@open-mercato/shared 0.6.6 → 0.6.7-canary.317.1.106b9d993b

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 236 entry points
+[build:shared] found 240 entry points
 [build:shared] built successfully

package/AGENTS.md

@@ -52,6 +52,7 @@ yarn workspace @open-mercato/shared build
 | `number.ts` | When parsing numeric strings from env/query params with a fallback and optional min/integer constraint | `@open-mercato/shared/lib/number` |
 | `openapi/` | When generating CRUD OpenAPI specs | `@open-mercato/shared/lib/openapi/crud` |
 | `profiler/` | When profiling with `OM_PROFILE` env flag | `@open-mercato/shared/lib/profiler` |
+| `string.ts` | When parsing comma-separated lists from CLI args/query params, or coercing a string to `undefined` when blank | `@open-mercato/shared/lib/string` |
 | `testing/` | When bootstrapping tests — register only what the test needs | `@open-mercato/shared/lib/testing/bootstrap` |
 
 ## Module Types (`src/modules/`)
@@ -94,6 +95,23 @@ const results = await findWithDecryption(em, 'Entity', filter, { tenantId, organ
 import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
 ```
 
+### Comma-Separated List Parsing — MUST use instead of ad-hoc splitting
+
+```typescript
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
+```
+
+`parseCommaSeparatedList(value)` splits on commas, trims each entry, and drops blanks. Non-string
+inputs (`null`/`undefined`) yield `[]`. MUST use it instead of hand-rolling
+`value.split(',').map((s) => s.trim()).filter(Boolean)` when reading CLI flags or query params.
+
+Keep the surrounding guard when a call site distinguishes "not supplied" (`undefined`) from
+"supplied but empty" (`[]`) — the helper always returns an array:
+
+```typescript
+const roleNames = rolesCsv ? parseCommaSeparatedList(rolesCsv) : undefined
+```
+
 ### Browser Storage — use the shared helpers instead of raw `localStorage`
 
 Persisted client UI state MUST go through the shared `browser/` helpers, never raw `window.localStorage` reads/writes scattered per component:
@@ -150,6 +168,30 @@ import { hasFeature, hasAllFeatures } from '@open-mercato/shared/security/featur
 - Use `hasAllFeatures(granted, required)` for arrays such as `features`, `requireFeatures`, or handler guard lists.
 - MUST NOT gate raw feature arrays with `includes(...)`, `Set.has(...)`, or ad hoc `every(...includes(...))` checks in shared registries or runners; wildcard grants like `module.*` and `*` are part of the RBAC contract.
 
+### CRUD HTTP Errors — MUST use the shared helpers instead of hand-rolling `CrudHttpError`
+
+`@open-mercato/shared/lib/crud/errors` owns the standardized error shapes. Use the helper, not a raw `new CrudHttpError(...)`:
+
+```typescript
+import { assertFound, notFound, badRequest, forbidden, conflict } from '@open-mercato/shared/lib/crud/errors'
+
+const deal = assertFound(await em.findOne(Deal, { id }), translate('customers.errors.deal_not_found', 'Deal not found'))
+```
+
+| Status | Helper |
+|--------|--------|
+| 400 | `badRequest(message)` |
+| 403 | `forbidden(message?)` |
+| 404 | `notFound(message?)` — or `assertFound(value, message)` when guarding a lookup |
+| 409 | `conflict(message)` |
+
+MUST rules:
+- MUST NOT hand-roll `throw new CrudHttpError(404, { error: msg })`. Pick the helper that fits the call site:
+  - **Inline lookup** → `const deal = assertFound(await em.findOne(Deal, { id }), msg)`. It throws the standardized 404 and returns the value narrowed to `T`, so there is no nullable intermediate binding.
+  - **Guard statement** (multi-line lookup, or a compound condition such as `if (!entity || entity.tenantId !== auth.tenantId)`) → `throw notFound(msg)`. TypeScript already narrows the value after the throw, so this keeps tenant-scoping conditions explicit without losing type safety.
+- `message` is passed through verbatim and is never derived from an entity name — keep routing 404 copy through `translate(...)` so it stays translatable.
+- `assertFound` treats every falsy value as missing. Use it for entity/object lookups only, never to guard numbers or strings where `0`/`''` are valid results.
+
 ### CRUD Multi-ID Filtering
 
 - Use `parseIdsParam()` and `mergeIdFilter()` from `@open-mercato/shared/lib/crud/ids` for factory-level `ids` query support.

package/dist/lib/bootstrap/dynamicLoader.js

@@ -93,13 +93,17 @@ async function loadBootstrapData(appRoot) {
     entitiesModule,
     diModule,
     searchModule,
-    commandLoadersModule
+    commandLoadersModule,
+    commandInterceptorsModule,
+    workflowsModule
   ] = await Promise.all([
     compileAndImport(path.join(generatedDir, "modules.cli.generated.ts")),
     compileAndImport(path.join(generatedDir, "entities.generated.ts")),
     compileAndImport(path.join(generatedDir, "di.generated.ts")),
     compileAndImport(path.join(generatedDir, "search.generated.ts")).catch(() => ({ searchModuleConfigs: [] })),
-    compileAndImport(path.join(generatedDir, "command-loaders.generated.ts")).catch(() => ({ commandLoaderEntries: [] }))
+    compileAndImport(path.join(generatedDir, "command-loaders.generated.ts")).catch(() => ({ commandLoaderEntries: [] })),
+    compileAndImport(path.join(generatedDir, "command-interceptors.generated.ts")).catch(() => ({ commandInterceptorEntries: [] })),
+    compileAndImport(path.join(generatedDir, "workflows.generated.ts")).catch(() => ({ allCodeWorkflows: [] }))
   ]);
   return {
     modules: modulesModule.modules,
@@ -109,6 +113,13 @@ async function loadBootstrapData(appRoot) {
     // Search configs are needed by workers for indexing
     searchModuleConfigs: searchModule.searchModuleConfigs ?? [],
     commandLoaderEntries: commandLoadersModule.commandLoaderEntries ?? [],
+    // Command interceptors must apply in worker/CLI processes too — the
+    // interceptor registry is per-process, so relying on the Next.js runtime's
+    // registration silently no-ops every interceptor for queued/CLI commands
+    // (#4327).
+    commandInterceptorEntries: commandInterceptorsModule.commandInterceptorEntries ?? [],
+    // Code workflow definitions are needed by workers to resume code-defined instances
+    codeWorkflows: workflowsModule.allCodeWorkflows ?? [],
     // Empty UI-related data - not needed for CLI
     dashboardWidgetEntries: [],
     injectionWidgetEntries: [],

package/dist/lib/bootstrap/dynamicLoader.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/bootstrap/dynamicLoader.ts"],
-  "sourcesContent": ["import type { BootstrapData } from './types'\nimport { findAppRoot, type AppRoot } from './appResolver'\nimport { registerEntityIds } from '../encryption/entityIds'\nimport {\n  ensureMikroOrmV7GeneratedCacheCompatibility,\n  recoverMikroOrmV7GeneratedCacheFromImportError,\n} from './generatedCacheRecovery'\nimport path from 'node:path'\nimport fs from 'node:fs'\nimport { pathToFileURL } from 'node:url'\n\n/**\n * Compile a TypeScript file to JavaScript using esbuild bundler.\n * This bundles the file and all its dependencies, handling JSON imports properly.\n * The compiled file is written next to the source file with a .mjs extension.\n */\nasync function compileAndImport(tsPath: string, allowRecovery: boolean = true): Promise<Record<string, unknown>> {\n  const jsPath = tsPath.replace(/\\.ts$/, '.mjs')\n  const appRoot = path.dirname(path.dirname(path.dirname(tsPath)))\n\n  // Check if we need to recompile (source newer than compiled)\n  const tsExists = fs.existsSync(tsPath)\n  const jsExists = fs.existsSync(jsPath)\n\n  if (!tsExists) {\n    throw new Error(`Generated file not found: ${tsPath}`)\n  }\n\n  const needsCompile = !jsExists ||\n    fs.statSync(tsPath).mtimeMs > fs.statSync(jsPath).mtimeMs\n\n  if (needsCompile) {\n    // Dynamically import esbuild only when needed\n    const esbuild = await import('esbuild')\n\n    // Plugin to resolve @/ alias to app root (works for @app modules)\n    const aliasPlugin: import('esbuild').Plugin = {\n      name: 'alias-resolver',\n      setup(build) {\n        // Resolve @/ alias to app root\n        build.onResolve({ filter: /^@\\// }, (args) => {\n          const resolved = path.join(appRoot, args.path.slice(2))\n          // Try with .ts extension if base path doesn't exist\n          if (!fs.existsSync(resolved) && fs.existsSync(resolved + '.ts')) {\n            return { path: resolved + '.ts' }\n          }\n          // Also check for /index.ts if it's a directory\n          if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory() && fs.existsSync(path.join(resolved, 'index.ts'))) {\n            return { path: path.join(resolved, 'index.ts') }\n          }\n          return { path: resolved }\n        })\n      },\n    }\n\n    // Plugin to mark non-JSON package imports as external\n    const externalNonJsonPlugin: import('esbuild').Plugin = {\n      name: 'external-non-json',\n      setup(build) {\n        // Mark all package imports as external EXCEPT JSON files\n        // Filter matches paths that don't start with . or / (package imports like @open-mercato/shared)\n        build.onResolve({ filter: /^[^./]/ }, (args) => {\n          // Skip Windows absolute paths (e.g., C:\\...) - they're local files, not packages\n          if (/^[a-zA-Z]:/.test(args.path)) {\n            return null // Let esbuild handle it\n          }\n          // If it's a JSON file, let esbuild bundle it\n          if (args.path.endsWith('.json')) {\n            return null // Let esbuild handle it\n          }\n          // Otherwise mark as external\n          return { path: args.path, external: true }\n        })\n      },\n    }\n\n    // Use esbuild.build with bundling to handle JSON imports\n    await esbuild.build({\n      entryPoints: [tsPath],\n      outfile: jsPath,\n      bundle: true,\n      format: 'esm',\n      platform: 'node',\n      target: 'node18',\n      plugins: [aliasPlugin, externalNonJsonPlugin],\n      // Allow JSON imports\n      loader: { '.json': 'json' },\n    })\n  }\n\n  // Import the compiled JavaScript\n  try {\n    const fileUrl = `${pathToFileURL(jsPath).href}?mtime=${fs.statSync(jsPath).mtimeMs}`\n    return import(fileUrl)\n  } catch (error) {\n    if (!allowRecovery) {\n      throw error\n    }\n\n    const recovered = recoverMikroOrmV7GeneratedCacheFromImportError(appRoot, error)\n    if (!recovered.applied) {\n      throw error\n    }\n\n    return compileAndImport(tsPath, false)\n  }\n}\n\n\n/**\n * Dynamically load bootstrap data from a resolved app directory.\n *\n * IMPORTANT: This only works in unbundled contexts (CLI, tsx).\n * Do NOT use this in Next.js bundled code - use static imports instead.\n *\n * For CLI context, we skip loading modules.generated.ts which has Next.js dependencies.\n * CLI commands are discovered separately via the CLI module system.\n *\n * @param appRoot - Optional explicit app root path. If not provided, will search from cwd.\n * @returns The loaded bootstrap data\n * @throws Error if app root cannot be found or generated files are missing\n */\nexport async function loadBootstrapData(appRoot?: string): Promise<BootstrapData> {\n  const resolved: AppRoot | null = appRoot\n    ? {\n        generatedDir: path.join(appRoot, '.mercato', 'generated'),\n        appDir: appRoot,\n        mercatoDir: path.join(appRoot, '.mercato'),\n      }\n    : findAppRoot()\n\n  if (!resolved) {\n    throw new Error(\n      'Could not find app root with .mercato/generated directory. ' +\n        'Make sure you run this command from within a Next.js app directory, ' +\n        'or run \"yarn mercato generate\" first to create the generated files.',\n    )\n  }\n\n  const { generatedDir } = resolved\n\n  ensureMikroOrmV7GeneratedCacheCompatibility(resolved.appDir)\n\n  // IMPORTANT: Load entity IDs FIRST and register them before loading modules.\n  // This is because modules (e.g., ce.ts files) use E.xxx.xxx at module scope,\n  // and they need entity IDs to be available when they're imported.\n  const entityIdsModule = await compileAndImport(path.join(generatedDir, 'entities.ids.generated.ts'))\n  registerEntityIds(entityIdsModule.E as BootstrapData['entityIds'])\n\n  // Now load the rest of the generated files.\n  // modules.cli.generated.ts excludes Next.js-dependent code (routes, APIs, widgets)\n  const [\n    modulesModule,\n    entitiesModule,\n    diModule,\n    searchModule,\n    commandLoadersModule,\n  ] = await Promise.all([\n    compileAndImport(path.join(generatedDir, 'modules.cli.generated.ts')),\n    compileAndImport(path.join(generatedDir, 'entities.generated.ts')),\n    compileAndImport(path.join(generatedDir, 'di.generated.ts')),\n    compileAndImport(path.join(generatedDir, 'search.generated.ts')).catch(() => ({ searchModuleConfigs: [] })),\n    compileAndImport(path.join(generatedDir, 'command-loaders.generated.ts')).catch(() => ({ commandLoaderEntries: [] })),\n  ])\n\n  return {\n    modules: modulesModule.modules as BootstrapData['modules'],\n    entities: entitiesModule.entities as BootstrapData['entities'],\n    diRegistrars: diModule.diRegistrars as BootstrapData['diRegistrars'],\n    entityIds: entityIdsModule.E as BootstrapData['entityIds'],\n    // Search configs are needed by workers for indexing\n    searchModuleConfigs: (searchModule.searchModuleConfigs ?? []) as BootstrapData['searchModuleConfigs'],\n    commandLoaderEntries: (commandLoadersModule.commandLoaderEntries ?? []) as BootstrapData['commandLoaderEntries'],\n    // Empty UI-related data - not needed for CLI\n    dashboardWidgetEntries: [],\n    injectionWidgetEntries: [],\n    injectionTables: [],\n    interceptorEntries: [],\n    componentOverrideEntries: [],\n  }\n}\n\n/**\n * Create and execute bootstrap in CLI context.\n *\n * This is a convenience function that finds the app root, loads the generated\n * data dynamically, and runs bootstrap. Use this in CLI entry points.\n *\n * Returns the loaded bootstrap data so the CLI can register modules directly\n * (avoids module resolution issues when importing @open-mercato/cli/mercato).\n *\n * @param appRoot - Optional explicit app root path\n * @returns The loaded bootstrap data (modules, entities, etc.)\n */\nexport async function bootstrapFromAppRoot(appRoot?: string): Promise<BootstrapData> {\n  const { createBootstrap, waitForAsyncRegistration } = await import('./factory.js')\n  const data = await loadBootstrapData(appRoot)\n  const bootstrap = createBootstrap(data)\n  bootstrap()\n  // In CLI context, wait for async registrations (UI widgets, search configs, etc.)\n  await waitForAsyncRegistration()\n\n  return data\n}\n"],
