@open-mercato/shared 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6814.1.0627c7e9f1

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 253 entry points
+[build:shared] found 254 entry points
 [build:shared] built successfully

package/dist/lib/di/container.js

@@ -12,6 +12,8 @@ import { createLogger } from "../logger/index.js";
 const logger = createLogger("shared").child({ component: "di" });
 const GLOBAL_KEY = "__openMercatoDiRegistrars__";
 const APP_DI_REGISTRAR_KEY = "__openMercatoAppDiRegistrar__";
+const APP_DI_LOAD_WARNING_KEY = "__openMercatoAppDiLoadWarningEmitted__";
+const APP_DI_REGISTER_WARNING_KEY = "__openMercatoAppDiRegisterWarningEmitted__";
 const BOOTSTRAP_CACHE_KEY = "__openMercatoBootstrapCache__";
 const ENCRYPTION_ENABLED_KEY = "__openMercatoEncryptionEnabledCache__";
 const BOOTSTRAP_CACHE_KEYS = [
@@ -96,6 +98,21 @@ function registerAppDiRegistrar(registrar) {
 function resetBootstrapCache() {
   globalThis[BOOTSTRAP_CACHE_KEY] = null;
   globalThis[ENCRYPTION_ENABLED_KEY] = void 0;
+  globalThis[APP_DI_LOAD_WARNING_KEY] = void 0;
+  globalThis[APP_DI_REGISTER_WARNING_KEY] = void 0;
+}
+function isAppDiModuleNotFound(error) {
+  if (!error || typeof error !== "object") return false;
+  const { code, message } = error;
+  const text = typeof message === "string" ? message : "";
+  const moduleNotFound = code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND" || text.startsWith("Cannot find module") || text.startsWith("Cannot find package");
+  return moduleNotFound && /(?:module|package) ['"]@\/di['"]/.test(text);
+}
+function warnAppDiFailureOnce(key, message, error) {
+  const globalScope = globalThis;
+  if (globalScope[key] === true) return;
+  globalScope[key] = true;
+  logger.warn(message, { err: error });
 }
 function isAwilixResolver(value) {
   return Boolean(value && typeof value === "object" && typeof value.resolve === "function");
@@ -192,11 +209,24 @@ async function createRequestContainer() {
         try {
           const maybe = appDi.register(container);
           if (maybe && typeof maybe.then === "function") await maybe;
-        } catch (error) {
-          logger.error("App-level DI registrar failed", { err: error });
+        } catch (err) {
+          warnAppDiFailureOnce(
+            APP_DI_REGISTER_WARNING_KEY,
+            "App-level DI override (src/di.ts register()) threw; its registrations are skipped",
+            err
+          );
         }
       }
-    } catch {
+    } catch (err) {
+      if (isAppDiModuleNotFound(err)) {
+        logger.debug("App-level DI override module (@/di) not resolvable; skipping", { err });
+      } else {
+        warnAppDiFailureOnce(
+          APP_DI_LOAD_WARNING_KEY,
+          "App-level DI override module (@/di) failed to load; its registrations are skipped",
+          err
+        );
+      }
     }
   }
   applyDiOverridesToContainer({

