@open-mercato/shared 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7016.1.4ed7b1e49d

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 261 entry points
+[build:shared] found 262 entry points
 [build:shared] built successfully

package/dist/lib/auth/principal-service.js

@@ -0,0 +1 @@
+//# sourceMappingURL=principal-service.js.map

package/dist/lib/auth/principal-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/lib/auth/server.js

@@ -114,12 +114,21 @@ async function resolveApiKeyAuth(secret) {
     const roles = roleIds.length ? await em.find(Role, { id: { $in: roleIds }, deletedAt: null }) : [];
     const roleNames = roles.map((role) => role.name).filter((name) => typeof name === "string" && name.length > 0);
     let keyIsSuperAdmin = false;
-    if (roleIds.length) {
-      const superAcl = await em.findOne(
+    const keyOrganizationId = typeof record.organizationId === "string" && record.organizationId.trim().length > 0 ? record.organizationId.trim() : null;
+    if (roleIds.length && !keyOrganizationId) {
+      const superAcls = await em.find(
         RoleAcl,
-        { role: { $in: roleIds }, isSuperAdmin: true, deletedAt: null }
+        {
+          role: { $in: roleIds },
+          tenantId: record.tenantId ?? null,
+          isSuperAdmin: true,
+          deletedAt: null
+        }
       );
-      keyIsSuperAdmin = !!(superAcl && superAcl.isSuperAdmin);
+      keyIsSuperAdmin = superAcls.some((acl) => {
+        const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+        return !organizations || organizations.length === 0 || organizations.includes("__all__");
+      });
     }
     if (cache.shouldWriteLastUsed(record.id)) {
       try {
@@ -128,7 +137,14 @@ async function resolveApiKeyAuth(secret) {
       } catch {
       }
     }
-    const actualUserId = record.sessionUserId ?? record.createdBy ?? null;
+    const isSessionBoundKey = Boolean(
+      record.sessionToken || record.sessionUserId || record.sessionSecretEncrypted || record.opencodeSessionId
+    );
+    const actualUserId = isSessionBoundKey ? record.sessionUserId ?? null : record.createdBy ?? null;
+    if (isSessionBoundKey && !actualUserId) {
+      cache.setMiss(secret);
+      return null;
+    }
     if (actualUserId) {
       const user = await em.findOne(User, { id: actualUserId, deletedAt: null });
       if (!user) {
@@ -139,7 +155,8 @@ async function resolveApiKeyAuth(secret) {
         cache.setMiss(secret);
         return null;
       }
-      if ((user.organizationId ?? null) !== (record.organizationId ?? null)) {
+      const requiresExactOrganization = isSessionBoundKey || Boolean(record.organizationId);
+      if (requiresExactOrganization && (user.organizationId ?? null) !== (record.organizationId ?? null)) {
         cache.setMiss(secret);
         return null;
       }

package/dist/lib/auth/server.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/auth/server.ts"],
-  "sourcesContent": ["import { cookies } from 'next/headers.js'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { verifyJwt } from './jwt'\nimport { getSharedApiKeyAuthCache } from './apiKeyAuthCache'\nimport { isTransientDbError } from '@open-mercato/shared/lib/db/pg-errors'\n\nconst TENANT_COOKIE_NAME = 'om_selected_tenant'\nconst ORGANIZATION_COOKIE_NAME = 'om_selected_org'\nconst ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'\nconst SUPERADMIN_ROLE = 'superadmin'\n\nexport type AuthContext = {\n  sub: string\n  sid?: string | null\n  tenantId: string | null\n  orgId: string | null\n  email?: string\n  roles?: string[]\n  isApiKey?: boolean\n  userId?: string\n  keyId?: string\n  keyName?: string\n  [k: string]: unknown\n} | null\n\ntype CookieOverride = { applied: boolean; value: string | null }\n// 'error' means auth could not be determined because of a transient/unexpected\n// failure (DB unavailable, connection-pool exhaustion, statement timeout, \u2026) \u2014\n// NOT because the token is genuinely invalid. Callers MUST NOT clear the user's\n// session cookies for 'error'; doing so would log everyone out at once during a\n// shared infrastructure blip (issue #4176).\ntype AuthResolutionStatus = 'authenticated' | 'missing' | 'invalid' | 'error'\ntype AuthResolution = {\n  auth: AuthContext\n  status: AuthResolutionStatus\n}\n\n// Thrown by `resolveCanonicalInteractiveAuthContext` when the canonical auth\n// lookup itself fails unexpectedly (as opposed to resolving to a genuine\n// \"not authorized\" null). Kept distinct so resolvers can map it to the\n// non-destructive 'error' status instead of the cookie-clearing 'invalid'.\nexport class AuthResolutionUnavailableError extends Error {\n  constructor(cause?: unknown) {\n    super('Auth resolution unavailable')\n    this.name = 'AuthResolutionUnavailableError'\n    if (cause !== undefined) (this as { cause?: unknown }).cause = cause\n  }\n}\n\n// Symbol-keyed trusted auth context. Set on synthetic Request objects by\n// callers that have already authenticated (e.g. the AI in-process operation\n// runner) so downstream auth resolution short-circuits without re-running\n// cookie/JWT/API-key parsing. The hook is fail-open: if absent the normal\n// resolution path runs unchanged.\nexport const TRUSTED_AUTH_CONTEXT_SYMBOL = Symbol.for('open-mercato.auth.trustedContext')\n\nexport type TrustedAuthContextEnvelope = {\n  auth: AuthContext\n  status?: AuthResolutionStatus\n}\n\nexport function attachTrustedAuthContext(\n  request: Request,\n  envelope: TrustedAuthContextEnvelope\n): Request {\n  ;(request as unknown as Record<symbol, TrustedAuthContextEnvelope>)[TRUSTED_AUTH_CONTEXT_SYMBOL] = envelope\n  return request\n}\n\nfunction readTrustedAuthContext(request: Request): TrustedAuthContextEnvelope | null {\n  const carrier = request as unknown as Record<symbol, unknown>\n  const envelope = carrier[TRUSTED_AUTH_CONTEXT_SYMBOL]\n  if (!envelope || typeof envelope !== 'object') return null\n  const candidate = envelope as TrustedAuthContextEnvelope\n  if (!('auth' in candidate)) return null\n  return candidate\n}\n\nfunction decodeCookieValue(raw: string | undefined): string | null {\n  if (raw === undefined) return null\n  try {\n    const decoded = decodeURIComponent(raw)\n    return decoded ?? null\n  } catch {\n    return raw ?? null\n  }\n}\n\nfunction readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\n/**\n * A blank `om_selected_tenant` is \"no selection\", not a deliberate \"no tenant\".\n *\n * Unlike the organization cookie there is no all-tenants sentinel to express, and the tenant\n * selector renders with `includeEmptyOption={false}`, so no UI produces a blank value. Treating it\n * as an applied override nulled `tenantId` for the whole super-admin session, which is what turned\n * a cosmetic client bug into `tenantId ?? ''` reaching a NOT NULL uuid column. Reporting the\n * override as not applied instead keeps the tenant carried in the token and remediates an\n * already-poisoned browser on its next request, whatever wrote the cookie.