,yBAAyB,SAAS,GAAG,GAAI;AACrK,cAAM,aAAa,GAAG,KAAK;AAC3B,cAAM,cAAc,wBAAiC,IAAI,IAAI,GAAG,QAAQ,cAAc,CAAC;AACvF,cAAM,kBAAkB,sCAA+C,QAAQ;AAC/E,cAAM,WAAW,gBAAyB,WAAW;AAAA,gCAC7B,eAAe;AAAA,oCACX,QAAQ;AAAA;AAEpC,YAAI,EAAE,OAAO,SAAS,GAAG,KAAK,CAAC;AAC/B,YAAI,EAAE,OAAO,YAAY,GAAG,UAAU,CAAC;AACvC,0BAAkB,KAAK,KAAK;AAC5B,sBAAc,IAAI,KAAK;AACvB,4BAAoB,IAAI,OAAO,UAAU;AAAA,MAC3C;AAAA,IACF;AAGA,eAAW,KAAK,WAAW;AACzB,UAAI,CAAC,EAAE,MAAM,WAAW,KAAK,EAAG;AAChC,YAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,YAAM,OAAO,iBAAiB,GAAG;AACjC,UAAI,CAAC,KAAM;AACX,WAAK,EAAE,OAAO,UAAU,EAAE,OAAO,YAAY,gBAAgB,OAAO,EAAE,UAAU,UAAU;AACxF,cAAM,SAAS,aAAa,OAAO,EAAE,KAAK,GAAG,YAAY;AACzD,cAAM,SAAS,OAAO;AACtB,YAAI,OAAO,QAAQ;AACjB,gBAAM,SAAS,KAAK,kBAAkB,GAAG;AAAA,YACvC,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO,EAAE;AAAA,YACT;AAAA,YACA;AAAA,YACA,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,YACnB,QAAQ,OAAO;AAAA,UACjB,CAAC;AACD,eAAK,eAAe,oBAAoB;AAAA,YACtC,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO,EAAE;AAAA,YACT,QAAQ,OAAO;AAAA,YACf;AAAA,YACA,SAAS,OAAO;AAAA,YAChB,UAAU,KAAK,YAAY;AAAA,YAC3B,mBAAmB;AAAA,UACrB,CAAC;AACD,cAAI,OAAO,SAAS;AAClB,gBAAI,OAAO;AACX;AAAA,UACF;AAAA,QACF,OAAO;AACL,eAAK,eAAe,+BAA+B;AAAA,YACjD,QAAQ,OAAO,MAAM;AAAA,YACrB,OAAO,EAAE;AAAA,YACT,OAAO,EAAE;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,KAAK,cAAc,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,mBAAmB;AAC1B,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,sCAAsC;AAC1E,YAAM,UAAU,WAAW;AAC3B,YAAM,UAAU,QAAQ,QAAQ,CAAC,MAAO,EAAU,oBAAoB,CAAC,CAAC;AACxE,YAAM,OAAO,QAAQ,OAAO,CAAC,MAAW,EAAE,SAAS,MAAM;AACzD,YAAM,SAAS,MAAM,QAAQ,KAAK,iBAAiB,IAC/C,KAAK,OAAO,CAAC,MAAY,KAAK,kBAA+B,SAAS,EAAE,SAAS,CAAC,IAClF;AACJ,iBAAW,KAAK,QAAQ;AACtB,cAAM,CAAC,EAAE,OAAO,IAAK,EAAE,UAAqB,MAAM,GAAG;AACrD,cAAM,WAAW,QAAQ,SAAS,GAAG,IAAI,UAAU,GAAG,OAAO;AAC7D,cAAM,QAAQ,OAAO,SAAS,OAAO,CAAC;AACtC,YAAI,EAAE;AAAA,UAAS,GAAG,QAAQ,OAAO,KAAK;AAAA,UAAW,CAAC,OAChD,GAAG,MAAM,GAAG,KAAK,IAAI,EAAE,KAAK,YAAY,IAAI,KAAK,GAAG,KAAK,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAGA,eAAW,KAAK,eAAe;AAC7B,UAAI,EAAE,MAAM,WAAW,KAAK,GAAG;AAC7B,cAAM,MAAM,EAAE,MAAM,MAAM,CAAC;AAC3B,cAAM,QAAQ,SAAS,MAAM,GAAG,EAAE;AAElC,YAAI,CAAC,kBAAkB,SAAS,KAAK,GAAG;AACtC,gBAAM,OAAO,iBAAiB,GAAG;AACjC,cAAI,MAAM;AACR,gBAAI,EAAE,OAAO,UAAyB,IAAI,IAAI,GAAG,KAAK,CAAC;AACvD,8BAAkB,KAAK,KAAK;AAAA,UAC9B;AAAA,QACF;AACA,YAAI,CAAC,sBAAuB,KAAI,EAAE,QAAQ,OAAQ,EAAE,OAAO,KAAa;AAAA,MAC1E,OAAO;AACL,YAAI,CAAC,sBAAuB,KAAI,EAAE,QAAQ,QAAQ,EAAE,KAAK,GAAI,EAAE,OAAO,KAAa;AAAA,MACrF;AAAA,IACF;AAGA,UAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,UAAM,WAAW,KAAK,MAAM,YAAY;AAExC,UAAM,sBAAuB,KAAK,sBAAsB,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,kBAAkB,SAAS,IAAK,SAAU,OAAO,KAAK,gBAAgB,EAAE,SAAS;AACvL,QAAI,qBAAqB;AACvB,UAAI,EAAE,QAAQ,GAAG,KAAK,KAAK;AAAA,IAC7B;AACA,UAAM,eAAe,sBACjB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,qBAA6B,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IACvH,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,qBAA6B,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;AAC5G,UAAM,WAAW,MAAM,aAAa,iBAAiB;AACrD,UAAM,QAAQ,OAAQ,UAAkB,SAAS,CAAC;AAClD,UAAM,YAAY,wBACd,IACA,EAAE,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAClD,UAAM,QAAQ,MAAM,UAAU,QAAQ;AAEtC,QAAI,cAAc,OAAO,GAAG;AAC1B,iBAAW,OAAO,OAAO;AACvB,mBAAW,SAAS,eAAe;AACjC,gBAAM,aAAa,oBAAoB,IAAI,KAAK;AAChD,gBAAM,UAAU,aAAa,QAAQ,IAAI,UAAU,CAAC,IAAI;AACxD,cAAI,MAAM,IAAI,KAAK;AACnB,cAAI,OAAO,QAAQ,UAAU;AAC3B,gBAAI;AAAE,oBAAM,KAAK,MAAM,GAAG;AAAA,YAAE,QAAQ;AAAA,YAA8B;AAAA,UACpE;AACA,cAAI,SAAS;AACX,gBAAI,OAAO,KAAM,KAAI,KAAK,IAAI,CAAC;AAAA,qBACtB,MAAM,QAAQ,GAAG,EAAG,KAAI,KAAK,IAAI;AAAA,gBACrC,KAAI,KAAK,IAAI,CAAC,GAAG;AAAA,UACxB,OAAO;AACL,gBAAI,MAAM,QAAQ,GAAG,EAAG,KAAI,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI;AAAA,gBAC1D,KAAI,KAAK,IAAI;AAAA,UACpB;AACA,cAAI,WAAY,QAAO,IAAI,UAAU;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,iBACJ,KAAK,sBAAsB,KAAK,GAAG;AAQrC,QAAI,iBAAiB;AACrB,QAAI,gBAAgB;AAClB,uBAAiB,MAAM,QAAQ;AAAA,QAC5B,MAAgB,IAAI,OAAO,SAAS;AACnC,cAAI;AACF,kBAAM,YAAY,MAAM;AAAA,cACtB;AAAA,cACA;AAAA,cACA,MAAM,aAAa,MAAM,YAAY,KAAK,YAAY;AAAA,cACtD,MAAM,mBAAmB,MAAM,kBAAkB,iBAAiB;AAAA,YACpE;AACA,mBAAO,EAAE,GAAG,MAAM,GAAG,UAAU;AAAA,UACjC,SAAS,KAAK;AACZ,oBAAQ,MAAM,gDAAgD,GAAG;AACjE,mBAAO;AAAA,UACT;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,aAAa,wBACf,iBAAiB,gBAA6C,aAAa,EACxE,OAAO,OAAO,KAAK,UAAU,OAAO,QAAQ,IAC/C;AAEJ,QAAI,cAA8B,EAAE,OAAO,YAAY,MAAM,UAAU,MAAM;AAG7E,QAAI,OAAO,cAAc;AACvB,YAAM,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI;AACvD,oBAAc,MAAM;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,SAAqB,QAAsC,IAAY,OAA4B;AACvH,YAAQ,IAAI;AAAA,MACV,KAAK;AACH,eAAO,UAAU,OACb,QAAQ,MAAM,QAAe,MAAM,IAAI,IACvC,QAAQ,MAAM,QAAe,KAAK,KAAY;AAAA,MACpD,KAAK;AACH,eAAO,UAAU,OACb,QAAQ,MAAM,QAAe,UAAU,IAAI,IAC3C,QAAQ,MAAM,QAAe,MAAM,KAAY;AAAA,MACrD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,KAAK,KAAY;AAAA,MACvD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,MAAM,KAAY;AAAA,MACxD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,KAAK,KAAY;AAAA,MACvD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,MAAM,KAAY;AAAA,MACxD,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MAClF,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MACtF,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,QAAQ,KAAY;AAAA,MAC1D,KAAK;AACH,eAAO,QAAQ,MAAM,QAAe,SAAS,KAAY;AAAA,MAC3D,KAAK;AACH,eAAO,QACH,QAAQ,MAAM,QAAe,UAAU,IAAI,IAC3C,QAAQ,MAAM,QAAe,MAAM,IAAI;AAAA,MAC7C;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAAA,EAEQ,wBAAwB,IAAS,QAAgB,IAAY,OAAqB;AACxF,YAAQ,IAAI;AAAA,MACV,KAAK;AAAM,eAAO,UAAU,OAAO,GAAG,QAAQ,MAAM,IAAI,IAAI,GAAG,QAAQ,KAAK,KAAK;AAAA,MACjF,KAAK;AAAM,eAAO,UAAU,OAAO,GAAG,QAAQ,UAAU,IAAI,IAAI,GAAG,QAAQ,MAAM,KAAK;AAAA,MACtF,KAAK;AAAM,eAAO,GAAG,QAAQ,KAAK,KAAK;AAAA,MACvC,KAAK;AAAO,eAAO,GAAG,QAAQ,MAAM,KAAK;AAAA,MACzC,KAAK;AAAM,eAAO,GAAG,QAAQ,KAAK,KAAK;AAAA,MACvC,KAAK;AAAO,eAAO,GAAG,QAAQ,MAAM,KAAK;AAAA,MACzC,KAAK;AAAM,eAAO,GAAG,QAAQ,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MACzE,KAAK;AAAO,eAAO,GAAG,QAAQ,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,MAC9E,KAAK;AAAQ,eAAO,GAAG,QAAQ,QAAQ,KAAK;AAAA,MAC5C,KAAK;AAAS,eAAO,GAAG,QAAQ,SAAS,KAAK;AAAA,MAC9C,KAAK;AAAU,eAAO,QAAQ,GAAG,QAAQ,UAAU,IAAI,IAAI,GAAG,QAAQ,MAAM,IAAI;AAAA,MAChF;AAAS,eAAO,GAAG,IAAI,IAAI;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAc,kBAAkB,OAAe,OAAuC;AACpF,QAAI,MAAM,KAAK,aAAa,OAAO,KAAK,EAAG,QAAO;AAClD,QAAI,UAAU,qBAAqB,MAAM,KAAK,aAAa,OAAO,IAAI,EAAG,QAAO;AAChF,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,aAAa,OAAe,QAAkC;AAC1E,UAAM,MAAM,GAAG,KAAK,IAAI,MAAM;AAC9B,QAAI,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7B,YAAM,SAAS,KAAK,YAAY,IAAI,GAAG;AACvC,UAAI,WAAW,KAAM,QAAO;AAC5B,WAAK,YAAY,OAAO,GAAG;AAAA,IAC7B;AACA,UAAM,KAAK,KAAK,MAAM;AACtB,UAAM,SAAS,MAAM,GAClB,WAAW,4BAAmC,EAC9C,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,cAAqB,KAAK,KAAK,EACrC,MAAM,eAAsB,KAAK,MAAM,EACvC,MAAM,CAAC,EACP,iBAAiB;AACpB,UAAM,UAAU,CAAC,CAAC;AAClB,QAAI,QAAS,MAAK,YAAY,IAAI,KAAK,IAAI;AAAA,QACtC,MAAK,YAAY,OAAO,GAAG;AAChC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,YAAY,OAAiC;AACzD,QAAI,KAAK,WAAW,IAAI,KAAK,EAAG,QAAO,KAAK,WAAW,IAAI,KAAK,KAAK;AACrE,UAAM,KAAK,KAAK,MAAM;AACtB,UAAM,SAAS,MAAM,GAClB,WAAW,2BAAkC,EAC7C,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,cAAqB,KAAK,KAAK,EACrC,MAAM,CAAC,EACP,iBAAiB;AACpB,UAAM,UAAU,CAAC,CAAC;AAClB,SAAK,WAAW,IAAI,OAAO,OAAO;AAClC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,gBACZ,QACA,UACA,UACkB;AAClB,QAAI;AACF,YAAM,KAAK,KAAK,MAAM;AACtB,UAAI,QAAoB,GACrB,WAAW,eAAsB,EACjC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,eAAsB,KAAK,MAAM,EACvC,MAAM,CAAC;AACV,UAAI,aAAa,QAAW;AAC1B,gBAAQ,MAAM,MAAM,qCAA8C,QAAQ,EAAE;AAAA,MAC9E;AACA,UAAI,UAAU;AACZ,gBAAQ,KAAK,uBAAuB,OAAO,iCAAiC,QAAQ;AAAA,MACtF;AACA,YAAM,MAAM,MAAM,MAAM,iBAAiB;AACzC,aAAO,CAAC,CAAC;AAAA,IACX,SAAS,KAAK;AACZ,WAAK,eAAe,2BAA2B;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,kBACN,GACA,MAU2C;AAC3C,QAAI,CAAC,KAAK,OAAO,QAAQ;AACvB,WAAK,eAAe,yBAAyB;AAAA,QAC3C,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK,YAAY;AAAA,QAC3B,mBAAmB,KAAK;AAAA,MAC1B,CAAC;AACD,aAAO,EAAE,SAAS,OAAO,SAAS,EAAE;AAAA,IACtC;AACA,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS;AACf,SAAK,eAAe,8BAA8B;AAAA,MAChD,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ;AAAA,MACA,YAAY,KAAK,OAAO;AAAA,MACxB,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK,YAAY;AAAA,MAC3B,mBAAmB,KAAK;AAAA,MACxB,aAAa,KAAK,eAAe;AAAA,IACnC,CAAC;AACD,UAAM,WAAW,CAAC,OAAY;AAC5B,UAAI,MAAkB,GACnB,WAAW,oBAAoB,KAAK,EAAE,EACtC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,GAAG,KAAK,gBAAgB,KAAK,KAAK,MAAM,EAC9C,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,KAAK,EACvC,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,KAAK,cAAc,CAAC,QAAQ,EAC5F,MAAM,GAAG,KAAK,eAAe,MAAM,KAAK,MAAM,EAC9C,QAAQ,CAAC,GAAG,KAAK,cAAc,GAAG,KAAK,QAAQ,CAAC,EAChD,OAAO,qBAA8B,IAAI,IAAI,GAAG,KAAK,aAAa,CAAC,QAAQ,KAAK,OAAO,MAAM,EAAE;AAClG,UAAI,KAAK,aAAa,QAAW;AAC/B,cAAM,IAAI,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,yBAAyB,KAAK,YAAY,IAAI,EAAE;AAAA,MAC9G;AACA,UAAI,KAAK,mBAAmB;AAC1B,cAAM,OAAO,uBAAuB,KAAK,GAAG,KAAK,oBAAoB,KAAK,iBAAiB;AAAA,MAC7F;AACA,aAAO;AAAA,IACT;AACA,UAAM,WAAW,KAAK,gBAAgB,OAAO,OAAO;AACpD,QAAI,aAAa,MAAM;AAIrB,YAAMA,QAAO,EAAE,MAAM,CAAC,OAAY,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,aAAO,EAAE,SAAS,MAAM,SAASA,MAAK;AAAA,IACxC;AACA,UAAM,OAAO,EAAE,MAAM,CAAC,OAAY,GAAG,OAAO,SAAS,EAAE,CAAC,CAAC;AACzD,WAAO,EAAE,SAAS,MAAM,SAAS,KAAK;AAAA,EACxC;AAAA,EAEQ,oBACN,GACA,MAYY;AACZ,SAAK,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY,KAAK,gBAAgB,OAAO,KAAK,UAAU,UAAU;AACtG,YAAM,SAAS,aAAa,OAAO,KAAK,KAAK,GAAG,KAAK,YAAY;AACjE,YAAM,SAAS,OAAO;AACtB,UAAI,OAAO,QAAQ;AACjB,cAAM,SAAS,KAAK,kBAAkB,GAAG;AAAA,UACvC,QAAQ,KAAK;AAAA,UACb,OAAO,KAAK;AAAA,UACZ;AAAA,UACA,gBAAgB,KAAK;AAAA,UACrB,UAAU,KAAK,YAAY;AAAA,UAC3B,mBAAmB,KAAK;AAAA,UACxB,QAAQ,OAAO;AAAA,QACjB,CAAC;AACD,aAAK,eAAe,2BAA2B;AAAA,UAC7C,QAAQ,KAAK;AAAA,UACb,OAAO,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,UACf;AAAA,UACA,SAAS,OAAO;AAAA,UAChB,UAAU,KAAK,YAAY;AAAA,UAC3B,mBAAmB,KAAK;AAAA,QAC1B,CAAC;AACD,YAAI,OAAO,QAAS,QAAO,OAAO;AAAA,MACpC,OAAO;AACL,aAAK,eAAe,sCAAsC;AAAA,UACxD,QAAQ,KAAK;AAAA,UACb,OAAO,KAAK;AAAA,UACZ,OAAO,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS;AACf,WAAO,EAAE,MAAM,CAAC,OAAY,GAAG,QAAQ,MAAM;AAC3C,UAAI,MAAkB,GACnB,WAAW,qBAAqB,KAAK,EAAE,EACvC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,GAAG,KAAK,gBAAgB,KAAK,KAAK,MAAM,EAC9C,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,KAAK,cAAc,CAAC,QAAQ;AAC/F,UAAI,KAAK,aAAa,QAAW;AAC/B,cAAM,IAAI,MAAM,MAAe,IAAI,IAAI,GAAG,KAAK,YAAY,CAAC,yBAAyB,KAAK,YAAY,IAAI,EAAE;AAAA,MAC9G;AACA,UAAI,KAAK,mBAAmB;AAC1B,cAAM,OAAO,uBAAuB,KAAK,GAAG,KAAK,oBAAoB,KAAK,iBAAiB;AAAA,MAC7F;AACA,UAAI,CAAC,KAAK,aAAa;AACrB,cAAM,IAAI,MAAM,GAAG,KAAK,eAAe,MAAM,IAAI;AAAA,MACnD;AAEA,YAAM,WAAW,OAAsB,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC,QAAQ,KAAK,KAAK;AAChF,cAAQ,KAAK,IAAI;AAAA,QACf,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,MAAM,KAAK,KAAK,EAAE;AAAG;AAAA,QAC9D,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,OAAO,KAAK,KAAK,EAAE;AAAG;AAAA,QAC/D,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,OAAO;AACV,gBAAM,WAAW,IAAI,IAAI,KAAK,OAAO,OAAO,MAAM,KAAK,OAAO,QAAQ,OAAO,KAAK,OAAO,OAAO,MAAM,IAAI;AAC1G,gBAAM,IAAI,MAAM,MAAe