package/dist/lib/di/container.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/di/container.ts"],
-  "sourcesContent": ["import { asFunction, createContainer, asValue, AwilixContainer, InjectionMode, type Resolver } from 'awilix'\nimport { RequestContext } from '@mikro-orm/core'\nimport { getOrm } from '@open-mercato/shared/lib/db/mikro'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'\nimport { DefaultDataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { commandRegistry, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overrides'\nimport { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'di' })\n\ntype DynamicCradle = Record<string, any>\n\nexport type AppContainer = AwilixContainer<DynamicCradle>\nexport type DiRegistrar = (container: AppContainer) => void\nexport type AppDiRegistrar = (container: AppContainer) => void | Promise<void>\n\n// Registration pattern for publishable packages\n// Use globalThis to survive tsx/esbuild module duplication issue where the same\n// file can be loaded as multiple module instances when mixing dynamic and static imports\nconst GLOBAL_KEY = '__openMercatoDiRegistrars__'\nconst APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'\n// Phase 5 \u2014 process-scoped bootstrap cache. The cache/event-bus/encryption\n// services bootstrap() creates are inherently process-scoped (they hold\n// state across requests). Caching them on globalThis after the first\n// successful bootstrap call lets every subsequent request skip the\n// `await bootstrap(container)` body and just re-register the cached\n// instances. Same globalThis pattern as registerDiRegistrars so HMR\n// keeps working.\nconst BOOTSTRAP_CACHE_KEY = '__openMercatoBootstrapCache__'\nconst ENCRYPTION_ENABLED_KEY = '__openMercatoEncryptionEnabledCache__'\n\nconst BOOTSTRAP_CACHE_KEYS = [\n  'cache',\n  'eventBus',\n  'kmsService',\n  'tenantEncryptionService',\n  'rateLimiterService',\n  'searchModuleConfigs',\n  'searchIndexer',\n] as const\n\ntype BootstrapCacheEntry = Partial<Record<(typeof BOOTSTRAP_CACHE_KEYS)[number], unknown>>\n\n// Phase 5 is opt-in. Some bootstrap services close over per-request state\n// (e.g. tenantEncryptionService captures the first request's `em.fork`, the\n// event-bus's resolver closes over the first container) so naively replaying\n// them on later requests yields stale references \u2014 observed as a 500 from\n// CRUD list endpoints in `next start`. Default OFF preserves develop's\n// per-request bootstrap. Set `OM_BOOTSTRAP_CACHE=1` to opt in once each\n// cached service is verified safe for cross-request reuse.\nfunction isBootstrapCacheEnabled(): boolean {\n  const raw = process.env.OM_BOOTSTRAP_CACHE\n  if (raw === undefined) return false\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return false\n  if (normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no') return false\n  return true\n}\n\nfunction getBootstrapCache(): BootstrapCacheEntry | null {\n  if (!isBootstrapCacheEnabled()) return null\n  const existing = (globalThis as any)[BOOTSTRAP_CACHE_KEY]\n  return existing && typeof existing === 'object' ? (existing as BootstrapCacheEntry) : null\n}\n\nfunction setBootstrapCache(entry: BootstrapCacheEntry): void {\n  if (!isBootstrapCacheEnabled()) return\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = entry\n}\n\nfunction harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry {\n  const entry: BootstrapCacheEntry = {}\n  for (const key of BOOTSTRAP_CACHE_KEYS) {\n    try {\n      const value: unknown = container.resolve(key as never)\n      if (value !== undefined && value !== null) entry[key] = value\n    } catch {\n      // not registered \u2014 skip\n    }\n  }\n  return entry\n}\n\ntype EncryptionEnabledProbe = { isEnabled?: () => boolean } | null | undefined\n\nfunction getCachedEncryptionEnabled(service: EncryptionEnabledProbe): boolean | null {\n  if (!service || typeof service.isEnabled !== 'function') return false\n  const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]\n  if (typeof cached === 'boolean') return cached\n  try {\n    const result = !!service.isEnabled()\n    ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result\n    return result\n  } catch {\n    return null\n  }\n}\n\nfunction getGlobalRegistrars(): DiRegistrar[] | null {\n  return (globalThis as any)[GLOBAL_KEY] ?? null\n}\n\nfunction setGlobalRegistrars(registrars: DiRegistrar[]): void {\n  (globalThis as any)[GLOBAL_KEY] = registrars\n}\n\nexport function registerDiRegistrars(registrars: DiRegistrar[]) {\n  const existing = getGlobalRegistrars()\n  if (existing !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('DI registrars re-registered (this may occur during HMR)')\n  }\n  setGlobalRegistrars(registrars)\n  // Force re-bootstrap on HMR \u2014 module subscribers may have changed.\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n}\n\nexport function getDiRegistrars(): DiRegistrar[] {\n  const registrars = getGlobalRegistrars()\n  if (!registrars) {\n    throw new Error('[Bootstrap] DI registrars not registered. Call registerDiRegistrars() at bootstrap.')\n  }\n  return registrars\n}\n\nfunction getAppDiRegistrar(): AppDiRegistrar | null {\n  const registrar = (globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY]\n  return typeof registrar === 'function' ? registrar as AppDiRegistrar : null\n}\n\nexport function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar\n}\n\n/** Test-only helper to drop the process-scoped bootstrap cache. */\nexport function resetBootstrapCache(): void {\n  (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n}\n\nfunction isAwilixResolver(value: unknown): value is Resolver<unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as { resolve?: unknown }).resolve === 'function')\n}\n\nfunction toAwilixRegistrations(registrations: Record<string, unknown>): Record<string, Resolver<any>> {\n  return Object.fromEntries(\n    Object.entries(registrations).map(([key, value]) => [\n      key,\n      isAwilixResolver(value) ? value : asValue(value),\n    ]),\n  )\n}\n\nexport async function createRequestContainer(): Promise<AppContainer> {\n  const diRegistrars = getDiRegistrars()\n  const orm = await getOrm()\n  // Use a fresh event manager so request-level subscribers (e.g., encryption) don't pile up globally\n  const baseEm = (RequestContext.getEntityManager() as any) ?? orm.em\n  const em = baseEm.fork({ clear: true, freshEventManager: true, useContext: true }) as unknown as EntityManager\n  const container = createContainer<DynamicCradle>({ injectionMode: InjectionMode.CLASSIC })\n  // Core registrations\n  container.register({\n    em: asValue(em),\n    queryEngine: asValue(new BasicQueryEngine(em, undefined, () => {\n      try { return container.resolve('tenantEncryptionService') as any } catch { return null }\n    })),\n    dataEngine: asValue(new DefaultDataEngine(em, container as any)),\n    commandRegistry: asValue(commandRegistry),\n    commandBus: asValue(new CommandBus()),\n    // Default OSS optimistic-lock guard. Reads from the global reader store\n    // (populated by `makeCrudRoute` auto-registration + any module-DI\n    // hand-wired calls to `registerOptimisticLockReaders`). Service is\n    // strictly additive: when `OM_OPTIMISTIC_LOCK=off` (or no header is\n    // sent) it short-circuits at validateMutation. Module-level di.ts\n    // registrations override this default via Awilix replace semantics \u2014\n    // see the enterprise `record_locks` module for the canonical override.\n    // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md\n    crudMutationGuardService: asFunction((em: EntityManager) =>\n      createOptimisticLockGuardService({\n        getEm: () => em,\n        readers: getAllOptimisticLockReaders(),\n      }),\n    ).scoped(),\n    // Default OSS command-level optimistic-lock guard, awaited by\n    // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.\n    // Header/explicit-token compare only (no `resolveExpected`), so it is\n    // behaviourally identical to calling `enforceCommandOptimisticLock`\n    // directly. The enterprise `record_locks` module overrides this DI key\n    // with a lock-backed `resolveExpected` via Awilix replace semantics.\n    // Spec: .ai/specs/enterprise/2026-06-09-record-locks-unified-coverage.md (Phase 0)\n    commandOptimisticLockGuardService: asFunction(() =>\n      createCommandOptimisticLockGuardService(),\n    ).scoped(),\n  })\n  // Allow modules to override/extend. Fail-open by design (one broken module's\n  // di.ts must not take down every request container), but never silently: the\n  // module's services would otherwise vanish with no trace until an unrelated\n  // Awilix resolution error surfaces much later.\n  for (const [registrarIndex, reg] of diRegistrars.entries()) {\n    try { reg?.(container) } catch (error) {\n      logger.error('Module DI registrar failed', { registrarIndex, err: error })\n    }\n  }\n  // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)\n  // Phase 5 \u2014 process-scoped once-guard. The first request runs the full\n  // bootstrap() body; later requests re-register the cached services\n  // directly on this request's container without re-importing or\n  // re-initializing anything. HMR clears the cache (see\n  // registerDiRegistrars). Skippable if a caller already wired eventBus.\n  const alreadyBootstrappedOnThisContainer = !!container.registrations?.eventBus\n  if (!alreadyBootstrappedOnThisContainer) {\n    const cached = getBootstrapCache()\n    if (cached) {\n      const replay: Record<string, any> = {}\n      for (const [key, value] of Object.entries(cached)) {\n        if (value !== undefined && value !== null) replay[key] = asValue(value)\n      }\n      if (Object.keys(replay).length > 0) container.register(replay)\n    } else {\n      try {\n        const { bootstrap } = await import('@open-mercato/core/bootstrap') as any\n        if (bootstrap && typeof bootstrap === 'function') {\n          await bootstrap(container)\n          setBootstrapCache(harvestBootstrapCache(container))\n        }\n      } catch { /* optional */ }\n    }\n  }\n  // App-level DI override. Scaffolded apps register this callback explicitly\n  // from their own bootstrap module so app aliases resolve in app context.\n  const appDiRegistrar = getAppDiRegistrar()\n  if (appDiRegistrar) {\n    try {\n      await appDiRegistrar(container)\n    } catch (error) {\n      logger.error('App-level DI registrar failed', { err: error })\n    }\n  } else {\n    // Backward-compatible fallback for apps that have not adopted explicit wiring.\n    try {\n      // @ts-ignore - @/di only exists in app context, not in packages\n      const appDi = await import('@/di') as any\n      if (appDi?.register) {\n        try {\n          const maybe = appDi.register(container)\n          if (maybe && typeof maybe.then === 'function') await maybe\n        } catch (error) {\n          logger.error('App-level DI registrar failed', { err: error })\n        }\n      }\n    } catch {}\n  }\n  applyDiOverridesToContainer({\n    register: (registrations) => container.register(toAwilixRegistrations(registrations)),\n    unregister: (key) => container.register({ [key]: asValue(undefined) }),\n  })\n  // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM\n  // Phase 5 \u2014 cache `tenantEncryptionService.isEnabled()` for the process\n  // lifetime. The result depends only on config that does not change at\n  // runtime, so reading it once skips a config lookup per request.\n  try {\n    const emForEnc = container.resolve('em') as any\n    const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')\n      ? (container.resolve('tenantEncryptionService') as any)\n      : null\n    if (emForEnc && tenantEncryptionService && getCachedEncryptionEnabled(tenantEncryptionService) === true) {\n      const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')\n      registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)\n    }\n  } catch {\n    // best-effort; do not block container creation\n  }\n  return container\n}\ntry {\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  require('server-only')\n} catch {\n  // allow CLI/generator usage where Next server-only is not present\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,iBAAiB,SAA0B,qBAAoC;AACpG,SAAS,sBAAsB;AAC/B,SAAS,cAAc;AAEvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+CAA+C;AACxD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AAW/D,MAAM,aAAa;AACnB,MAAM,uBAAuB;AAQ7B,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,MAAI,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe,KAAM,QAAO;AACxG,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,QAAM,WAAY,WAAmB,mBAAmB;AACxD,SAAO,YAAY,OAAO,aAAa,WAAY,WAAmC;AACxF;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,MAAI,CAAC,wBAAwB,EAAG;AAC/B,EAAC,WAAmB,mBAAmB,IAAI;AAC9C;AAEA,SAAS,sBAAsB,WAAiD;AAC9E,QAAM,QAA6B,CAAC;AACpC,aAAW,OAAO,sBAAsB;AACtC,QAAI;AACF,YAAM,QAAiB,UAAU,QAAQ,GAAY;AACrD,UAAI,UAAU,UAAa,UAAU,KAAM,OAAM,GAAG,IAAI;AAAA,IAC1D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,2BAA2B,SAAiD;AACnF,MAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,WAAY,QAAO;AAChE,QAAM,SAAU,WAAuC,sBAAsB;AAC7E,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,MAAI;AACF,UAAM,SAAS,CAAC,CAAC,QAAQ,UAAU;AAClC,IAAC,WAAuC,sBAAsB,IAAI;AACnE,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAA4C;AACnD,SAAQ,WAAmB,UAAU,KAAK;AAC5C;AAEA,SAAS,oBAAoB,YAAiC;AAC5D,EAAC,WAAmB,UAAU,IAAI;AACpC;AAEO,SAAS,qBAAqB,YAA2B;AAC9D,QAAM,WAAW,oBAAoB;AACrC,MAAI,aAAa,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC/D,WAAO,MAAM,yDAAyD;AAAA,EACxE;AACA,sBAAoB,UAAU;AAE7B,EAAC,WAAmB,mBAAmB,IAAI;AAC3C,EAAC,WAAmB,sBAAsB,IAAI;AACjD;AAEO,SAAS,kBAAiC;AAC/C,QAAM,aAAa,oBAAoB;AACvC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,oBAA2C;AAClD,QAAM,YAAa,WAAuC,oBAAoB;AAC9E,SAAO,OAAO,cAAc,aAAa,YAA8B;AACzE;AAEO,SAAS,uBAAuB,WAAwC;AAC7E;AAAC,EAAC,WAAuC,oBAAoB,IAAI;AACnE;AAGO,SAAS,sBAA4B;AAC1C,EAAC,WAAmB,mBAAmB,IAAI;AAC1C,EAAC,WAAmB,sBAAsB,IAAI;AACjD;AAEA,SAAS,iBAAiB,OAA4C;AACpE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACrH;AAEA,SAAS,sBAAsB,eAAuE;AACpG,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAClD;AAAA,MACA,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,yBAAgD;AACpE,QAAM,eAAe,gBAAgB;AACrC,QAAM,MAAM,MAAM,OAAO;AAEzB,QAAM,SAAU,eAAe,iBAAiB,KAAa,IAAI;AACjE,QAAM,KAAK,OAAO,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjF,QAAM,YAAY,gBAA+B,EAAE,eAAe,cAAc,QAAQ,CAAC;AAEzF,YAAU,SAAS;AAAA,IACjB,IAAI,QAAQ,EAAE;AAAA,IACd,aAAa,QAAQ,IAAI,iBAAiB,IAAI,QAAW,MAAM;AAC7D,UAAI;AAAE,eAAO,UAAU,QAAQ,yBAAyB;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACzF,CAAC,CAAC;AAAA,IACF,YAAY,QAAQ,IAAI,kBAAkB,IAAI,SAAgB,CAAC;AAAA,IAC/D,iBAAiB,QAAQ,eAAe;AAAA,IACxC,YAAY,QAAQ,IAAI,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASpC,0BAA0B;AAAA,MAAW,CAACA,QACpC,iCAAiC;AAAA,QAC/B,OAAO,MAAMA;AAAA,QACb,SAAS,4BAA4B;AAAA,MACvC,CAAC;AAAA,IACH,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQT,mCAAmC;AAAA,MAAW,MAC5C,wCAAwC;AAAA,IAC1C,EAAE,OAAO;AAAA,EACX,CAAC;AAKD,aAAW,CAAC,gBAAgB,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1D,QAAI;AAAE,YAAM,SAAS;AAAA,IAAE,SAAS,OAAO;AACrC,aAAO,MAAM,8BAA8B,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,IAC3E;AAAA,EACF;AAOA,QAAM,qCAAqC,CAAC,CAAC,UAAU,eAAe;AACtE,MAAI,CAAC,oCAAoC;AACvC,UAAM,SAAS,kBAAkB;AACjC,QAAI,QAAQ;AACV,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM,QAAO,GAAG,IAAI,QAAQ,KAAK;AAAA,MACxE;AACA,UAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,WAAU,SAAS,MAAM;AAAA,IAC/D,OAAO;AACL,UAAI;AACF,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,8BAA8B;AACjE,YAAI,aAAa,OAAO,cAAc,YAAY;AAChD,gBAAM,UAAU,SAAS;AACzB,4BAAkB,sBAAsB,SAAS,CAAC;AAAA,QACpD;AAAA,MACF,QAAQ;AAAA,MAAiB;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,SAAS;AAAA,IAChC,SAAS,OAAO;AACd,aAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC9D;AAAA,EACF,OAAO;AAEL,QAAI;AAEF,YAAM,QAAQ,MAAM,OAAO,MAAM;AACjC,UAAI,OAAO,UAAU;AACnB,YAAI;AACF,gBAAM,QAAQ,MAAM,SAAS,SAAS;AACtC,cAAI,SAAS,OAAO,MAAM,SAAS,WAAY,OAAM;AAAA,QACvD,SAAS,OAAO;AACd,iBAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,QAC9D;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,8BAA4B;AAAA,IAC1B,UAAU,CAAC,kBAAkB,UAAU,SAAS,sBAAsB,aAAa,CAAC;AAAA,IACpF,YAAY,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,GAAG,QAAQ,MAAS,EAAE,CAAC;AAAA,EACvE,CAAC;AAKD,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,IAAI;AACvC,UAAM,0BAA0B,UAAU,gBAAgB,yBAAyB,IAC9E,UAAU,QAAQ,yBAAyB,IAC5C;AACJ,QAAI,YAAY,2BAA2B,2BAA2B,uBAAuB,MAAM,MAAM;AACvG,YAAM,EAAE,mCAAmC,IAAI,MAAM,OAAO,gDAAgD;AAC5G,yCAAmC,UAAU,uBAAuB;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AACA,IAAI;AAEF,UAAQ,aAAa;AACvB,QAAQ;AAER;",
+  "sourcesContent": ["import { asFunction, createContainer, asValue, AwilixContainer, InjectionMode, type Resolver } from 'awilix'\nimport { RequestContext } from '@mikro-orm/core'\nimport { getOrm } from '@open-mercato/shared/lib/db/mikro'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'\nimport { DefaultDataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { commandRegistry, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overrides'\nimport { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'di' })\n\ntype DynamicCradle = Record<string, any>\n\nexport type AppContainer = AwilixContainer<DynamicCradle>\nexport type DiRegistrar = (container: AppContainer) => void\nexport type AppDiRegistrar = (container: AppContainer) => void | Promise<void>\n\n// Registration pattern for publishable packages\n// Use globalThis to survive tsx/esbuild module duplication issue where the same\n// file can be loaded as multiple module instances when mixing dynamic and static imports\nconst GLOBAL_KEY = '__openMercatoDiRegistrars__'\nconst APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'\nconst APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'\nconst APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'\n// Phase 5 \u2014 process-scoped bootstrap cache. The cache/event-bus/encryption\n// services bootstrap() creates are inherently process-scoped (they hold\n// state across requests). Caching them on globalThis after the first\n// successful bootstrap call lets every subsequent request skip the\n// `await bootstrap(container)` body and just re-register the cached\n// instances. Same globalThis pattern as registerDiRegistrars so HMR\n// keeps working.\nconst BOOTSTRAP_CACHE_KEY = '__openMercatoBootstrapCache__'\nconst ENCRYPTION_ENABLED_KEY = '__openMercatoEncryptionEnabledCache__'\n\nconst BOOTSTRAP_CACHE_KEYS = [\n  'cache',\n  'eventBus',\n  'kmsService',\n  'tenantEncryptionService',\n  'rateLimiterService',\n  'searchModuleConfigs',\n  'searchIndexer',\n] as const\n\ntype BootstrapCacheEntry = Partial<Record<(typeof BOOTSTRAP_CACHE_KEYS)[number], unknown>>\n\n// Phase 5 is opt-in. Some bootstrap services close over per-request state\n// (e.g. tenantEncryptionService captures the first request's `em.fork`, the\n// event-bus's resolver closes over the first container) so naively replaying\n// them on later requests yields stale references \u2014 observed as a 500 from\n// CRUD list endpoints in `next start`. Default OFF preserves develop's\n// per-request bootstrap. Set `OM_BOOTSTRAP_CACHE=1` to opt in once each\n// cached service is verified safe for cross-request reuse.\nfunction isBootstrapCacheEnabled(): boolean {\n  const raw = process.env.OM_BOOTSTRAP_CACHE\n  if (raw === undefined) return false\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return false\n  if (normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no') return false\n  return true\n}\n\nfunction getBootstrapCache(): BootstrapCacheEntry | null {\n  if (!isBootstrapCacheEnabled()) return null\n  const existing = (globalThis as any)[BOOTSTRAP_CACHE_KEY]\n  return existing && typeof existing === 'object' ? (existing as BootstrapCacheEntry) : null\n}\n\nfunction setBootstrapCache(entry: BootstrapCacheEntry): void {\n  if (!isBootstrapCacheEnabled()) return\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = entry\n}\n\nfunction harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry {\n  const entry: BootstrapCacheEntry = {}\n  for (const key of BOOTSTRAP_CACHE_KEYS) {\n    try {\n      const value: unknown = container.resolve(key as never)\n      if (value !== undefined && value !== null) entry[key] = value\n    } catch {\n      // not registered \u2014 skip\n    }\n  }\n  return entry\n}\n\ntype EncryptionEnabledProbe = { isEnabled?: () => boolean } | null | undefined\n\nfunction getCachedEncryptionEnabled(service: EncryptionEnabledProbe): boolean | null {\n  if (!service || typeof service.isEnabled !== 'function') return false\n  const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]\n  if (typeof cached === 'boolean') return cached\n  try {\n    const result = !!service.isEnabled()\n    ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result\n    return result\n  } catch {\n    return null\n  }\n}\n\nfunction getGlobalRegistrars(): DiRegistrar[] | null {\n  return (globalThis as any)[GLOBAL_KEY] ?? null\n}\n\nfunction setGlobalRegistrars(registrars: DiRegistrar[]): void {\n  (globalThis as any)[GLOBAL_KEY] = registrars\n}\n\nexport function registerDiRegistrars(registrars: DiRegistrar[]) {\n  const existing = getGlobalRegistrars()\n  if (existing !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('DI registrars re-registered (this may occur during HMR)')\n  }\n  setGlobalRegistrars(registrars)\n  // Force re-bootstrap on HMR \u2014 module subscribers may have changed.\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n}\n\nexport function getDiRegistrars(): DiRegistrar[] {\n  const registrars = getGlobalRegistrars()\n  if (!registrars) {\n    throw new Error('[Bootstrap] DI registrars not registered. Call registerDiRegistrars() at bootstrap.')\n  }\n  return registrars\n}\n\nfunction getAppDiRegistrar(): AppDiRegistrar | null {\n  const registrar = (globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY]\n  return typeof registrar === 'function' ? registrar as AppDiRegistrar : null\n}\n\nexport function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar\n}\n\n/** Test-only helper to drop process-scoped request-container state. */\nexport function resetBootstrapCache(): void {\n  (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined\n}\n\nfunction isAppDiModuleNotFound(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const { code, message } = error as { code?: unknown; message?: unknown }\n  const text = typeof message === 'string' ? message : ''\n  const moduleNotFound =\n    code === 'MODULE_NOT_FOUND'\n    || code === 'ERR_MODULE_NOT_FOUND'\n    || text.startsWith('Cannot find module')\n    || text.startsWith('Cannot find package')\n  return moduleNotFound && /(?:module|package) ['\"]@\\/di['\"]/.test(text)\n}\n\nfunction warnAppDiFailureOnce(\n  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,\n  message: string,\n  error: unknown,\n): void {\n  const globalScope = globalThis as Record<string, unknown>\n  if (globalScope[key] === true) return\n  globalScope[key] = true\n  logger.warn(message, { err: error })\n}\n\nfunction isAwilixResolver(value: unknown): value is Resolver<unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as { resolve?: unknown }).resolve === 'function')\n}\n\nfunction toAwilixRegistrations(registrations: Record<string, unknown>): Record<string, Resolver<any>> {\n  return Object.fromEntries(\n    Object.entries(registrations).map(([key, value]) => [\n      key,\n      isAwilixResolver(value) ? value : asValue(value),\n    ]),\n  )\n}\n\nexport async function createRequestContainer(): Promise<AppContainer> {\n  const diRegistrars = getDiRegistrars()\n  const orm = await getOrm()\n  // Use a fresh event manager so request-level subscribers (e.g., encryption) don't pile up globally\n  const baseEm = (RequestContext.getEntityManager() as any) ?? orm.em\n  const em = baseEm.fork({ clear: true, freshEventManager: true, useContext: true }) as unknown as EntityManager\n  const container = createContainer<DynamicCradle>({ injectionMode: InjectionMode.CLASSIC })\n  // Core registrations\n  container.register({\n    em: asValue(em),\n    queryEngine: asValue(new BasicQueryEngine(em, undefined, () => {\n      try { return container.resolve('tenantEncryptionService') as any } catch { return null }\n    })),\n    dataEngine: asValue(new DefaultDataEngine(em, container as any)),\n    commandRegistry: asValue(commandRegistry),\n    commandBus: asValue(new CommandBus()),\n    // Default OSS optimistic-lock guard. Reads from the global reader store\n    // (populated by `makeCrudRoute` auto-registration + any module-DI\n    // hand-wired calls to `registerOptimisticLockReaders`). Service is\n    // strictly additive: when `OM_OPTIMISTIC_LOCK=off` (or no header is\n    // sent) it short-circuits at validateMutation. Module-level di.ts\n    // registrations override this default via Awilix replace semantics \u2014\n    // see the enterprise `record_locks` module for the canonical override.\n    // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md\n    crudMutationGuardService: asFunction((em: EntityManager) =>\n      createOptimisticLockGuardService({\n        getEm: () => em,\n        readers: getAllOptimisticLockReaders(),\n      }),\n    ).scoped(),\n    // Default OSS command-level optimistic-lock guard, awaited by\n    // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.\n    // Header/explicit-token compare only (no `resolveExpected`), so it is\n    // behaviourally identical to calling `enforceCommandOptimisticLock`\n    // directly. The enterprise `record_locks` module overrides this DI key\n    // with a lock-backed `resolveExpected` via Awilix replace semantics.\n    // Spec: .ai/specs/enterprise/2026-06-09-record-locks-unified-coverage.md (Phase 0)\n    commandOptimisticLockGuardService: asFunction(() =>\n      createCommandOptimisticLockGuardService(),\n    ).scoped(),\n  })\n  // Allow modules to override/extend. Fail-open by design (one broken module's\n  // di.ts must not take down every request container), but never silently: the\n  // module's services would otherwise vanish with no trace until an unrelated\n  // Awilix resolution error surfaces much later.\n  for (const [registrarIndex, reg] of diRegistrars.entries()) {\n    try { reg?.(container) } catch (error) {\n      logger.error('Module DI registrar failed', { registrarIndex, err: error })\n    }\n  }\n  // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)\n  // Phase 5 \u2014 process-scoped once-guard. The first request runs the full\n  // bootstrap() body; later requests re-register the cached services\n  // directly on this request's container without re-importing or\n  // re-initializing anything. HMR clears the cache (see\n  // registerDiRegistrars). Skippable if a caller already wired eventBus.\n  const alreadyBootstrappedOnThisContainer = !!container.registrations?.eventBus\n  if (!alreadyBootstrappedOnThisContainer) {\n    const cached = getBootstrapCache()\n    if (cached) {\n      const replay: Record<string, any> = {}\n      for (const [key, value] of Object.entries(cached)) {\n        if (value !== undefined && value !== null) replay[key] = asValue(value)\n      }\n      if (Object.keys(replay).length > 0) container.register(replay)\n    } else {\n      try {\n        const { bootstrap } = await import('@open-mercato/core/bootstrap') as any\n        if (bootstrap && typeof bootstrap === 'function') {\n          await bootstrap(container)\n          setBootstrapCache(harvestBootstrapCache(container))\n        }\n      } catch { /* optional */ }\n    }\n  }\n  // App-level DI override. Scaffolded apps register this callback explicitly\n  // from their own bootstrap module so app aliases resolve in app context.\n  const appDiRegistrar = getAppDiRegistrar()\n  if (appDiRegistrar) {\n    try {\n      await appDiRegistrar(container)\n    } catch (error) {\n      logger.error('App-level DI registrar failed', { err: error })\n    }\n  } else {\n    // Backward-compatible fallback for apps that have not adopted explicit wiring.\n    try {\n      // @ts-ignore - @/di only exists in app context, not in packages\n      const appDi = await import('@/di') as any\n      if (appDi?.register) {\n        try {\n          const maybe = appDi.register(container)\n          if (maybe && typeof maybe.then === 'function') await maybe\n        } catch (err) {\n          warnAppDiFailureOnce(\n            APP_DI_REGISTER_WARNING_KEY,\n            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',\n            err,\n          )\n        }\n      }\n    } catch (err) {\n      if (isAppDiModuleNotFound(err)) {\n        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })\n      } else {\n        warnAppDiFailureOnce(\n          APP_DI_LOAD_WARNING_KEY,\n          'App-level DI override module (@/di) failed to load; its registrations are skipped',\n          err,\n        )\n      }\n    }\n  }\n  applyDiOverridesToContainer({\n    register: (registrations) => container.register(toAwilixRegistrations(registrations)),\n    unregister: (key) => container.register({ [key]: asValue(undefined) }),\n  })\n  // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM\n  // Phase 5 \u2014 cache `tenantEncryptionService.isEnabled()` for the process\n  // lifetime. The result depends only on config that does not change at\n  // runtime, so reading it once skips a config lookup per request.\n  try {\n    const emForEnc = container.resolve('em') as any\n    const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')\n      ? (container.resolve('tenantEncryptionService') as any)\n      : null\n    if (emForEnc && tenantEncryptionService && getCachedEncryptionEnabled(tenantEncryptionService) === true) {\n      const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')\n      registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)\n    }\n  } catch {\n    // best-effort; do not block container creation\n  }\n  return container\n}\ntry {\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  require('server-only')\n} catch {\n  // allow CLI/generator usage where Next server-only is not present\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,iBAAiB,SAA0B,qBAAoC;AACpG,SAAS,sBAAsB;AAC/B,SAAS,cAAc;AAEvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+CAA+C;AACxD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AAW/D,MAAM,aAAa;AACnB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B;AAQpC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,MAAI,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe,KAAM,QAAO;AACxG,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,QAAM,WAAY,WAAmB,mBAAmB;AACxD,SAAO,YAAY,OAAO,aAAa,WAAY,WAAmC;AACxF;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,MAAI,CAAC,wBAAwB,EAAG;AAC/B,EAAC,WAAmB,mBAAmB,IAAI;AAC9C;AAEA,SAAS,sBAAsB,WAAiD;AAC9E,QAAM,QAA6B,CAAC;AACpC,aAAW,OAAO,sBAAsB;AACtC,QAAI;AACF,YAAM,QAAiB,UAAU,QAAQ,GAAY;AACrD,UAAI,UAAU,UAAa,UAAU,KAAM,OAAM,GAAG,IAAI;AAAA,IAC1D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,2BAA2B,SAAiD;AACnF,MAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,WAAY,QAAO;AAChE,QAAM,SAAU,WAAuC,sBAAsB;AAC7E,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,MAAI;AACF,UAAM,SAAS,CAAC,CAAC,QAAQ,UAAU;AAClC,IAAC,WAAuC,sBAAsB,IAAI;AACnE,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAA4C;AACnD,SAAQ,WAAmB,UAAU,KAAK;AAC5C;AAEA,SAAS,oBAAoB,YAAiC;AAC5D,EAAC,WAAmB,UAAU,IAAI;AACpC;AAEO,SAAS,qBAAqB,YAA2B;AAC9D,QAAM,WAAW,oBAAoB;AACrC,MAAI,aAAa,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC/D,WAAO,MAAM,yDAAyD;AAAA,EACxE;AACA,sBAAoB,UAAU;AAE7B,EAAC,WAAmB,mBAAmB,IAAI;AAC3C,EAAC,WAAmB,sBAAsB,IAAI;AACjD;AAEO,SAAS,kBAAiC;AAC/C,QAAM,aAAa,oBAAoB;AACvC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,oBAA2C;AAClD,QAAM,YAAa,WAAuC,oBAAoB;AAC9E,SAAO,OAAO,cAAc,aAAa,YAA8B;AACzE;AAEO,SAAS,uBAAuB,WAAwC;AAC7E;AAAC,EAAC,WAAuC,oBAAoB,IAAI;AACnE;AAGO,SAAS,sBAA4B;AAC1C,EAAC,WAAmB,mBAAmB,IAAI;AAC1C,EAAC,WAAmB,sBAAsB,IAAI;AAC9C,EAAC,WAAuC,uBAAuB,IAAI;AACnE,EAAC,WAAuC,2BAA2B,IAAI;AAC1E;AAEA,SAAS,sBAAsB,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,QAAM,OAAO,OAAO,YAAY,WAAW,UAAU;AACrD,QAAM,iBACJ,SAAS,sBACN,SAAS,0BACT,KAAK,WAAW,oBAAoB,KACpC,KAAK,WAAW,qBAAqB;AAC1C,SAAO,kBAAkB,mCAAmC,KAAK,IAAI;AACvE;AAEA,SAAS,qBACP,KACA,SACA,OACM;AACN,QAAM,cAAc;AACpB,MAAI,YAAY,GAAG,MAAM,KAAM;AAC/B,cAAY,GAAG,IAAI;AACnB,SAAO,KAAK,SAAS,EAAE,KAAK,MAAM,CAAC;AACrC;AAEA,SAAS,iBAAiB,OAA4C;AACpE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACrH;AAEA,SAAS,sBAAsB,eAAuE;AACpG,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAClD;AAAA,MACA,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,yBAAgD;AACpE,QAAM,eAAe,gBAAgB;AACrC,QAAM,MAAM,MAAM,OAAO;AAEzB,QAAM,SAAU,eAAe,iBAAiB,KAAa,IAAI;AACjE,QAAM,KAAK,OAAO,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjF,QAAM,YAAY,gBAA+B,EAAE,eAAe,cAAc,QAAQ,CAAC;AAEzF,YAAU,SAAS;AAAA,IACjB,IAAI,QAAQ,EAAE;AAAA,IACd,aAAa,QAAQ,IAAI,iBAAiB,IAAI,QAAW,MAAM;AAC7D,UAAI;AAAE,eAAO,UAAU,QAAQ,yBAAyB;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACzF,CAAC,CAAC;AAAA,IACF,YAAY,QAAQ,IAAI,kBAAkB,IAAI,SAAgB,CAAC;AAAA,IAC/D,iBAAiB,QAAQ,eAAe;AAAA,IACxC,YAAY,QAAQ,IAAI,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASpC,0BAA0B;AAAA,MAAW,CAACA,QACpC,iCAAiC;AAAA,QAC/B,OAAO,MAAMA;AAAA,QACb,SAAS,4BAA4B;AAAA,MACvC,CAAC;AAAA,IACH,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQT,mCAAmC;AAAA,MAAW,MAC5C,wCAAwC;AAAA,IAC1C,EAAE,OAAO;AAAA,EACX,CAAC;AAKD,aAAW,CAAC,gBAAgB,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1D,QAAI;AAAE,YAAM,SAAS;AAAA,IAAE,SAAS,OAAO;AACrC,aAAO,MAAM,8BAA8B,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,IAC3E;AAAA,EACF;AAOA,QAAM,qCAAqC,CAAC,CAAC,UAAU,eAAe;AACtE,MAAI,CAAC,oCAAoC;AACvC,UAAM,SAAS,kBAAkB;AACjC,QAAI,QAAQ;AACV,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM,QAAO,GAAG,IAAI,QAAQ,KAAK;AAAA,MACxE;AACA,UAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,WAAU,SAAS,MAAM;AAAA,IAC/D,OAAO;AACL,UAAI;AACF,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,8BAA8B;AACjE,YAAI,aAAa,OAAO,cAAc,YAAY;AAChD,gBAAM,UAAU,SAAS;AACzB,4BAAkB,sBAAsB,SAAS,CAAC;AAAA,QACpD;AAAA,MACF,QAAQ;AAAA,MAAiB;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,SAAS;AAAA,IAChC,SAAS,OAAO;AACd,aAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC9D;AAAA,EACF,OAAO;AAEL,QAAI;AAEF,YAAM,QAAQ,MAAM,OAAO,MAAM;AACjC,UAAI,OAAO,UAAU;AACnB,YAAI;AACF,gBAAM,QAAQ,MAAM,SAAS,SAAS;AACtC,cAAI,SAAS,OAAO,MAAM,SAAS,WAAY,OAAM;AAAA,QACvD,SAAS,KAAK;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,sBAAsB,GAAG,GAAG;AAC9B,eAAO,MAAM,gEAAgE,EAAE,IAAI,CAAC;AAAA,MACtF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,8BAA4B;AAAA,IAC1B,UAAU,CAAC,kBAAkB,UAAU,SAAS,sBAAsB,aAAa,CAAC;AAAA,IACpF,YAAY,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,GAAG,QAAQ,MAAS,EAAE,CAAC;AAAA,EACvE,CAAC;AAKD,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,IAAI;AACvC,UAAM,0BAA0B,UAAU,gBAAgB,yBAAyB,IAC9E,UAAU,QAAQ,yBAAyB,IAC5C;AACJ,QAAI,YAAY,2BAA2B,2BAA2B,uBAAuB,MAAM,MAAM;AACvG,YAAM,EAAE,mCAAmC,IAAI,MAAM,OAAO,gDAAgD;AAC5G,yCAAmC,UAAU,uBAAuB;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AACA,IAAI;AAEF,UAAQ,aAAa;AACvB,QAAQ;AAER;",
   "names": ["em"]
 }