\n */\nfunction resolveTenantOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded) return { applied: false, value: null }\n  const trimmed = decoded.trim()\n  if (!trimmed) return { applied: false, value: null }\n  return { applied: true, value: trimmed }\n}\n\nfunction resolveOrganizationOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded || decoded === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  const trimmed = decoded.trim()\n  if (!trimmed || trimmed === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  return { applied: true, value: trimmed }\n}\n\nfunction isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  return (auth as Record<string, unknown>).isSuperAdmin === true\n}\n\nfunction applySuperAdminScope(\n  auth: AuthContext,\n  tenantCookie: string | undefined,\n  orgCookie: string | undefined\n): AuthContext {\n  if (!auth || !isSuperAdminAuth(auth)) return auth\n\n  const tenantOverride = resolveTenantOverride(tenantCookie)\n  const orgOverride = resolveOrganizationOverride(orgCookie)\n  if (!tenantOverride.applied && !orgOverride.applied) return auth\n\n  type MutableAuthContext = Exclude<AuthContext, null> & {\n    actorTenantId?: string | null\n    actorOrgId?: string | null\n  }\n  const baseAuth = auth as Exclude<AuthContext, null>\n  const next: MutableAuthContext = { ...baseAuth }\n  if (tenantOverride.applied) {\n    if (!('actorTenantId' in next)) next.actorTenantId = auth?.tenantId ?? null\n    next.tenantId = tenantOverride.value\n  }\n  if (orgOverride.applied) {\n    if (!('actorOrgId' in next)) next.actorOrgId = auth?.orgId ?? null\n    next.orgId = orgOverride.value\n  }\n  next.isSuperAdmin = true\n  const existingRoles = Array.isArray(next.roles) ? next.roles : []\n  if (!existingRoles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)) {\n    next.roles = [...existingRoles, 'superadmin']\n  }\n  return next\n}\n\nasync function resolveApiKeyAuth(secret: string): Promise<AuthContext> {\n  if (!secret) return null\n  const cache = getSharedApiKeyAuthCache()\n  const cached = cache.get(secret)\n  if (cached !== undefined) return cached as AuthContext\n  try {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')\n    const { Role, RoleAcl, User } = await import('@open-mercato/core/modules/auth/data/entities')\n    const { Organization, Tenant } = await import('@open-mercato/core/modules/directory/data/entities')\n\n    const record = await findApiKeyBySecret(em, secret)\n    if (!record) {\n      cache.setMiss(secret)\n      return null\n    }\n\n    const roleIds = Array.isArray(record.rolesJson)\n      ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)\n      : []\n    const roles = roleIds.length\n      ? await em.find(Role, { id: { $in: roleIds }, deletedAt: null })\n      : []\n    const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)\n\n    let keyIsSuperAdmin = false\n    if (roleIds.length) {\n      const superAcl = await em.findOne(\n        RoleAcl,\n        { role: { $in: roleIds } as any, isSuperAdmin: true, deletedAt: null } as any,\n      )\n      keyIsSuperAdmin = !!(superAcl && (superAcl as { isSuperAdmin?: boolean }).isSuperAdmin)\n    }\n\n    if (cache.shouldWriteLastUsed(record.id)) {\n      try {\n        record.lastUsedAt = new Date()\n        await em.persist(record).flush()\n      } catch {\n        // best-effort update; ignore write failures\n      }\n    }\n\n    // For session keys, use sessionUserId; for regular keys, use createdBy\n    const actualUserId = record.sessionUserId ?? record.createdBy ?? null\n\n    if (actualUserId) {\n      const user = await em.findOne(User, { id: actualUserId, deletedAt: null })\n      if (!user) {\n        cache.setMiss(secret)\n        return null\n      }\n      if ((user.tenantId ?? null) !== (record.tenantId ?? null)) {\n        cache.setMiss(secret)\n        return null\n      }\n      if ((user.organizationId ?? null) !== (record.organizationId ?? null)) {\n        cache.setMiss(secret)\n        return null\n      }\n    } else {\n      if (record.tenantId) {\n        const tenant = await em.findOne(Tenant, { id: record.tenantId, deletedAt: null, isActive: true })\n        if (!tenant) {\n          cache.setMiss(secret)\n          return null\n        }\n      }\n      if (record.organizationId) {\n        const organization = await em.findOne(Organization, { id: record.organizationId, deletedAt: null, isActive: true })\n        if (!organization) {\n          cache.setMiss(secret)\n          return null\n        }\n        if (record.tenantId && String(organization.tenant.id) !== record.tenantId) {\n          cache.setMiss(secret)\n          return null\n        }\n      }\n    }\n\n    const auth: Exclude<AuthContext, null> = {\n      sub: `api_key:${record.id}`,\n      tenantId: record.tenantId ?? null,\n      orgId: record.organizationId ?? null,\n      roles: roleNames,\n      isApiKey: true,\n      isSuperAdmin: keyIsSuperAdmin,\n      keyId: record.id,\n      keyName: record.name,\n      ...(actualUserId ? { userId: actualUserId } : {}),\n    }\n    cache.setSuccess(secret, auth, record.expiresAt ? record.expiresAt.getTime() : null)\n    return auth\n  } catch (err) {\n    // A transient DB failure (pool exhausted, `max_connections` reached, DB\n    // restarting) means we could not confirm the key \u2014 NOT that it is invalid.\n    // Surface it so callers return a retryable 503 instead of masking it as an\n    // auth miss (401). Genuine misses already returned `null` above.\n    if (isTransientDbError(err)) {\n      throw new AuthResolutionUnavailableError(err)\n    }\n    return null\n  }\n}\n\nfunction extractApiKey(req: Request): string | null {\n  const header = (req.headers.get('x-api-key') || '').trim()\n  if (header) return header\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  if (authHeader.toLowerCase().startsWith('apikey ')) {\n    return authHeader.slice(7).trim()\n  }\n  return null\n}\n\nasync function resolveCanonicalInteractiveAuthContext(auth: AuthContext): Promise<AuthContext> {\n  if (!auth || auth.isApiKey) return auth\n  if (typeof auth.sub !== 'string' || auth.sub.trim().length === 0) return null\n\n  try {\n    const [{ createRequestContainer }, { resolveCanonicalStaffAuthContext }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/auth/lib/sessionIntegrity'),\n    ])\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    return await resolveCanonicalStaffAuthContext(em, auth)\n  } catch (err) {\n    // A thrown error here means we could not check the token against the\n    // database (DB down, pool exhausted, timeout). This is NOT the same as the\n    // token being invalid \u2014 surface it so callers keep the session intact and\n    // fail the request transiently instead of force-logging the user out.