-  "mappings": "AACA,SAAS,mBAAiC;AAC1C,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,OAAO,UAAU;AACjB,OAAO,QAAQ;AACf,SAAS,qBAAqB;AAO9B,eAAe,iBAAiB,QAAgB,gBAAyB,MAAwC;AAC/G,QAAM,SAAS,OAAO,QAAQ,SAAS,MAAM;AAC7C,QAAM,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ,MAAM,CAAC,CAAC;AAG/D,QAAM,WAAW,GAAG,WAAW,MAAM;AACrC,QAAM,WAAW,GAAG,WAAW,MAAM;AAErC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,MAAM,EAAE;AAAA,EACvD;AAEA,QAAM,eAAe,CAAC,YACpB,GAAG,SAAS,MAAM,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE;AAEpD,MAAI,cAAc;AAEhB,UAAM,UAAU,MAAM,OAAO,SAAS;AAGtC,UAAM,cAAwC;AAAA,MAC5C,MAAM;AAAA,MACN,MAAM,OAAO;AAEX,cAAM,UAAU,EAAE,QAAQ,OAAO,GAAG,CAAC,SAAS;AAC5C,gBAAM,WAAW,KAAK,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,CAAC;AAEtD,cAAI,CAAC,GAAG,WAAW,QAAQ,KAAK,GAAG,WAAW,WAAW,KAAK,GAAG;AAC/D,mBAAO,EAAE,MAAM,WAAW,MAAM;AAAA,UAClC;AAEA,cAAI,GAAG,WAAW,QAAQ,KAAK,GAAG,SAAS,QAAQ,EAAE,YAAY,KAAK,GAAG,WAAW,KAAK,KAAK,UAAU,UAAU,CAAC,GAAG;AACpH,mBAAO,EAAE,MAAM,KAAK,KAAK,UAAU,UAAU,EAAE;AAAA,UACjD;AACA,iBAAO,EAAE,MAAM,SAAS;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAGA,UAAM,wBAAkD;AAAA,MACtD,MAAM;AAAA,MACN,MAAM,OAAO;AAGX,cAAM,UAAU,EAAE,QAAQ,SAAS,GAAG,CAAC,SAAS;AAE9C,cAAI,aAAa,KAAK,KAAK,IAAI,GAAG;AAChC,mBAAO;AAAA,UACT;AAEA,cAAI,KAAK,KAAK,SAAS,OAAO,GAAG;AAC/B,mBAAO;AAAA,UACT;AAEA,iBAAO,EAAE,MAAM,KAAK,MAAM,UAAU,KAAK;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB,aAAa,CAAC,MAAM;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,SAAS,CAAC,aAAa,qBAAqB;AAAA;AAAA,MAE5C,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH;AAGA,MAAI;AACF,UAAM,UAAU,GAAG,cAAc,MAAM,EAAE,IAAI,UAAU,GAAG,SAAS,MAAM,EAAE,OAAO;AAClF,WAAO,OAAO;AAAA,EAChB,SAAS,OAAO;AACd,QAAI,CAAC,eAAe;AAClB,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,+CAA+C,SAAS,KAAK;AAC/E,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM;AAAA,IACR;AAEA,WAAO,iBAAiB,QAAQ,KAAK;AAAA,EACvC;AACF;AAgBA,eAAsB,kBAAkB,SAA0C;AAChF,QAAM,WAA2B,UAC7B;AAAA,IACE,cAAc,KAAK,KAAK,SAAS,YAAY,WAAW;AAAA,IACxD,QAAQ;AAAA,IACR,YAAY,KAAK,KAAK,SAAS,UAAU;AAAA,EAC3C,IACA,YAAY;AAEhB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,EAAE,aAAa,IAAI;AAEzB,8CAA4C,SAAS,MAAM;AAK3D,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,KAAK,cAAc,2BAA2B,CAAC;AACnG,oBAAkB,gBAAgB,CAA+B;AAIjE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,iBAAiB,KAAK,KAAK,cAAc,0BAA0B,CAAC;AAAA,IACpE,iBAAiB,KAAK,KAAK,cAAc,uBAAuB,CAAC;AAAA,IACjE,iBAAiB,KAAK,KAAK,cAAc,iBAAiB,CAAC;AAAA,IAC3D,iBAAiB,KAAK,KAAK,cAAc,qBAAqB,CAAC,EAAE,MAAM,OAAO,EAAE,qBAAqB,CAAC,EAAE,EAAE;AAAA,IAC1G,iBAAiB,KAAK,KAAK,cAAc,8BAA8B,CAAC,EAAE,MAAM,OAAO,EAAE,sBAAsB,CAAC,EAAE,EAAE;AAAA,EACtH,CAAC;AAED,SAAO;AAAA,IACL,SAAS,cAAc;AAAA,IACvB,UAAU,eAAe;AAAA,IACzB,cAAc,SAAS;AAAA,IACvB,WAAW,gBAAgB;AAAA;AAAA,IAE3B,qBAAsB,aAAa,uBAAuB,CAAC;AAAA,IAC3D,sBAAuB,qBAAqB,wBAAwB,CAAC;AAAA;AAAA,IAErE,wBAAwB,CAAC;AAAA,IACzB,wBAAwB,CAAC;AAAA,IACzB,iBAAiB,CAAC;AAAA,IAClB,oBAAoB,CAAC;AAAA,IACrB,0BAA0B,CAAC;AAAA,EAC7B;AACF;AAcA,eAAsB,qBAAqB,SAA0C;AACnF,QAAM,EAAE,iBAAiB,yBAAyB,IAAI,MAAM,OAAO,cAAc;AACjF,QAAM,OAAO,MAAM,kBAAkB,OAAO;AAC5C,QAAM,YAAY,gBAAgB,IAAI;AACtC,YAAU;AAEV,QAAM,yBAAyB;AAE/B,SAAO;AACT;",
+  "sourcesContent": ["import type { BootstrapData } from './types'\nimport { findAppRoot, type AppRoot } from './appResolver'\nimport { registerEntityIds } from '../encryption/entityIds'\nimport {\n  ensureMikroOrmV7GeneratedCacheCompatibility,\n  recoverMikroOrmV7GeneratedCacheFromImportError,\n} from './generatedCacheRecovery'\nimport path from 'node:path'\nimport fs from 'node:fs'\nimport { pathToFileURL } from 'node:url'\n\n/**\n * Compile a TypeScript file to JavaScript using esbuild bundler.\n * This bundles the file and all its dependencies, handling JSON imports properly.\n * The compiled file is written next to the source file with a .mjs extension.\n */\nasync function compileAndImport(tsPath: string, allowRecovery: boolean = true): Promise<Record<string, unknown>> {\n  const jsPath = tsPath.replace(/\\.ts$/, '.mjs')\n  const appRoot = path.dirname(path.dirname(path.dirname(tsPath)))\n\n  // Check if we need to recompile (source newer than compiled)\n  const tsExists = fs.existsSync(tsPath)\n  const jsExists = fs.existsSync(jsPath)\n\n  if (!tsExists) {\n    throw new Error(`Generated file not found: ${tsPath}`)\n  }\n\n  const needsCompile = !jsExists ||\n    fs.statSync(tsPath).mtimeMs > fs.statSync(jsPath).mtimeMs\n\n  if (needsCompile) {\n    // Dynamically import esbuild only when needed\n    const esbuild = await import('esbuild')\n\n    // Plugin to resolve @/ alias to app root (works for @app modules)\n    const aliasPlugin: import('esbuild').Plugin = {\n      name: 'alias-resolver',\n      setup(build) {\n        // Resolve @/ alias to app root\n        build.onResolve({ filter: /^@\\// }, (args) => {\n          const resolved = path.join(appRoot, args.path.slice(2))\n          // Try with .ts extension if base path doesn't exist\n          if (!fs.existsSync(resolved) && fs.existsSync(resolved + '.ts')) {\n            return { path: resolved + '.ts' }\n          }\n          // Also check for /index.ts if it's a directory\n          if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory() && fs.existsSync(path.join(resolved, 'index.ts'))) {\n            return { path: path.join(resolved, 'index.ts') }\n          }\n          return { path: resolved }\n        })\n      },\n    }\n\n    // Plugin to mark non-JSON package imports as external\n    const externalNonJsonPlugin: import('esbuild').Plugin = {\n      name: 'external-non-json',\n      setup(build) {\n        // Mark all package imports as external EXCEPT JSON files\n        // Filter matches paths that don't start with . or / (package imports like @open-mercato/shared)\n        build.onResolve({ filter: /^[^./]/ }, (args) => {\n          // Skip Windows absolute paths (e.g., C:\\...) - they're local files, not packages\n          if (/^[a-zA-Z]:/.test(args.path)) {\n            return null // Let esbuild handle it\n          }\n          // If it's a JSON file, let esbuild bundle it\n          if (args.path.endsWith('.json')) {\n            return null // Let esbuild handle it\n          }\n          // Otherwise mark as external\n          return { path: args.path, external: true }\n        })\n      },\n    }\n\n    // Use esbuild.build with bundling to handle JSON imports\n    await esbuild.build({\n      entryPoints: [tsPath],\n      outfile: jsPath,\n      bundle: true,\n      format: 'esm',\n      platform: 'node',\n      target: 'node18',\n      plugins: [aliasPlugin, externalNonJsonPlugin],\n      // Allow JSON imports\n      loader: { '.json': 'json' },\n    })\n  }\n\n  // Import the compiled JavaScript\n  try {\n    const fileUrl = `${pathToFileURL(jsPath).href}?mtime=${fs.statSync(jsPath).mtimeMs}`\n    return import(fileUrl)\n  } catch (error) {\n    if (!allowRecovery) {\n      throw error\n    }\n\n    const recovered = recoverMikroOrmV7GeneratedCacheFromImportError(appRoot, error)\n    if (!recovered.applied) {\n      throw error\n    }\n\n    return compileAndImport(tsPath, false)\n  }\n}\n\n\n/**\n * Dynamically load bootstrap data from a resolved app directory.\n *\n * IMPORTANT: This only works in unbundled contexts (CLI, tsx).\n * Do NOT use this in Next.js bundled code - use static imports instead.\n *\n * For CLI context, we skip loading modules.generated.ts which has Next.js dependencies.\n * CLI commands are discovered separately via the CLI module system.\n *\n * @param appRoot - Optional explicit app root path. If not provided, will search from cwd.\n * @returns The loaded bootstrap data\n * @throws Error if app root cannot be found or generated files are missing\n */\nexport async function loadBootstrapData(appRoot?: string): Promise<BootstrapData> {\n  const resolved: AppRoot | null = appRoot\n    ? {\n        generatedDir: path.join(appRoot, '.mercato', 'generated'),\n        appDir: appRoot,\n        mercatoDir: path.join(appRoot, '.mercato'),\n      }\n    : findAppRoot()\n\n  if (!resolved) {\n    throw new Error(\n      'Could not find app root with .mercato/generated directory. ' +\n        'Make sure you run this command from within a Next.js app directory, ' +\n        'or run \"yarn mercato generate\" first to create the generated files.',\n    )\n  }\n\n  const { generatedDir } = resolved\n\n  ensureMikroOrmV7GeneratedCacheCompatibility(resolved.appDir)\n\n  // IMPORTANT: Load entity IDs FIRST and register them before loading modules.\n  // This is because modules (e.g., ce.ts files) use E.xxx.xxx at module scope,\n  // and they need entity IDs to be available when they're imported.\n  const entityIdsModule = await compileAndImport(path.join(generatedDir, 'entities.ids.generated.ts'))\n  registerEntityIds(entityIdsModule.E as BootstrapData['entityIds'])\n\n  // Now load the rest of the generated files.\n  // modules.cli.generated.ts excludes Next.js-dependent code (routes, APIs, widgets)\n  const [\n    modulesModule,\n    entitiesModule,\n    diModule,\n    searchModule,\n    commandLoadersModule,\n    commandInterceptorsModule,\n    workflowsModule,\n  ] = await Promise.all([\n    compileAndImport(path.join(generatedDir, 'modules.cli.generated.ts')),\n    compileAndImport(path.join(generatedDir, 'entities.generated.ts')),\n    compileAndImport(path.join(generatedDir, 'di.generated.ts')),\n    compileAndImport(path.join(generatedDir, 'search.generated.ts')).catch(() => ({ searchModuleConfigs: [] })),\n    compileAndImport(path.join(generatedDir, 'command-loaders.generated.ts')).catch(() => ({ commandLoaderEntries: [] })),\n    compileAndImport(path.join(generatedDir, 'command-interceptors.generated.ts')).catch(() => ({ commandInterceptorEntries: [] })),\n    compileAndImport(path.join(generatedDir, 'workflows.generated.ts')).catch(() => ({ allCodeWorkflows: [] })),\n  ])\n\n  return {\n    modules: modulesModule.modules as BootstrapData['modules'],\n    entities: entitiesModule.entities as BootstrapData['entities'],\n    diRegistrars: diModule.diRegistrars as BootstrapData['diRegistrars'],\n    entityIds: entityIdsModule.E as BootstrapData['entityIds'],\n    // Search configs are needed by workers for indexing\n    searchModuleConfigs: (searchModule.searchModuleConfigs ?? []) as BootstrapData['searchModuleConfigs'],\n    commandLoaderEntries: (commandLoadersModule.commandLoaderEntries ?? []) as BootstrapData['commandLoaderEntries'],\n    // Command interceptors must apply in worker/CLI processes too \u2014 the\n    // interceptor registry is per-process, so relying on the Next.js runtime's\n    // registration silently no-ops every interceptor for queued/CLI commands\n    // (#4327).\n    commandInterceptorEntries: (commandInterceptorsModule.commandInterceptorEntries ??\n      []) as BootstrapData['commandInterceptorEntries'],\n    // Code workflow definitions are needed by workers to resume code-defined instances\n    codeWorkflows: (workflowsModule.allCodeWorkflows ?? []) as BootstrapData['codeWorkflows'],\n    // Empty UI-related data - not needed for CLI\n    dashboardWidgetEntries: [],\n    injectionWidgetEntries: [],\n    injectionTables: [],\n    interceptorEntries: [],\n    componentOverrideEntries: [],\n  }\n}\n\n/**\n * Create and execute bootstrap in CLI context.\n *\n * This is a convenience function that finds the app root, loads the generated\n * data dynamically, and runs bootstrap. Use this in CLI entry points.\n *\n * Returns the loaded bootstrap data so the CLI can register modules directly\n * (avoids module resolution issues when importing @open-mercato/cli/mercato).\n *\n * @param appRoot - Optional explicit app root path\n * @returns The loaded bootstrap data (modules, entities, etc.)\n */\nexport async function bootstrapFromAppRoot(appRoot?: string): Promise<BootstrapData> {\n  const { createBootstrap, waitForAsyncRegistration } = await import('./factory.js')\n  const data = await loadBootstrapData(appRoot)\n  const bootstrap = createBootstrap(data)\n  bootstrap()\n  // In CLI context, wait for async registrations (UI widgets, search configs, etc.)\n  await waitForAsyncRegistration()\n\n  return data\n}\n"],
+  "mappings": "AACA,SAAS,mBAAiC;AAC1C,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,OAAO,UAAU;AACjB,OAAO,QAAQ;AACf,SAAS,qBAAqB;AAO9B,eAAe,iBAAiB,QAAgB,gBAAyB,MAAwC;AAC/G,QAAM,SAAS,OAAO,QAAQ,SAAS,MAAM;AAC7C,QAAM,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ,MAAM,CAAC,CAAC;AAG/D,QAAM,WAAW,GAAG,WAAW,MAAM;AACrC,QAAM,WAAW,GAAG,WAAW,MAAM;AAErC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,MAAM,EAAE;AAAA,EACvD;AAEA,QAAM,eAAe,CAAC,YACpB,GAAG,SAAS,MAAM,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE;AAEpD,MAAI,cAAc;AAEhB,UAAM,UAAU,MAAM,OAAO,SAAS;AAGtC,UAAM,cAAwC;AAAA,MAC5C,MAAM;AAAA,MACN,MAAM,OAAO;AAEX,cAAM,UAAU,EAAE,QAAQ,OAAO,GAAG,CAAC,SAAS;AAC5C,gBAAM,WAAW,KAAK,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,CAAC;AAEtD,cAAI,CAAC,GAAG,WAAW,QAAQ,KAAK,GAAG,WAAW,WAAW,KAAK,GAAG;AAC/D,mBAAO,EAAE,MAAM,WAAW,MAAM;AAAA,UAClC;AAEA,cAAI,GAAG,WAAW,QAAQ,KAAK,GAAG,SAAS,QAAQ,EAAE,YAAY,KAAK,GAAG,WAAW,KAAK,KAAK,UAAU,UAAU,CAAC,GAAG;AACpH,mBAAO,EAAE,MAAM,KAAK,KAAK,UAAU,UAAU,EAAE;AAAA,UACjD;AACA,iBAAO,EAAE,MAAM,SAAS;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAGA,UAAM,wBAAkD;AAAA,MACtD,MAAM;AAAA,MACN,MAAM,OAAO;AAGX,cAAM,UAAU,EAAE,QAAQ,SAAS,GAAG,CAAC,SAAS;AAE9C,cAAI,aAAa,KAAK,KAAK,IAAI,GAAG;AAChC,mBAAO;AAAA,UACT;AAEA,cAAI,KAAK,KAAK,SAAS,OAAO,GAAG;AAC/B,mBAAO;AAAA,UACT;AAEA,iBAAO,EAAE,MAAM,KAAK,MAAM,UAAU,KAAK;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB,aAAa,CAAC,MAAM;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,SAAS,CAAC,aAAa,qBAAqB;AAAA;AAAA,MAE5C,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH;AAGA,MAAI;AACF,UAAM,UAAU,GAAG,cAAc,MAAM,EAAE,IAAI,UAAU,GAAG,SAAS,MAAM,EAAE,OAAO;AAClF,WAAO,OAAO;AAAA,EAChB,SAAS,OAAO;AACd,QAAI,CAAC,eAAe;AAClB,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,+CAA+C,SAAS,KAAK;AAC/E,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM;AAAA,IACR;AAEA,WAAO,iBAAiB,QAAQ,KAAK;AAAA,EACvC;AACF;AAgBA,eAAsB,kBAAkB,SAA0C;AAChF,QAAM,WAA2B,UAC7B;AAAA,IACE,cAAc,KAAK,KAAK,SAAS,YAAY,WAAW;AAAA,IACxD,QAAQ;AAAA,IACR,YAAY,KAAK,KAAK,SAAS,UAAU;AAAA,EAC3C,IACA,YAAY;AAEhB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,EAAE,aAAa,IAAI;AAEzB,8CAA4C,SAAS,MAAM;AAK3D,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,KAAK,cAAc,2BAA2B,CAAC;AACnG,oBAAkB,gBAAgB,CAA+B;AAIjE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,iBAAiB,KAAK,KAAK,cAAc,0BAA0B,CAAC;AAAA,IACpE,iBAAiB,KAAK,KAAK,cAAc,uBAAuB,CAAC;AAAA,IACjE,iBAAiB,KAAK,KAAK,cAAc,iBAAiB,CAAC;AAAA,IAC3D,iBAAiB,KAAK,KAAK,cAAc,qBAAqB,CAAC,EAAE,MAAM,OAAO,EAAE,qBAAqB,CAAC,EAAE,EAAE;AAAA,IAC1G,iBAAiB,KAAK,KAAK,cAAc,8BAA8B,CAAC,EAAE,MAAM,OAAO,EAAE,sBAAsB,CAAC,EAAE,EAAE;AAAA,IACpH,iBAAiB,KAAK,KAAK,cAAc,mCAAmC,CAAC,EAAE,MAAM,OAAO,EAAE,2BAA2B,CAAC,EAAE,EAAE;AAAA,IAC9H,iBAAiB,KAAK,KAAK,cAAc,wBAAwB,CAAC,EAAE,MAAM,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE;AAAA,EAC5G,CAAC;AAED,SAAO;AAAA,IACL,SAAS,cAAc;AAAA,IACvB,UAAU,eAAe;AAAA,IACzB,cAAc,SAAS;AAAA,IACvB,WAAW,gBAAgB;AAAA;AAAA,IAE3B,qBAAsB,aAAa,uBAAuB,CAAC;AAAA,IAC3D,sBAAuB,qBAAqB,wBAAwB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAKrE,2BAA4B,0BAA0B,6BACpD,CAAC;AAAA;AAAA,IAEH,eAAgB,gBAAgB,oBAAoB,CAAC;AAAA;AAAA,IAErD,wBAAwB,CAAC;AAAA,IACzB,wBAAwB,CAAC;AAAA,IACzB,iBAAiB,CAAC;AAAA,IAClB,oBAAoB,CAAC;AAAA,IACrB,0BAA0B,CAAC;AAAA,EAC7B;AACF;AAcA,eAAsB,qBAAqB,SAA0C;AACnF,QAAM,EAAE,iBAAiB,yBAAyB,IAAI,MAAM,OAAO,cAAc;AACjF,QAAM,OAAO,MAAM,kBAAkB,OAAO;AAC5C,QAAM,YAAY,gBAAgB,IAAI;AACtC,YAAU;AAEV,QAAM,yBAAyB;AAE/B,SAAO;AACT;",