package/dist/lib/email/send.js

@@ -1,8 +1,64 @@
 import { Resend } from "resend";
+import React from "react";
+import { appendFile, mkdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
 import { parseBooleanWithDefault } from "../boolean.js";
 import { resolveDefaultEmailFromAddress } from "./config.js";
+const DEFAULT_TEST_EMAIL_CAPTURE_PATH = join(tmpdir(), "open-mercato-email-capture.jsonl");
+function resolveTestEmailCapturePath() {
+  return process.env.OM_TEST_EMAIL_CAPTURE_PATH?.trim() || DEFAULT_TEST_EMAIL_CAPTURE_PATH;
+}
+function readElementProps(node) {
+  return node.props;
+}
+function collectEmailLinks(node, links = []) {
+  if (node == null || typeof node === "boolean") return links;
+  if (Array.isArray(node)) {
+    for (const child of node) collectEmailLinks(child, links);
+    return links;
+  }
+  if (React.isValidElement(node)) {
+    const props = readElementProps(node);
+    if (typeof props.href === "string" && props.href.length > 0) links.push(props.href);
+    collectEmailLinks(props.children, links);
+  }
+  return links;
+}
+function collectEmailText(node, parts = []) {
+  if (node == null || typeof node === "boolean") return parts;
+  if (typeof node === "string" || typeof node === "number") {
+    parts.push(String(node));
+    return parts;
+  }
+  if (Array.isArray(node)) {
+    for (const child of node) collectEmailText(child, parts);
+    return parts;
+  }
+  if (React.isValidElement(node)) {
+    collectEmailText(readElementProps(node).children, parts);
+  }
+  return parts;
+}
+async function captureEmailForTests(options) {
+  if (!parseBooleanWithDefault(process.env.OM_TEST_MODE, false)) return;
+  const capturePath = resolveTestEmailCapturePath();
+  const record = {
+    to: options.to,
+    subject: options.subject,
+    from: options.from ?? resolveDefaultEmailFromAddress() ?? null,
+    replyTo: options.replyTo ?? null,
+    links: collectEmailLinks(options.react),
+    text: collectEmailText(options.react).join(" ").replace(/\s+/g, " ").trim(),
+    capturedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await mkdir(dirname(capturePath), { recursive: true });
+  await appendFile(capturePath, `${JSON.stringify(record)}
+`, "utf8");
+}
 async function sendEmail({ to, subject, react, from, replyTo, attachments }) {
   const emailDisabled = parseBooleanWithDefault(process.env.OM_DISABLE_EMAIL_DELIVERY, false) || parseBooleanWithDefault(process.env.OM_TEST_MODE, false);
+  await captureEmailForTests({ to, subject, react, from, replyTo, attachments });
   if (emailDisabled) return;
   const apiKey = process.env.RESEND_API_KEY;
   if (!apiKey) throw new Error("RESEND_API_KEY is not set");