\n    throw new AuthResolutionUnavailableError(err)\n  }\n}\n\nexport async function resolveAuthFromCookiesDetailed(): Promise<AuthResolution> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('auth_token')?.value\n  if (!token) return { auth: null, status: 'missing' }\n  try {\n    const payload = verifyJwt(token) as AuthContext\n    if (!payload) return { auth: null, status: 'invalid' }\n    if (payload.type === 'customer') return { auth: null, status: 'invalid' }\n    const canonicalAuth = await resolveCanonicalInteractiveAuthContext(payload)\n    if (!canonicalAuth) return { auth: null, status: 'invalid' }\n    const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value\n    const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value\n    return {\n      auth: applySuperAdminScope(canonicalAuth, tenantCookie, orgCookie),\n      status: 'authenticated',\n    }\n  } catch (err) {\n    if (err instanceof AuthResolutionUnavailableError) return { auth: null, status: 'error' }\n    return { auth: null, status: 'invalid' }\n  }\n}\n\nexport async function getAuthFromCookies(): Promise<AuthContext> {\n  return (await resolveAuthFromCookiesDetailed()).auth\n}\n\nexport async function resolveAuthFromRequestDetailed(req: Request): Promise<AuthResolution> {\n  const trusted = readTrustedAuthContext(req)\n  if (trusted) {\n    return {\n      auth: trusted.auth,\n      status: trusted.status ?? (trusted.auth ? 'authenticated' : 'missing'),\n    }\n  }\n  const cookieHeader = req.headers.get('cookie') || ''\n  const tenantCookie = readCookieFromHeader(cookieHeader, TENANT_COOKIE_NAME)\n  const orgCookie = readCookieFromHeader(cookieHeader, ORGANIZATION_COOKIE_NAME)\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  let token: string | undefined\n  let hadInvalidInteractiveToken = false\n  let hadUnavailableResolution = false\n  if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()\n  if (!token) {\n    const match = cookieHeader.match(/(?:^|;\\s*)auth_token=([^;]+)/)\n    if (match) token = decodeURIComponent(match[1])\n  }\n  if (token) {\n    try {\n      const payload = verifyJwt(token) as AuthContext\n      if (payload && payload.type === 'customer') return { auth: null, status: 'invalid' }\n      if (payload) {\n        const canonicalAuth = await resolveCanonicalInteractiveAuthContext(payload)\n        if (canonicalAuth) {\n          return {\n            auth: applySuperAdminScope(canonicalAuth, tenantCookie, orgCookie),\n            status: 'authenticated',\n          }\n        }\n        hadInvalidInteractiveToken = true\n      }\n    } catch (err) {\n      // Transient/unexpected canonical-resolution failures must not invalidate\n      // the token \u2014 surface them so we return 'error' (retryable) rather than\n      // clearing the session cookies.\n      if (err instanceof AuthResolutionUnavailableError) hadUnavailableResolution = true\n      else hadInvalidInteractiveToken = true\n    }\n  }\n\n  const resolveUnauthenticatedStatus = (): AuthResolutionStatus =>\n    hadUnavailableResolution ? 'error' : hadInvalidInteractiveToken ? 'invalid' : 'missing'\n\n  const apiKey = extractApiKey(req)\n  if (!apiKey) {\n    return { auth: null, status: resolveUnauthenticatedStatus() }\n  }\n  let apiAuth: AuthContext\n  try {\n    apiAuth = await resolveApiKeyAuth(apiKey)\n  } catch (err) {\n    // Only a transient canonical-resolution failure maps to 'error' (retryable\n    // 503), mirroring the interactive-token path above. Anything else is an\n    // unexpected bug \u2014 rethrow so it surfaces as a 500 rather than being masked\n    // as an auth failure.\n    if (!(err instanceof AuthResolutionUnavailableError)) {\n      throw err\n    }\n    hadUnavailableResolution = true\n    return { auth: null, status: resolveUnauthenticatedStatus() }\n  }\n  if (!apiAuth) {\n    return { auth: null, status: resolveUnauthenticatedStatus() }\n  }\n  return {\n    auth: applySuperAdminScope(apiAuth, tenantCookie, orgCookie),\n    status: 'authenticated',\n  }\n}\n\nexport async function getAuthFromRequest(req: Request): Promise<AuthContext> {\n  return (await resolveAuthFromRequestDetailed(req)).auth\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,iBAAiB;AAC1B,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AAEnC,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iCAAiC;AACvC,MAAM,kBAAkB;AAgCjB,MAAM,uCAAuC,MAAM;AAAA,EACxD,YAAY,OAAiB;AAC3B,UAAM,6BAA6B;AACnC,SAAK,OAAO;AACZ,QAAI,UAAU,OAAW,CAAC,KAA6B,QAAQ;AAAA,EACjE;AACF;AAOO,MAAM,8BAA8B,uBAAO,IAAI,kCAAkC;AAOjF,SAAS,yBACd,SACA,UACS;AACT;AAAC,EAAC,QAAkE,2BAA2B,IAAI;AACnG,SAAO;AACT;AAEA,SAAS,uBAAuB,SAAqD;AACnF,QAAM,UAAU;AAChB,QAAM,WAAW,QAAQ,2BAA2B;AACpD,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,QAAM,YAAY;AAClB,MAAI,EAAE,UAAU,WAAY,QAAO;AACnC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAwC;AACjE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,UAAM,UAAU,mBAAmB,GAAG;AACtC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,QAAmC,MAAkC;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAYA,SAAS,sBAAsB,KAAyC;AACtE,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AACnD,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AACnD,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,4BAA4B,KAAyC;AAC5E,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,iBAAiB,MAA+C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAQ,KAAiC,iBAAiB;AAC5D;AAEA,SAAS,qBACP,MACA,cACA,WACa;AACb,MAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAG,QAAO;AAE7C,QAAM,iBAAiB,sBAAsB,YAAY;AACzD,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,eAAe,WAAW,CAAC,YAAY,QAAS,QAAO;AAM5D,QAAM,WAAW;AACjB,QAAM,OAA2B,EAAE,GAAG,SAAS;AAC/C,MAAI,eAAe,SAAS;AAC1B,QAAI,EAAE,mBAAmB,MAAO,MAAK,gBAAgB,MAAM,YAAY;AACvE,SAAK,WAAW,eAAe;AAAA,EACjC;AACA,MAAI,YAAY,SAAS;AACvB,QAAI,EAAE,gBAAgB,MAAO,MAAK,aAAa,MAAM,SAAS;AAC9D,SAAK,QAAQ,YAAY;AAAA,EAC3B;AACA,OAAK,eAAe;AACpB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAChE,MAAI,CAAC,cAAc,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe,GAAG;AAC5G,SAAK,QAAQ,CAAC,GAAG,eAAe,YAAY;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAe,kBAAkB,QAAsC;AACrE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,yBAAyB;AACvC,QAAM,SAAS,MAAM,IAAI,MAAM;AAC/B,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI;AACF,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,4DAA4D;AACxG,UAAM,EAAE,MAAM,SAAS,KAAK,IAAI,MAAM,OAAO,+CAA+C;AAC5F,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,OAAO,oDAAoD;AAElG,UAAM,SAAS,MAAM,mBAAmB,IAAI,MAAM;AAClD,QAAI,CAAC,QAAQ;AACX,YAAM,QAAQ,MAAM;AACpB,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,MAAM,QAAQ,OAAO,SAAS,IAC1C,OAAO,