,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,EAAE;AACnE;AAAA,QACF;AAAA,QACA,KAAK,MAAM;AACT,gBAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;AACjE,gBAAM,IAAI,MAAM,MAAe,QAAQ,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG;AAC/F;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AACV,gBAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,KAAK,KAAK;AACjE,gBAAM,IAAI,MAAM,MAAe,QAAQ,YAAY,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG;AACnG;AAAA,QACF;AAAA,QACA,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,SAAS,KAAK,KAAK,EAAE;AAAG;AAAA,QACjE,KAAK;AACH,gBAAM,IAAI,MAAM,MAAe,QAAQ,UAAU,KAAK,KAAK,EAAE;AAAG;AAAA,QAClE,KAAK;AACH,gBAAM,KAAK,QACP,IAAI,MAAM,MAAe,QAAQ,cAAc,IAC/C,IAAI,MAAM,MAAe,QAAQ,UAAU;AAC/C;AAAA,QACF;AACE;AAAA,MACJ;AACA,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AAAA,EAEQ,4BACN,GACA,WACA,YACA,IACA,MACA,SAC+D;AAC/D,UAAM,UAAuC;AAAA,MAC3C;AAAA,QACE,UAAU;AAAA,QACV,OAAO;AAAA,QACP,OAAO;AAAA,QACP,cAAc,MAAc,IAAI,IAAI,GAAG,SAAS,KAAK,CAAC;AAAA,MACxD;AAAA,IACF;AACA,UAAM,SAAmC,KAAK,sBAAsB,CAAC;AACrE,QAAI,OAAO;AACX,WAAO,QAAQ,CAAC,QAAQ,UAAU;AAChC,YAAM,YAAY,OAAO,SAAS,uBAAuB,KAAK,IAAI,OAAO,QAAQ;AACjF,YAAM,QAAQ,OAAO,SAAS,OAAO,KAAK;AAC1C,YAAM,OAAO,OAAO;AACpB,UAAI,CAAC,MAAM;AACT,cAAM,IAAI,MAAM,6CAA6C,OAAO,OAAO,QAAQ,CAAC,gCAAgC;AAAA,MACtH;AACA,YAAM,UAAU,KAAK,QAAQ,YAAY,UAAU,cAAc;AACjE,aAAQ,KAAa,MAAM,EAAE,GAAG,SAAS,OAAO,KAAK,IAAI,CAAC,OACxD,GAAG,MAAM,GAAG,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC;AACpE,YAAM,eAAe,OAAO,kBAAkB;AAC9C,cAAQ,KAAK;AAAA,QACX,UAAU,OAAO;AAAA,QACjB;AAAA,QACA,OAAO;AAAA,QACP,cAAc,MAAc,IAAI,IAAI,GAAG,KAAK,IAAI,YAAY,EAAE,CAAC;AAAA,MACjE,CAAC;AAAA,IACH,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClC;AAAA,EAEQ,eAAe,OAAe,SAAkC;AACtE,QAAI;AACF,cAAQ,KAAK,kBAAkB,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,IAC/D,QAAQ;AACN,cAAQ,KAAK,kBAAkB,OAAO,OAAO;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,yBAAyB,MAAoE;AACnG,QAAI,KAAK,oBAAoB,QAAW;AACtC,YAAM,OAAO,KAAK,mBAAmB,CAAC,GAAG,IAAI,CAAC,OAAQ,OAAO,OAAO,WAAW,GAAG,KAAK,IAAI,EAAG;AAC9F,YAAM,cAAc,IAAI,KAAK,CAAC,OAAO,MAAM,QAAQ,OAAO,EAAE;AAC5D,YAAM,MAAM,IAAI,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACpF,aAAO,EAAE,KAAK,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,YAAY;AAAA,IACtD;AACA,QAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,EAAE,SAAS,GAAG;AACpF,aAAO,EAAE,KAAK,CAAC,KAAK,cAAc,GAAG,aAAa,MAAM;AAAA,IAC1D;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuB,GAAe,QAAgB,OAA4D;AACxH,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,MAAM,IAAI,WAAW,KAAK,CAAC,MAAM,aAAa;AAChD,aAAO,EAAE,MAAM,UAAmB;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,CAAC,OAAY;AAC1B,YAAM,QAAe,CAAC;AACtB,UAAI,MAAM,IAAI,SAAS,EAAG,OAAM,KAAK,GAAG,QAAQ,MAAM,MAAM,GAAG,CAAC;AAChE,UAAI,MAAM,YAAa,OAAM,KAAK,GAAG,QAAQ,MAAM,IAAI,CAAC;AACxD,UAAI,MAAM,WAAW,EAAG,QAAO,MAAM,CAAC;AACtC,aAAO,GAAG,GAAG,KAAK;AAAA,IACpB,CAAC;AAAA,EACH;AACF;",
   "names": ["next"]
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.4-develop.4038.1.91ce075c8a";
+const APP_VERSION = "0.6.4-develop.4095.1.9c790dc021";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.4-develop.4038.1.91ce075c8a'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.4-develop.4095.1.9c790dc021'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.4-develop.4038.1.91ce075c8a",
+  "version": "0.6.4-develop.4095.1.9c790dc021",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -92,7 +92,7 @@
     "@mikro-orm/core": "^7.1.1",
     "@mikro-orm/decorators": "^7.1.1",
     "@mikro-orm/postgresql": "^7.1.1",
-    "@open-mercato/cache": "0.6.4-develop.4038.1.91ce075c8a",
+    "@open-mercato/cache": "0.6.4-develop.4095.1.9c790dc021",
     "dotenv": "^17.4.2",
     "rate-limiter-flexible": "^11.1.0",
     "re2js": "2.8.3",