package/dist/lib/email/send.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/email/send.ts"],
-  "sourcesContent": ["import { Resend } from 'resend'\nimport React from 'react'\nimport { parseBooleanWithDefault } from '../boolean'\nimport { resolveDefaultEmailFromAddress } from './config'\n\nexport type SendEmailOptions = {\n  to: string\n  subject: string\n  react: React.ReactElement\n  from?: string\n  replyTo?: string\n  attachments?: Array<{\n    filename: string\n    content: string\n    contentType?: string\n  }>\n}\n\nexport async function sendEmail({ to, subject, react, from, replyTo, attachments }: SendEmailOptions) {\n  const emailDisabled =\n    parseBooleanWithDefault(process.env.OM_DISABLE_EMAIL_DELIVERY, false) ||\n    parseBooleanWithDefault(process.env.OM_TEST_MODE, false)\n  if (emailDisabled) return\n\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is not set')\n  const resend = new Resend(apiKey)\n  const fromAddr = from || resolveDefaultEmailFromAddress()\n  if (!fromAddr) {\n    throw new Error('EMAIL_FROM_NOT_CONFIGURED: set NOTIFICATIONS_EMAIL_FROM, EMAIL_FROM, or ADMIN_EMAIL')\n  }\n  const payload = {\n    to,\n    subject,\n    from: fromAddr,\n    react,\n    ...(replyTo ? { reply_to: replyTo } : {}),\n    ...(attachments?.length ? { attachments } : {}),\n  }\n  const result = await resend.emails.send(payload)\n  const errorMessage =\n    typeof (result as any)?.error === 'string'\n      ? (result as any).error\n      : typeof (result as any)?.error?.message === 'string'\n        ? (result as any).error.message\n        : null\n  if (errorMessage) {\n    throw new Error(`RESEND_SEND_FAILED: ${errorMessage}`)\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,cAAc;AAEvB,SAAS,+BAA+B;AACxC,SAAS,sCAAsC;AAe/C,eAAsB,UAAU,EAAE,IAAI,SAAS,OAAO,MAAM,SAAS,YAAY,GAAqB;AACpG,QAAM,gBACJ,wBAAwB,QAAQ,IAAI,2BAA2B,KAAK,KACpE,wBAAwB,QAAQ,IAAI,cAAc,KAAK;AACzD,MAAI,cAAe;AAEnB,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AACxD,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,WAAW,QAAQ,+BAA+B;AACxD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,GAAI,UAAU,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,IACvC,GAAI,aAAa,SAAS,EAAE,YAAY,IAAI,CAAC;AAAA,EAC/C;AACA,QAAM,SAAS,MAAM,OAAO,OAAO,KAAK,OAAO;AAC/C,QAAM,eACJ,OAAQ,QAAgB,UAAU,WAC7B,OAAe,QAChB,OAAQ,QAAgB,OAAO,YAAY,WACxC,OAAe,MAAM,UACtB;AACR,MAAI,cAAc;AAChB,UAAM,IAAI,MAAM,uBAAuB,YAAY,EAAE;AAAA,EACvD;AACF;",
+  "sourcesContent": ["import { Resend } from 'resend'\nimport React from 'react'\nimport { appendFile, mkdir } from 'node:fs/promises'\nimport { dirname, join } from 'node:path'\nimport { tmpdir } from 'node:os'\nimport { parseBooleanWithDefault } from '../boolean'\nimport { resolveDefaultEmailFromAddress } from './config'\n\nexport type SendEmailOptions = {\n  to: string\n  subject: string\n  react: React.ReactElement\n  from?: string\n  replyTo?: string\n  attachments?: Array<{\n    filename: string\n    content: string\n    contentType?: string\n  }>\n}\n\ntype CapturedEmail = {\n  to: string\n  subject: string\n  from: string | null\n  replyTo: string | null\n  links: string[]\n  text: string\n  capturedAt: string\n}\n\ntype ReactElementProps = {\n  href?: unknown\n  children?: unknown\n}\n\nconst DEFAULT_TEST_EMAIL_CAPTURE_PATH = join(tmpdir(), 'open-mercato-email-capture.jsonl')\n\nfunction resolveTestEmailCapturePath(): string {\n  return process.env.OM_TEST_EMAIL_CAPTURE_PATH?.trim() || DEFAULT_TEST_EMAIL_CAPTURE_PATH\n}\n\nfunction readElementProps(node: React.ReactElement): ReactElementProps {\n  return node.props as ReactElementProps\n}\n\nfunction collectEmailLinks(node: unknown, links: string[] = []): string[] {\n  if (node == null || typeof node === 'boolean') return links\n  if (Array.isArray(node)) {\n    for (const child of node) collectEmailLinks(child, links)\n    return links\n  }\n  if (React.isValidElement(node)) {\n    const props = readElementProps(node)\n    if (typeof props.href === 'string' && props.href.length > 0) links.push(props.href)\n    collectEmailLinks(props.children, links)\n  }\n  return links\n}\n\nfunction collectEmailText(node: unknown, parts: string[] = []): string[] {\n  if (node == null || typeof node === 'boolean') return parts\n  if (typeof node === 'string' || typeof node === 'number') {\n    parts.push(String(node))\n    return parts\n  }\n  if (Array.isArray(node)) {\n    for (const child of node) collectEmailText(child, parts)\n    return parts\n  }\n  if (React.isValidElement(node)) {\n    collectEmailText(readElementProps(node).children, parts)\n  }\n  return parts\n}\n\nasync function captureEmailForTests(options: SendEmailOptions): Promise<void> {\n  if (!parseBooleanWithDefault(process.env.OM_TEST_MODE, false)) return\n\n  const capturePath = resolveTestEmailCapturePath()\n  const record: CapturedEmail = {\n    to: options.to,\n    subject: options.subject,\n    from: options.from ?? resolveDefaultEmailFromAddress() ?? null,\n    replyTo: options.replyTo ?? null,\n    links: collectEmailLinks(options.react),\n    text: collectEmailText(options.react).join(' ').replace(/\\s+/g, ' ').trim(),\n    capturedAt: new Date().toISOString(),\n  }\n\n  await mkdir(dirname(capturePath), { recursive: true })\n  await appendFile(capturePath, `${JSON.stringify(record)}\\n`, 'utf8')\n}\n\nexport async function sendEmail({ to, subject, react, from, replyTo, attachments }: SendEmailOptions) {\n  const emailDisabled =\n    parseBooleanWithDefault(process.env.OM_DISABLE_EMAIL_DELIVERY, false) ||\n    parseBooleanWithDefault(process.env.OM_TEST_MODE, false)\n\n  await captureEmailForTests({ to, subject, react, from, replyTo, attachments })\n\n  if (emailDisabled) return\n\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is not set')\n  const resend = new Resend(apiKey)\n  const fromAddr = from || resolveDefaultEmailFromAddress()\n  if (!fromAddr) {\n    throw new Error('EMAIL_FROM_NOT_CONFIGURED: set NOTIFICATIONS_EMAIL_FROM, EMAIL_FROM, or ADMIN_EMAIL')\n  }\n  const payload = {\n    to,\n    subject,\n    from: fromAddr,\n    react,\n    ...(replyTo ? { reply_to: replyTo } : {}),\n    ...(attachments?.length ? { attachments } : {}),\n  }\n  const result = await resend.emails.send(payload)\n  const errorMessage =\n    typeof (result as any)?.error === 'string'\n      ? (result as any).error\n      : typeof (result as any)?.error?.message === 'string'\n        ? (result as any).error.message\n        : null\n  if (errorMessage) {\n    throw new Error(`RESEND_SEND_FAILED: ${errorMessage}`)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,cAAc;AACvB,OAAO,WAAW;AAClB,SAAS,YAAY,aAAa;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,cAAc;AACvB,SAAS,+BAA+B;AACxC,SAAS,sCAAsC;AA8B/C,MAAM,kCAAkC,KAAK,OAAO,GAAG,kCAAkC;AAEzF,SAAS,8BAAsC;AAC7C,SAAO,QAAQ,IAAI,4BAA4B,KAAK,KAAK;AAC3D;AAEA,SAAS,iBAAiB,MAA6C;AACrE,SAAO,KAAK;AACd;AAEA,SAAS,kBAAkB,MAAe,QAAkB,CAAC,GAAa;AACxE,MAAI,QAAQ,QAAQ,OAAO,SAAS,UAAW,QAAO;AACtD,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,eAAW,SAAS,KAAM,mBAAkB,OAAO,KAAK;AACxD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,eAAe,IAAI,GAAG;AAC9B,UAAM,QAAQ,iBAAiB,IAAI;AACnC,QAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,EAAG,OAAM,KAAK,MAAM,IAAI;AAClF,sBAAkB,MAAM,UAAU,KAAK;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAe,QAAkB,CAAC,GAAa;AACvE,MAAI,QAAQ,QAAQ,OAAO,SAAS,UAAW,QAAO;AACtD,MAAI,OAAO,SAAS,YAAY,OAAO,SAAS,UAAU;AACxD,UAAM,KAAK,OAAO,IAAI,CAAC;AACvB,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,eAAW,SAAS,KAAM,kBAAiB,OAAO,KAAK;AACvD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,eAAe,IAAI,GAAG;AAC9B,qBAAiB,iBAAiB,IAAI,EAAE,UAAU,KAAK;AAAA,EACzD;AACA,SAAO;AACT;AAEA,eAAe,qBAAqB,SAA0C;AAC5E,MAAI,CAAC,wBAAwB,QAAQ,IAAI,cAAc,KAAK,EAAG;AAE/D,QAAM,cAAc,4BAA4B;AAChD,QAAM,SAAwB;AAAA,IAC5B,IAAI,QAAQ;AAAA,IACZ,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ,QAAQ,+BAA+B,KAAK;AAAA,IAC1D,SAAS,QAAQ,WAAW;AAAA,IAC5B,OAAO,kBAAkB,QAAQ,KAAK;AAAA,IACtC,MAAM,iBAAiB,QAAQ,KAAK,EAAE,KAAK,GAAG,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,IAC1E,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,QAAM,MAAM,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,QAAM,WAAW,aAAa,GAAG,KAAK,UAAU,MAAM,CAAC;AAAA,GAAM,MAAM;AACrE;AAEA,eAAsB,UAAU,EAAE,IAAI,SAAS,OAAO,MAAM,SAAS,YAAY,GAAqB;AACpG,QAAM,gBACJ,wBAAwB,QAAQ,IAAI,2BAA2B,KAAK,KACpE,wBAAwB,QAAQ,IAAI,cAAc,KAAK;AAEzD,QAAM,qBAAqB,EAAE,IAAI,SAAS,OAAO,MAAM,SAAS,YAAY,CAAC;AAE7E,MAAI,cAAe;AAEnB,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AACxD,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,WAAW,QAAQ,+BAA+B;AACxD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,GAAI,UAAU,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,IACvC,GAAI,aAAa,SAAS,EAAE,YAAY,IAAI,CAAC;AAAA,EAC/C;AACA,QAAM,SAAS,MAAM,OAAO,OAAO,KAAK,OAAO;AAC/C,QAAM,eACJ,OAAQ,QAAgB,UAAU,WAC7B,OAAe,QAChB,OAAQ,QAAgB,OAAO,YAAY,WACxC,OAAe,MAAM,UACtB;AACR,MAAI,cAAc;AAChB,UAAM,IAAI,MAAM,uBAAuB,YAAY,EAAE;AAAA,EACvD;AACF;",
   "names": []
 }