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IACjG,CAAC;AACL,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,QAAQ,GAAG,WAAW,KAAK,CAAC,IAC7D,CAAC;AACL,UAAM,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAE7H,QAAI,kBAAkB;AACtB,QAAI,QAAQ,QAAQ;AAClB,YAAM,WAAW,MAAM,GAAG;AAAA,QACxB;AAAA,QACA,EAAE,MAAM,EAAE,KAAK,QAAQ,GAAU,cAAc,MAAM,WAAW,KAAK;AAAA,MACvE;AACA,wBAAkB,CAAC,EAAE,YAAa,SAAwC;AAAA,IAC5E;AAEA,QAAI,MAAM,oBAAoB,OAAO,EAAE,GAAG;AACxC,UAAI;AACF,eAAO,aAAa,oBAAI,KAAK;AAC7B,cAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAAA,MACjC,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,UAAM,eAAe,OAAO,iBAAiB,OAAO,aAAa;AAEjE,QAAI,cAAc;AAChB,YAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,cAAc,WAAW,KAAK,CAAC;AACzE,UAAI,CAAC,MAAM;AACT,cAAM,QAAQ,MAAM;AACpB,eAAO;AAAA,MACT;AACA,WAAK,KAAK,YAAY,WAAW,OAAO,YAAY,OAAO;AACzD,cAAM,QAAQ,MAAM;AACpB,eAAO;AAAA,MACT;AACA,WAAK,KAAK,kBAAkB,WAAW,OAAO,kBAAkB,OAAO;AACrE,cAAM,QAAQ,MAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,UAAI,OAAO,UAAU;AACnB,cAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,UAAU,WAAW,MAAM,UAAU,KAAK,CAAC;AAChG,YAAI,CAAC,QAAQ;AACX,gBAAM,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB;AACzB,cAAM,eAAe,MAAM,GAAG,QAAQ,cAAc,EAAE,IAAI,OAAO,gBAAgB,WAAW,MAAM,UAAU,KAAK,CAAC;AAClH,YAAI,CAAC,cAAc;AACjB,gBAAM,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT;AACA,YAAI,OAAO,YAAY,OAAO,aAAa,OAAO,EAAE,MAAM,OAAO,UAAU;AACzE,gBAAM,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAmC;AAAA,MACvC,KAAK,WAAW,OAAO,EAAE;AAAA,MACzB,UAAU,OAAO,YAAY;AAAA,MAC7B,OAAO,OAAO,kBAAkB;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,IACjD;AACA,UAAM,WAAW,QAAQ,MAAM,OAAO,YAAY,OAAO,UAAU,QAAQ,IAAI,IAAI;AACnF,WAAO;AAAA,EACT,SAAS,KAAK;AAKZ,QAAI,mBAAmB,GAAG,GAAG;AAC3B,YAAM,IAAI,+BAA+B,GAAG;AAAA,IAC9C;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAA6B;AAClD,QAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK;AACzD,MAAI,OAAQ,QAAO;AACnB,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,WAAO,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAe,uCAAuC,MAAyC;AAC7F,MAAI,CAAC,QAAQ,KAAK,SAAU,QAAO;AACnC,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AAEzE,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,iCAAiC,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC3F,OAAO,uCAAuC;AAAA,MAC9C,OAAO,sDAAsD;AAAA,IAC/D,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,iCAAiC,IAAI,IAAI;AAAA,EACxD,SAAS,KAAK;AAKZ,UAAM,IAAI,+BAA+B,GAAG;AAAA,EAC9C;AACF;AAEA,eAAsB,iCAA0D;AAC9E,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACnD,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACrD,QAAI,QAAQ,SAAS,WAAY,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACxE,UAAM,gBAAgB,MAAM,uCAAuC,OAAO;AAC1E,QAAI,CAAC,cAAe,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AAC3D,UAAM,eAAe,YAAY,IAAI,kBAAkB,GAAG;AAC1D,UAAM,YAAY,YAAY,IAAI,wBAAwB,GAAG;AAC7D,WAAO;AAAA,MACL,MAAM,qBAAqB,eAAe,cAAc,SAAS;AAAA,MACjE,QAAQ;AAAA,IACV;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,+BAAgC,QAAO,EAAE,MAAM,MAAM,QAAQ,QAAQ;AACxF,WAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AAAA,EACzC;AACF;AAEA,eAAsB,qBAA2C;AAC/D,UAAQ,MAAM,+BAA+B,GAAG;AAClD;AAEA,eAAsB,+BAA+B,KAAuC;AAC1F,QAAM,UAAU,uBAAuB,GAAG;AAC1C,MAAI,SAAS;AACX,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ,WAAW,QAAQ,OAAO,kBAAkB;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,eAAe,qBAAqB,cAAc,kBAAkB;AAC1E,QAAM,YAAY,qBAAqB,cAAc,wBAAwB;AAC7E,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI;AACJ,MAAI,6BAA6B;AACjC,MAAI,2BAA2B;AAC/B,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,EAAG,SAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,aAAa,MAAM,8BAA8B;AAC/D,QAAI,MAAO,SAAQ,mBAAmB,MAAM,CAAC,CAAC;AAAA,EAChD;AACA,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU,UAAU,KAAK;AAC/B,UAAI,WAAW,QAAQ,SAAS,WAAY,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACnF,UAAI,SAAS;AACX,cAAM,gBAAgB,MAAM,uCAAuC,OAAO;AAC1E,YAAI,eAAe;AACjB,iBAAO;AAAA,YACL,MAAM,qBAAqB,eAAe,cAAc,SAAS;AAAA,YACjE,QAAQ;AAAA,UACV;AAAA,QACF;AACA,qCAA6B;AAAA,MAC/B;AAAA,IACF,SAAS,KAAK;AAIZ,UAAI,eAAe,+BAAgC,4BAA2B;AAAA,UACzE,8BAA6B;AAAA,IACpC;AAAA,EACF;AAEA,QAAM,+BAA+B,MACnC,2BAA2B,UAAU,6BAA6B,YAAY;AAEhF,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,MAAM,MAAM,QAAQ,6BAA6B,EAAE;AAAA,EAC9D;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,kBAAkB,MAAM;AAAA,EAC1C,SAAS,KAAK;AAKZ,QAAI,EAAE,eAAe,iCAAiC;AACpD,YAAM;AAAA,IACR;AACA,+BAA2B;AAC3B,WAAO,EAAE,MAAM,MAAM,QAAQ,6BAA6B,EAAE;AAAA,EAC9D;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,MAAM,MAAM,QAAQ,6BAA6B,EAAE;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,MAAM,qBAAqB,SAAS,cAAc,SAAS;AAAA,IAC3D,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,mBAAmB,KAAoC;AAC3E,UAAQ,MAAM,+BAA+B,GAAG,GAAG;AACrD;",
+  "sourcesContent": ["import { cookies } from 'next/headers.js'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { verifyJwt } from './jwt'\nimport { getSharedApiKeyAuthCache } from './apiKeyAuthCache'\nimport { isTransientDbError } from '@open-mercato/shared/lib/db/pg-errors'\n\nconst TENANT_COOKIE_NAME = 'om_selected_tenant'\nconst ORGANIZATION_COOKIE_NAME = 'om_selected_org'\nconst ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'\nconst SUPERADMIN_ROLE = 'superadmin'\n\nexport type AuthContext = {\n  sub: string\n  sid?: string | null\n  tenantId: string | null\n  orgId: string | null\n  email?: string\n  roles?: string[]\n  isApiKey?: boolean\n  userId?: string\n  keyId?: string\n  keyName?: string\n  [k: string]: unknown\n} | null\n\ntype CookieOverride = { applied: boolean; value: string | null }\n// 'error' means auth could not be determined because of a transient/unexpected\n// failure (DB unavailable, connection-pool exhaustion, statement timeout, \u2026) \u2014\n// NOT because the token is genuinely invalid. Callers MUST NOT clear the user's\n// session cookies for 'error'; doing so would log everyone out at once during a\n// shared infrastructure blip (issue #4176).\ntype AuthResolutionStatus = 'authenticated' | 'missing' | 'invalid' | 'error'\ntype AuthResolution = {\n  auth: AuthContext\n  status: AuthResolutionStatus\n}\n\n// Thrown by `resolveCanonicalInteractiveAuthContext` when the canonical auth\n// lookup itself fails unexpectedly (as opposed to resolving to a genuine\n// \"not authorized\" null). Kept distinct so resolvers can map it to the\n// non-destructive 'error' status instead of the cookie-clearing 'invalid'.\nexport class AuthResolutionUnavailableError extends Error {\n  constructor(cause?: unknown) {\n    super('Auth resolution unavailable')\n    this.name = 'AuthResolutionUnavailableError'\n    if (cause !== undefined) (this as { cause?: unknown }).cause = cause\n  }\n}\n\n// Symbol-keyed trusted auth context. Set on synthetic Request objects by\n// callers that have already authenticated (e.g. the AI in-process operation\n// runner) so downstream auth resolution short-circuits without re-running\n// cookie/JWT/API-key parsing. The hook is fail-open: if absent the normal\n// resolution path runs unchanged.