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -128,3 +128,24 @@ describe('TenantDataEncryptionService.decryptFields (issue #1734)', () => {
     expect(out.description).toBe('null')
   })
 })
+
+describe('TenantDataEncryptionService.getEncryptedFieldNames', () => {
+  it('returns active encryption-map field names for query planning', async () => {
+    const service = new TenantDataEncryptionService({} as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+    ;(service as unknown as {
+      getMap: () => Promise<{ fields: Array<{ field?: unknown }> }>
+    }).getMap = jest.fn(async () => ({
+      fields: [
+        { field: 'display_name' },
+        { field: 'primary_email' },
+        { field: '' },
+        { field: null },
+      ],
+    }))
+
+    await expect(
+      service.getEncryptedFieldNames('customers:customer_entity', 't1', 'org1'),
+    ).resolves.toEqual(['display_name', 'primary_email'])
+  })
+})

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -236,6 +236,19 @@ export class TenantDataEncryptionService {
     }
   }
 
+  async getEncryptedFieldNames(
+    entityId: string,
+    tenantId: string | null | undefined,
+    organizationId?: string | null
+  ): Promise<string[]> {
+    if (!this.isEnabled()) return []
+    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
+    if (!map || !map.fields?.length) return []
+    return map.fields
+      .map((rule) => rule.field)
+      .filter((field): field is string => typeof field === 'string' && field.trim().length > 0)
+  }
+
   private encryptFields(
     obj: Record<string, unknown>,
     fields: EncryptedFieldRule[],