package/dist/lib/query/types.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/query/types.ts"],
-  "sourcesContent": ["import type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { Profiler } from '../profiler'\nimport type { ResolvedCustomFieldDefinitions } from '../crud/custom-field-definition-index'\n\nexport type FilterOp = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'nin' | 'like' | 'ilike' | 'exists'\n\nexport enum SortDir {\n  Asc = 'asc',\n  Desc = 'desc',\n}\n\nexport type FieldSelector = string // base field or custom field key (prefixed with 'cf:')\n\nexport type Filter = {\n  field: FieldSelector\n  op: FilterOp\n  value?: any\n}\n\nexport type Sort = { field: FieldSelector; dir?: SortDir }\n\nexport type Page = { page?: number; pageSize?: number }\n\n// Mongo/Medusa-style filter operators (typed)\nexport type WhereOps<T> = {\n  $eq?: T\n  $ne?: T | null\n  $gt?: T extends number | Date ? T : never\n  $gte?: T extends number | Date ? T : never\n  $lt?: T extends number | Date ? T : never\n  $lte?: T extends number | Date ? T : never\n  $in?: T[]\n  $nin?: T[]\n  $like?: T extends string ? string : never\n  $ilike?: T extends string ? string : never\n  $exists?: boolean\n}\n\n// A field filter can be a direct value (equals) or ops object\nexport type WhereValue<T = any> = T | WhereOps<T>\n\n// Generic shape for object filters. If you have a typed map of field\u2192type,\n// pass it as the generic to get end-to-end typing.\n// Example: Where<{\n//   id: string; title: string; created_at: Date; 'cf:severity': number\n// }>\nexport type Where<Fields extends Record<string, any> = Record<string, any>> =\n  Partial<{ [K in keyof Fields]: WhereValue<Fields[K]> }> & Record<string, WhereValue>\n\nexport type QueryCustomFieldJoin = {\n  fromField: string\n  toField: string\n  type?: 'left' | 'inner'\n}\n\nexport type QueryCustomFieldSource = {\n  entityId: EntityId\n  table?: string\n  alias?: string\n  recordIdColumn?: string\n  join?: QueryCustomFieldJoin\n  tenantField?: string\n  organizationField?: string\n}\n\nexport type QueryJoinEdge = {\n  alias: string\n  table?: string\n  entityId?: EntityId\n  from: {\n    alias?: string\n    field: string\n  }\n  to: {\n    field: string\n  }\n  type?: 'left' | 'inner'\n}\n\n/**\n * Optional context for query-level UMES extensions.\n * When provided, the query engine will execute sync lifecycle events\n * (querying/queried) and apply query-enabled enrichers.\n */\nexport type QueryExtensionsConfig = {\n  userId?: string\n  container?: unknown\n  userFeatures?: string[]\n  resolve?: <T = unknown>(name: string) => T\n}\n\nexport type QueryOptions = {\n  fields?: FieldSelector[] // base fields and/or 'cf:<key>' for custom fields\n  includeExtensions?: boolean | string[] // include all registered extensions or only specific ones by entity id\n  includeCustomFields?: boolean | string[] // include all CFs or specific keys\n  // Accept classic array syntax or Mongo-style object syntax\n  filters?: Filter[] | Where\n  sort?: Sort[]\n  page?: Page\n  organizationId?: string // enforce multi-tenant scope\n  tenantId?: string // enforce tenant scope\n  // Optional list of organization ids to scope results. Takes precedence over organizationId.\n  organizationIds?: string[]\n  /**\n   * When true, the engine does not apply default `organization_id` / `tenant_id` equality guards.\n   *\n   * Callers MUST encode full visibility in `filters` (for example with `$or` of scoped branches)\n   * and MUST fail closed when the authenticated principal lacks a resolvable tenant/org, otherwise\n   * queries return cross-tenant rows.\n   *\n   * When this flag is set, the hybrid query engine delegates to the basic engine, which means\n   * custom-field (`cf:*`) filters/sorts, `search_tokens` fulltext filtering, and vector-search\n   * branches are BYPASSED. Only use this on entities whose scoping does not match the standard\n   * `organization_id = X AND tenant_id = Y` shape and which do not rely on custom-field/search\n   * features.\n   */\n  omitAutomaticTenantOrgScope?: boolean\n  // Soft-delete behavior: when false (default), rows with non-null deleted_at\n  // are excluded if the base table has that column. Set true to include them.\n  withDeleted?: boolean\n  customFieldSources?: QueryCustomFieldSource[]\n  joins?: QueryJoinEdge[]\n  profiler?: Profiler\n  // When true, suppress automatic reindex scheduling triggered by coverage gap detection.\n  // Used by the search indexing pipeline to prevent feedback loops where indexing triggers\n  // re-indexing indefinitely.\n  skipAutoReindex?: boolean\n  /**\n   * Force routing this query to custom-entity doc storage (`custom_entities_storage`)\n   * instead of classifying the entity automatically. Automatic classification routes\n   * ids backed by a registered ORM table to that base table, so surfaces that manage\n   * doc records for ids that are ALSO table-backed (e.g. the entities records browser\n   * reading a module-declared custom entity such as `example:todo`) must set this flag.\n   * Honored by the hybrid query engine only; `BasicQueryEngine` has no doc-storage\n   * reader and ignores it.\n   */\n  forceCustomEntityStorage?: boolean\n  // Optional UMES query extensions context. When provided, the engine will\n  // emit sync lifecycle events and apply query-level enrichers.\n  extensions?: QueryExtensionsConfig\n}\n\nexport type PartialIndexWarning = {\n  entity: EntityId\n  entityLabel?: string | null\n  baseCount?: number | null\n  indexedCount?: number | null\n  scope?: 'scoped' | 'global'\n}\n\nexport type EncryptedSortRowCapWarning = {\n  entity: EntityId\n  sortFields: string[]\n  maxRows: number\n  totalMatched: number\n}\n\nexport type QueryResultMeta = {\n  partialIndexWarning?: PartialIndexWarning\n  encryptedSortRowCapWarning?: EncryptedSortRowCapWarning\n}\n\nexport type QueryResult<T = any> = {\n  items: T[]\n  page: number\n  pageSize: number\n  total: number\n  meta?: QueryResultMeta\n  /**\n   * Custom-field definitions the engine resolved while building this result\n   * (only present when `includeCustomFields: true`). Lets the CRUD factory\n   * decorate list rows without reloading definitions from the DB (issue #2133).\n   * Internal contract \u2014 additive and optional; callers must treat absence as a\n   * cue to load definitions themselves.\n   */\n  customFieldDefinitions?: ResolvedCustomFieldDefinitions\n}\n\nexport interface QueryEngine {\n  query<T = any>(entity: EntityId, opts?: QueryOptions): Promise<QueryResult<T>>\n}\n"],
+  "sourcesContent": ["import type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { Profiler } from '../profiler'\nimport type { ResolvedCustomFieldDefinitions } from '../crud/custom-field-definition-index'\n\nexport type FilterOp = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'nin' | 'like' | 'ilike' | 'exists'\n\nexport enum SortDir {\n  Asc = 'asc',\n  Desc = 'desc',\n}\n\nexport type FieldSelector = string // base field or custom field key (prefixed with 'cf:')\n\nexport type Filter = {\n  field: FieldSelector\n  op: FilterOp\n  value?: any\n}\n\nexport type Sort = { field: FieldSelector; dir?: SortDir }\n\nexport type Page = { page?: number; pageSize?: number }\n\n// Mongo/Medusa-style filter operators (typed)\nexport type WhereOps<T> = {\n  $eq?: T\n  $ne?: T | null\n  $gt?: T extends number | Date ? T : never\n  $gte?: T extends number | Date ? T : never\n  $lt?: T extends number | Date ? T : never\n  $lte?: T extends number | Date ? T : never\n  $in?: T[]\n  $nin?: T[]\n  $like?: T extends string ? string : never\n  $ilike?: T extends string ? string : never\n  $exists?: boolean\n}\n\n// A field filter can be a direct value (equals) or ops object\nexport type WhereValue<T = any> = T | WhereOps<T>\n\n// Generic shape for object filters. If you have a typed map of field\u2192type,\n// pass it as the generic to get end-to-end typing.\n// Example: Where<{\n//   id: string; title: string; created_at: Date; 'cf:severity': number\n// }>\nexport type Where<Fields extends Record<string, any> = Record<string, any>> =\n  Partial<{ [K in keyof Fields]: WhereValue<Fields[K]> }> & Record<string, WhereValue>\n\nexport type QueryCustomFieldJoin = {\n  fromField: string\n  toField: string\n  type?: 'left' | 'inner'\n}\n\nexport type QueryCustomFieldSource = {\n  entityId: EntityId\n  table?: string\n  alias?: string\n  recordIdColumn?: string\n  join?: QueryCustomFieldJoin\n  tenantField?: string\n  organizationField?: string\n}\n\nexport type QueryJoinEdge = {\n  alias: string\n  table?: string\n  entityId?: EntityId\n  from: {\n    alias?: string\n    field: string\n  }\n  to: {\n    field: string\n  }\n  type?: 'left' | 'inner'\n}\n\n/**\n * Optional context for query-level UMES extensions.\n * When provided, the query engine will execute sync lifecycle events\n * (querying/queried) and apply query-enabled enrichers.\n */\nexport type QueryExtensionsConfig = {\n  userId?: string\n  container?: unknown\n  userFeatures?: string[]\n  resolve?: <T = unknown>(name: string) => T\n}\n\nexport type QueryOptions = {\n  fields?: FieldSelector[] // base fields and/or 'cf:<key>' for custom fields\n  includeExtensions?: boolean | string[] // include all registered extensions or only specific ones by entity id\n  includeCustomFields?: boolean | string[] // include all CFs or specific keys\n  // Accept classic array syntax or Mongo-style object syntax\n  filters?: Filter[] | Where\n  sort?: Sort[]\n  page?: Page\n  organizationId?: string // enforce multi-tenant scope\n  tenantId?: string // enforce tenant scope\n  // Optional list of organization ids to scope results. Takes precedence over organizationId.\n  organizationIds?: string[]\n  /**\n   * When true, the engine does not apply default `organization_id` / `tenant_id` equality guards.\n   *\n   * Callers MUST encode full visibility in `filters` (for example with `$or` of scoped branches)\n   * and MUST fail closed when the authenticated principal lacks a resolvable tenant/org, otherwise\n   * queries return cross-tenant rows.\n   *\n   * When this flag is set, the hybrid query engine delegates to the basic engine. The basic engine\n   * still applies `cf:*` filters/sorts, but `search_tokens` fulltext filtering, the JSONB index read\n   * path, and the vector-search branch are BYPASSED. Only use this on entities whose scoping does\n   * not match the standard `organization_id = X AND tenant_id = Y` shape.\n   */\n  omitAutomaticTenantOrgScope?: boolean\n  // Soft-delete behavior: when false (default), rows with non-null deleted_at\n  // are excluded if the base table has that column. Set true to include them.\n  withDeleted?: boolean\n  customFieldSources?: QueryCustomFieldSource[]\n  joins?: QueryJoinEdge[]\n  profiler?: Profiler\n  // When true, suppress automatic reindex scheduling triggered by coverage gap detection.\n  // Used by the search indexing pipeline to prevent feedback loops where indexing triggers\n  // re-indexing indefinitely.\n  skipAutoReindex?: boolean\n  /**\n   * Force routing this query to custom-entity doc storage (`custom_entities_storage`)\n   * instead of classifying the entity automatically. Automatic classification routes\n   * ids backed by a registered ORM table to that base table, so surfaces that manage\n   * doc records for ids that are ALSO table-backed (e.g. the entities records browser\n   * reading a module-declared custom entity such as `example:todo`) must set this flag.\n   * Honored by the hybrid query engine only; `BasicQueryEngine` has no doc-storage\n   * reader and ignores it.\n   */\n  forceCustomEntityStorage?: boolean\n  // Optional UMES query extensions context. When provided, the engine will\n  // emit sync lifecycle events and apply query-level enrichers.\n  extensions?: QueryExtensionsConfig\n}\n\nexport type PartialIndexWarning = {\n  entity: EntityId\n  entityLabel?: string | null\n  baseCount?: number | null\n  indexedCount?: number | null\n  scope?: 'scoped' | 'global'\n}\n\nexport type EncryptedSortRowCapWarning = {\n  entity: EntityId\n  sortFields: string[]\n  maxRows: number\n  totalMatched: number\n}\n\nexport type QueryResultMeta = {\n  partialIndexWarning?: PartialIndexWarning\n  encryptedSortRowCapWarning?: EncryptedSortRowCapWarning\n}\n\nexport type QueryResult<T = any> = {\n  items: T[]\n  page: number\n  pageSize: number\n  total: number\n  meta?: QueryResultMeta\n  /**\n   * Custom-field definitions the engine resolved while building this result\n   * (only present when `includeCustomFields: true`). Lets the CRUD factory\n   * decorate list rows without reloading definitions from the DB (issue #2133).\n   * Internal contract \u2014 additive and optional; callers must treat absence as a\n   * cue to load definitions themselves.\n   */\n  customFieldDefinitions?: ResolvedCustomFieldDefinitions\n}\n\nexport interface QueryEngine {\n  query<T = any>(entity: EntityId, opts?: QueryOptions): Promise<QueryResult<T>>\n}\n"],
   "mappings": "AAMO,IAAK,UAAL,kBAAKA,aAAL;AACL,EAAAA,SAAA,SAAM;AACN,EAAAA,SAAA,UAAO;AAFG,SAAAA;AAAA,GAAA;",
   "names": ["SortDir"]
 }

package/dist/lib/search/config.js

@@ -2,6 +2,9 @@ import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
 import { parseNumberWithDefault } from "@open-mercato/shared/lib/number";
 import { parseCommaSeparatedList } from "@open-mercato/shared/lib/string";
 const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3;
+const DEFAULT_SEARCH_MAX_FIELD_CHARS = 2e4;
+const DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD = 5e3;
+const DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD = 2e4;
 const DEFAULT_BLOCKLIST = ["password", "token", "secret", "hash"];
 const ENTITY_BLOCKLIST_SEPARATOR = "@";
 function parseBoolean(raw, fallback) {
@@ -10,6 +13,18 @@ function parseBoolean(raw, fallback) {
 function parseNumber(raw, fallback, min = 1) {
   return parseNumberWithDefault(raw, fallback, { integer: true, min });
 }
+function resolveSearchTokenLimits(config) {
+  const resolveLimit = (value, fallback) => {
+    if (value === void 0) return fallback;
+    if (!Number.isFinite(value) || value < 0) return fallback;
+    return Math.trunc(value);
+  };
+  return {
+    maxFieldChars: resolveLimit(config.maxFieldChars, DEFAULT_SEARCH_MAX_FIELD_CHARS),
+    maxTokensPerField: resolveLimit(config.maxTokensPerField, DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD),
+    maxTokensPerRecord: resolveLimit(config.maxTokensPerRecord, DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD)
+  };
+}
 function parseHashAlgorithm(raw) {
   const value = (raw ?? "").trim().toLowerCase();
   if (value === "sha1") return "sha1";
@@ -49,7 +64,10 @@ function resolveSearchConfig() {
     hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),
     storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),
     blocklistedFields: blocklist.global,
-    entityBlocklistedFields: blocklist.byEntity
+    entityBlocklistedFields: blocklist.byEntity,
+    maxFieldChars: parseNumber(process.env.OM_SEARCH_MAX_FIELD_CHARS, DEFAULT_SEARCH_MAX_FIELD_CHARS, 0),
+    maxTokensPerField: parseNumber(process.env.OM_SEARCH_MAX_TOKENS_PER_FIELD, DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD, 0),
+    maxTokensPerRecord: parseNumber(process.env.OM_SEARCH_MAX_TOKENS_PER_RECORD, DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD, 0)
   };
 }
 function isSearchFieldBlocklisted(field, entityType, config) {
@@ -64,9 +82,13 @@ function resolveSearchMinTokenLength() {
   return parseNumber(process.env.OM_SEARCH_MIN_LEN, DEFAULT_SEARCH_MIN_TOKEN_LENGTH, 1);
 }
 export {
+  DEFAULT_SEARCH_MAX_FIELD_CHARS,
+  DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD,
+  DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD,
   DEFAULT_SEARCH_MIN_TOKEN_LENGTH,
   isSearchFieldBlocklisted,
   resolveSearchConfig,
-  resolveSearchMinTokenLength
+  resolveSearchMinTokenLength,
+  resolveSearchTokenLimits
 };
 //# sourceMappingURL=config.js.map