\nexport const TRUSTED_AUTH_CONTEXT_SYMBOL = Symbol.for('open-mercato.auth.trustedContext')\n\nexport type TrustedAuthContextEnvelope = {\n  auth: AuthContext\n  status?: AuthResolutionStatus\n}\n\nexport function attachTrustedAuthContext(\n  request: Request,\n  envelope: TrustedAuthContextEnvelope\n): Request {\n  ;(request as unknown as Record<symbol, TrustedAuthContextEnvelope>)[TRUSTED_AUTH_CONTEXT_SYMBOL] = envelope\n  return request\n}\n\nfunction readTrustedAuthContext(request: Request): TrustedAuthContextEnvelope | null {\n  const carrier = request as unknown as Record<symbol, unknown>\n  const envelope = carrier[TRUSTED_AUTH_CONTEXT_SYMBOL]\n  if (!envelope || typeof envelope !== 'object') return null\n  const candidate = envelope as TrustedAuthContextEnvelope\n  if (!('auth' in candidate)) return null\n  return candidate\n}\n\nfunction decodeCookieValue(raw: string | undefined): string | null {\n  if (raw === undefined) return null\n  try {\n    const decoded = decodeURIComponent(raw)\n    return decoded ?? null\n  } catch {\n    return raw ?? null\n  }\n}\n\nfunction readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\n/**\n * A blank `om_selected_tenant` is \"no selection\", not a deliberate \"no tenant\".\n *\n * Unlike the organization cookie there is no all-tenants sentinel to express, and the tenant\n * selector renders with `includeEmptyOption={false}`, so no UI produces a blank value. Treating it\n * as an applied override nulled `tenantId` for the whole super-admin session, which is what turned\n * a cosmetic client bug into `tenantId ?? ''` reaching a NOT NULL uuid column. Reporting the\n * override as not applied instead keeps the tenant carried in the token and remediates an\n * already-poisoned browser on its next request, whatever wrote the cookie.\n */\nfunction resolveTenantOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded) return { applied: false, value: null }\n  const trimmed = decoded.trim()\n  if (!trimmed) return { applied: false, value: null }\n  return { applied: true, value: trimmed }\n}\n\nfunction resolveOrganizationOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded || decoded === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  const trimmed = decoded.trim()\n  if (!trimmed || trimmed === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  return { applied: true, value: trimmed }\n}\n\nfunction isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  return (auth as Record<string, unknown>).isSuperAdmin === true\n}\n\nfunction applySuperAdminScope(\n  auth: AuthContext,\n  tenantCookie: string | undefined,\n  orgCookie: string | undefined\n): AuthContext {\n  if (!auth || !isSuperAdminAuth(auth)) return auth\n\n  const tenantOverride = resolveTenantOverride(tenantCookie)\n  const orgOverride = resolveOrganizationOverride(orgCookie)\n  if (!tenantOverride.applied && !orgOverride.applied) return auth\n\n  type MutableAuthContext = Exclude<AuthContext, null> & {\n    actorTenantId?: string | null\n    actorOrgId?: string | null\n  }\n  const baseAuth = auth as Exclude<AuthContext, null>\n  const next: MutableAuthContext = { ...baseAuth }\n  if (tenantOverride.applied) {\n    if (!('actorTenantId' in next)) next.actorTenantId = auth?.tenantId ?? null\n    next.tenantId = tenantOverride.value\n  }\n  if (orgOverride.applied) {\n    if (!('actorOrgId' in next)) next.actorOrgId = auth?.orgId ?? null\n    next.orgId = orgOverride.value\n  }\n  next.isSuperAdmin = true\n  const existingRoles = Array.isArray(next.roles) ? next.roles : []\n  if (!existingRoles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)) {\n    next.roles = [...existingRoles, 'superadmin']\n  }\n  return next\n}\n\nasync function resolveApiKeyAuth(secret: string): Promise<AuthContext> {\n  if (!secret) return null\n  const cache = getSharedApiKeyAuthCache()\n  const cached = cache.get(secret)\n  if (cached !== undefined) return cached as AuthContext\n  try {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')\n    const { Role, RoleAcl, User } = await import('@open-mercato/core/modules/auth/data/entities')\n    const { Organization, Tenant } = await import('@open-mercato/core/modules/directory/data/entities')\n\n    const record = await findApiKeyBySecret(em, secret)\n    if (!record) {\n      cache.setMiss(secret)\n      return null\n    }\n\n    const roleIds = Array.isArray(record.rolesJson)\n      ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)\n      : []\n    const roles = roleIds.length\n      ? await em.find(Role, { id: { $in: roleIds }, deletedAt: null })\n      : []\n    const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)\n\n    // A role-level super-admin grant is authorization-grade only when it is genuinely\n    // unrestricted: the grant itself must not be organization-scoped, it must belong to the\n    // key's tenant, and the key must not be bound to a single organization. RbacService applies\n    // the same intersection when projecting the scoped ACL, but generic guards\n    // (tenantAccess.resolveIsSuperAdmin, the scoped-API helpers) trust this raw bit *before*\n    // live RBAC runs \u2014 so an organization-restricted key must never carry it.\n    let keyIsSuperAdmin = false\n    const keyOrganizationId = typeof record.organizationId === 'string' && record.organizationId.trim().length > 0\n      ? record.organizationId.trim()\n      : null\n    if (roleIds.length && !keyOrganizationId) {\n      const superAcls = await em.find(\n        RoleAcl,\n        {\n          role: { $in: roleIds } as any,\n          tenantId: record.tenantId ?? null,\n          isSuperAdmin: true,\n          deletedAt: null,\n        } as any,\n      )\n      keyIsSuperAdmin = superAcls.some((acl) => {\n        const organizations = Array.isArray((acl as { organizationsJson?: string[] | null }).organizationsJson)\n          ? (acl as { organizationsJson?: string[] | null }).organizationsJson as string[]\n          : null\n        // An empty list means \"inherit the key's own binding\"; with no binding that is tenant-wide.\n        return !organizations || organizations.length === 0 || organizations.includes('__all__')\n      })\n    }\n\n    if (cache.shouldWriteLastUsed(record.id)) {\n      try {\n        record.lastUsedAt = new Date()\n        await em.persist(record).flush()\n      } catch {\n        // best-effort update; ignore write failures\n      }\n    }\n\n    // Ephemeral session keys are always user-bound. Regular keys retain their\n    // legacy creator identity, while tenant-scoped regular keys ignore only the\n    // creator's concrete organization when validating the wider key scope.