package/src/lib/query/__tests__/engine.test.ts

@@ -516,4 +516,90 @@ describe('BasicQueryEngine (Kysely)', () => {
       : false
     expect(hasInFilter).toBe(true)
   })
+
+  test('sorts encrypted base fields after decryption before pagination', async () => {
+    const fakeDb = createFakeKysely({
+      customer_entities: [
+        { id: '3', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-c' },
+        { id: '1', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-a' },
+        { id: '5', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-e' },
+        { id: '2', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-b' },
+        { id: '4', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-d' },
+      ],
+      'information_schema.columns': [
+        { table_name: 'customer_entities', column_name: 'id' },
+        { table_name: 'customer_entities', column_name: 'tenant_id' },
+        { table_name: 'customer_entities', column_name: 'organization_id' },
+        { table_name: 'customer_entities', column_name: 'deleted_at' },
+        { table_name: 'customer_entities', column_name: 'display_name' },
+      ],
+    })
+    const namesById: Record<string, string> = {
+      '1': 'Alice',
+      '2': 'Bob',
+      '3': 'Charlie',
+      '4': 'Dave',
+      '5': 'Eve',
+    }
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({
+        isEnabled: () => true,
+        getEncryptedFieldNames: async () => ['display_name'],
+        decryptEntityPayload: async (_entityId, payload) => ({
+          display_name: namesById[String(payload.id)],
+        }),
+      }),
+    )
+
+    const result = await engine.query('customers:customer_entity', {
+      tenantId: 't1',
+      organizationId: 'org1',
+      fields: ['id', 'display_name'],
+      sort: [{ field: 'display_name', dir: SortDir.Asc }],
+      page: { page: 2, pageSize: 2 },
+    })
+
+    expect(result.items.map((item: any) => item.display_name)).toEqual(['Charlie', 'Dave'])
+    const baseCall = fakeDb._calls.find((call: any) => call._ops.table === 'customer_entities')
+    expect(baseCall._ops.orderBys).toEqual([])
+    expect(baseCall._ops.limits).toBe(0)
+  })
+
+  test('keeps SQL ordering and pagination for unencrypted base fields', async () => {
+    const fakeDb = createFakeKysely({
+      customer_entities: [
+        { id: '1', tenant_id: 't1', organization_id: 'org1', display_name: 'Alice' },
+      ],
+      'information_schema.columns': [
+        { table_name: 'customer_entities', column_name: 'id' },
+        { table_name: 'customer_entities', column_name: 'tenant_id' },
+        { table_name: 'customer_entities', column_name: 'organization_id' },
+        { table_name: 'customer_entities', column_name: 'deleted_at' },
+        { table_name: 'customer_entities', column_name: 'display_name' },
+      ],
+    })
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({
+        isEnabled: () => true,
+        getEncryptedFieldNames: async () => [],
+      }),
+    )
+
+    await engine.query('customers:customer_entity', {
+      tenantId: 't1',
+      organizationId: 'org1',
+      fields: ['id', 'display_name'],
+      sort: [{ field: 'display_name', dir: SortDir.Asc }],
+      page: { page: 2, pageSize: 10 },
+    })
+
+    const baseCall = fakeDb._calls.find((call: any) => call._ops.table === 'customer_entities')
+    expect(baseCall._ops.orderBys).toEqual([['customer_entities.display_name', 'asc']])
+    expect(baseCall._ops.limits).toBe(10)
+    expect(baseCall._ops.offsets).toBe(10)
+  })
 })