   "names": []
 }

package/dist/lib/bootstrap/factory.js

@@ -1,10 +1,11 @@
 import { registerOrmEntities } from "../db/mikro.js";
-import { registerDiRegistrars } from "../di/container.js";
+import { registerAppDiRegistrar, registerDiRegistrars } from "../di/container.js";
 import { registerModules } from "../modules/registry.js";
 import { registerEntityIds } from "../encryption/entityIds.js";
 import { registerEntityFields } from "../encryption/entityFields.js";
 import { registerSearchModuleConfigs } from "../../modules/search.js";
 import { registerAnalyticsModuleConfigs } from "../../modules/analytics.js";
+import { registerCodeWorkflowEntries } from "../../modules/workflows/code-registry.js";
 import { registerResponseEnrichers } from "../crud/enricher-registry.js";
 import { registerApiInterceptors } from "../crud/interceptor-registry.js";
 import { registerComponentOverrides } from "../../modules/widgets/component-registry.js";
@@ -18,6 +19,9 @@ let _bootstrapped = false;
 let _asyncRegistrationPromise = null;
 function createBootstrap(data, options = {}) {
   return function bootstrap() {
+    if (options.appDiRegistrar) {
+      registerAppDiRegistrar(options.appDiRegistrar);
+    }
     if (_bootstrapped && process.env.NODE_ENV !== "development") return;
     _bootstrapped = true;
     registerOrmEntities(data.entities);
@@ -42,6 +46,9 @@ function createBootstrap(data, options = {}) {
     if (data.analyticsModuleConfigs) {
       registerAnalyticsModuleConfigs(data.analyticsModuleConfigs);
     }
+    if (data.codeWorkflows?.length) {
+      registerCodeWorkflowEntries(data.codeWorkflows);
+    }
     if (data.enricherEntries) {
       registerResponseEnrichers(data.enricherEntries);
     }

package/dist/lib/bootstrap/factory.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/bootstrap/factory.ts"],
-  "sourcesContent": ["import type { BootstrapData, BootstrapOptions } from './types'\nimport { registerOrmEntities } from '../db/mikro'\nimport { registerDiRegistrars } from '../di/container'\nimport { registerModules } from '../modules/registry'\nimport { registerEntityIds } from '../encryption/entityIds'\nimport { registerEntityFields } from '../encryption/entityFields'\nimport { registerSearchModuleConfigs } from '../../modules/search'\nimport { registerAnalyticsModuleConfigs } from '../../modules/analytics'\nimport { registerResponseEnrichers } from '../crud/enricher-registry'\nimport { registerApiInterceptors } from '../crud/interceptor-registry'\nimport { registerComponentOverrides } from '../../modules/widgets/component-registry'\nimport { registerMutationGuards } from '../crud/mutation-guard-store'\nimport { registerCommandInterceptors } from '../commands/command-interceptor-store'\nimport { registerCommandLoaders } from '../commands/registry'\nimport { registerNotificationHandlers } from '../notifications/handler-registry'\nimport { clearRegisteredIntegrations, registerBundles, registerIntegrations } from '../../modules/integrations/types'\nimport { applyComponentOverridesToEntries } from '../../modules/overrides'\n\nlet _bootstrapped = false\n\n// Store the async registration promise so callers can await it if needed\nlet _asyncRegistrationPromise: Promise<void> | null = null\n\n/**\n * Creates a bootstrap function that registers all application dependencies.\n *\n * The returned function should be called once at application startup.\n * In development mode, it can be called multiple times (for HMR).\n *\n * @param data - All generated registry data from .mercato/generated/\n * @param options - Optional configuration\n * @returns A bootstrap function to call at app startup\n */\nexport function createBootstrap(data: BootstrapData, options: BootstrapOptions = {}) {\n  return function bootstrap(): void {\n    // In development, always re-run registrations to handle HMR\n    // (Module state may be reset when Turbopack reloads packages)\n    if (_bootstrapped && process.env.NODE_ENV !== 'development') return\n    _bootstrapped = true\n\n    // === 1. Foundation: ORM entities and DI registrars ===\n    registerOrmEntities(data.entities)\n    registerDiRegistrars(data.diRegistrars.filter((r): r is NonNullable<typeof r> => r != null))\n\n    // === 2. Modules registry (required by i18n, query engine, dashboards, CLI) ===\n    registerModules(data.modules)\n    clearRegisteredIntegrations()\n    for (const module of data.modules) {\n      if (module.integrations?.length) {\n        registerIntegrations(module.integrations)\n      }\n      if (module.bundles?.length) {\n        registerBundles(module.bundles)\n      }\n    }\n\n    // === 3. Entity IDs (required by encryption, indexing, entity links) ===\n    registerEntityIds(data.entityIds)\n\n    // === 4. Entity fields registry (for encryption manager, Turbopack compatibility) ===\n    if (data.entityFieldsRegistry) {\n      registerEntityFields(data.entityFieldsRegistry)\n    }\n\n    // === 5. Search module configs (for search service registration in DI) ===\n    if (data.searchModuleConfigs) {\n      registerSearchModuleConfigs(data.searchModuleConfigs)\n    }\n\n    // === 6. Analytics module configs (for dashboard widgets and analytics API) ===\n    if (data.analyticsModuleConfigs) {\n      registerAnalyticsModuleConfigs(data.analyticsModuleConfigs)\n    }\n\n    // === 6b. Response enrichers (for CRUD response enrichment) ===\n    if (data.enricherEntries) {\n      registerResponseEnrichers(data.enricherEntries)\n    }\n\n    // === 6c. API interceptors (for CRUD route interception) ===\n    if (data.interceptorEntries) {\n      registerApiInterceptors(data.interceptorEntries)\n    }\n\n    // === 6d. Component overrides (for page/component replacement) ===\n    if (data.componentOverrideEntries) {\n      const finalEntries = applyComponentOverridesToEntries(data.componentOverrideEntries)\n      const allOverrides = finalEntries.flatMap((entry) => entry.componentOverrides ?? [])\n      registerComponentOverrides(allOverrides)\n    }\n\n    // === 6e. Mutation guards (for CRUD mutation lifecycle) ===\n    if (data.guardEntries) {\n      registerMutationGuards(data.guardEntries)\n    }\n\n    // === 6f. Command interceptors (for command bus lifecycle) ===\n    if (data.commandInterceptorEntries) {\n      registerCommandInterceptors(data.commandInterceptorEntries)\n    }\n\n    // === 6f.1. Command loaders (for lazy command handler registration) ===\n    if (data.commandLoaderEntries) {\n      registerCommandLoaders(data.commandLoaderEntries)\n    }\n\n    // === 6g. Notification handlers (reactive notification side-effects) ===\n    if (data.notificationHandlerEntries) {\n      registerNotificationHandlers(data.notificationHandlerEntries)\n    }\n\n    // === 7-8. UI Widgets and Optional packages (async to avoid circular deps) ===\n    // Store the promise so CLI context can await it\n    _asyncRegistrationPromise = registerWidgetsAndOptionalPackages(data, options)\n    void _asyncRegistrationPromise\n\n    options.onRegistrationComplete?.()\n  }\n}\n\n/**\n * Wait for async registrations (CLI modules, widgets, etc.) to complete.\n * Call this after bootstrap() in CLI context where you need modules immediately.\n */\nexport async function waitForAsyncRegistration(): Promise<void> {\n  if (_asyncRegistrationPromise) {\n    await _asyncRegistrationPromise\n  }\n}\n\nasync function registerWidgetsAndOptionalPackages(data: BootstrapData, options: BootstrapOptions): Promise<void> {\n  // Register UI widgets (dynamic imports to avoid circular deps with ui/core packages)\n  try {\n    const [dashboardRegistry, injectionRegistry, coreInjection] = await Promise.all([\n      import('@open-mercato/ui/backend/dashboard/widgetRegistry'),\n      import('@open-mercato/ui/backend/injection/widgetRegistry'),\n      import('@open-mercato/core/modules/widgets/lib/injection'),\n    ])\n\n    dashboardRegistry.registerDashboardWidgets(data.dashboardWidgetEntries)\n    injectionRegistry.registerInjectionWidgets(data.injectionWidgetEntries)\n    coreInjection.registerCoreInjectionWidgets(data.injectionWidgetEntries)\n    coreInjection.registerCoreInjectionTables(data.injectionTables)\n    coreInjection.registerEnabledModuleIds(\n      data.modules.map((module) => module.id).filter((id): id is string => typeof id === 'string' && id.length > 0),\n    )\n  } catch {\n    // UI packages may not be available in all contexts\n  }\n\n  // Note: Search module configs are registered synchronously in the main bootstrap.\n  // The actual registerSearchModule() call happens in core/bootstrap.ts when the\n  // DI container is created, using getSearchModuleConfigs() from the global registry.\n\n  // Note: CLI module registration is handled separately in CLI context\n  // via bootstrapFromAppRoot in dynamicLoader. We don't import CLI here\n  // to avoid Turbopack tracing through the CLI package in Next.js context.\n}\n\n/**\n * Check if bootstrap has been called.\n */\nexport function isBootstrapped(): boolean {\n  return _bootstrapped\n}\n\n/**\n * Reset bootstrap state. Useful for testing.\n */\nexport function resetBootstrapState(): void {\n  _bootstrapped = false\n}\n"],
-  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,sCAAsC;AAC/C,SAAS,iCAAiC;AAC1C,SAAS,+BAA+B;AACxC,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AACvC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C,SAAS,6BAA6B,iBAAiB,4BAA4B;AACnF,SAAS,wCAAwC;AAEjD,IAAI,gBAAgB;AAGpB,IAAI,4BAAkD;AAY/C,SAAS,gBAAgB,MAAqB,UAA4B,CAAC,GAAG;AACnF,SAAO,SAAS,YAAkB;AAGhC,QAAI,iBAAiB,QAAQ,IAAI,aAAa,cAAe;AAC7D,oBAAgB;AAGhB,wBAAoB,KAAK,QAAQ;AACjC,yBAAqB,KAAK,aAAa,OAAO,CAAC,MAAkC,KAAK,IAAI,CAAC;AAG3F,oBAAgB,KAAK,OAAO;AAC5B,gCAA4B;AAC5B,eAAW,UAAU,KAAK,SAAS;AACjC,UAAI,OAAO,cAAc,QAAQ;AAC/B,6BAAqB,OAAO,YAAY;AAAA,MAC1C;AACA,UAAI,OAAO,SAAS,QAAQ;AAC1B,wBAAgB,OAAO,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,sBAAkB,KAAK,SAAS;AAGhC,QAAI,KAAK,sBAAsB;AAC7B,2BAAqB,KAAK,oBAAoB;AAAA,IAChD;AAGA,QAAI,KAAK,qBAAqB;AAC5B,kCAA4B,KAAK,mBAAmB;AAAA,IACtD;AAGA,QAAI,KAAK,wBAAwB;AAC/B,qCAA+B,KAAK,sBAAsB;AAAA,IAC5D;AAGA,QAAI,KAAK,iBAAiB;AACxB,gCAA0B,KAAK,eAAe;AAAA,IAChD;AAGA,QAAI,KAAK,oBAAoB;AAC3B,8BAAwB,KAAK,kBAAkB;AAAA,IACjD;AAGA,QAAI,KAAK,0BAA0B;AACjC,YAAM,eAAe,iCAAiC,KAAK,wBAAwB;AACnF,YAAM,eAAe,aAAa,QAAQ,CAAC,UAAU,MAAM,sBAAsB,CAAC,CAAC;AACnF,iCAA2B,YAAY;AAAA,IACzC;AAGA,QAAI,KAAK,cAAc;AACrB,6BAAuB,KAAK,YAAY;AAAA,IAC1C;AAGA,QAAI,KAAK,2BAA2B;AAClC,kCAA4B,KAAK,yBAAyB;AAAA,IAC5D;AAGA,QAAI,KAAK,sBAAsB;AAC7B,6BAAuB,KAAK,oBAAoB;AAAA,IAClD;AAGA,QAAI,KAAK,4BAA4B;AACnC,mCAA6B,KAAK,0BAA0B;AAAA,IAC9D;AAIA,gCAA4B,mCAAmC,MAAM,OAAO;AAC5E,SAAK;AAEL,YAAQ,yBAAyB;AAAA,EACnC;AACF;AAMA,eAAsB,2BAA0C;AAC9D,MAAI,2BAA2B;AAC7B,UAAM;AAAA,EACR;AACF;AAEA,eAAe,mCAAmC,MAAqB,SAA0C;AAE/G,MAAI;AACF,UAAM,CAAC,mBAAmB,mBAAmB,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC9E,OAAO,mDAAmD;AAAA,MAC1D,OAAO,mDAAmD;AAAA,MAC1D,OAAO,kDAAkD;AAAA,IAC3D,CAAC;AAED,sBAAkB,yBAAyB,KAAK,sBAAsB;AACtE,sBAAkB,yBAAyB,KAAK,sBAAsB;AACtE,kBAAc,6BAA6B,KAAK,sBAAsB;AACtE,kBAAc,4BAA4B,KAAK,eAAe;AAC9D,kBAAc;AAAA,MACZ,KAAK,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,IAC9G;AAAA,EACF,QAAQ;AAAA,EAER;AASF;AAKO,SAAS,iBAA0B;AACxC,SAAO;AACT;AAKO,SAAS,sBAA4B;AAC1C,kBAAgB;AAClB;",