\n    // Keep every session marker fail-closed so a malformed session key cannot\n    // fall back to the regular key path and escape its user/scope binding.\n    const isSessionBoundKey = Boolean(\n      record.sessionToken\n      || record.sessionUserId\n      || record.sessionSecretEncrypted\n      || record.opencodeSessionId\n    )\n    const actualUserId = isSessionBoundKey\n      ? record.sessionUserId ?? null\n      : record.createdBy ?? null\n\n    if (isSessionBoundKey && !actualUserId) {\n      cache.setMiss(secret)\n      return null\n    }\n\n    if (actualUserId) {\n      const user = await em.findOne(User, { id: actualUserId, deletedAt: null })\n      if (!user) {\n        cache.setMiss(secret)\n        return null\n      }\n      if ((user.tenantId ?? null) !== (record.tenantId ?? null)) {\n        cache.setMiss(secret)\n        return null\n      }\n      const requiresExactOrganization = isSessionBoundKey || Boolean(record.organizationId)\n      if (requiresExactOrganization && (user.organizationId ?? null) !== (record.organizationId ?? null)) {\n        cache.setMiss(secret)\n        return null\n      }\n    } else {\n      if (record.tenantId) {\n        const tenant = await em.findOne(Tenant, { id: record.tenantId, deletedAt: null, isActive: true })\n        if (!tenant) {\n          cache.setMiss(secret)\n          return null\n        }\n      }\n      if (record.organizationId) {\n        const organization = await em.findOne(Organization, { id: record.organizationId, deletedAt: null, isActive: true })\n        if (!organization) {\n          cache.setMiss(secret)\n          return null\n        }\n        if (record.tenantId && String(organization.tenant.id) !== record.tenantId) {\n          cache.setMiss(secret)\n          return null\n        }\n      }\n    }\n\n    const auth: Exclude<AuthContext, null> = {\n      sub: `api_key:${record.id}`,\n      tenantId: record.tenantId ?? null,\n      orgId: record.organizationId ?? null,\n      roles: roleNames,\n      isApiKey: true,\n      isSuperAdmin: keyIsSuperAdmin,\n      keyId: record.id,\n      keyName: record.name,\n      ...(actualUserId ? { userId: actualUserId } : {}),\n    }\n    cache.setSuccess(secret, auth, record.expiresAt ? record.expiresAt.getTime() : null)\n    return auth\n  } catch (err) {\n    // A transient DB failure (pool exhausted, `max_connections` reached, DB\n    // restarting) means we could not confirm the key \u2014 NOT that it is invalid.\n    // Surface it so callers return a retryable 503 instead of masking it as an\n    // auth miss (401). Genuine misses already returned `null` above.\n    if (isTransientDbError(err)) {\n      throw new AuthResolutionUnavailableError(err)\n    }\n    return null\n  }\n}\n\nfunction extractApiKey(req: Request): string | null {\n  const header = (req.headers.get('x-api-key') || '').trim()\n  if (header) return header\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  if (authHeader.toLowerCase().startsWith('apikey ')) {\n    return authHeader.slice(7).trim()\n  }\n  return null\n}\n\nasync function resolveCanonicalInteractiveAuthContext(auth: AuthContext): Promise<AuthContext> {\n  if (!auth || auth.isApiKey) return auth\n  if (typeof auth.sub !== 'string' || auth.sub.trim().length === 0) return null\n\n  try {\n    const [{ createRequestContainer }, { resolveCanonicalStaffAuthContext }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/auth/lib/sessionIntegrity'),\n    ])\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    return await resolveCanonicalStaffAuthContext(em, auth)\n  } catch (err) {\n    // A thrown error here means we could not check the token against the\n    // database (DB down, pool exhausted, timeout). This is NOT the same as the\n    // token being invalid \u2014 surface it so callers keep the session intact and\n    // fail the request transiently instead of force-logging the user out.\n    throw new AuthResolutionUnavailableError(err)\n  }\n}\n\nexport async function resolveAuthFromCookiesDetailed(): Promise<AuthResolution> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('auth_token')?.value\n  if (!token) return { auth: null, status: 'missing' }\n  try {\n    const payload = verifyJwt(token) as AuthContext\n    if (!payload) return { auth: null, status: 'invalid' }\n    if (payload.type === 'customer') return { auth: null, status: 'invalid' }\n    const canonicalAuth = await resolveCanonicalInteractiveAuthContext(payload)\n    if (!canonicalAuth) return { auth: null, status: 'invalid' }\n    const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value\n    const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value\n    return {\n      auth: applySuperAdminScope(canonicalAuth, tenantCookie, orgCookie),\n      status: 'authenticated',\n    }\n  } catch (err) {\n    if (err instanceof AuthResolutionUnavailableError) return { auth: null, status: 'error' }\n    return { auth: null, status: 'invalid' }\n  }\n}\n\nexport async function getAuthFromCookies(): Promise<AuthContext> {\n  return (await resolveAuthFromCookiesDetailed()).auth\n}\n\nexport async function resolveAuthFromRequestDetailed(req: Request): Promise<AuthResolution> {\n  const trusted = readTrustedAuthContext(req)\n  if (trusted) {\n    return {\n      auth: trusted.auth,\n      status: trusted.status ?? (trusted.auth ? 'authenticated' : 'missing'),\n    }\n  }\n  const cookieHeader = req.headers.get('cookie') || ''\n  const tenantCookie = readCookieFromHeader(cookieHeader, TENANT_COOKIE_NAME)\n  const orgCookie = readCookieFromHeader(cookieHeader, ORGANIZATION_COOKIE_NAME)\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  let token: string | undefined\n  let hadInvalidInteractiveToken = false\n  let hadUnavailableResolution = false\n  if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()\n  if (!token) {\n    const match = cookieHeader.match(/(?:^|;\\s*)auth_token=([^;]+)/)\n    if (match) token = decodeURIComponent(match[1])\n  }\n  if (token) {\n    try {\n      const payload = verifyJwt(token) as AuthContext\n      if (payload && payload.type === 'customer') return { auth: null, status: 'invalid' }\n      if (payload) {\n        const canonicalAuth = await resolveCanonicalInteractiveAuthContext(payload)\n        if (canonicalAuth) {\n          return {\n            auth: applySuperAdminScope(canonicalAuth, tenantCookie, orgCookie),\n            status: 'authenticated',\n          }\n        }\n        hadInvalidInteractiveToken = true\n      }\n    } catch (err) {\n      // Transient/unexpected canonical-resolution failures must not invalidate\n      // the token \u2014 surface them so we return 'error' (retryable) rather than\n      // clearing the session cookies.