package/src/lib/query/encrypted-sort.ts

@@ -0,0 +1,86 @@
+import type { EntityId } from '@open-mercato/shared/modules/entities'
+import { SortDir, type Sort } from './types'
+
+export type QueryEncryptionService = {
+  getEncryptedFieldNames?: (
+    entityId: EntityId,
+    tenantId?: string | null,
+    organizationId?: string | null,
+  ) => Promise<readonly string[]>
+  isEnabled?: () => boolean
+}
+
+const toSnakeCase = (value: string): string =>
+  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()
+
+const toCamelCase = (value: string): string =>
+  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())
+
+export function fieldNameCandidates(field: string): string[] {
+  const raw = String(field || '').trim()
+  if (!raw) return []
+  const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)]
+  if (raw.startsWith('cf:')) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, '_'))
+  return Array.from(new Set(candidates))
+}
+
+export async function resolveEncryptedSortFields(
+  service: QueryEncryptionService | null | undefined,
+  entity: EntityId,
+  sortFields: readonly string[],
+  tenantId?: string | null,
+  organizationId?: string | null,
+): Promise<Set<string>> {
+  if (!service?.getEncryptedFieldNames) return new Set()
+  if (service.isEnabled && !service.isEnabled()) return new Set()
+  const encrypted = await service.getEncryptedFieldNames(entity, tenantId ?? null, organizationId ?? null)
+  const encryptedCandidates = new Set<string>()
+  for (const field of encrypted) {
+    for (const candidate of fieldNameCandidates(field)) encryptedCandidates.add(candidate)
+  }
+  const result = new Set<string>()
+  for (const field of sortFields) {
+    if (field.startsWith('cf:')) continue
+    const matches = fieldNameCandidates(field).some((candidate) => encryptedCandidates.has(candidate))
+    if (matches) result.add(field)
+  }
+  return result
+}
+
+function readField(row: Record<string, unknown>, field: string): unknown {
+  for (const candidate of fieldNameCandidates(field)) {
+    if (Object.prototype.hasOwnProperty.call(row, candidate)) return row[candidate]
+  }
+  return undefined
+}
+
+function compareValues(left: unknown, right: unknown): number {
+  const leftMissing = left === null || left === undefined
+  const rightMissing = right === null || right === undefined
+  if (leftMissing && rightMissing) return 0
+  if (leftMissing) return 1
+  if (rightMissing) return -1
+  if (left instanceof Date && right instanceof Date) return left.getTime() - right.getTime()
+  if (typeof left === 'number' && typeof right === 'number') return left - right
+  if (typeof left === 'boolean' && typeof right === 'boolean') return Number(left) - Number(right)
+  return String(left).localeCompare(String(right), undefined, {
+    sensitivity: 'base',
+    numeric: true,
+  })
+}
+
+export function sortRowsInMemory<T extends Record<string, unknown>>(
+  rows: readonly T[],
+  sorts: readonly Sort[],
+): T[] {
+  return [...rows].sort((left, right) => {
+    for (const sort of sorts) {
+      const direction = sort.dir === SortDir.Desc ? -1 : 1
+      const compared = compareValues(readField(left, sort.field), readField(right, sort.field))
+      if (compared !== 0) return compared * direction
+    }
+    const leftId = readField(left, 'id')
+    const rightId = readField(right, 'id')
+    return compareValues(leftId, rightId)
+  })
+}

package/src/lib/query/engine.ts

@@ -1,4 +1,4 @@
-import type { QueryEngine, QueryOptions, QueryResult, QueryCustomFieldSource, QueryExtensionsConfig } from './types'
+import type { QueryEngine, QueryOptions, QueryResult, QueryCustomFieldSource, QueryExtensionsConfig, Sort } from './types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql, type RawBuilder } from 'kysely'
@@ -14,6 +14,7 @@ import {
 import { resolveSearchConfig } from '../search/config'
 import { tokenizeText } from '../search/tokenize'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from './query-extension-runner'
+import { resolveEncryptedSortFields, sortRowsInMemory } from './encrypted-sort'
 
 type AnyDb = Kysely<any>
 type AnyBuilder = any
@@ -22,6 +23,7 @@ const entityTableCache = new Map<string, string>()
 
 type EncryptionResolver = () => {
   decryptEntityPayload?: (entityId: EntityId, payload: Record<string, unknown>, tenantId?: string | null, organizationId?: string | null) => Promise<Record<string, unknown>>
+  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null) => Promise<readonly string[]>
   isEnabled?: () => boolean
 } | null
 