+  "sourcesContent": ["import type { BootstrapData, BootstrapOptions } from './types'\nimport { registerOrmEntities } from '../db/mikro'\nimport { registerAppDiRegistrar, registerDiRegistrars } from '../di/container'\nimport { registerModules } from '../modules/registry'\nimport { registerEntityIds } from '../encryption/entityIds'\nimport { registerEntityFields } from '../encryption/entityFields'\nimport { registerSearchModuleConfigs } from '../../modules/search'\nimport { registerAnalyticsModuleConfigs } from '../../modules/analytics'\nimport { registerCodeWorkflowEntries } from '../../modules/workflows/code-registry'\nimport { registerResponseEnrichers } from '../crud/enricher-registry'\nimport { registerApiInterceptors } from '../crud/interceptor-registry'\nimport { registerComponentOverrides } from '../../modules/widgets/component-registry'\nimport { registerMutationGuards } from '../crud/mutation-guard-store'\nimport { registerCommandInterceptors } from '../commands/command-interceptor-store'\nimport { registerCommandLoaders } from '../commands/registry'\nimport { registerNotificationHandlers } from '../notifications/handler-registry'\nimport { clearRegisteredIntegrations, registerBundles, registerIntegrations } from '../../modules/integrations/types'\nimport { applyComponentOverridesToEntries } from '../../modules/overrides'\n\nlet _bootstrapped = false\n\n// Store the async registration promise so callers can await it if needed\nlet _asyncRegistrationPromise: Promise<void> | null = null\n\n/**\n * Creates a bootstrap function that registers all application dependencies.\n *\n * The returned function should be called once at application startup.\n * In development mode, it can be called multiple times (for HMR).\n *\n * @param data - All generated registry data from .mercato/generated/\n * @param options - Optional configuration\n * @returns A bootstrap function to call at app startup\n */\nexport function createBootstrap(data: BootstrapData, options: BootstrapOptions = {}) {\n  return function bootstrap(): void {\n    if (options.appDiRegistrar) {\n      registerAppDiRegistrar(options.appDiRegistrar)\n    }\n    // In development, always re-run registrations to handle HMR\n    // (Module state may be reset when Turbopack reloads packages)\n    if (_bootstrapped && process.env.NODE_ENV !== 'development') return\n    _bootstrapped = true\n\n    // === 1. Foundation: ORM entities and DI registrars ===\n    registerOrmEntities(data.entities)\n    registerDiRegistrars(data.diRegistrars.filter((r): r is NonNullable<typeof r> => r != null))\n\n    // === 2. Modules registry (required by i18n, query engine, dashboards, CLI) ===\n    registerModules(data.modules)\n    clearRegisteredIntegrations()\n    for (const module of data.modules) {\n      if (module.integrations?.length) {\n        registerIntegrations(module.integrations)\n      }\n      if (module.bundles?.length) {\n        registerBundles(module.bundles)\n      }\n    }\n\n    // === 3. Entity IDs (required by encryption, indexing, entity links) ===\n    registerEntityIds(data.entityIds)\n\n    // === 4. Entity fields registry (for encryption manager, Turbopack compatibility) ===\n    if (data.entityFieldsRegistry) {\n      registerEntityFields(data.entityFieldsRegistry)\n    }\n\n    // === 5. Search module configs (for search service registration in DI) ===\n    if (data.searchModuleConfigs) {\n      registerSearchModuleConfigs(data.searchModuleConfigs)\n    }\n\n    // === 6. Analytics module configs (for dashboard widgets and analytics API) ===\n    if (data.analyticsModuleConfigs) {\n      registerAnalyticsModuleConfigs(data.analyticsModuleConfigs)\n    }\n\n    // === 6a. Code workflow definitions (so CLI/worker processes resolve them like the app runtime) ===\n    if (data.codeWorkflows?.length) {\n      registerCodeWorkflowEntries(data.codeWorkflows)\n    }\n\n    // === 6b. Response enrichers (for CRUD response enrichment) ===\n    if (data.enricherEntries) {\n      registerResponseEnrichers(data.enricherEntries)\n    }\n\n    // === 6c. API interceptors (for CRUD route interception) ===\n    if (data.interceptorEntries) {\n      registerApiInterceptors(data.interceptorEntries)\n    }\n\n    // === 6d. Component overrides (for page/component replacement) ===\n    if (data.componentOverrideEntries) {\n      const finalEntries = applyComponentOverridesToEntries(data.componentOverrideEntries)\n      const allOverrides = finalEntries.flatMap((entry) => entry.componentOverrides ?? [])\n      registerComponentOverrides(allOverrides)\n    }\n\n    // === 6e. Mutation guards (for CRUD mutation lifecycle) ===\n    if (data.guardEntries) {\n      registerMutationGuards(data.guardEntries)\n    }\n\n    // === 6f. Command interceptors (for command bus lifecycle) ===\n    if (data.commandInterceptorEntries) {\n      registerCommandInterceptors(data.commandInterceptorEntries)\n    }\n\n    // === 6f.1. Command loaders (for lazy command handler registration) ===\n    if (data.commandLoaderEntries) {\n      registerCommandLoaders(data.commandLoaderEntries)\n    }\n\n    // === 6g. Notification handlers (reactive notification side-effects) ===\n    if (data.notificationHandlerEntries) {\n      registerNotificationHandlers(data.notificationHandlerEntries)\n    }\n\n    // === 7-8. UI Widgets and Optional packages (async to avoid circular deps) ===\n    // Store the promise so CLI context can await it\n    _asyncRegistrationPromise = registerWidgetsAndOptionalPackages(data, options)\n    void _asyncRegistrationPromise\n\n    options.onRegistrationComplete?.()\n  }\n}\n\n/**\n * Wait for async registrations (CLI modules, widgets, etc.) to complete.\n * Call this after bootstrap() in CLI context where you need modules immediately.\n */\nexport async function waitForAsyncRegistration(): Promise<void> {\n  if (_asyncRegistrationPromise) {\n    await _asyncRegistrationPromise\n  }\n}\n\nasync function registerWidgetsAndOptionalPackages(data: BootstrapData, options: BootstrapOptions): Promise<void> {\n  // Register UI widgets (dynamic imports to avoid circular deps with ui/core packages)\n  try {\n    const [dashboardRegistry, injectionRegistry, coreInjection] = await Promise.all([\n      import('@open-mercato/ui/backend/dashboard/widgetRegistry'),\n      import('@open-mercato/ui/backend/injection/widgetRegistry'),\n      import('@open-mercato/core/modules/widgets/lib/injection'),\n    ])\n\n    dashboardRegistry.registerDashboardWidgets(data.dashboardWidgetEntries)\n    injectionRegistry.registerInjectionWidgets(data.injectionWidgetEntries)\n    coreInjection.registerCoreInjectionWidgets(data.injectionWidgetEntries)\n    coreInjection.registerCoreInjectionTables(data.injectionTables)\n    coreInjection.registerEnabledModuleIds(\n      data.modules.map((module) => module.id).filter((id): id is string => typeof id === 'string' && id.length > 0),\n    )\n  } catch {\n    // UI packages may not be available in all contexts\n  }\n\n  // Note: Search module configs are registered synchronously in the main bootstrap.\n  // The actual registerSearchModule() call happens in core/bootstrap.ts when the\n  // DI container is created, using getSearchModuleConfigs() from the global registry.\n\n  // Note: CLI module registration is handled separately in CLI context\n  // via bootstrapFromAppRoot in dynamicLoader. We don't import CLI here\n  // to avoid Turbopack tracing through the CLI package in Next.js context.\n}\n\n/**\n * Check if bootstrap has been called.\n */\nexport function isBootstrapped(): boolean {\n  return _bootstrapped\n}\n\n/**\n * Reset bootstrap state. Useful for testing.\n */\nexport function resetBootstrapState(): void {\n  _bootstrapped = false\n}\n"],
+  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,4BAA4B;AAC7D,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,sCAAsC;AAC/C,SAAS,mCAAmC;AAC5C,SAAS,iCAAiC;AAC1C,SAAS,+BAA+B;AACxC,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AACvC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,oCAAoC;AAC7C,SAAS,6BAA6B,iBAAiB,4BAA4B;AACnF,SAAS,wCAAwC;AAEjD,IAAI,gBAAgB;AAGpB,IAAI,4BAAkD;AAY/C,SAAS,gBAAgB,MAAqB,UAA4B,CAAC,GAAG;AACnF,SAAO,SAAS,YAAkB;AAChC,QAAI,QAAQ,gBAAgB;AAC1B,6BAAuB,QAAQ,cAAc;AAAA,IAC/C;AAGA,QAAI,iBAAiB,QAAQ,IAAI,aAAa,cAAe;AAC7D,oBAAgB;AAGhB,wBAAoB,KAAK,QAAQ;AACjC,yBAAqB,KAAK,aAAa,OAAO,CAAC,MAAkC,KAAK,IAAI,CAAC;AAG3F,oBAAgB,KAAK,OAAO;AAC5B,gCAA4B;AAC5B,eAAW,UAAU,KAAK,SAAS;AACjC,UAAI,OAAO,cAAc,QAAQ;AAC/B,6BAAqB,OAAO,YAAY;AAAA,MAC1C;AACA,UAAI,OAAO,SAAS,QAAQ;AAC1B,wBAAgB,OAAO,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,sBAAkB,KAAK,SAAS;AAGhC,QAAI,KAAK,sBAAsB;AAC7B,2BAAqB,KAAK,oBAAoB;AAAA,IAChD;AAGA,QAAI,KAAK,qBAAqB;AAC5B,kCAA4B,KAAK,mBAAmB;AAAA,IACtD;AAGA,QAAI,KAAK,wBAAwB;AAC/B,qCAA+B,KAAK,sBAAsB;AAAA,IAC5D;AAGA,QAAI,KAAK,eAAe,QAAQ;AAC9B,kCAA4B,KAAK,aAAa;AAAA,IAChD;AAGA,QAAI,KAAK,iBAAiB;AACxB,gCAA0B,KAAK,eAAe;AAAA,IAChD;AAGA,QAAI,KAAK,oBAAoB;AAC3B,8BAAwB,KAAK,kBAAkB;AAAA,IACjD;AAGA,QAAI,KAAK,0BAA0B;AACjC,YAAM,eAAe,iCAAiC,KAAK,wBAAwB;AACnF,YAAM,eAAe,aAAa,QAAQ,CAAC,UAAU,MAAM,sBAAsB,CAAC,CAAC;AACnF,iCAA2B,YAAY;AAAA,IACzC;AAGA,QAAI,KAAK,cAAc;AACrB,6BAAuB,KAAK,YAAY;AAAA,IAC1C;AAGA,QAAI,KAAK,2BAA2B;AAClC,kCAA4B,KAAK,yBAAyB;AAAA,IAC5D;AAGA,QAAI,KAAK,sBAAsB;AAC7B,6BAAuB,KAAK,oBAAoB;AAAA,IAClD;AAGA,QAAI,KAAK,4BAA4B;AACnC,mCAA6B,KAAK,0BAA0B;AAAA,IAC9D;AAIA,gCAA4B,mCAAmC,MAAM,OAAO;AAC5E,SAAK;AAEL,YAAQ,yBAAyB;AAAA,EACnC;AACF;AAMA,eAAsB,2BAA0C;AAC9D,MAAI,2BAA2B;AAC7B,UAAM;AAAA,EACR;AACF;AAEA,eAAe,mCAAmC,MAAqB,SAA0C;AAE/G,MAAI;AACF,UAAM,CAAC,mBAAmB,mBAAmB,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC9E,OAAO,mDAAmD;AAAA,MAC1D,OAAO,mDAAmD;AAAA,MAC1D,OAAO,kDAAkD;AAAA,IAC3D,CAAC;AAED,sBAAkB,yBAAyB,KAAK,sBAAsB;AACtE,sBAAkB,yBAAyB,KAAK,sBAAsB;AACtE,kBAAc,6BAA6B,KAAK,sBAAsB;AACtE,kBAAc,4BAA4B,KAAK,eAAe;AAC9D,kBAAc;AAAA,MACZ,KAAK,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,IAC9G;AAAA,EACF,QAAQ;AAAA,EAER;AASF;AAKO,SAAS,iBAA0B;AACxC,SAAO;AACT;AAKO,SAAS,sBAA4B;AAC1C,kBAAgB;AAClB;",
   "names": []
 }

package/dist/lib/cache/maintenance.js

@@ -0,0 +1,5 @@
+import { purgeConfiguredCachePatternsAcrossTenantScopes } from "@open-mercato/cache/service";
+export {
+  purgeConfiguredCachePatternsAcrossTenantScopes
+};
+//# sourceMappingURL=maintenance.js.map

package/dist/lib/cache/maintenance.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/cache/maintenance.ts"],
+  "sourcesContent": ["export { purgeConfiguredCachePatternsAcrossTenantScopes } from '@open-mercato/cache/service'\n"],
+  "mappings": "AAAA,SAAS,sDAAsD;",
+  "names": []
+}

package/dist/lib/commands/helpers.js

@@ -22,24 +22,26 @@ async function setCustomFieldsIfAny(opts) {
   });
 }
 async function emitCrudSideEffects(opts) {
-  const { dataEngine, action, entity, identifiers, syncOrigin, events, indexer } = opts;
+  const { dataEngine, action, entity, identifiers, syncOrigin, actorUserId, events, indexer } = opts;
   dataEngine.markOrmEntityChange({
     action,
     entity,
     identifiers,
     syncOrigin,
+    actorUserId,
     events,
     indexer
   });
 }
 async function emitCrudUndoSideEffects(opts) {
-  const { dataEngine, action, entity, identifiers, syncOrigin, events, indexer } = opts;
+  const { dataEngine, action, entity, identifiers, syncOrigin, actorUserId, events, indexer } = opts;
   if (!entity) return;
   dataEngine.markOrmEntityChange({
     action,
     entity,
     identifiers,
     syncOrigin,
+    actorUserId,
     events,
     indexer
   });

package/dist/lib/commands/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/commands/helpers.ts"],
-  "sourcesContent": ["import { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport type { z } from 'zod'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nexport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nimport type { CrudEventsConfig, CrudIndexerConfig, CrudEmitContext } from '@open-mercato/shared/lib/crud/types'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { CommandLogMetadata } from '@open-mercato/shared/lib/commands'\nimport type { BulkImportSuppression } from '@open-mercato/shared/lib/commands'\n\nexport type ParsedPayload<TSchema extends z.ZodTypeAny> = {\n  parsed: z.infer<TSchema>\n  custom: Record<string, unknown>\n}\n\nexport function parseWithCustomFields<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  raw: unknown\n): ParsedPayload<TSchema> {\n  const { base, custom } = splitCustomFieldPayload(raw)\n  const parsed = schema.parse(base)\n  return { parsed, custom }\n}\n\nexport async function setCustomFieldsIfAny(opts: {\n  dataEngine: DataEngine\n  entityId: string\n  recordId: string\n  tenantId: string | null\n  organizationId: string | null\n  values: Record<string, unknown>\n  notify?: boolean\n}) {\n  const { values } = opts\n  if (!values || !Object.keys(values).length) return\n  const { dataEngine, entityId, recordId, tenantId, organizationId, notify = false } = opts\n  const normalized = normalizeCustomFieldValues(values)\n  await dataEngine.setCustomFields({\n    entityId,\n    recordId,\n    tenantId,\n    organizationId,\n    values: normalized,\n    notify,\n  })\n}\n\nexport async function emitCrudSideEffects<TEntity>(opts: {\n  dataEngine: DataEngine\n  action: 'created' | 'updated' | 'deleted'\n  entity: TEntity\n  identifiers: CrudEmitContext<TEntity>['identifiers']\n  syncOrigin?: string | null\n  events?: CrudEventsConfig<any>\n  indexer?: CrudIndexerConfig<any>\n}) {\n  const { dataEngine, action, entity, identifiers, syncOrigin, events, indexer } = opts\n  dataEngine.markOrmEntityChange({\n    action,\n    entity,\n    identifiers,\n    syncOrigin,\n    events,\n    indexer,\n  })\n}\n\nexport async function emitCrudUndoSideEffects<TEntity>(opts: {\n  dataEngine: DataEngine\n  action: 'created' | 'updated' | 'deleted'\n  entity: TEntity | null | undefined\n  identifiers: CrudEmitContext<TEntity>['identifiers']\n  syncOrigin?: string | null\n  events?: CrudEventsConfig<any>\n  indexer?: CrudIndexerConfig<any>\n}) {\n  const { dataEngine, action, entity, identifiers, syncOrigin, events, indexer } = opts\n  if (!entity) return\n  dataEngine.markOrmEntityChange({\n    action,\n    entity,\n    identifiers,\n    syncOrigin,\n    events,\n    indexer,\n  })\n}\n\nexport async function flushCrudSideEffects(dataEngine: DataEngine, suppress?: BulkImportSuppression): Promise<void> {\n  // Direct-write bulk paths (those that flush here instead of going through the command bus) can\n  // pass the same `bulkImport` suppression so a bulk run defers per-record events/reindex on this\n  // path too. Omitted for normal writes \u2192 unchanged behavior. Mirrors the command bus's own flush.\n  await dataEngine.flushOrmEntityChanges(suppress)\n}\n\nexport function buildChanges(\n  before: Record<string, unknown> | null | undefined,\n  after: Record<string, unknown>,\n  keys: readonly string[]\n): Record<string, { from: unknown; to: unknown }> {\n  if (!before) return {}\n  const diff: Record<string, { from: unknown; to: unknown }> = {}\n  const skipped = new Set(['updatedAt', 'updated_at'])\n  for (const key of keys) {\n    if (skipped.has(key)) continue\n    const prev = before[key]\n    const next = after[key]\n    if (prev !== next) diff[key] = { from: prev, to: next }\n  }\n  return diff\n}\n\nexport function requireTenantScope(authTenantId: string | null, requested?: string | null): string {\n  if (authTenantId && requested && requested !