package/dist/lib/search/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/search/config.ts"],
-  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { parseNumberWithDefault } from '@open-mercato/shared/lib/number'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\n\nexport type SearchConfig = {\n  enabled: boolean\n  minTokenLength: number\n  enablePartials: boolean\n  hashAlgorithm: 'sha256' | 'sha1' | 'md5'\n  storeRawTokens: boolean\n  blocklistedFields: string[]\n  entityBlocklistedFields?: Record<string, string[]>\n}\n\nexport const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3\n\nconst DEFAULT_BLOCKLIST = ['password', 'token', 'secret', 'hash']\n\nconst ENTITY_BLOCKLIST_SEPARATOR = '@'\n\nfunction parseBoolean(raw: string | undefined, fallback: boolean): boolean {\n  return parseBooleanWithDefault(raw, fallback)\n}\n\nfunction parseNumber(raw: string | undefined, fallback: number, min = 1): number {\n  return parseNumberWithDefault(raw, fallback, { integer: true, min })\n}\n\nfunction parseHashAlgorithm(raw: string | undefined): 'sha256' | 'sha1' | 'md5' {\n  const value = (raw ?? '').trim().toLowerCase()\n  if (value === 'sha1') return 'sha1'\n  if (value === 'md5') return 'md5'\n  return 'sha256'\n}\n\n/**\n * Parses `OM_SEARCH_FIELD_BLOCKLIST` into a global list plus per-entity-type lists.\n *\n * Why: a deployment often needs to keep one large free-text column out of the token\n * index (e-mail bodies on `customers:customer_interaction`) while still indexing the\n * same-named column elsewhere. A flat global list cannot express that.\n *\n * How to apply: entries are comma-separated; an entry may carry an optional\n * `entityType@` prefix \u2014 `body` blocks the field everywhere, while\n * `customers:customer_interaction@body` blocks it only for that entity type. Entries\n * whose field part is empty are ignored so malformed env input cannot break indexing.\n */\nfunction parseFieldBlocklist(raw: string | undefined): {\n  global: string[]\n  byEntity: Record<string, string[]>\n} {\n  const global: string[] = []\n  const byEntity = new Map<string, string[]>()\n\n  for (const rawEntry of parseCommaSeparatedList(raw)) {\n    const entry = rawEntry.toLowerCase()\n    const separatorIndex = entry.indexOf(ENTITY_BLOCKLIST_SEPARATOR)\n    const entityType = separatorIndex >= 0 ? entry.slice(0, separatorIndex).trim() : ''\n    const field = separatorIndex >= 0 ? entry.slice(separatorIndex + 1).trim() : entry\n    if (!field.length) continue\n\n    if (!entityType.length) {\n      if (!global.includes(field)) global.push(field)\n      continue\n    }\n\n    const scoped = byEntity.get(entityType) ?? []\n    if (!scoped.includes(field)) scoped.push(field)\n    byEntity.set(entityType, scoped)\n  }\n\n  for (const fallback of DEFAULT_BLOCKLIST) {\n    if (!global.includes(fallback)) global.push(fallback)\n  }\n\n  const scopedBlocklist = Object.create(null) as Record<string, string[]>\n  for (const [entityType, fields] of byEntity) scopedBlocklist[entityType] = fields\n\n  return { global, byEntity: scopedBlocklist }\n}\n\nexport function resolveSearchConfig(): SearchConfig {\n  const blocklist = parseFieldBlocklist(process.env.OM_SEARCH_FIELD_BLOCKLIST)\n  return {\n    enabled: parseBoolean(process.env.OM_SEARCH_ENABLED, true),\n    minTokenLength: resolveSearchMinTokenLength(),\n    enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),\n    hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),\n    storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),\n    blocklistedFields: blocklist.global,\n    entityBlocklistedFields: blocklist.byEntity,\n  }\n}\n\n/**\n * Single matcher for \"should this field be kept out of the search index?\".\n *\n * Why: the per-field token path and the `search_text` aggregate previously each\n * decided this on their own, and the aggregate simply never consulted the config \u2014\n * so a blocklisted column's text came back into the index under the aggregate's\n * field name (#4624). Both paths now share this function so they cannot drift.\n *\n * How to apply: pass the document's field name and the entity type being indexed;\n * `entityType` may be omitted when unknown, in which case only global entries apply.\n * Matching keeps the historical substring semantics (`fieldName.includes(pattern)`).\n */\nexport function isSearchFieldBlocklisted(\n  field: string,\n  entityType: string | null | undefined,\n  config: SearchConfig,\n): boolean {\n  const lower = field.toLowerCase()\n  if (config.blocklistedFields.some((blocked) => lower.includes(blocked))) return true\n  if (!entityType) return false\n  const scoped = config.entityBlocklistedFields?.[entityType.trim().toLowerCase()]\n  if (!Array.isArray(scoped) || !scoped.length) return false\n  return scoped.some((blocked) => lower.includes(blocked))\n}\n\n/**\n * Browser-safe accessor for the minimum search token length.\n *\n * Why: client components (e.g. global search dialog) must mirror the server-side\n * tokenizer's `minTokenLength` so the UI gates the request before hitting an\n * empty result set. Pulling the value through this single helper keeps the env\n * contract (`OM_SEARCH_MIN_LEN`) authoritative on both sides.\n *\n * How to apply: call from anywhere \u2014 server, client (when the host app exposes\n * `OM_SEARCH_MIN_LEN` through `next.config.ts`'s `env` block), or tests.\n */\nexport function resolveSearchMinTokenLength(): number {\n  return parseNumber(process.env.OM_SEARCH_MIN_LEN, DEFAULT_SEARCH_MIN_TOKEN_LENGTH, 1)\n}\n"],
-  "mappings": "AAAA,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AAYjC,MAAM,kCAAkC;AAE/C,MAAM,oBAAoB,CAAC,YAAY,SAAS,UAAU,MAAM;AAEhE,MAAM,6BAA6B;AAEnC,SAAS,aAAa,KAAyB,UAA4B;AACzE,SAAO,wBAAwB,KAAK,QAAQ;AAC9C;AAEA,SAAS,YAAY,KAAyB,UAAkB,MAAM,GAAW;AAC/E,SAAO,uBAAuB,KAAK,UAAU,EAAE,SAAS,MAAM,IAAI,CAAC;AACrE;AAEA,SAAS,mBAAmB,KAAoD;AAC9E,QAAM,SAAS,OAAO,IAAI,KAAK,EAAE,YAAY;AAC7C,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,MAAO,QAAO;AAC5B,SAAO;AACT;AAcA,SAAS,oBAAoB,KAG3B;AACA,QAAM,SAAmB,CAAC;AAC1B,QAAM,WAAW,oBAAI,IAAsB;AAE3C,aAAW,YAAY,wBAAwB,GAAG,GAAG;AACnD,UAAM,QAAQ,SAAS,YAAY;AACnC,UAAM,iBAAiB,MAAM,QAAQ,0BAA0B;AAC/D,UAAM,aAAa,kBAAkB,IAAI,MAAM,MAAM,GAAG,cAAc,EAAE,KAAK,IAAI;AACjF,UAAM,QAAQ,kBAAkB,IAAI,MAAM,MAAM,iBAAiB,CAAC,EAAE,KAAK,IAAI;AAC7E,QAAI,CAAC,MAAM,OAAQ;AAEnB,QAAI,CAAC,WAAW,QAAQ;AACtB,UAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,KAAK;AAC9C;AAAA,IACF;AAEA,UAAM,SAAS,SAAS,IAAI,UAAU,KAAK,CAAC;AAC5C,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,KAAK;AAC9C,aAAS,IAAI,YAAY,MAAM;AAAA,EACjC;AAEA,aAAW,YAAY,mBAAmB;AACxC,QAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO,KAAK,QAAQ;AAAA,EACtD;AAEA,QAAM,kBAAkB,uBAAO,OAAO,IAAI;AAC1C,aAAW,CAAC,YAAY,MAAM,KAAK,SAAU,iBAAgB,UAAU,IAAI;AAE3E,SAAO,EAAE,QAAQ,UAAU,gBAAgB;AAC7C;AAEO,SAAS,sBAAoC;AAClD,QAAM,YAAY,oBAAoB,QAAQ,IAAI,yBAAyB;AAC3E,SAAO;AAAA,IACL,SAAS,aAAa,QAAQ,IAAI,mBAAmB,IAAI;AAAA,IACzD,gBAAgB,4BAA4B;AAAA,IAC5C,gBAAgB,aAAa,QAAQ,IAAI,0BAA0B,IAAI;AAAA,IACvE,eAAe,mBAAmB,QAAQ,IAAI,mBAAmB;AAAA,IACjE,gBAAgB,aAAa,QAAQ,IAAI,4BAA4B,KAAK;AAAA,IAC1E,mBAAmB,UAAU;AAAA,IAC7B,yBAAyB,UAAU;AAAA,EACrC;AACF;AAcO,SAAS,yBACd,OACA,YACA,QACS;AACT,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,OAAO,kBAAkB,KAAK,CAAC,YAAY,MAAM,SAAS,OAAO,CAAC,EAAG,QAAO;AAChF,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,SAAS,OAAO,0BAA0B,WAAW,KAAK,EAAE,YAAY,CAAC;AAC/E,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,OAAQ,QAAO;AACrD,SAAO,OAAO,KAAK,CAAC,YAAY,MAAM,SAAS,OAAO,CAAC;AACzD;AAaO,SAAS,8BAAsC;AACpD,SAAO,YAAY,QAAQ,IAAI,mBAAmB,iCAAiC,CAAC;AACtF;",
+  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { parseNumberWithDefault } from '@open-mercato/shared/lib/number'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\n\nexport type SearchConfig = {\n  enabled: boolean\n  minTokenLength: number\n  enablePartials: boolean\n  hashAlgorithm: 'sha256' | 'sha1' | 'md5'\n  storeRawTokens: boolean\n  blocklistedFields: string[]\n  entityBlocklistedFields?: Record<string, string[]>\n  maxFieldChars?: number\n  maxTokensPerField?: number\n  maxTokensPerRecord?: number\n}\n\nexport const DEFAULT_SEARCH_MIN_TOKEN_LENGTH = 3\nexport const DEFAULT_SEARCH_MAX_FIELD_CHARS = 20_000\nexport const DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD = 5_000\nexport const DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD = 20_000\n\nexport type SearchTokenLimits = {\n  maxFieldChars: number\n  maxTokensPerField: number\n  maxTokensPerRecord: number\n}\n\nconst DEFAULT_BLOCKLIST = ['password', 'token', 'secret', 'hash']\n\nconst ENTITY_BLOCKLIST_SEPARATOR = '@'\n\nfunction parseBoolean(raw: string | undefined, fallback: boolean): boolean {\n  return parseBooleanWithDefault(raw, fallback)\n}\n\nfunction parseNumber(raw: string | undefined, fallback: number, min = 1): number {\n  return parseNumberWithDefault(raw, fallback, { integer: true, min })\n}\n\nexport function resolveSearchTokenLimits(config: SearchConfig): SearchTokenLimits {\n  const resolveLimit = (value: number | undefined, fallback: number): number => {\n    if (value === undefined) return fallback\n    if (!Number.isFinite(value) || value < 0) return fallback\n    return Math.trunc(value)\n  }\n  return {\n    maxFieldChars: resolveLimit(config.maxFieldChars, DEFAULT_SEARCH_MAX_FIELD_CHARS),\n    maxTokensPerField: resolveLimit(config.maxTokensPerField, DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD),\n    maxTokensPerRecord: resolveLimit(config.maxTokensPerRecord, DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD),\n  }\n}\n\nfunction parseHashAlgorithm(raw: string | undefined): 'sha256' | 'sha1' | 'md5' {\n  const value = (raw ?? '').trim().toLowerCase()\n  if (value === 'sha1') return 'sha1'\n  if (value === 'md5') return 'md5'\n  return 'sha256'\n}\n\n/**\n * Parses `OM_SEARCH_FIELD_BLOCKLIST` into a global list plus per-entity-type lists.\n *\n * Why: a deployment often needs to keep one large free-text column out of the token\n * index (e-mail bodies on `customers:customer_interaction`) while still indexing the\n * same-named column elsewhere. A flat global list cannot express that.\n *\n * How to apply: entries are comma-separated; an entry may carry an optional\n * `entityType@` prefix \u2014 `body` blocks the field everywhere, while\n * `customers:customer_interaction@body` blocks it only for that entity type. Entries\n * whose field part is empty are ignored so malformed env input cannot break indexing.\n */\nfunction parseFieldBlocklist(raw: string | undefined): {\n  global: string[]\n  byEntity: Record<string, string[]>\n} {\n  const global: string[] = []\n  const byEntity = new Map<string, string[]>()\n\n  for (const rawEntry of parseCommaSeparatedList(raw)) {\n    const entry = rawEntry.toLowerCase()\n    const separatorIndex = entry.indexOf(ENTITY_BLOCKLIST_SEPARATOR)\n    const entityType = separatorIndex >= 0 ? entry.slice(0, separatorIndex).trim() : ''\n    const field = separatorIndex >= 0 ? entry.slice(separatorIndex + 1).trim() : entry\n    if (!field.length) continue\n\n    if (!entityType.length) {\n      if (!global.includes(field)) global.push(field)\n      continue\n    }\n\n    const scoped = byEntity.get(entityType) ?? []\n    if (!scoped.includes(field)) scoped.push(field)\n    byEntity.set(entityType, scoped)\n  }\n\n  for (const fallback of DEFAULT_BLOCKLIST) {\n    if (!global.includes(fallback)) global.push(fallback)\n  }\n\n  const scopedBlocklist = Object.create(null) as Record<string, string[]>\n  for (const [entityType, fields] of byEntity) scopedBlocklist[entityType] = fields\n\n  return { global, byEntity: scopedBlocklist }\n}\n\nexport function resolveSearchConfig(): SearchConfig {\n  const blocklist = parseFieldBlocklist(process.env.OM_SEARCH_FIELD_BLOCKLIST)\n  return {\n    enabled: parseBoolean(process.env.OM_SEARCH_ENABLED, true),\n    minTokenLength: resolveSearchMinTokenLength(),\n    enablePartials: parseBoolean(process.env.OM_SEARCH_ENABLE_PARTIAL, true),\n    hashAlgorithm: parseHashAlgorithm(process.env.OM_SEARCH_HASH_ALGO),\n    storeRawTokens: parseBoolean(process.env.OM_SEARCH_STORE_RAW_TOKENS, false),\n    blocklistedFields: blocklist.global,\n    entityBlocklistedFields: blocklist.byEntity,\n    maxFieldChars: parseNumber(process.env.OM_SEARCH_MAX_FIELD_CHARS, DEFAULT_SEARCH_MAX_FIELD_CHARS, 0),\n    maxTokensPerField: parseNumber(process.env.OM_SEARCH_MAX_TOKENS_PER_FIELD, DEFAULT_SEARCH_MAX_TOKENS_PER_FIELD, 0),\n    maxTokensPerRecord: parseNumber(process.env.OM_SEARCH_MAX_TOKENS_PER_RECORD, DEFAULT_SEARCH_MAX_TOKENS_PER_RECORD, 0),\n  }\n}\n\n/**\n * Single matcher for \"should this field be kept out of the search index?\".\n *\n * Why: the per-field token path and the `search_text` aggregate previously each\n * decided this on their own, and the aggregate simply never consulted the config \u2014\n * so a blocklisted column's text came back into the index under the aggregate's\n * field name (#4624). Both paths now share this function so they cannot drift.\n *\n * How to apply: pass the document's field name and the entity type being indexed;\n * `entityType` may be omitted when unknown, in which case only global entries apply.\n * Matching keeps the historical substring semantics (`fieldName.includes(pattern)`).\n */\nexport function isSearchFieldBlocklisted(\n  field: string,\n  entityType: string | null | undefined,\n  config: SearchConfig,\n): boolean {\n  const lower = field.toLowerCase()\n  if (config.blocklistedFields.some((blocked) => lower.includes(blocked))) return true\n  if (!entityType) return false\n  const scoped = config.entityBlocklistedFields?.[entityType.trim().toLowerCase()]\n  if (!Array.isArray(scoped) || !scoped.length) return false\n  return scoped.some((blocked) => lower.includes(blocked))\n}\n\n/**\n * Browser-safe accessor for the minimum search token length.\n *\n * Why: client components (e.g. global search dialog) must mirror the server-side\n * tokenizer's `minTokenLength` so the UI gates the request before hitting an\n * empty result set. Pulling the value through this single helper keeps the env\n * contract (`OM_SEARCH_MIN_LEN`) authoritative on both sides.\n *\n * How to apply: call from anywhere \u2014 server, client (when the host app exposes\n * `OM_SEARCH_MIN_LEN` through `next.config.ts`'s `env` block), or tests.\n */\nexport function resolveSearchMinTokenLength(): number {\n  return parseNumber(process.env.OM_SEARCH_MIN_LEN, DEFAULT_SEARCH_MIN_TOKEN_LENGTH, 1)\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AAejC,MAAM,kCAAkC;AACxC,MAAM,iCAAiC;AACvC,MAAM,sCAAsC;AAC5C,MAAM,uCAAuC;AAQpD,MAAM,oBAAoB,CAAC,YAAY,SAAS,UAAU,MAAM;AAEhE,MAAM,6BAA6B;AAEnC,SAAS,aAAa,KAAyB,UAA4B;AACzE,SAAO,wBAAwB,KAAK,QAAQ;AAC9C;AAEA,SAAS,YAAY,KAAyB,UAAkB,MAAM,GAAW;AAC/E,SAAO,uBAAuB,KAAK,UAAU,EAAE,SAAS,MAAM,IAAI,CAAC;AACrE;AAEO,SAAS,yBAAyB,QAAyC;AAChF,QAAM,eAAe,CAAC,OAA2B,aAA6B;AAC5E,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,QAAO;AACjD,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB;AACA,SAAO;AAAA,IACL,eAAe,aAAa,OAAO,eAAe,8BAA8B;AAAA,IAChF,mBAAmB,aAAa,OAAO,mBAAmB,mCAAmC;AAAA,IAC7F,oBAAoB,aAAa,OAAO,oBAAoB,oCAAoC;AAAA,EAClG;AACF;AAEA,SAAS,mBAAmB,KAAoD;AAC9E,QAAM,SAAS,OAAO,IAAI,KAAK,EAAE,YAAY;AAC7C,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,MAAO,QAAO;AAC5B,SAAO;AACT;AAcA,SAAS,oBAAoB,KAG3B;AACA,QAAM,SAAmB,CAAC;AAC1B,QAAM,WAAW,oBAAI,IAAsB;AAE3C,aAAW,YAAY,wBAAwB,GAAG,GAAG;AACnD,UAAM,QAAQ,SAAS,YAAY;AACnC,UAAM,iBAAiB,MAAM,QAAQ,0BAA0B;AAC/D,UAAM,aAAa,kBAAkB,IAAI,MAAM,MAAM,GAAG,cAAc,EAAE,KAAK,IAAI;AACjF,UAAM,QAAQ,kBAAkB,IAAI,MAAM,MAAM,iBAAiB,CAAC,EAAE,KAAK,IAAI;AAC7E,QAAI,CAAC,MAAM,OAAQ;AAEnB,QAAI,CAAC,WAAW,QAAQ;AACtB,UAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,KAAK;AAC9C;AAAA,IACF;AAEA,UAAM,SAAS,SAAS,IAAI,UAAU,KAAK,CAAC;AAC5C,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,KAAK;AAC9C,aAAS,IAAI,YAAY,MAAM;AAAA,EACjC;AAEA,aAAW,YAAY,mBAAmB;AACxC,QAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO,KAAK,QAAQ;AAAA,EACtD;AAEA,QAAM,kBAAkB,uBAAO,OAAO,IAAI;AAC1C,aAAW,CAAC,YAAY,MAAM,KAAK,SAAU,iBAAgB,UAAU,IAAI;AAE3E,SAAO,EAAE,QAAQ,UAAU,gBAAgB;AAC7C;AAEO,SAAS,sBAAoC;AAClD,QAAM,YAAY,oBAAoB,QAAQ,IAAI,yBAAyB;AAC3E,SAAO;AAAA,IACL,SAAS,aAAa,QAAQ,IAAI,mBAAmB,IAAI;AAAA,IACzD,gBAAgB,4BAA4B;AAAA,IAC5C,gBAAgB,aAAa,QAAQ,IAAI,0BAA0B,IAAI;AAAA,IACvE,eAAe,mBAAmB,QAAQ,IAAI,mBAAmB;AAAA,IACjE,gBAAgB,aAAa,QAAQ,IAAI,4BAA4B,KAAK;AAAA,IAC1E,mBAAmB,UAAU;AAAA,IAC7B,yBAAyB,UAAU;AAAA,IACnC,eAAe,YAAY,QAAQ,IAAI,2BAA2B,gCAAgC,CAAC;AAAA,IACnG,mBAAmB,YAAY,QAAQ,IAAI,gCAAgC,qCAAqC,CAAC;AAAA,IACjH,oBAAoB,YAAY,QAAQ,IAAI,iCAAiC,sCAAsC,CAAC;AAAA,EACtH;AACF;AAcO,SAAS,yBACd,OACA,YACA,QACS;AACT,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,OAAO,kBAAkB,KAAK,CAAC,YAAY,MAAM,SAAS,OAAO,CAAC,EAAG,QAAO;AAChF,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,SAAS,OAAO,0BAA0B,WAAW,KAAK,EAAE,YAAY,CAAC;AAC/E,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,OAAQ,QAAO;AACrD,SAAO,OAAO,KAAK,CAAC,YAAY,MAAM,SAAS,OAAO,CAAC;AACzD;AAaO,SAAS,8BAAsC;AACpD,SAAO,YAAY,QAAQ,IAAI,mBAAmB,iCAAiC,CAAC;AACtF;",
   "names": []
 }