\n      if (err instanceof AuthResolutionUnavailableError) hadUnavailableResolution = true\n      else hadInvalidInteractiveToken = true\n    }\n  }\n\n  const resolveUnauthenticatedStatus = (): AuthResolutionStatus =>\n    hadUnavailableResolution ? 'error' : hadInvalidInteractiveToken ? 'invalid' : 'missing'\n\n  const apiKey = extractApiKey(req)\n  if (!apiKey) {\n    return { auth: null, status: resolveUnauthenticatedStatus() }\n  }\n  let apiAuth: AuthContext\n  try {\n    apiAuth = await resolveApiKeyAuth(apiKey)\n  } catch (err) {\n    // Only a transient canonical-resolution failure maps to 'error' (retryable\n    // 503), mirroring the interactive-token path above. Anything else is an\n    // unexpected bug \u2014 rethrow so it surfaces as a 500 rather than being masked\n    // as an auth failure.\n    if (!(err instanceof AuthResolutionUnavailableError)) {\n      throw err\n    }\n    hadUnavailableResolution = true\n    return { auth: null, status: resolveUnauthenticatedStatus() }\n  }\n  if (!apiAuth) {\n    return { auth: null, status: resolveUnauthenticatedStatus() }\n  }\n  return {\n    auth: applySuperAdminScope(apiAuth, tenantCookie, orgCookie),\n    status: 'authenticated',\n  }\n}\n\nexport async function getAuthFromRequest(req: Request): Promise<AuthContext> {\n  return (await resolveAuthFromRequestDetailed(req)).auth\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,iBAAiB;AAC1B,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AAEnC,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iCAAiC;AACvC,MAAM,kBAAkB;AAgCjB,MAAM,uCAAuC,MAAM;AAAA,EACxD,YAAY,OAAiB;AAC3B,UAAM,6BAA6B;AACnC,SAAK,OAAO;AACZ,QAAI,UAAU,OAAW,CAAC,KAA6B,QAAQ;AAAA,EACjE;AACF;AAOO,MAAM,8BAA8B,uBAAO,IAAI,kCAAkC;AAOjF,SAAS,yBACd,SACA,UACS;AACT;AAAC,EAAC,QAAkE,2BAA2B,IAAI;AACnG,SAAO;AACT;AAEA,SAAS,uBAAuB,SAAqD;AACnF,QAAM,UAAU;AAChB,QAAM,WAAW,QAAQ,2BAA2B;AACpD,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,QAAM,YAAY;AAClB,MAAI,EAAE,UAAU,WAAY,QAAO;AACnC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAwC;AACjE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,UAAM,UAAU,mBAAmB,GAAG;AACtC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,QAAmC,MAAkC;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAYA,SAAS,sBAAsB,KAAyC;AACtE,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AACnD,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AACnD,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,4BAA4B,KAAyC;AAC5E,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,iBAAiB,MAA+C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAQ,KAAiC,iBAAiB;AAC5D;AAEA,SAAS,qBACP,MACA,cACA,WACa;AACb,MAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAG,QAAO;AAE7C,QAAM,iBAAiB,sBAAsB,YAAY;AACzD,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,eAAe,WAAW,CAAC,YAAY,QAAS,QAAO;AAM5D,QAAM,WAAW;AACjB,QAAM,OAA2B,EAAE,GAAG,SAAS;AAC/C,MAAI,eAAe,SAAS;AAC1B,QAAI,EAAE,mBAAmB,MAAO,MAAK,gBAAgB,MAAM,YAAY;AACvE,SAAK,WAAW,eAAe;AAAA,EACjC;AACA,MAAI,YAAY,SAAS;AACvB,QAAI,EAAE,gBAAgB,MAAO,MAAK,aAAa,MAAM,SAAS;AAC9D,SAAK,QAAQ,YAAY;AAAA,EAC3B;AACA,OAAK,eAAe;AACpB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAChE,MAAI,CAAC,cAAc,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe,GAAG;AAC5G,SAAK,QAAQ,CAAC,GAAG,eAAe,YAAY;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAe,kBAAkB,QAAsC;AACrE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,yBAAyB;AACvC,QAAM,SAAS,MAAM,IAAI,MAAM;AAC/B,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI;AACF,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,4DAA4D;AACxG,UAAM,EAAE,MAAM,SAAS,KAAK,IAAI,MAAM,OAAO,+CAA+C;AAC5F,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,OAAO,oDAAoD;AAElG,UAAM,SAAS,MAAM,mBAAmB,IAAI,MAAM;AAClD,QAAI,CAAC,QAAQ;AACX,YAAM,QAAQ,MAAM;AACpB,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,MAAM,QAAQ,OAAO,SAAS,IAC1C,OAAO,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IACjG,CAAC;AACL,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,QAAQ,GAAG,WAAW,KAAK,CAAC,IAC7D,CAAC;AACL,UAAM,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAQ7H,QAAI,kBAAkB;AACtB,UAAM,oBAAoB,OAAO,OAAO,mBAAmB,YAAY,OAAO,eAAe,KAAK,EAAE,SAAS,IACzG,OAAO,eAAe,KAAK,IAC3B;AACJ,QAAI,QAAQ,UAAU,CAAC,mBAAmB;AACxC,YAAM,YAAY,MAAM,GAAG;AAAA,QACzB;AAAA,QACA;AAAA,UACE,MAAM,EAAE,KAAK,QAAQ;AAAA,UACrB,UAAU,OAAO,YAAY;AAAA,UAC7B,cAAc;AAAA,UACd,WAAW;AAAA,QACb;AAAA,MACF;AACA,wBAAkB,UAAU,KAAK,CAAC,QAAQ;AACxC,cAAM,gBAAgB,MAAM,QAAS,IAAgD,iBAAiB,IACjG,IAAgD,oBACjD;AAEJ,eAAO,CAAC,iBAAiB,cAAc,WAAW,KAAK,cAAc,SAAS,SAAS;AAAA,MACzF,CAAC;AAAA,IACH;AAEA,QAAI,MAAM,oBAAoB,OAAO,EAAE,GAAG;AACxC,UAAI;AACF,eAAO,aAAa,oBAAI,KAAK;AAC7B,cAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAAA,MACjC,QAAQ;AAAA,MAER;AAAA,IACF;AAOA,UAAM,oBAAoB;AAAA,MACxB,OAAO,gBACJ,OAAO,iBACP,OAAO,0BACP,OAAO;AAAA,IACZ;AACA,UAAM,eAAe,oBACjB,OAAO,iBAAiB,OACxB,OAAO,aAAa;AAExB,QAAI,qBAAqB,CAAC,cAAc;AACtC,YAAM,QAAQ,MAAM;AACpB,aAAO;AAAA,IACT;AAEA,QAAI,cAAc;AAChB,YAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,cAAc,WAAW,KAAK,CAAC;AACzE,UAAI,CAAC,MAAM;AACT,cAAM,QAAQ,MAAM;AACpB,eAAO;AAAA,MACT;AACA,WAAK,KAAK,YAAY,WAAW,OAAO,YAAY,OAAO;AACzD,cAAM,QAAQ,MAAM;AACpB,eAAO;AAAA,MACT;AACA,YAAM,4BAA4B,qBAAqB,QAAQ,OAAO,cAAc;AACpF,UAAI,8BAA8B,KAAK,kBAAkB,WAAW,OAAO,kBAAkB,OAAO;AAClG,cAAM,QAAQ,MAAM;AACpB,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,UAAI,OAAO,UAAU;AACnB,cAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,UAAU,WAAW,MAAM,UAAU,KAAK,CAAC;AAChG,YAAI,CAAC,QAAQ;AACX,gBAAM,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,OAAO,gBAAgB;AACzB,cAAM,eAAe,MAAM,GAAG,QAAQ,cAAc,EAAE,IAAI,OAAO,gBAAgB,WAAW,MAAM,UAAU,KAAK,CAAC;AAClH,YAAI,CAAC,cAAc;AACjB,gBAAM,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT;AACA,YAAI,OAAO,YAAY,OAAO,aAAa,OAAO,EAAE,MAAM,OAAO,UAAU;AACzE,gBAAM,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAmC;AAAA,MACvC,KAAK,WAAW,OAAO,EAAE;AAAA,MACzB,UAAU,OAAO,YAAY;AAAA,MAC7B,OAAO,OAAO,kBAAkB;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,IACjD;AACA,UAAM,WAAW,QAAQ,MAAM,OAAO,YAAY,OAAO,UAAU,QAAQ,IAAI,IAAI;AACnF,WAAO;AAAA,EACT,SAAS,KAAK;AAKZ,QAAI,mBAAmB,GAAG,GAAG;AAC3B,YAAM,IAAI,+BAA+B,GAAG;AAAA,IAC9C;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAA6B;AAClD,QAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK;AACzD,MAAI,OAAQ,QAAO;AACnB,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,WAAO,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAe,uCAAuC,MAAyC;AAC7F,MAAI,CAAC,QAAQ,KAAK,SAAU,QAAO;AACnC,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AAEzE,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,iCAAiC,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC3F,OAAO,uCAAuC;AAAA,MAC9C,OAAO,sDAAsD;AAAA,IAC/D,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,iCAAiC,IAAI,IAAI;AAAA,EACxD,SAAS,KAAK;AAKZ,UAAM,IAAI,+BAA+B,GAAG;AAAA,EAC9C;AACF;AAEA,eAAsB,iCAA0D;AAC9E,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACnD,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACrD,QAAI,QAAQ,SAAS,WAAY,