== authTenantId) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n  const tenantId = requested || authTenantId\n  if (!tenantId) throw new CrudHttpError(400, { error: 'Tenant scope required' })\n  return tenantId\n}\n\nexport function requireId(value: unknown, message = 'ID is required'): string {\n  if (typeof value === 'string' && value.trim()) return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  if (value && typeof value === 'object') {\n    const source = value as Record<string, unknown>\n    const candidates: unknown[] = [\n      source.id,\n      source.recordId,\n      isRecord(source.body) ? source.body.id : undefined,\n      isRecord(source.query) ? source.query.id : undefined,\n    ]\n    for (const candidate of candidates) {\n      if (typeof candidate === 'string' && candidate.trim()) return candidate\n      if (typeof candidate === 'number' || typeof candidate === 'bigint') return String(candidate)\n    }\n  }\n  throw new CrudHttpError(400, { error: message })\n}\n\nfunction isRecord(input: unknown): input is { [key: string]: unknown } {\n  return !!input && typeof input === 'object'\n}\n\nexport type LogBuilderArgs<TInput, TResult> = {\n  input: TInput\n  result: TResult\n  ctx: CommandRuntimeContext\n  snapshots: { before?: unknown; after?: unknown }\n}\n\nexport type LogBuilder<TInput, TResult> = (args: LogBuilderArgs<TInput, TResult>) => CommandLogMetadata | null | Promise<CommandLogMetadata | null>\n\nexport function snapshotsEqual(a: unknown, b: unknown): boolean {\n  if (Object.is(a, b)) return true\n  if (a == null || b == null) return a === b\n  if (typeof a !== typeof b) return false\n  if (typeof a !== 'object') return false\n  if (Array.isArray(a) !== Array.isArray(b)) return false\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    return a.every((value, index) => snapshotsEqual(value, b[index]))\n  }\n  const keysA = Object.keys(a as Record<string, unknown>)\n  const keysB = Object.keys(b as Record<string, unknown>)\n  if (keysA.length !== keysB.length) return false\n  return keysA.every((key) =>\n    snapshotsEqual((a as Record<string, unknown>)[key], (b as Record<string, unknown>)[key])\n  )\n}\n\nconst AUTHOR_UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\nexport function normalizeAuthorUserId(\n  explicitAuthorUserId: string | undefined | null,\n  auth: { isApiKey?: boolean; isSuperAdmin?: boolean; sub?: string | null } | undefined | null\n): string | null {\n  if (\n    explicitAuthorUserId &&\n    auth?.isSuperAdmin === true &&\n    auth.isApiKey !== true &&\n    AUTHOR_UUID_REGEX.test(explicitAuthorUserId)\n  ) {\n    return explicitAuthorUserId\n  }\n  const authSub = auth?.isApiKey ? null : auth?.sub ?? null\n  if (!authSub) return null\n  return AUTHOR_UUID_REGEX.test(authSub) ? authSub : null\n}\n"],
-  "mappings": "AAAA,SAAS,+BAA+B;AAExC,SAAS,qBAAqB;AAE9B,SAAS,kCAAkC;AAC3C,SAAS,8BAAAA,mCAAkC;AAWpC,SAAS,sBACd,QACA,KACwB;AACxB,QAAM,EAAE,MAAM,OAAO,IAAI,wBAAwB,GAAG;AACpD,QAAM,SAAS,OAAO,MAAM,IAAI;AAChC,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,qBAAqB,MAQxC;AACD,QAAM,EAAE,OAAO,IAAI;AACnB,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,EAAE,OAAQ;AAC5C,QAAM,EAAE,YAAY,UAAU,UAAU,UAAU,gBAAgB,SAAS,MAAM,IAAI;AACrF,QAAM,aAAa,2BAA2B,MAAM;AACpD,QAAM,WAAW,gBAAgB;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,oBAA6B,MAQhD;AACD,QAAM,EAAE,YAAY,QAAQ,QAAQ,aAAa,YAAY,QAAQ,QAAQ,IAAI;AACjF,aAAW,oBAAoB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,wBAAiC,MAQpD;AACD,QAAM,EAAE,YAAY,QAAQ,QAAQ,aAAa,YAAY,QAAQ,QAAQ,IAAI;AACjF,MAAI,CAAC,OAAQ;AACb,aAAW,oBAAoB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,qBAAqB,YAAwB,UAAiD;AAIlH,QAAM,WAAW,sBAAsB,QAAQ;AACjD;AAEO,SAAS,aACd,QACA,OACA,MACgD;AAChD,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,OAAuD,CAAC;AAC9D,QAAM,UAAU,oBAAI,IAAI,CAAC,aAAa,YAAY,CAAC;AACnD,aAAW,OAAO,MAAM;AACtB,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,UAAM,OAAO,OAAO,GAAG;AACvB,UAAM,OAAO,MAAM,GAAG;AACtB,QAAI,SAAS,KAAM,MAAK,GAAG,IAAI,EAAE,MAAM,MAAM,IAAI,KAAK;AAAA,EACxD;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,cAA6B,WAAmC;AACjG,MAAI,gBAAgB,aAAa,cAAc,cAAc;AAC3D,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACA,QAAM,WAAW,aAAa;AAC9B,MAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAC9E,SAAO;AACT;AAEO,SAAS,UAAU,OAAgB,UAAU,kBAA0B;AAC5E,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,QAAO;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,SAAS;AACf,UAAM,aAAwB;AAAA,MAC5B,OAAO;AAAA,MACP,OAAO;AAAA,MACP,SAAS,OAAO,IAAI,IAAI,OAAO,KAAK,KAAK;AAAA,MACzC,SAAS,OAAO,KAAK,IAAI,OAAO,MAAM,KAAK;AAAA,IAC7C;AACA,eAAW,aAAa,YAAY;AAClC,UAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAG,QAAO;AAC9D,UAAI,OAAO,cAAc,YAAY,OAAO,cAAc,SAAU,QAAO,OAAO,SAAS;AAAA,IAC7F;AAAA,EACF;AACA,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AACjD;AAEA,SAAS,SAAS,OAAqD;AACrE,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU;AACrC;AAWO,SAAS,eAAe,GAAY,GAAqB;AAC9D,MAAI,OAAO,GAAG,GAAG,CAAC,EAAG,QAAO;AAC5B,MAAI,KAAK,QAAQ,KAAK,KAAM,QAAO,MAAM;AACzC,MAAI,OAAO,MAAM,OAAO,EAAG,QAAO;AAClC,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,MAAM,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAClD,MAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;AACxC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,WAAO,EAAE,MAAM,CAAC,OAAO,UAAU,eAAe,OAAO,EAAE,KAAK,CAAC,CAAC;AAAA,EAClE;AACA,QAAM,QAAQ,OAAO,KAAK,CAA4B;AACtD,QAAM,QAAQ,OAAO,KAAK,CAA4B;AACtD,MAAI,MAAM,WAAW,MAAM,OAAQ,QAAO;AAC1C,SAAO,MAAM;AAAA,IAAM,CAAC,QAClB,eAAgB,EAA8B,GAAG,GAAI,EAA8B,GAAG,CAAC;AAAA,EACzF;AACF;AAEA,MAAM,oBAAoB;AAEnB,SAAS,sBACd,sBACA,MACe;AACf,MACE,wBACA,MAAM,iBAAiB,QACvB,KAAK,aAAa,QAClB,kBAAkB,KAAK,oBAAoB,GAC3C;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,WAAW,OAAO,MAAM,OAAO;AACrD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,kBAAkB,KAAK,OAAO,IAAI,UAAU;AACrD;",
+  "sourcesContent": ["import { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport type { z } from 'zod'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nexport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nimport type { CrudEventsConfig, CrudIndexerConfig, CrudEmitContext } from '@open-mercato/shared/lib/crud/types'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { CommandLogMetadata } from '@open-mercato/shared/lib/commands'\nimport type { BulkImportSuppression } from '@open-mercato/shared/lib/commands'\n\nexport type ParsedPayload<TSchema extends z.ZodTypeAny> = {\n  parsed: z.infer<TSchema>\n  custom: Record<string, unknown>\n}\n\nexport function parseWithCustomFields<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  raw: unknown\n): ParsedPayload<TSchema> {\n  const { base, custom } = splitCustomFieldPayload(raw)\n  const parsed = schema.parse(base)\n  return { parsed, custom }\n}\n\nexport async function setCustomFieldsIfAny(opts: {\n  dataEngine: DataEngine\n  entityId: string\n  recordId: string\n  tenantId: string | null\n  organizationId: string | null\n  values: Record<string, unknown>\n  notify?: boolean\n}) {\n  const { values } = opts\n  if (!values || !Object.keys(values).length) return\n  const { dataEngine, entityId, recordId, tenantId, organizationId, notify = false } = opts\n  const normalized = normalizeCustomFieldValues(values)\n  await dataEngine.setCustomFields({\n    entityId,\n    recordId,\n    tenantId,\n    organizationId,\n    values: normalized,\n    notify,\n  })\n}\n\nexport async function emitCrudSideEffects<TEntity>(opts: {\n  dataEngine: DataEngine\n  action: 'created' | 'updated' | 'deleted'\n  entity: TEntity\n  identifiers: CrudEmitContext<TEntity>['identifiers']\n  syncOrigin?: string | null\n  actorUserId?: string | null\n  events?: CrudEventsConfig<any>\n  indexer?: CrudIndexerConfig<any>\n}) {\n  const { dataEngine, action, entity, identifiers, syncOrigin, actorUserId, events, indexer } = opts\n  dataEngine.markOrmEntityChange({\n    action,\n    entity,\n    identifiers,\n    syncOrigin,\n    actorUserId,\n    events,\n    indexer,\n  })\n}\n\nexport async function emitCrudUndoSideEffects<TEntity>(opts: {\n  dataEngine: DataEngine\n  action: 'created' | 'updated' | 'deleted'\n  entity: TEntity | null | undefined\n  identifiers: CrudEmitContext<TEntity>['identifiers']\n  syncOrigin?: string | null\n  actorUserId?: string | null\n  events?: CrudEventsConfig<any>\n  indexer?: CrudIndexerConfig<any>\n}) {\n  const { dataEngine, action, entity, identifiers, syncOrigin, actorUserId, events, indexer } = opts\n  if (!entity) return\n  dataEngine.markOrmEntityChange({\n    action,\n    entity,\n    identifiers,\n    syncOrigin,\n    actorUserId,\n    events,\n    indexer,\n  })\n}\n\nexport async function flushCrudSideEffects(dataEngine: DataEngine, suppress?: BulkImportSuppression): Promise<void> {\n  // Direct-write bulk paths (those that flush here instead of going through the command bus) can\n  // pass the same `bulkImport` suppression so a bulk run defers per-record events/reindex on this\n  // path too. Omitted for normal writes \u2192 unchanged behavior. Mirrors the command bus's own flush.\n  await dataEngine.flushOrmEntityChanges(suppress)\n}\n\nexport function buildChanges(\n  before: Record<string, unknown> | null | undefined,\n  after: Record<string, unknown>,\n  keys: readonly string[]\n): Record<string, { from: unknown; to: unknown }> {\n  if (!before) return {}\n  const diff: Record<string, { from: unknown; to: unknown }> = {}\n  const skipped = new Set(['updatedAt', 'updated_at'])\n  for (const key of keys) {\n    if (skipped.has(key)) continue\n    const prev = before[key]\n    const next = after[key]\n    if (prev !== next) diff[key] = { from: prev, to: next }\n  }\n  return diff\n}\n\nexport function requireTenantScope(authTenantId: string | null, requested?: string | null): string {\n  if (authTenantId && requested && requested !== authTenantId) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n  const tenantId = requested || authTenantId\n  if (!tenantId) throw new CrudHttpError(400, { error: 'Tenant scope required' })\n  return tenantId\n}\n\nexport function requireId(value: unknown, message = 'ID is required'): string {\n  if (typeof value === 'string' && value.trim()) return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  if (value && typeof value === 'object') {\n    const source = value as Record<string, unknown>\n    const candidates: unknown[] = [\n      source.id,\n      source.recordId,\n      isRecord(source.body) ? source.body.id : undefined,\n      isRecord(source.query) ? source.query.id : undefined,\n    ]\n    for (const candidate of candidates) {\n      if (typeof candidate === 'string' && candidate.trim()) return candidate\n      if (typeof candidate === 'number' || typeof candidate === 'bigint') return String(candidate)\n    }\n  }\n  throw new CrudHttpError(400, { error: message })\n}\n\nfunction isRecord(input: unknown): input is { [key: string]: unknown } {\n  return !!input && typeof input === 'object'\n}\n\nexport type LogBuilderArgs<TInput, TResult> = {\n  input: TInput\n  result: TResult\n  ctx: CommandRuntimeContext\n  snapshots: { before?: unknown; after?: unknown }\n}\n\nexport type LogBuilder<TInput, TResult> = (args: LogBuilderArgs<TInput, TResult>) => CommandLogMetadata | null | Promise<CommandLogMetadata | null>\n\nexport function snapshotsEqual(a: unknown, b: unknown): boolean {\n  if (Object.is(a, b)) return true\n  if (a == null || b == null) return a === b\n  if (typeof a !== typeof b) return false\n  if (typeof a !== 'object') return false\n  if (Array.isArray(a) !== Array.isArray(b)) return false\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    return a.every((value, index) => snapshotsEqual(value, b[index]))\n  }\n  const keysA = Object.keys(a as Record<string, unknown>)\n  const keysB = Object.keys(b as Record<string, unknown>)\n  if (keysA.length !== keysB.length) return false\n  return keysA.every((key) =>\n    snapshotsEqual((a as Record<string, unknown>)[key], (b as Record<string, unknown>)[key])\n  )\n}\n\nconst AUTHOR_UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\nexport function normalizeAuthorUserId(\n  explicitAuthorUserId: string | undefined | null,\n  auth: { isApiKey?: boolean; isSuperAdmin?: boolean; sub?: string | null } | undefined | null\n): string | null {\n  if (\n    explicitAuthorUserId &&\n    auth?.isSuperAdmin === true &&\n    auth.isApiKey !== true &&\n    AUTHOR_UUID_REGEX.test(explicitAuthorUserId)\n  ) {\n    return explicitAuthorUserId\n  }\n  const authSub = auth?.isApiKey ? null : auth?.sub ?? null\n  if (!authSub) return null\n  return AUTHOR_UUID_REGEX.test(authSub) ? authSub : null\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B;AAExC,SAAS,qBAAqB;AAE9B,SAAS,kCAAkC;AAC3C,SAAS,8BAAAA,mCAAkC;AAWpC,SAAS,sBACd,QACA,KACwB;AACxB,QAAM,EAAE,MAAM,OAAO,IAAI,wBAAwB,GAAG;AACpD,QAAM,SAAS,OAAO,MAAM,IAAI;AAChC,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,qBAAqB,MAQxC;AACD,QAAM,EAAE,OAAO,IAAI;AACnB,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,EAAE,OAAQ;AAC5C,QAAM,EAAE,YAAY,UAAU,UAAU,UAAU,gBAAgB,SAAS,MAAM,IAAI;AACrF,QAAM,aAAa,2BAA2B,MAAM;AACpD,QAAM,WAAW,gBAAgB;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,oBAA6B,MAShD;AACD,QAAM,EAAE,YAAY,QAAQ,QAAQ,aAAa,YAAY,aAAa,QAAQ,QAAQ,IAAI;AAC9F,aAAW,oBAAoB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,wBAAiC,MASpD;AACD,QAAM,EAAE,YAAY,QAAQ,QAAQ,aAAa,YAAY,aAAa,QAAQ,QAAQ,IAAI;AAC9F,MAAI,CAAC,OAAQ;AACb,aAAW,oBAAoB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,qBAAqB,YAAwB,UAAiD;AAIlH,QAAM,WAAW,sBAAsB,QAAQ;AACjD;AAEO,SAAS,aACd,QACA,OACA,MACgD;AAChD,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,OAAuD,CAAC;AAC9D,QAAM,UAAU,oBAAI,IAAI,CAAC,aAAa,YAAY,CAAC;AACnD,aAAW,OAAO,MAAM;AACtB,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,UAAM,OAAO,OAAO,GAAG;AACvB,UAAM,OAAO,MAAM,GAAG;AACtB,QAAI,SAAS,KAAM,MAAK,GAAG,IAAI,EAAE,MAAM,MAAM,IAAI,KAAK;AAAA,EACxD;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,cAA6B,WAAmC;AACjG,MAAI,gBAAgB,aAAa,cAAc,cAAc;AAC3D,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACA,QAAM,WAAW,aAAa;AAC9B,MAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAC9E,SAAO;AACT;AAEO,SAAS,UAAU,OAAgB,UAAU,kBAA0B;AAC5E,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,QAAO;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,SAAS;AACf,UAAM,aAAwB;AAAA,MAC5B,OAAO;AAAA,MACP,OAAO;AAAA,MACP,SAAS,OAAO,IAAI,IAAI,OAAO,KAAK,KAAK;AAAA,MACzC,SAAS,OAAO,KAAK,IAAI,OAAO,MAAM,KAAK;AAAA,IAC7C;AACA,eAAW,aAAa,YAAY;AAClC,UAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAG,QAAO;AAC9D,UAAI,OAAO,cAAc,YAAY,OAAO,cAAc,SAAU,QAAO,OAAO,SAAS;AAAA,IAC7F;AAAA,EACF;AACA,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AACjD;AAEA,SAAS,SAAS,OAAqD;AACrE,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU;AACrC;AAWO,SAAS,eAAe,GAAY,GAAqB;AAC9D,MAAI,OAAO,GAAG,GAAG,CAAC,EAAG,QAAO;AAC5B,MAAI,KAAK,QAAQ,KAAK,KAAM,QAAO,MAAM;AACzC,MAAI,OAAO,MAAM,OAAO,EAAG,QAAO;AAClC,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,MAAM,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAClD,MAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;AACxC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,WAAO,EAAE,MAAM,CAAC,OAAO,UAAU,eAAe,OAAO,EAAE,KAAK,CAAC,CAAC;AAAA,EAClE;AACA,QAAM,QAAQ,OAAO,KAAK,CAA4B;AACtD,QAAM,QAAQ,OAAO,KAAK,CAA4B;AACtD,MAAI,MAAM,WAAW,MAAM,OAAQ,QAAO;AAC1C,SAAO,MAAM;AAAA,IAAM,CAAC,QAClB,eAAgB,EAA8B,GAAG,GAAI,EAA8B,GAAG,CAAC;AAAA,EACzF;AACF;AAEA,MAAM,oBAAoB;AAEnB,SAAS,sBACd,sBACA,MACe;AACf,MACE,wBACA,MAAM,iBAAiB,QACvB,KAAK,aAAa,QAClB,kBAAkB,KAAK,oBAAoB,GAC3C;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,WAAW,OAAO,MAAM,OAAO;AACrD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,kBAAkB,KAAK,OAAO,IAAI,UAAU;AACrD;",