package/dist/lib/search/tokenize.js

@@ -1,18 +1,25 @@
 import crypto from "crypto";
-import { resolveSearchConfig } from "./config.js";
+import { resolveSearchConfig, resolveSearchTokenLimits } from "./config.js";
 function normalizeText(text) {
   return text.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[%_]/g, " ").toLowerCase();
 }
 function splitTokens(text, minLength) {
   return normalizeText(text).split(/[^a-z0-9]+/i).filter((token) => token.length >= minLength);
 }
-function expandToken(token, config) {
-  if (!config.enablePartials) return [token];
-  const results = [];
-  for (let i = config.minTokenLength; i <= token.length; i += 1) {
-    results.push(token.slice(0, i));
+function appendExpandedToken(token, config, seen, tokens, limit) {
+  const append = (candidate) => {
+    if (seen.has(candidate)) return tokens.length < limit;
+    seen.add(candidate);
+    tokens.push(candidate);
+    return tokens.length < limit;
+  };
+  if (!config.enablePartials) {
+    append(token);
+    return;
+  }
+  for (let length = config.minTokenLength; length <= token.length; length += 1) {
+    if (!append(token.slice(0, length))) return;
   }
-  return results;
 }
 function hashToken(token, config) {
   const cfg = config ?? resolveSearchConfig();
@@ -20,10 +27,15 @@ function hashToken(token, config) {
 }
 function tokenizeText(text, config) {
   const cfg = config ?? resolveSearchConfig();
-  const baseTokens = splitTokens(text, cfg.minTokenLength);
-  const expanded = baseTokens.flatMap((token) => expandToken(token, cfg));
-  const unique = Array.from(new Set(expanded));
-  const tokens = unique.filter((token) => token.length >= cfg.minTokenLength);
+  const limits = resolveSearchTokenLimits(cfg);
+  const boundedText = limits.maxFieldChars > 0 ? text.slice(0, limits.maxFieldChars) : text;
+  const tokenLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY;
+  const seen = /* @__PURE__ */ new Set();
+  const tokens = [];
+  for (const token of splitTokens(boundedText, cfg.minTokenLength)) {
+    if (tokens.length >= tokenLimit) break;
+    appendExpandedToken(token, cfg, seen, tokens, tokenLimit);
+  }
   const hashes = tokens.map((token) => hashToken(token, cfg));
   return { tokens, hashes };
 }