@@ -475,9 +477,35 @@ export class BasicQueryEngine implements QueryEngine {
       applyJoinFilterOp,
       columnExists: (tbl, column) => this.columnExists(tbl, column),
     })
+
+    const fallbackOrgId =
+      opts.organizationId
+      ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)
+    const encryptionService = this.getEncryptionService()
+    const resolvedSorts: Sort[] = []
+    for (const s of opts.sort || []) {
+      if (s.field.startsWith('cf:')) {
+        resolvedSorts.push(s)
+      } else {
+        const column = await this.resolveBaseColumn(table, s.field)
+        if (column) resolvedSorts.push({ ...s, field: column })
+      }
+    }
+    const encryptedSortFields = await resolveEncryptedSortFields(
+      encryptionService,
+      entity,
+      resolvedSorts.filter((sort) => !sort.field.startsWith('cf:')).map((sort) => sort.field),
+      opts.tenantId ?? null,
+      fallbackOrgId,
+    )
+    const requiresPlaintextSort = encryptedSortFields.size > 0
+
     // Selection (base columns only here; cf:* handled later)
     if (opts.fields && opts.fields.length) {
-      const cols = opts.fields.filter((f) => !f.startsWith('cf:'))
+      const cols = new Set(opts.fields.filter((f) => !f.startsWith('cf:')))
+      if (requiresPlaintextSort) {
+        for (const field of encryptedSortFields) cols.add(field)
+      }
       for (const c of cols) {
         // Qualify and alias to base names to avoid ambiguity
         q = q.select(sql.ref(qualify(c)).as(c))
@@ -714,7 +742,7 @@ export class BasicQueryEngine implements QueryEngine {
     }
 
     // Sorting: base fields and cf:* (use aggregated alias for cf)
-    for (const s of opts.sort || []) {
+    for (const s of resolvedSorts) {
       if (s.field.startsWith('cf:')) {
         const key = s.field.slice(3)
         const alias = sanitize(`cf:${key}`)
@@ -726,11 +754,9 @@ export class BasicQueryEngine implements QueryEngine {
             cfSelectedAliases.push(alias)
           }
         }
-        q = q.orderBy(alias, (s.dir ?? 'asc') as any)
+        if (!requiresPlaintextSort) q = q.orderBy(alias, (s.dir ?? 'asc') as any)
       } else {
-        const column = await this.resolveBaseColumn(table, s.field)
-        if (!column) continue
-        q = q.orderBy(qualify(column), (s.dir ?? 'asc') as any)
+        if (!requiresPlaintextSort) q = q.orderBy(qualify(s.field), (s.dir ?? 'asc') as any)
       }
     }
 
@@ -747,7 +773,10 @@ export class BasicQueryEngine implements QueryEngine {
       : q.clearSelect().clearOrderBy().select(sql<string>`count(distinct ${sql.ref(`${table}.id`)})`.as('count'))
     const countRow = await countBuilder.executeTakeFirst() as { count: unknown } | undefined
     const total = Number((countRow as any)?.count ?? 0)
-    const items = await q.limit(pageSize).offset((page - 1) * pageSize).execute() as any[]
+    const dataQuery = requiresPlaintextSort
+      ? q
+      : q.limit(pageSize).offset((page - 1) * pageSize)
+    const items = await dataQuery.execute() as any[]
 
     if (cfJsonAliases.size > 0) {
       for (const row of items) {
@@ -771,7 +800,7 @@ export class BasicQueryEngine implements QueryEngine {
       }
     }
 
-    const svc = this.getEncryptionService()
+    const svc = encryptionService
     const decryptPayload =
       svc?.decryptEntityPayload?.bind(svc) as
         | ((
@@ -783,9 +812,6 @@ export class BasicQueryEngine implements QueryEngine {
         | null
     let decryptedItems = items
     if (decryptPayload) {
-      const fallbackOrgId =
-        opts.organizationId
-        ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)
       decryptedItems = await Promise.all(
         (items as any[]).map(async (item) => {
           try {
@@ -804,7 +830,12 @@ export class BasicQueryEngine implements QueryEngine {
       )
     }
 
-    let queryResult: QueryResult<T> = { items: decryptedItems, page, pageSize, total }
+    const pagedItems = requiresPlaintextSort
+      ? sortRowsInMemory(decryptedItems as Record<string, unknown>[], resolvedSorts)
+          .slice((page - 1) * pageSize, page * pageSize)
+      : decryptedItems
+
+    let queryResult: QueryResult<T> = { items: pagedItems, page, pageSize, total }
 
     // --- UMES query extension: after-query pipeline ---
     if (ext && extensionCtx) {