   "names": ["normalizeCustomFieldValues"]
 }

package/dist/lib/crud/cache.js

@@ -144,11 +144,9 @@ async function invalidateCrudCache(container, resource, identifiers, fallbackTen
     if (recordId) {
       tags.add(buildRecordTag(key, tenantId, recordId));
     }
-    const organizationIds = [];
-    if (identifiers.organizationId !== void 0) {
-      organizationIds.push(identifiers.organizationId ?? null);
-    }
-    if (!organizationIds.length) organizationIds.push(null);
+    const organizationIds = [null];
+    const recordOrganizationId = identifiers.organizationId ?? null;
+    if (recordOrganizationId) organizationIds.push(recordOrganizationId);
     for (const tag of buildCollectionTags(key, tenantId, organizationIds)) {
       tags.add(tag);
     }

package/dist/lib/crud/cache.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/cache.ts"],
-  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport { runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'\nimport { parseBooleanToken } from '../boolean'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'crud-cache' })\n\nexport type CrudCacheIdentifiers = {\n  id?: string | null\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nlet crudCacheEnabledFlag: boolean | null = null\nexport function isCrudCacheEnabled(): boolean {\n  if (crudCacheEnabledFlag !== null) return crudCacheEnabledFlag\n  crudCacheEnabledFlag = parseBooleanToken(process.env.ENABLE_CRUD_API_CACHE ?? '') === true\n  return crudCacheEnabledFlag\n}\n\nlet crudCacheDebugFlag: boolean | null = null\nexport function isCrudCacheDebugEnabled(): boolean {\n  if (crudCacheDebugFlag !== null) return crudCacheDebugFlag\n  crudCacheDebugFlag = parseBooleanToken(process.env.QUERY_ENGINE_DEBUG_SQL ?? '') === true\n  return crudCacheDebugFlag\n}\n\nexport function debugCrudCache(event: string, context: Record<string, unknown>) {\n  if (!isCrudCacheDebugEnabled()) return\n  try {\n    logger.debug(event, context)\n  } catch {}\n}\n\nexport function resolveCrudCache(container: AwilixContainer): CacheStrategy | null {\n  try {\n    const cache = (container.resolve('cache') as CacheStrategy)\n    if (cache && typeof cache.get === 'function' && typeof cache.set === 'function') {\n      return cache\n    }\n  } catch {}\n  return null\n}\n\nexport function normalizeTagSegment(value: string | null | undefined): string {\n  if (value === null || value === undefined || value === '') return 'null'\n  return value.toString().trim().replace(/[^a-zA-Z0-9._-]/g, '-')\n}\n\nexport function canonicalizeResourceTag(value: string | null | undefined): string | null {\n  if (value === null || value === undefined) return null\n  const trimmed = String(value).trim()\n  if (!trimmed.length) return null\n  const withSeparators = trimmed\n    .replace(/::/g, '.')\n    .replace(/[/\\\\]+/g, '.')\n    .replace(/[\\s]+/g, '.')\n    .replace(/_/g, '.')\n    .replace(/-+/g, '.')\n  const withCamelBreaks = withSeparators.replace(/([a-z0-9])([A-Z])/g, '$1.$2')\n  const collapsed = withCamelBreaks.replace(/\\.{2,}/g, '.').replace(/(?:^\\.+|\\.+$)/g, '')\n  const lowered = collapsed.toLowerCase()\n  return lowered.length ? lowered : null\n}\n\nexport function buildRecordTag(resource: string, tenantId: string | null, recordId: string): string {\n  return [\n    'crud',\n    normalizeTagSegment(resource),\n    'tenant',\n    normalizeTagSegment(tenantId),\n    'record',\n    normalizeTagSegment(recordId),\n  ].join(':')\n}\n\nexport function buildCollectionTags(\n  resource: string,\n  tenantId: string | null,\n  organizationIds: Array<string | null>\n): string[] {\n  const normalizedResource = normalizeTagSegment(resource)\n  const normalizedTenant = normalizeTagSegment(tenantId)\n  const tags = new Set<string>()\n  if (!organizationIds.length) {\n    tags.add(['crud', normalizedResource, 'tenant', normalizedTenant, 'org', 'null', 'collection'].join(':'))\n    return Array.from(tags)\n  }\n  for (const orgId of organizationIds) {\n    tags.add(['crud', normalizedResource, 'tenant', normalizedTenant, 'org', normalizeTagSegment(orgId), 'collection'].join(':'))\n  }\n  return Array.from(tags)\n}\n\nexport function normalizeIdentifierValue(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  if (typeof value === 'object') {\n    if (value instanceof Date) return value.toISOString()\n    if (value && typeof (value as { id?: unknown }).id !== 'undefined') {\n      return normalizeIdentifierValue((value as { id?: unknown }).id)\n    }\n  }\n  return String(value)\n}\n\nexport function pickFirstIdentifier(...values: Array<unknown>): string | null {\n  for (const value of values) {\n    const normalized = normalizeIdentifierValue(value)\n    if (normalized) return normalized\n  }\n  return null\n}\n\nconst IRREGULAR_PLURALS: Record<string, string> = {\n  people: 'person',\n  children: 'child',\n  mice: 'mouse',\n  men: 'man',\n  women: 'woman',\n  geese: 'goose',\n  feet: 'foot',\n  teeth: 'tooth',\n  oxen: 'ox',\n}\n\nfunction singularizeSegment(segment: string): string {\n  const lower = segment.toLowerCase()\n  const irregular = IRREGULAR_PLURALS[lower]\n  if (irregular) return irregular\n  if (lower.endsWith('ies') && lower.length > 3) return lower.slice(0, -3) + 'y'\n  if (lower.endsWith('ses') && lower.length > 3) return lower.slice(0, -2)\n  if (\n    (lower.endsWith('xes') ||\n      lower.endsWith('zes') ||\n      lower.endsWith('ches') ||\n      lower.endsWith('shes')) &&\n    lower.length > 3\n  ) {\n    return lower.slice(0, -2)\n  }\n  if (lower.endsWith('s') && !lower.endsWith('ss') && lower.length > 1) return lower.slice(0, -1)\n  return lower\n}\n\nfunction singularizeResourceSegment(segment: string): string {\n  return segment\n    .split('-')\n    .map((part) => singularizeSegment(part))\n    .join('-')\n}\n\nexport function deriveResourceFromCommandId(commandId: string | undefined | null): string | null {\n  if (!commandId || typeof commandId !== 'string') return null\n  const parts = commandId.split('.')\n  if (parts.length < 2) return null\n  const modulePart = parts[0]\n  const entityPart = singularizeResourceSegment(parts[1])\n  if (!modulePart || !entityPart) return null\n  return `${modulePart}.${entityPart}`\n}\n\nexport function expandResourceAliases(resource: string, aliases?: string[]): string[] {\n  const set = new Set<string>()\n  const inputs = [resource, ...(aliases ?? [])]\n  for (const candidate of inputs) {\n    const canonical = canonicalizeResourceTag(candidate)\n    if (canonical) set.add(canonical)\n  }\n  if (!set.size) return []\n  return Array.from(set)\n}\n\nexport async function invalidateCrudCache(\n  container: AwilixContainer,\n  resource: string,\n  identifiers: CrudCacheIdentifiers,\n  fallbackTenant: string | null,\n  reason: string,\n  aliases?: string[]\n): Promise<void> {\n  if (!isCrudCacheEnabled()) return\n  const cache = resolveCrudCache(container)\n  if (!cache || typeof cache.deleteByTags !== 'function') return\n  const resources = expandResourceAliases(resource, aliases)\n  const tenantId = identifiers.tenantId ?? fallbackTenant ?? null\n  const recordId = normalizeIdentifierValue(identifiers.id)\n  const tags = new Set<string>()\n  for (const key of resources) {\n    if (recordId) {\n      tags.add(buildRecordTag(key, tenantId, recordId))\n    }\n    const organizationIds: Array<string | null> = []\n    if (identifiers.organizationId !== undefined) {\n      organizationIds.push(identifiers.organizationId ?? null)\n    }\n    if (!organizationIds.length) organizationIds.push(null)\n    for (const tag of buildCollectionTags(key, tenantId, organizationIds)) {\n      tags.add(tag)\n    }\n  }\n  if (!tags.size) return\n  const tagList = Array.from(tags)\n  debugCrudCache('invalidate', {\n    resource,\n    aliases: resources,\n    reason,\n    tenantId: tenantId ?? 'null',\n    tags: tagList,\n    action: 'clearing',\n  })\n  const deleted = await runWithCacheTenant(tenantId, () => cache.deleteByTags(tagList))\n  debugCrudCache('invalidate', {\n    resource,\n    reason,\n    tenantId: tenantId ?? 'null',\n    tags: tagList,\n    action: 'cleared',\n    deleted,\n  })\n}\n"],
-  "mappings": "AACA,SAAS,0BAA8C;AACvD,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAQvE,IAAI,uBAAuC;AACpC,SAAS,qBAA8B;AAC5C,MAAI,yBAAyB,KAAM,QAAO;AAC1C,yBAAuB,kBAAkB,QAAQ,IAAI,yBAAyB,EAAE,MAAM;AACtF,SAAO;AACT;AAEA,IAAI,qBAAqC;AAClC,SAAS,0BAAmC;AACjD,MAAI,uBAAuB,KAAM,QAAO;AACxC,uBAAqB,kBAAkB,QAAQ,IAAI,0BAA0B,EAAE,MAAM;AACrF,SAAO;AACT;AAEO,SAAS,eAAe,OAAe,SAAkC;AAC9E,MAAI,CAAC,wBAAwB,EAAG;AAChC,MAAI;AACF,WAAO,MAAM,OAAO,OAAO;AAAA,EAC7B,QAAQ;AAAA,EAAC;AACX;AAEO,SAAS,iBAAiB,WAAkD;AACjF,MAAI;AACF,UAAM,QAAS,UAAU,QAAQ,OAAO;AACxC,QAAI,SAAS,OAAO,MAAM,QAAQ,cAAc,OAAO,MAAM,QAAQ,YAAY;AAC/E,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEO,SAAS,oBAAoB,OAA0C;AAC5E,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,GAAI,QAAO;AAClE,SAAO,MAAM,SAAS,EAAE,KAAK,EAAE,QAAQ,oBAAoB,GAAG;AAChE;AAEO,SAAS,wBAAwB,OAAiD;AACvF,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,UAAU,OAAO,KAAK,EAAE,KAAK;AACnC,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,iBAAiB,QACpB,QAAQ,OAAO,GAAG,EAClB,QAAQ,WAAW,GAAG,EACtB,QAAQ,UAAU,GAAG,EACrB,QAAQ,MAAM,GAAG,EACjB,QAAQ,OAAO,GAAG;AACrB,QAAM,kBAAkB,eAAe,QAAQ,sBAAsB,OAAO;AAC5E,QAAM,YAAY,gBAAgB,QAAQ,WAAW,GAAG,EAAE,QAAQ,kBAAkB,EAAE;AACtF,QAAM,UAAU,UAAU,YAAY;AACtC,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEO,SAAS,eAAe,UAAkB,UAAyB,UAA0B;AAClG,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B;AAAA,IACA,oBAAoB,QAAQ;AAAA,EAC9B,EAAE,KAAK,GAAG;AACZ;AAEO,SAAS,oBACd,UACA,UACA,iBACU;AACV,QAAM,qBAAqB,oBAAoB,QAAQ;AACvD,QAAM,mBAAmB,oBAAoB,QAAQ;AACrD,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,CAAC,gBAAgB,QAAQ;AAC3B,SAAK,IAAI,CAAC,QAAQ,oBAAoB,UAAU,kBAAkB,OAAO,QAAQ,YAAY,EAAE,KAAK,GAAG,CAAC;AACxG,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AACA,aAAW,SAAS,iBAAiB;AACnC,SAAK,IAAI,CAAC,QAAQ,oBAAoB,UAAU,kBAAkB,OAAO,oBAAoB,KAAK,GAAG,YAAY,EAAE,KAAK,GAAG,CAAC;AAAA,EAC9H;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,yBAAyB,OAA+B;AACtE,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAI,SAAS,OAAQ,MAA2B,OAAO,aAAa;AAClE,aAAO,yBAA0B,MAA2B,EAAE;AAAA,IAChE;AAAA,EACF;AACA,SAAO,OAAO,KAAK;AACrB;AAEO,SAAS,uBAAuB,QAAuC;AAC5E,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,yBAAyB,KAAK;AACjD,QAAI,WAAY,QAAO;AAAA,EACzB;AACA,SAAO;AACT;AAEA,MAAM,oBAA4C;AAAA,EAChD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AAAA,EACP,OAAO;AAAA,EACP,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AACR;AAEA,SAAS,mBAAmB,SAAyB;AACnD,QAAM,QAAQ,QAAQ,YAAY;AAClC,QAAM,YAAY,kBAAkB,KAAK;AACzC,MAAI,UAAW,QAAO;AACtB,MAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,MAAM,GAAG,EAAE,IAAI;AAC3E,MAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,MAAM,GAAG,EAAE;AACvE,OACG,MAAM,SAAS,KAAK,KACnB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,MAAM,KACrB,MAAM,SAAS,MAAM,MACvB,MAAM,SAAS,GACf;AACA,WAAO,MAAM,MAAM,GAAG,EAAE;AAAA,EAC1B;AACA,MAAI,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,MAAM,GAAG,EAAE;AAC9F,SAAO;AACT;AAEA,SAAS,2BAA2B,SAAyB;AAC3D,SAAO,QACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC,EACtC,KAAK,GAAG;AACb;AAEO,SAAS,4BAA4B,WAAqD;AAC/F,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,QAAQ,UAAU,MAAM,GAAG;AACjC,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,QAAM,aAAa,MAAM,CAAC;AAC1B,QAAM,aAAa,2BAA2B,MAAM,CAAC,CAAC;AACtD,MAAI,CAAC,cAAc,CAAC,WAAY,QAAO;AACvC,SAAO,GAAG,UAAU,IAAI,UAAU;AACpC;AAEO,SAAS,sBAAsB,UAAkB,SAA8B;AACpF,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,SAAS,CAAC,UAAU,GAAI,WAAW,CAAC,CAAE;AAC5C,aAAW,aAAa,QAAQ;AAC9B,UAAM,YAAY,wBAAwB,SAAS;AACnD,QAAI,UAAW,KAAI,IAAI,SAAS;AAAA,EAClC;AACA,MAAI,CAAC,IAAI,KAAM,QAAO,CAAC;AACvB,SAAO,MAAM,KAAK,GAAG;AACvB;AAEA,eAAsB,oBACpB,WACA,UACA,aACA,gBACA,QACA,SACe;AACf,MAAI,CAAC,mBAAmB,EAAG;AAC3B,QAAM,QAAQ,iBAAiB,SAAS;AACxC,MAAI,CAAC,SAAS,OAAO,MAAM,iBAAiB,WAAY;AACxD,QAAM,YAAY,sBAAsB,UAAU,OAAO;AACzD,QAAM,WAAW,YAAY,YAAY,kBAAkB;AAC3D,QAAM,WAAW,yBAAyB,YAAY,EAAE;AACxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,OAAO,WAAW;AAC3B,QAAI,UAAU;AACZ,WAAK,IAAI,eAAe,KAAK,UAAU,QAAQ,CAAC;AAAA,IAClD;AACA,UAAM,kBAAwC,CAAC;AAC/C,QAAI,YAAY,mBAAmB,QAAW;AAC5C,sBAAgB,KAAK,YAAY,kBAAkB,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,gBAAgB,OAAQ,iBAAgB,KAAK,IAAI;AACtD,eAAW,OAAO,oBAAoB,KAAK,UAAU,eAAe,GAAG;AACrE,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF;AACA,MAAI,CAAC,KAAK,KAAM;AAChB,QAAM,UAAU,MAAM,KAAK,IAAI;AAC/B,iBAAe,cAAc;AAAA,IAC3B;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,UAAU,MAAM,mBAAmB,UAAU,MAAM,MAAM,aAAa,OAAO,CAAC;AACpF,iBAAe,cAAc;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport { runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'\nimport { parseBooleanToken } from '../boolean'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'crud-cache' })\n\nexport type CrudCacheIdentifiers = {\n  id?: string | null\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nlet crudCacheEnabledFlag: boolean | null = null\nexport function isCrudCacheEnabled(): boolean {\n  if (crudCacheEnabledFlag !