package/dist/lib/search/tokenize.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/search/tokenize.ts"],
-  "sourcesContent": ["import crypto from 'crypto'\nimport { resolveSearchConfig, type SearchConfig } from './config'\n\nexport type TokenizationResult = {\n  tokens: string[]\n  hashes: string[]\n}\n\nfunction normalizeText(text: string): string {\n  return text\n    .normalize('NFKD')\n    .replace(/[\\u0300-\\u036f]/g, '')\n    .replace(/[%_]/g, ' ')\n    .toLowerCase()\n}\n\nfunction splitTokens(text: string, minLength: number): string[] {\n  return normalizeText(text)\n    .split(/[^a-z0-9]+/i)\n    .filter((token) => token.length >= minLength)\n}\n\nfunction expandToken(token: string, config: SearchConfig): string[] {\n  if (!config.enablePartials) return [token]\n  const results: string[] = []\n  for (let i = config.minTokenLength; i <= token.length; i += 1) {\n    results.push(token.slice(0, i))\n  }\n  return results\n}\n\nexport function hashToken(token: string, config?: SearchConfig): string {\n  const cfg = config ?? resolveSearchConfig()\n  return crypto.createHash(cfg.hashAlgorithm).update(token).digest('hex')\n}\n\nexport function tokenizeText(text: string, config?: SearchConfig): TokenizationResult {\n  const cfg = config ?? resolveSearchConfig()\n  const baseTokens = splitTokens(text, cfg.minTokenLength)\n  const expanded = baseTokens.flatMap((token) => expandToken(token, cfg))\n  const unique = Array.from(new Set(expanded))\n  const tokens = unique.filter((token) => token.length >= cfg.minTokenLength)\n  const hashes = tokens.map((token) => hashToken(token, cfg))\n  return { tokens, hashes }\n}\n"],
-  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,2BAA8C;AAOvD,SAAS,cAAc,MAAsB;AAC3C,SAAO,KACJ,UAAU,MAAM,EAChB,QAAQ,oBAAoB,EAAE,EAC9B,QAAQ,SAAS,GAAG,EACpB,YAAY;AACjB;AAEA,SAAS,YAAY,MAAc,WAA6B;AAC9D,SAAO,cAAc,IAAI,EACtB,MAAM,aAAa,EACnB,OAAO,CAAC,UAAU,MAAM,UAAU,SAAS;AAChD;AAEA,SAAS,YAAY,OAAe,QAAgC;AAClE,MAAI,CAAC,OAAO,eAAgB,QAAO,CAAC,KAAK;AACzC,QAAM,UAAoB,CAAC;AAC3B,WAAS,IAAI,OAAO,gBAAgB,KAAK,MAAM,QAAQ,KAAK,GAAG;AAC7D,YAAQ,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAEO,SAAS,UAAU,OAAe,QAA+B;AACtE,QAAM,MAAM,UAAU,oBAAoB;AAC1C,SAAO,OAAO,WAAW,IAAI,aAAa,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxE;AAEO,SAAS,aAAa,MAAc,QAA2C;AACpF,QAAM,MAAM,UAAU,oBAAoB;AAC1C,QAAM,aAAa,YAAY,MAAM,IAAI,cAAc;AACvD,QAAM,WAAW,WAAW,QAAQ,CAAC,UAAU,YAAY,OAAO,GAAG,CAAC;AACtE,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;AAC3C,QAAM,SAAS,OAAO,OAAO,CAAC,UAAU,MAAM,UAAU,IAAI,cAAc;AAC1E,QAAM,SAAS,OAAO,IAAI,CAAC,UAAU,UAAU,OAAO,GAAG,CAAC;AAC1D,SAAO,EAAE,QAAQ,OAAO;AAC1B;",
+  "sourcesContent": ["import crypto from 'crypto'\nimport { resolveSearchConfig, resolveSearchTokenLimits, type SearchConfig } from './config'\n\nexport type TokenizationResult = {\n  tokens: string[]\n  hashes: string[]\n}\n\nfunction normalizeText(text: string): string {\n  return text\n    .normalize('NFKD')\n    .replace(/[\\u0300-\\u036f]/g, '')\n    .replace(/[%_]/g, ' ')\n    .toLowerCase()\n}\n\nfunction splitTokens(text: string, minLength: number): string[] {\n  return normalizeText(text)\n    .split(/[^a-z0-9]+/i)\n    .filter((token) => token.length >= minLength)\n}\n\nfunction appendExpandedToken(\n  token: string,\n  config: SearchConfig,\n  seen: Set<string>,\n  tokens: string[],\n  limit: number,\n): void {\n  const append = (candidate: string): boolean => {\n    if (seen.has(candidate)) return tokens.length < limit\n    seen.add(candidate)\n    tokens.push(candidate)\n    return tokens.length < limit\n  }\n\n  if (!config.enablePartials) {\n    append(token)\n    return\n  }\n\n  for (let length = config.minTokenLength; length <= token.length; length += 1) {\n    if (!append(token.slice(0, length))) return\n  }\n}\n\nexport function hashToken(token: string, config?: SearchConfig): string {\n  const cfg = config ?? resolveSearchConfig()\n  return crypto.createHash(cfg.hashAlgorithm).update(token).digest('hex')\n}\n\nexport function tokenizeText(text: string, config?: SearchConfig): TokenizationResult {\n  const cfg = config ?? resolveSearchConfig()\n  const limits = resolveSearchTokenLimits(cfg)\n  const boundedText = limits.maxFieldChars > 0 ? text.slice(0, limits.maxFieldChars) : text\n  const tokenLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY\n  const seen = new Set<string>()\n  const tokens: string[] = []\n\n  for (const token of splitTokens(boundedText, cfg.minTokenLength)) {\n    if (tokens.length >= tokenLimit) break\n    appendExpandedToken(token, cfg, seen, tokens, tokenLimit)\n  }\n\n  const hashes = tokens.map((token) => hashToken(token, cfg))\n  return { tokens, hashes }\n}\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,qBAAqB,gCAAmD;AAOjF,SAAS,cAAc,MAAsB;AAC3C,SAAO,KACJ,UAAU,MAAM,EAChB,QAAQ,oBAAoB,EAAE,EAC9B,QAAQ,SAAS,GAAG,EACpB,YAAY;AACjB;AAEA,SAAS,YAAY,MAAc,WAA6B;AAC9D,SAAO,cAAc,IAAI,EACtB,MAAM,aAAa,EACnB,OAAO,CAAC,UAAU,MAAM,UAAU,SAAS;AAChD;AAEA,SAAS,oBACP,OACA,QACA,MACA,QACA,OACM;AACN,QAAM,SAAS,CAAC,cAA+B;AAC7C,QAAI,KAAK,IAAI,SAAS,EAAG,QAAO,OAAO,SAAS;AAChD,SAAK,IAAI,SAAS;AAClB,WAAO,KAAK,SAAS;AACrB,WAAO,OAAO,SAAS;AAAA,EACzB;AAEA,MAAI,CAAC,OAAO,gBAAgB;AAC1B,WAAO,KAAK;AACZ;AAAA,EACF;AAEA,WAAS,SAAS,OAAO,gBAAgB,UAAU,MAAM,QAAQ,UAAU,GAAG;AAC5E,QAAI,CAAC,OAAO,MAAM,MAAM,GAAG,MAAM,CAAC,EAAG;AAAA,EACvC;AACF;AAEO,SAAS,UAAU,OAAe,QAA+B;AACtE,QAAM,MAAM,UAAU,oBAAoB;AAC1C,SAAO,OAAO,WAAW,IAAI,aAAa,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxE;AAEO,SAAS,aAAa,MAAc,QAA2C;AACpF,QAAM,MAAM,UAAU,oBAAoB;AAC1C,QAAM,SAAS,yBAAyB,GAAG;AAC3C,QAAM,cAAc,OAAO,gBAAgB,IAAI,KAAK,MAAM,GAAG,OAAO,aAAa,IAAI;AACrF,QAAM,aAAa,OAAO,oBAAoB,IAAI,OAAO,oBAAoB,OAAO;AACpF,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAmB,CAAC;AAE1B,aAAW,SAAS,YAAY,aAAa,IAAI,cAAc,GAAG;AAChE,QAAI,OAAO,UAAU,WAAY;AACjC,wBAAoB,OAAO,KAAK,MAAM,QAAQ,UAAU;AAAA,EAC1D;AAEA,QAAM,SAAS,OAAO,IAAI,CAAC,UAAU,UAAU,OAAO,GAAG,CAAC;AAC1D,SAAO,EAAE,QAAQ,OAAO;AAC1B;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.7-develop.6795.1.8a3f27921c";
+const APP_VERSION = "0.6.7-develop.6814.1.0627c7e9f1";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6795.1.8a3f27921c';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6814.1.0627c7e9f1';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/lib/webhooks/body.js

@@ -0,0 +1,57 @@
+import { parseNumberWithDefault } from "../number.js";
+const DEFAULT_WEBHOOK_BODY_LIMIT_BYTES = 1024 * 1024;
+class WebhookBodyTooLargeError extends Error {
+  constructor(limitBytes) {
+    super(`Webhook body exceeds the ${limitBytes}-byte limit`);
+    this.name = "WebhookBodyTooLargeError";
+    this.limitBytes = limitBytes;
+  }
+}
+function resolveWebhookBodyLimitBytes(raw = typeof process === "undefined" ? void 0 : process.env.OM_WEBHOOK_MAX_BODY_BYTES, fallbackBytes = DEFAULT_WEBHOOK_BODY_LIMIT_BYTES) {
+  const fallback = Number.isSafeInteger(fallbackBytes) && fallbackBytes > 0 ? fallbackBytes : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES;
+  const parsed = parseNumberWithDefault(raw, fallback, { min: 1 });
+  return Number.isSafeInteger(parsed) ? parsed : fallback;
+}
+async function readBoundedRequestBody(request, options) {
+  const configuredLimit = options?.maxBytes ?? resolveWebhookBodyLimitBytes();
+  const maxBytes = Number.isSafeInteger(configuredLimit) && configuredLimit > 0 ? configuredLimit : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES;
+  const declaredLength = request.headers.get("content-length")?.trim();
+  if (declaredLength && /^\d+$/.test(declaredLength)) {
+    const declaredBytes = Number(declaredLength);
+    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {
+      throw new WebhookBodyTooLargeError(maxBytes);
+    }
+  }
+  if (!request.body) return "";
+  const reader = request.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new WebhookBodyTooLargeError(maxBytes);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(body);
+}
+export {
+  DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,
+  WebhookBodyTooLargeError,
+  readBoundedRequestBody,
+  resolveWebhookBodyLimitBytes
+};
+//# sourceMappingURL=body.js.map

package/dist/lib/webhooks/body.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/webhooks/body.ts"],
+  "sourcesContent": ["import { parseNumberWithDefault } from '../number'\n\nexport const DEFAULT_WEBHOOK_BODY_LIMIT_BYTES = 1024 * 1024\n\nexport class WebhookBodyTooLargeError extends Error {\n  readonly limitBytes: number\n\n  constructor(limitBytes: number) {\n    super(`Webhook body exceeds the ${limitBytes}-byte limit`)\n    this.name = 'WebhookBodyTooLargeError'\n    this.limitBytes = limitBytes\n  }\n}\n\nexport function resolveWebhookBodyLimitBytes(\n  raw = typeof process === 'undefined' ? undefined : process.env.OM_WEBHOOK_MAX_BODY_BYTES,\n  fallbackBytes = DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,\n): number {\n  const fallback = Number.isSafeInteger(fallbackBytes) && fallbackBytes > 0\n    ? fallbackBytes\n    : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES\n  const parsed = parseNumberWithDefault(raw, fallback, { min: 1 })\n  return Number.isSafeInteger(parsed) ? parsed : fallback\n}\n\nexport async function readBoundedRequestBody(\n  request: Request,\n  options?: { maxBytes?: number },\n): Promise<string> {\n  const configuredLimit = options?.maxBytes ?? resolveWebhookBodyLimitBytes()\n  const maxBytes = Number.isSafeInteger(configuredLimit) && configuredLimit > 0\n    ? configuredLimit\n    : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES\n  const declaredLength = request.headers.get('content-length')?.trim()\n  if (declaredLength && /^\\d+$/.test(declaredLength)) {\n    const declaredBytes = Number(declaredLength)\n    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {\n      throw new WebhookBodyTooLargeError(maxBytes)\n    }\n  }\n\n  if (!request.body) return ''\n\n  const reader = request.body.getReader()\n  const chunks: Uint8Array[] = []\n  let totalBytes = 0\n\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      totalBytes += value.byteLength\n      if (totalBytes > maxBytes) {\n        await reader.cancel().catch(() => undefined)\n        throw new WebhookBodyTooLargeError(maxBytes)\n      }\n      chunks.push(value)\n    }\n  } finally {\n    reader.releaseLock()\n  }\n\n  const body = new Uint8Array(totalBytes)\n  let offset = 0\n  for (const chunk of chunks) {\n    body.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return new TextDecoder().decode(body)\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AAEhC,MAAM,mCAAmC,OAAO;AAEhD,MAAM,iCAAiC,MAAM;AAAA,EAGlD,YAAY,YAAoB;AAC9B,UAAM,4BAA4B,UAAU,aAAa;AACzD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,SAAS,6BACd,MAAM,OAAO,YAAY,cAAc,SAAY,QAAQ,IAAI,2BAC/D,gBAAgB,kCACR;AACR,QAAM,WAAW,OAAO,cAAc,aAAa,KAAK,gBAAgB,IACpE,gBACA;AACJ,QAAM,SAAS,uBAAuB,KAAK,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/D,SAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,eAAsB,uBACpB,SACA,SACiB;AACjB,QAAM,kBAAkB,SAAS,YAAY,6BAA6B;AAC1E,QAAM,WAAW,OAAO,cAAc,eAAe,KAAK,kBAAkB,IACxE,kBACA;AACJ,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AACnE,MAAI,kBAAkB,QAAQ,KAAK,cAAc,GAAG;AAClD,UAAM,gBAAgB,OAAO,cAAc;AAC3C,QAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU;AACpE,YAAM,IAAI,yBAAyB,QAAQ;AAAA,IAC7C;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,aAAa;AAEjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,oBAAc,MAAM;AACpB,UAAI,aAAa,UAAU;AACzB,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,IAAI,yBAAyB,QAAQ;AAAA,MAC7C;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,OAAO,IAAI,WAAW,UAAU;AACtC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AACtC;",
+  "names": []
+}

package/dist/lib/webhooks/index.js

@@ -1,12 +1,24 @@
 import { signWebhookPayload, buildWebhookHeaders, generateMessageId } from "./sign.js";
-import { verifyWebhookSignature } from "./verify.js";
+import { WEBHOOK_SIGNATURE_TOLERANCE_SECONDS, isWebhookTimestampWithinTolerance, verifyWebhookSignature } from "./verify.js";
 import { generateWebhookSecret, parseWebhookSecret, isValidWebhookSecret } from "./secrets.js";
+import {
+  DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,
+  readBoundedRequestBody,
+  resolveWebhookBodyLimitBytes,
+  WebhookBodyTooLargeError
+} from "./body.js";
 export {
+  DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,
+  WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,
+  WebhookBodyTooLargeError,
   buildWebhookHeaders,
   generateMessageId,
   generateWebhookSecret,
   isValidWebhookSecret,
+  isWebhookTimestampWithinTolerance,
   parseWebhookSecret,
+  readBoundedRequestBody,
+  resolveWebhookBodyLimitBytes,
   signWebhookPayload,
   verifyWebhookSignature
 };

package/dist/lib/webhooks/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/webhooks/index.ts"],
-  "sourcesContent": ["export { signWebhookPayload, buildWebhookHeaders, generateMessageId } from './sign'\nexport { verifyWebhookSignature } from './verify'\nexport { generateWebhookSecret, parseWebhookSecret, isValidWebhookSecret } from './secrets'\nexport type { StandardWebhookHeaders, WebhookSigningKey, WebhookVerificationResult, StandardWebhookPayload } from './types'\nexport type {\n  InboundWebhookRequest,\n  WebhookSourceCredentialField,\n  WebhookSourceConfig,\n  WebhookHandlerMeta,\n  WebhookHandlerPayload,\n  WebhookHandlerContext,\n  WebhookHandler,\n  WebhookHandlerRegistryEntry,\n  WebhookHandlerResult,\n  WebhookIngestionStatus,\n} from './inbound-types'\n"],
-  "mappings": "AAAA,SAAS,oBAAoB,qBAAqB,yBAAyB;AAC3E,SAAS,8BAA8B;AACvC,SAAS,uBAAuB,oBAAoB,4BAA4B;",
+  "sourcesContent": ["export { signWebhookPayload, buildWebhookHeaders, generateMessageId } from './sign'\nexport { WEBHOOK_SIGNATURE_TOLERANCE_SECONDS, isWebhookTimestampWithinTolerance, verifyWebhookSignature } from './verify'\nexport { generateWebhookSecret, parseWebhookSecret, isValidWebhookSecret } from './secrets'\nexport {\n  DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,\n  readBoundedRequestBody,\n  resolveWebhookBodyLimitBytes,\n  WebhookBodyTooLargeError,\n} from './body'\nexport type { StandardWebhookHeaders, WebhookSigningKey, WebhookVerificationResult, StandardWebhookPayload } from './types'\nexport type {\n  InboundWebhookRequest,\n  WebhookSourceCredentialField,\n  WebhookSourceConfig,\n  WebhookHandlerMeta,\n  WebhookHandlerPayload,\n  WebhookHandlerContext,\n  WebhookHandler,\n  WebhookHandlerRegistryEntry,\n  WebhookHandlerResult,\n  WebhookIngestionStatus,\n} from './inbound-types'\n"],
+  "mappings": "AAAA,SAAS,oBAAoB,qBAAqB,yBAAyB;AAC3E,SAAS,qCAAqC,mCAAmC,8BAA8B;AAC/G,SAAS,uBAAuB,oBAAoB,4BAA4B;AAChF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
   "names": []
 }