== null) return crudCacheEnabledFlag\n  crudCacheEnabledFlag = parseBooleanToken(process.env.ENABLE_CRUD_API_CACHE ?? '') === true\n  return crudCacheEnabledFlag\n}\n\nlet crudCacheDebugFlag: boolean | null = null\nexport function isCrudCacheDebugEnabled(): boolean {\n  if (crudCacheDebugFlag !== null) return crudCacheDebugFlag\n  crudCacheDebugFlag = parseBooleanToken(process.env.QUERY_ENGINE_DEBUG_SQL ?? '') === true\n  return crudCacheDebugFlag\n}\n\nexport function debugCrudCache(event: string, context: Record<string, unknown>) {\n  if (!isCrudCacheDebugEnabled()) return\n  try {\n    logger.debug(event, context)\n  } catch {}\n}\n\nexport function resolveCrudCache(container: AwilixContainer): CacheStrategy | null {\n  try {\n    const cache = (container.resolve('cache') as CacheStrategy)\n    if (cache && typeof cache.get === 'function' && typeof cache.set === 'function') {\n      return cache\n    }\n  } catch {}\n  return null\n}\n\nexport function normalizeTagSegment(value: string | null | undefined): string {\n  if (value === null || value === undefined || value === '') return 'null'\n  return value.toString().trim().replace(/[^a-zA-Z0-9._-]/g, '-')\n}\n\nexport function canonicalizeResourceTag(value: string | null | undefined): string | null {\n  if (value === null || value === undefined) return null\n  const trimmed = String(value).trim()\n  if (!trimmed.length) return null\n  const withSeparators = trimmed\n    .replace(/::/g, '.')\n    .replace(/[/\\\\]+/g, '.')\n    .replace(/[\\s]+/g, '.')\n    .replace(/_/g, '.')\n    .replace(/-+/g, '.')\n  const withCamelBreaks = withSeparators.replace(/([a-z0-9])([A-Z])/g, '$1.$2')\n  const collapsed = withCamelBreaks.replace(/\\.{2,}/g, '.').replace(/(?:^\\.+|\\.+$)/g, '')\n  const lowered = collapsed.toLowerCase()\n  return lowered.length ? lowered : null\n}\n\nexport function buildRecordTag(resource: string, tenantId: string | null, recordId: string): string {\n  return [\n    'crud',\n    normalizeTagSegment(resource),\n    'tenant',\n    normalizeTagSegment(tenantId),\n    'record',\n    normalizeTagSegment(recordId),\n  ].join(':')\n}\n\nexport function buildCollectionTags(\n  resource: string,\n  tenantId: string | null,\n  organizationIds: Array<string | null>\n): string[] {\n  const normalizedResource = normalizeTagSegment(resource)\n  const normalizedTenant = normalizeTagSegment(tenantId)\n  const tags = new Set<string>()\n  if (!organizationIds.length) {\n    tags.add(['crud', normalizedResource, 'tenant', normalizedTenant, 'org', 'null', 'collection'].join(':'))\n    return Array.from(tags)\n  }\n  for (const orgId of organizationIds) {\n    tags.add(['crud', normalizedResource, 'tenant', normalizedTenant, 'org', normalizeTagSegment(orgId), 'collection'].join(':'))\n  }\n  return Array.from(tags)\n}\n\nexport function normalizeIdentifierValue(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  if (typeof value === 'object') {\n    if (value instanceof Date) return value.toISOString()\n    if (value && typeof (value as { id?: unknown }).id !== 'undefined') {\n      return normalizeIdentifierValue((value as { id?: unknown }).id)\n    }\n  }\n  return String(value)\n}\n\nexport function pickFirstIdentifier(...values: Array<unknown>): string | null {\n  for (const value of values) {\n    const normalized = normalizeIdentifierValue(value)\n    if (normalized) return normalized\n  }\n  return null\n}\n\nconst IRREGULAR_PLURALS: Record<string, string> = {\n  people: 'person',\n  children: 'child',\n  mice: 'mouse',\n  men: 'man',\n  women: 'woman',\n  geese: 'goose',\n  feet: 'foot',\n  teeth: 'tooth',\n  oxen: 'ox',\n}\n\nfunction singularizeSegment(segment: string): string {\n  const lower = segment.toLowerCase()\n  const irregular = IRREGULAR_PLURALS[lower]\n  if (irregular) return irregular\n  if (lower.endsWith('ies') && lower.length > 3) return lower.slice(0, -3) + 'y'\n  if (lower.endsWith('ses') && lower.length > 3) return lower.slice(0, -2)\n  if (\n    (lower.endsWith('xes') ||\n      lower.endsWith('zes') ||\n      lower.endsWith('ches') ||\n      lower.endsWith('shes')) &&\n    lower.length > 3\n  ) {\n    return lower.slice(0, -2)\n  }\n  if (lower.endsWith('s') && !lower.endsWith('ss') && lower.length > 1) return lower.slice(0, -1)\n  return lower\n}\n\nfunction singularizeResourceSegment(segment: string): string {\n  return segment\n    .split('-')\n    .map((part) => singularizeSegment(part))\n    .join('-')\n}\n\nexport function deriveResourceFromCommandId(commandId: string | undefined | null): string | null {\n  if (!commandId || typeof commandId !== 'string') return null\n  const parts = commandId.split('.')\n  if (parts.length < 2) return null\n  const modulePart = parts[0]\n  const entityPart = singularizeResourceSegment(parts[1])\n  if (!modulePart || !entityPart) return null\n  return `${modulePart}.${entityPart}`\n}\n\nexport function expandResourceAliases(resource: string, aliases?: string[]): string[] {\n  const set = new Set<string>()\n  const inputs = [resource, ...(aliases ?? [])]\n  for (const candidate of inputs) {\n    const canonical = canonicalizeResourceTag(candidate)\n    if (canonical) set.add(canonical)\n  }\n  if (!set.size) return []\n  return Array.from(set)\n}\n\nexport async function invalidateCrudCache(\n  container: AwilixContainer,\n  resource: string,\n  identifiers: CrudCacheIdentifiers,\n  fallbackTenant: string | null,\n  reason: string,\n  aliases?: string[]\n): Promise<void> {\n  if (!isCrudCacheEnabled()) return\n  const cache = resolveCrudCache(container)\n  if (!cache || typeof cache.deleteByTags !== 'function') return\n  const resources = expandResourceAliases(resource, aliases)\n  const tenantId = identifiers.tenantId ?? fallbackTenant ?? null\n  const recordId = normalizeIdentifierValue(identifiers.id)\n  const tags = new Set<string>()\n  for (const key of resources) {\n    if (recordId) {\n      tags.add(buildRecordTag(key, tenantId, recordId))\n    }\n    // Always flush the tenant-level (org:null) collection tag alongside the\n    // write's own org. Tenant-scoped entities (orgField: null \u2014 e.g. auth roles)\n    // cache their collections under org:null, but the command bus resolves a\n    // write's organizationId from the actor's auth context, so the org-specific\n    // tag alone never matches those entries and they only expire on TTL (#2919).\n    const organizationIds: Array<string | null> = [null]\n    const recordOrganizationId = identifiers.organizationId ?? null\n    if (recordOrganizationId) organizationIds.push(recordOrganizationId)\n    for (const tag of buildCollectionTags(key, tenantId, organizationIds)) {\n      tags.add(tag)\n    }\n  }\n  if (!tags.size) return\n  const tagList = Array.from(tags)\n  debugCrudCache('invalidate', {\n    resource,\n    aliases: resources,\n    reason,\n    tenantId: tenantId ?? 'null',\n    tags: tagList,\n    action: 'clearing',\n  })\n  const deleted = await runWithCacheTenant(tenantId, () => cache.deleteByTags(tagList))\n  debugCrudCache('invalidate', {\n    resource,\n    reason,\n    tenantId: tenantId ?? 'null',\n    tags: tagList,\n    action: 'cleared',\n    deleted,\n  })\n}\n"],
+  "mappings": "AACA,SAAS,0BAA8C;AACvD,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAQvE,IAAI,uBAAuC;AACpC,SAAS,qBAA8B;AAC5C,MAAI,yBAAyB,KAAM,QAAO;AAC1C,yBAAuB,kBAAkB,QAAQ,IAAI,yBAAyB,EAAE,MAAM;AACtF,SAAO;AACT;AAEA,IAAI,qBAAqC;AAClC,SAAS,0BAAmC;AACjD,MAAI,uBAAuB,KAAM,QAAO;AACxC,uBAAqB,kBAAkB,QAAQ,IAAI,0BAA0B,EAAE,MAAM;AACrF,SAAO;AACT;AAEO,SAAS,eAAe,OAAe,SAAkC;AAC9E,MAAI,CAAC,wBAAwB,EAAG;AAChC,MAAI;AACF,WAAO,MAAM,OAAO,OAAO;AAAA,EAC7B,QAAQ;AAAA,EAAC;AACX;AAEO,SAAS,iBAAiB,WAAkD;AACjF,MAAI;AACF,UAAM,QAAS,UAAU,QAAQ,OAAO;AACxC,QAAI,SAAS,OAAO,MAAM,QAAQ,cAAc,OAAO,MAAM,QAAQ,YAAY;AAC/E,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEO,SAAS,oBAAoB,OAA0C;AAC5E,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,GAAI,QAAO;AAClE,SAAO,MAAM,SAAS,EAAE,KAAK,EAAE,QAAQ,oBAAoB,GAAG;AAChE;AAEO,SAAS,wBAAwB,OAAiD;AACvF,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,UAAU,OAAO,KAAK,EAAE,KAAK;AACnC,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,iBAAiB,QACpB,QAAQ,OAAO,GAAG,EAClB,QAAQ,WAAW,GAAG,EACtB,QAAQ,UAAU,GAAG,EACrB,QAAQ,MAAM,GAAG,EACjB,QAAQ,OAAO,GAAG;AACrB,QAAM,kBAAkB,eAAe,QAAQ,sBAAsB,OAAO;AAC5E,QAAM,YAAY,gBAAgB,QAAQ,WAAW,GAAG,EAAE,QAAQ,kBAAkB,EAAE;AACtF,QAAM,UAAU,UAAU,YAAY;AACtC,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEO,SAAS,eAAe,UAAkB,UAAyB,UAA0B;AAClG,SAAO;AAAA,IACL;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B;AAAA,IACA,oBAAoB,QAAQ;AAAA,EAC9B,EAAE,KAAK,GAAG;AACZ;AAEO,SAAS,oBACd,UACA,UACA,iBACU;AACV,QAAM,qBAAqB,oBAAoB,QAAQ;AACvD,QAAM,mBAAmB,oBAAoB,QAAQ;AACrD,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,CAAC,gBAAgB,QAAQ;AAC3B,SAAK,IAAI,CAAC,QAAQ,oBAAoB,UAAU,kBAAkB,OAAO,QAAQ,YAAY,EAAE,KAAK,GAAG,CAAC;AACxG,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AACA,aAAW,SAAS,iBAAiB;AACnC,SAAK,IAAI,CAAC,QAAQ,oBAAoB,UAAU,kBAAkB,OAAO,oBAAoB,KAAK,GAAG,YAAY,EAAE,KAAK,GAAG,CAAC;AAAA,EAC9H;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,yBAAyB,OAA+B;AACtE,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAI,SAAS,OAAQ,MAA2B,OAAO,aAAa;AAClE,aAAO,yBAA0B,MAA2B,EAAE;AAAA,IAChE;AAAA,EACF;AACA,SAAO,OAAO,KAAK;AACrB;AAEO,SAAS,uBAAuB,QAAuC;AAC5E,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,yBAAyB,KAAK;AACjD,QAAI,WAAY,QAAO;AAAA,EACzB;AACA,SAAO;AACT;AAEA,MAAM,oBAA4C;AAAA,EAChD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AAAA,EACP,OAAO;AAAA,EACP,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AACR;AAEA,SAAS,mBAAmB,SAAyB;AACnD,QAAM,QAAQ,QAAQ,YAAY;AAClC,QAAM,YAAY,kBAAkB,KAAK;AACzC,MAAI,UAAW,QAAO;AACtB,MAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,MAAM,GAAG,EAAE,IAAI;AAC3E,MAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,MAAM,GAAG,EAAE;AACvE,OACG,MAAM,SAAS,KAAK,KACnB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,MAAM,KACrB,MAAM,SAAS,MAAM,MACvB,MAAM,SAAS,GACf;AACA,WAAO,MAAM,MAAM,GAAG,EAAE;AAAA,EAC1B;AACA,MAAI,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,MAAM,GAAG,EAAE;AAC9F,SAAO;AACT;AAEA,SAAS,2BAA2B,SAAyB;AAC3D,SAAO,QACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC,EACtC,KAAK,GAAG;AACb;AAEO,SAAS,4BAA4B,WAAqD;AAC/F,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,QAAQ,UAAU,MAAM,GAAG;AACjC,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,QAAM,aAAa,MAAM,CAAC;AAC1B,QAAM,aAAa,2BAA2B,MAAM,CAAC,CAAC;AACtD,MAAI,CAAC,cAAc,CAAC,WAAY,QAAO;AACvC,SAAO,GAAG,UAAU,IAAI,UAAU;AACpC;AAEO,SAAS,sBAAsB,UAAkB,SAA8B;AACpF,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,SAAS,CAAC,UAAU,GAAI,WAAW,CAAC,CAAE;AAC5C,aAAW,aAAa,QAAQ;AAC9B,UAAM,YAAY,wBAAwB,SAAS;AACnD,QAAI,UAAW,KAAI,IAAI,SAAS;AAAA,EAClC;AACA,MAAI,CAAC,IAAI,KAAM,QAAO,CAAC;AACvB,SAAO,MAAM,KAAK,GAAG;AACvB;AAEA,eAAsB,oBACpB,WACA,UACA,aACA,gBACA,QACA,SACe;AACf,MAAI,CAAC,mBAAmB,EAAG;AAC3B,QAAM,QAAQ,iBAAiB,SAAS;AACxC,MAAI,CAAC,SAAS,OAAO,MAAM,iBAAiB,WAAY;AACxD,QAAM,YAAY,sBAAsB,UAAU,OAAO;AACzD,QAAM,WAAW,YAAY,YAAY,kBAAkB;AAC3D,QAAM,WAAW,yBAAyB,YAAY,EAAE;AACxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,OAAO,WAAW;AAC3B,QAAI,UAAU;AACZ,WAAK,IAAI,eAAe,KAAK,UAAU,QAAQ,CAAC;AAAA,IAClD;AAMA,UAAM,kBAAwC,CAAC,IAAI;AACnD,UAAM,uBAAuB,YAAY,kBAAkB;AAC3D,QAAI,qBAAsB,iBAAgB,KAAK,oBAAoB;AACnE,eAAW,OAAO,oBAAoB,KAAK,UAAU,eAAe,GAAG;AACrE,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF;AACA,MAAI,CAAC,KAAK,KAAM;AAChB,QAAM,UAAU,MAAM,KAAK,IAAI;AAC/B,iBAAe,cAAc;AAAA,IAC3B;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,UAAU,MAAM,mBAAmB,UAAU,MAAM,MAAM,aAAa,OAAO,CAAC;AACpF,iBAAe,cAAc;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/lib/crud/errors.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/errors.ts"],
-  "sourcesContent": ["// Use Symbol.for so the marker survives module duplication across bundle boundaries\n// (same behaviour as globalThis-based registries used for DI registrars)\nconst CRUD_HTTP_ERROR_MARKER = Symbol.for('@open-mercato/CrudHttpError')\n\nexport class CrudHttpError extends Error {\n  readonly [CRUD_HTTP_ERROR_MARKER] = true\n  status: number\n  body: Record<string, any>\n\n  constructor(\n    status: number,\n    body?: Record<string, any> | string,\n    options?: { cause?: unknown },\n  ) {\n    const normalizedBody = typeof body === 'string' ? { error: body } : body ?? {}\n    super(typeof body === 'string' ? body : normalizedBody.error ?? 'Request failed', options)\n    this.status = status\n    this.body = normalizedBody\n  }\n}\n\n/**\n * Type-safe check for CrudHttpError that works across module/bundle boundaries.\n * Prefer this over `instanceof CrudHttpError` whenever the error may originate\n * from a different module bundle (e.g. enterprise packages, dynamic imports).\n */\nexport function isCrudHttpError(err: unknown): err is CrudHttpError {\n  return !!err && typeof err === 'object' && (err as Record<symbol, unknown>)[CRUD_HTTP_ERROR_MARKER] === true\n}\n\nexport function badRequest(message: string): CrudHttpError {\n  return new CrudHttpError(400, { error: message })\n}\n\nexport function forbidden(message = 'Forbidden'): CrudHttpError {\n  return new CrudHttpError(403, { error: message })\n}\n\nexport function notFound(message = 'Not found'): CrudHttpError {\n  return new CrudHttpError(404, { error: message })\n}\n\nexport function conflict(message: string): CrudHttpError {\n  return new CrudHttpError(409, { error: message })\n}\n\nconst POSTGRES_UNIQUE_VIOLATION = '23505'\n\n/**\n * Detects a Postgres unique-constraint violation (SQLSTATE 23505) on a thrown\n * error, looking through MikroORM's driver-error wrapping. Use this to map a DB\n * uniqueness race (e.g. a soft-deleted row the in-app check missed, or a\n * timestamp-precision mismatch) onto a clean 409 instead of a generic 500.\n */\nexport function isUniqueViolation(err: unknown, constraintName?: string): boolean {\n  if (!err || typeof err !== 'object') return false\n  const candidates: unknown[] = [err, (err as { cause?: unknown }).cause, (err as { previous?: unknown }).previous]\n  for (const candidate of candidates) {\n    if (!candidate || typeof candidate !== 'object') continue\n    const record = candidate as Record<string, unknown>\n    if (record.code === POSTGRES_UNIQUE_VIOLATION) {\n      if (!constraintName) return true\n      const constraint = typeof record.constraint === 'string' ? record.constraint : ''\n      const detail = typeof record.detail === 'string' ? record.detail : ''\n      const message = typeof record.message === 'string' ? record.message : ''\n      return constraint === constraintName || detail.includes(constraintName) || message.includes(constraintName)\n    }\n  }\n  return false\n}\n\nexport function assertFound<T>(value: T | null | undefined, message: string): T {\n  if (!value) throw notFound(message)\n  return value\n}\n"],
-  "mappings": "AAAA;AAEA,MAAM,yBAAyB,uBAAO,IAAI,6BAA6B;AAEhE,MAAM,uBAAsB,YACvB,6BADuB,IAAM;AAAA,EAKvC,YACE,QACA,MACA,SACA;AACA,UAAM,iBAAiB,OAAO,SAAS,WAAW,EAAE,OAAO,KAAK,IAAI,QAAQ,CAAC;AAC7E,UAAM,OAAO,SAAS,WAAW,OAAO,eAAe,SAAS,kBAAkB,OAAO;AAV3F,SAAU,MAA0B;AAWlC,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,gBAAgB,KAAoC;AAClE,SAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,YAAa,IAAgC,sBAAsB,MAAM;AAC1G;AAEO,SAAS,WAAW,SAAgC;AACzD,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEO,SAAS,UAAU,UAAU,aAA4B;AAC9D,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEO,SAAS,SAAS,UAAU,aAA4B;AAC7D,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEO,SAAS,SAAS,SAAgC;AACvD,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEA,MAAM,4BAA4B;AAQ3B,SAAS,kBAAkB,KAAc,gBAAkC;AAChF,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,aAAwB,CAAC,KAAM,IAA4B,OAAQ,IAA+B,QAAQ;AAChH,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,aAAa,OAAO,cAAc,SAAU;AACjD,UAAM,SAAS;AACf,QAAI,OAAO,SAAS,2BAA2B;AAC7C,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,aAAa,OAAO,OAAO,eAAe,WAAW,OAAO,aAAa;AAC/E,YAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,YAAM,UAAU,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACtE,aAAO,eAAe,kBAAkB,OAAO,SAAS,cAAc,KAAK,QAAQ,SAAS,cAAc;AAAA,IAC5G;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,YAAe,OAA6B,SAAoB;AAC9E,MAAI,CAAC,MAAO,OAAM,SAAS,OAAO;AAClC,SAAO;AACT;",
+  "sourcesContent": ["// Use Symbol.for so the marker survives module duplication across bundle boundaries\n// (same behaviour as globalThis-based registries used for DI registrars)\nconst CRUD_HTTP_ERROR_MARKER = Symbol.for('@open-mercato/CrudHttpError')\n\nexport class CrudHttpError extends Error {\n  readonly [CRUD_HTTP_ERROR_MARKER] = true\n  status: number\n  body: Record<string, any>\n\n  constructor(\n    status: number,\n    body?: Record<string, any> | string,\n    options?: { cause?: unknown },\n  ) {\n    const normalizedBody = typeof body === 'string' ? { error: body } : body ?? {}\n    super(typeof body === 'string' ? body : normalizedBody.error ?? 'Request failed', options)\n    this.status = status\n    this.body = normalizedBody\n  }\n}\n\n/**\n * Type-safe check for CrudHttpError that works across module/bundle boundaries.\n * Prefer this over `instanceof CrudHttpError` whenever the error may originate\n * from a different module bundle (e.g. enterprise packages, dynamic imports).\n */\nexport function isCrudHttpError(err: unknown): err is CrudHttpError {\n  return !!err && typeof err === 'object' && (err as Record<symbol, unknown>)[CRUD_HTTP_ERROR_MARKER] === true\n}\n\nexport function badRequest(message: string): CrudHttpError {\n  return new CrudHttpError(400, { error: message })\n}\n\nexport function forbidden(message = 'Forbidden'): CrudHttpError {\n  return new CrudHttpError(403, { error: message })\n}\n\n/**\n * Builds the standardized 404 (`{ error: message }`) \u2014 use it instead of hand-rolling\n * `new CrudHttpError(404, { error: message })`. Reach for this in guard statements, where\n * the lookup spans several lines or the condition is compound\n * (`if (!entity || entity.tenantId !== auth.tenantId) throw notFound(msg)`); TypeScript\n * still narrows the value after the throw. For a plain inline lookup, `assertFound` is terser.\n *\n * Pass an already-translated message; this helper never derives one, so 404 copy\n * stays routed through i18n.\n */\nexport function notFound(message = 'Not found'): CrudHttpError {\n  return new CrudHttpError(404, { error: message })\n}\n\nexport function conflict(message: string): CrudHttpError {\n  return new CrudHttpError(409, { error: message })\n}\n\nconst POSTGRES_UNIQUE_VIOLATION = '23505'\n\n/**\n * Detects a Postgres unique-constraint violation (SQLSTATE 23505) on a thrown\n * error, looking through MikroORM's driver-error wrapping. Use this to map a DB\n * uniqueness race (e.g. a soft-deleted row the in-app check missed, or a\n * timestamp-precision mismatch) onto a clean 409 instead of a generic 500.\n */\nexport function isUniqueViolation(err: unknown, constraintName?: string): boolean {\n  if (!err || typeof err !== 'object') return false\n  const candidates: unknown[] = [err, (err as { cause?: unknown }).cause, (err as { previous?: unknown }).previous]\n  for (const candidate of candidates) {\n    if (!candidate || typeof candidate !== 'object') continue\n    const record = candidate as Record<string, unknown>\n    if (record.code === POSTGRES_UNIQUE_VIOLATION) {\n      if (!constraintName) return true\n      const constraint = typeof record.constraint === 'string' ? record.constraint : ''\n      const detail = typeof record.detail === 'string' ? record.detail : ''\n      const message = typeof record.message === 'string' ? record.message : ''\n      return constraint === constraintName || detail.includes(constraintName) || message.includes(constraintName)\n    }\n  }\n  return false\n}\n\n/**\n * The canonical \"entity must exist\" guard for API routes and commands: throws the\n * standardized 404 when the lookup came back empty, and returns the value narrowed\n * to `T` so callers drop the `| null` without a cast.\n *\n *   const deal = assertFound(await em.findOne(Deal, { id }), translate('customers.errors.deal_not_found', 'Deal not found'))\n *\n * Use this instead of hand-rolling `if (!entity) throw new CrudHttpError(404, ...)`.\n * `message` is required and passed through verbatim, so it must already be translated.\n *\n * Treats every falsy value as missing, so it suits entity/object lookups \u2014 do not use\n * it to guard numbers or strings, where `0` and `''` are legitimate results.\n */\nexport function assertFound<T>(value: T | null | undefined, message: string): T {\n  if (!value) throw notFound(message)\n  return value\n}\n"],
+  "mappings": "AAAA;AAEA,MAAM,yBAAyB,uBAAO,IAAI,6BAA6B;AAEhE,MAAM,uBAAsB,YACvB,6BADuB,IAAM;AAAA,EAKvC,YACE,QACA,MACA,SACA;AACA,UAAM,iBAAiB,OAAO,SAAS,WAAW,EAAE,OAAO,KAAK,IAAI,QAAQ,CAAC;AAC7E,UAAM,OAAO,SAAS,WAAW,OAAO,eAAe,SAAS,kBAAkB,OAAO;AAV3F,SAAU,MAA0B;AAWlC,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,gBAAgB,KAAoC;AAClE,SAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,YAAa,IAAgC,sBAAsB,MAAM;AAC1G;AAEO,SAAS,WAAW,SAAgC;AACzD,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEO,SAAS,UAAU,UAAU,aAA4B;AAC9D,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAYO,SAAS,SAAS,UAAU,aAA4B;AAC7D,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEO,SAAS,SAAS,SAAgC;AACvD,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAEA,MAAM,4BAA4B;AAQ3B,SAAS,kBAAkB,KAAc,gBAAkC;AAChF,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,aAAwB,CAAC,KAAM,IAA4B,OAAQ,IAA+B,QAAQ;AAChH,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,aAAa,OAAO,cAAc,SAAU;AACjD,UAAM,SAAS;AACf,QAAI,OAAO,SAAS,2BAA2B;AAC7C,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,aAAa,OAAO,OAAO,eAAe,WAAW,OAAO,aAAa;AAC/E,YAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AACnE,YAAM,UAAU,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACtE,aAAO,eAAe,kBAAkB,OAAO,SAAS,cAAc,KAAK,QAAQ,SAAS,cAAc;AAAA,IAC5G;AAAA,EACF;AACA,SAAO;AACT;AAeO,SAAS,YAAe,OAA6B,SAAoB;AAC9E,MAAI,CAAC,MAAO,OAAM,SAAS,OAAO;AAClC,SAAO;AACT;",
   "names": []
 }

package/dist/lib/crud/factory.js

@@ -45,7 +45,7 @@ import { createProfiler, shouldEnableProfiler } from "@open-mercato/shared/lib/p
 import { getTranslationOverlayPlugin } from "@open-mercato/shared/lib/localization/overlay-plugin";
 import { applyResponseEnrichers, applyResponseEnricherToRecord, resolveListCacheEnricherPlan } from "./enricher-runner.js";
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from "./interceptor-runner.js";
-import { mergeIdFilter, parseIdsParam } from "./ids.js";
+import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from "./ids.js";
 import { mergeAdvancedFilters } from "./advanced-filter-integration.js";
 import { parseExtensionHeaders } from "../umes/extension-headers.js";
 import { createGenericOptimisticLockReader } from "./optimistic-lock.js";
@@ -264,6 +264,8 @@ function json(data, init) {
     headers: { "content-type": "application/json", ...init?.headers || {} }
   });
 }
+const SELECTED_ORG_COOKIE = "om_selected_org";
+const CLEAR_SELECTED_ORG_COOKIE = `${SELECTED_ORG_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax`;
 function attachOperationHeader(res, logEntry) {
   if (!res || !(res instanceof Response)) return res;
   if (!logEntry || typeof logEntry !== "object") return res;
@@ -892,6 +894,26 @@ function makeCrudRoute(opts) {
     }
     return { container, auth: scopedAuth, organizationScope: scope, selectedOrganizationId, organizationIds, request };
   }
+  function rejectInvalidOrgSelection(ctx, action) {
+    if (!ormCfg.orgField) return null;
+    if (!ctx.organizationScope?.selectionRejected) return null;
+    logForbidden({
+      resourceKind,
+      action,
+      reason: "organization_selection_invalid",
+      userId: ctx.auth?.sub ?? null,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationIds: ctx.organizationIds
+    });
+    const headers = action === "list" ? { "set-cookie": CLEAR_SELECTED_ORG_COOKIE } : {};
+    return json(
+      {
+        error: "Your selected organization is no longer available. Please re-select an organization and try again.",
+        code: "organization_selection_invalid"
+      },
+      { status: 422, headers }
+    );
+  }
   async function GET(request) {
     const profiler = createCrudProfiler(resourceKind, "list");
     const requestMeta = { method: request.method };
@@ -919,6 +941,11 @@ function makeCrudRoute(opts) {
         finishProfile({ reason: "unauthorized" });
         return json({ error: "Unauthorized" }, { status: 401 });
       }
+      const listSelectionRejected = rejectInvalidOrgSelection(ctx, "list");
+      if (listSelectionRejected) {
+        finishProfile({ reason: "organization_selection_invalid" });
+        return listSelectionRejected;
+      }
       if (!opts.list) {
         finishProfile({ reason: "list_not_configured" });
         return json({ error: "Not implemented" }, { status: 501 });
@@ -948,6 +975,7 @@ function makeCrudRoute(opts) {
         ...interceptorRequest.query ?? {}
       };
       const parsedIds = parseIdsParam(queryParams.ids);
+      const idsParamProvided = isIdsParamProvided(queryParams.ids);
       await opts.hooks?.beforeList?.(validated, ctx);
       profiler.mark("before_list_hook");
       const availableFormats = resolveAvailableExportFormats(opts.list);
@@ -1128,7 +1156,7 @@ function makeCrudRoute(opts) {
         const page = exportRequested ? { page: 1, pageSize: exportPageSize } : { page: requestedPage, pageSize: requestedPageSize };
         const baseFilters = exportFullRequested ? {} : opts.list.buildFilters ? await opts.list.buildFilters(validated, ctx) : {};
         const filters = exportFullRequested ? baseFilters : mergeAdvancedFilters(baseFilters, validated);
-        const mergedFilters = exportFullRequested ? filters : mergeIdFilter(filters, parsedIds);
+        const mergedFilters = exportFullRequested ? filters : mergeIdFilter(filters, parsedIds, { idsParamProvided });
         const withDeleted = parseBooleanToken(queryParams.withDeleted) === true;
         profiler.mark("filters_ready", { withDeleted });
         if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0 && !opts.list?.omitAutomaticTenantOrgScope) {
@@ -1385,7 +1413,7 @@ function makeCrudRoute(opts) {
       }
       const fallbackBaseFilters = exportFullRequested ? {} : opts.list.buildFilters ? await opts.list.buildFilters(validated, ctx) : {};
       const fallbackFilters = exportFullRequested ? fallbackBaseFilters : mergeAdvancedFilters(fallbackBaseFilters, validated);
-      const mergedFallbackFilters = exportFullRequested ? fallbackFilters : mergeIdFilter(fallbackFilters, parsedIds);
+      const mergedFallbackFilters = exportFullRequested ? fallbackFilters : mergeIdFilter(fallbackFilters, parsedIds, { idsParamProvided });
       const ormFilters = translateFiltersForOrm(
         mergedFallbackFilters,
         em,
@@ -1510,6 +1538,8 @@ function makeCrudRoute(opts) {
       if (!opts.create && !useCommand) return json({ error: "Not implemented" }, { status: 501 });
       const ctx = await withCtx(request);
       if (!ctx.auth) return json({ error: "Unauthorized" }, { status: 401 });
+      const createSelectionRejected = rejectInvalidOrgSelection(ctx, "create");
+      if (createSelectionRejected) return createSelectionRejected;
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,
@@ -1753,6 +1783,8 @@ function makeCrudRoute(opts) {
       if (!opts.update && !useCommand) return json({ error: "Not implemented" }, { status: 501 });
       const ctx = await withCtx(request);
       if (!ctx.auth) return json({ error: "Unauthorized" }, { status: 401 });
+      const updateSelectionRejected = rejectInvalidOrgSelection(ctx, "update");
+      if (updateSelectionRejected) return updateSelectionRejected;
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,
@@ -2053,6 +2085,8 @@ function makeCrudRoute(opts) {
     try {
       const ctx = await withCtx(request);
       if (!ctx.auth) return json({ error: "Unauthorized" }, { status: 401 });
+      const deleteSelectionRejected = rejectInvalidOrgSelection(ctx, "delete");
+      if (deleteSelectionRejected) return deleteSelectionRejected;
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,