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACxE,UAAM,gBAAgB,MAAM,uCAAuC,OAAO;AAC1E,QAAI,CAAC,cAAe,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AAC3D,UAAM,eAAe,YAAY,IAAI,kBAAkB,GAAG;AAC1D,UAAM,YAAY,YAAY,IAAI,wBAAwB,GAAG;AAC7D,WAAO;AAAA,MACL,MAAM,qBAAqB,eAAe,cAAc,SAAS;AAAA,MACjE,QAAQ;AAAA,IACV;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,+BAAgC,QAAO,EAAE,MAAM,MAAM,QAAQ,QAAQ;AACxF,WAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AAAA,EACzC;AACF;AAEA,eAAsB,qBAA2C;AAC/D,UAAQ,MAAM,+BAA+B,GAAG;AAClD;AAEA,eAAsB,+BAA+B,KAAuC;AAC1F,QAAM,UAAU,uBAAuB,GAAG;AAC1C,MAAI,SAAS;AACX,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ,WAAW,QAAQ,OAAO,kBAAkB;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,eAAe,qBAAqB,cAAc,kBAAkB;AAC1E,QAAM,YAAY,qBAAqB,cAAc,wBAAwB;AAC7E,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI;AACJ,MAAI,6BAA6B;AACjC,MAAI,2BAA2B;AAC/B,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,EAAG,SAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,aAAa,MAAM,8BAA8B;AAC/D,QAAI,MAAO,SAAQ,mBAAmB,MAAM,CAAC,CAAC;AAAA,EAChD;AACA,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU,UAAU,KAAK;AAC/B,UAAI,WAAW,QAAQ,SAAS,WAAY,QAAO,EAAE,MAAM,MAAM,QAAQ,UAAU;AACnF,UAAI,SAAS;AACX,cAAM,gBAAgB,MAAM,uCAAuC,OAAO;AAC1E,YAAI,eAAe;AACjB,iBAAO;AAAA,YACL,MAAM,qBAAqB,eAAe,cAAc,SAAS;AAAA,YACjE,QAAQ;AAAA,UACV;AAAA,QACF;AACA,qCAA6B;AAAA,MAC/B;AAAA,IACF,SAAS,KAAK;AAIZ,UAAI,eAAe,+BAAgC,4BAA2B;AAAA,UACzE,8BAA6B;AAAA,IACpC;AAAA,EACF;AAEA,QAAM,+BAA+B,MACnC,2BAA2B,UAAU,6BAA6B,YAAY;AAEhF,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,MAAM,MAAM,QAAQ,6BAA6B,EAAE;AAAA,EAC9D;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,kBAAkB,MAAM;AAAA,EAC1C,SAAS,KAAK;AAKZ,QAAI,EAAE,eAAe,iCAAiC;AACpD,YAAM;AAAA,IACR;AACA,+BAA2B;AAC3B,WAAO,EAAE,MAAM,MAAM,QAAQ,6BAA6B,EAAE;AAAA,EAC9D;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,MAAM,MAAM,QAAQ,6BAA6B,EAAE;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,MAAM,qBAAqB,SAAS,cAAc,SAAS;AAAA,IAC3D,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,mBAAmB,KAAoC;AAC3E,UAAQ,MAAM,+BAA+B,GAAG,GAAG;AACrD;",
   "names": []
 }

package/dist/lib/data/engine.js

@@ -93,7 +93,12 @@ class DefaultDataEngine {
           const eventName = `${mod}.${ent}.updated`;
           warnIfUndeclaredEvent(eventName, "setCustomFields");
           try {
-            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, { persistent: true });
+            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, {
+              persistent: true,
+              tenantId,
+              organizationId,
+              emitterModuleId: mod
+            });
           } catch {
           }
         }
@@ -402,7 +407,8 @@ class DefaultDataEngine {
         await bus.emitEvent(eventName, payload, {
           persistent: !!events.persistent,
           tenantId: ctx.identifiers.tenantId ?? null,
-          organizationId: ctx.identifiers.organizationId ?? null
+          organizationId: ctx.identifiers.organizationId ?? null,
+          emitterModuleId: events.module
         });
       } catch {
       }

package/dist/lib/data/engine.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/data/engine.ts"],
-  "sourcesContent": ["import type { EntityData, EntityName, FilterQuery, RequiredEntityData } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { type Kysely, sql } from 'kysely'\nimport { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'\nimport { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'\nimport { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'\nimport type { EventBus } from '@open-mercato/events/types'\nimport {\n  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n  type CrudEventAction,\n  type CrudEventsConfig,\n  type CrudIndexerConfig,\n  type CrudEntityIdentifiers,\n} from '../crud/types'\nimport type { BulkImportSuppression } from '../commands/types'\nimport { CrudHttpError } from '../crud/errors'\nimport { resolveRegisteredEntityTableName } from '../query/engine'\nimport { getEntityIds } from '../encryption/entityIds'\nimport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nimport { parseBooleanToken } from '../boolean'\nimport { isReadProjectionAlwaysConsistent } from './consistency'\nimport { isEventDeclared } from '../../modules/events'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'data-engine' })\n\nconst undeclaredEventWarned = new Set<string>()\n\nfunction warnIfUndeclaredEvent(eventName: string, context: string): void {\n  if (isEventDeclared(eventName)) return\n  if (undeclaredEventWarned.has(eventName)) return\n  undeclaredEventWarned.add(eventName)\n  logger.warn('Emitting undeclared event \u2014 declare it in the owning module events.ts (createModuleEvents) so the event registry stays authoritative', { context, eventName })\n}\n\n/** Internal: clear the undeclared-event warning cache. Exposed for tests. */\nexport function __resetUndeclaredEventWarningsForTests(): void {\n  undeclaredEventWarned.clear()\n}\n\nconst COVERAGE_REFRESH_INTERVAL_MS = 5 * 60 * 1000\nconst coverageRefreshTracker = new Map<string, number>()\n\nfunction shouldTriggerCoverageRefresh(entityType: string | undefined, tenantId: string | null): boolean {\n  if (!entityType) return false\n  const key = `${entityType}|${tenantId ?? '__null__'}`\n  const now = Date.now()\n  const last = coverageRefreshTracker.get(key) ?? 0\n  if (now - last < COVERAGE_REFRESH_INTERVAL_MS) return false\n  coverageRefreshTracker.set(key, now)\n  return true\n}\n\ntype CustomEntityValues = Record<string, unknown>\n\ntype QueuedCrudSideEffect = {\n  action: CrudEventAction\n  entity: unknown\n  identifiers: CrudEntityIdentifiers\n  syncOrigin?: string | null\n  actorUserId?: string | null\n  events?: CrudEventsConfig<unknown>\n  indexer?: CrudIndexerConfig<unknown>\n}\n\nexport interface DataEngine {\n  setCustomFields(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: Record<string, string | number | boolean | null | undefined | Array<string | number | boolean | null | undefined>>\n    notify?: boolean // default true -> emit '<module>.<entity>.updated'\n  }): Promise<void>\n\n  // Storage for user-defined entities (doc-based)\n  createCustomEntityRecord(opts: {\n    entityId: string // '<module>:<entity>'\n    recordId?: string // optional; auto-generate if not provided\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<{ id: string }>\n\n  updateCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<void>\n\n  deleteCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    soft?: boolean // default true: sets deleted_at\n    notify?: boolean // keep event emitting as it is (no extra events here)\n  }): Promise<void>\n\n  // Generic ORM-backed entity operations used by CrudFactory\n  createOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    data: EntityData<T>\n  }): Promise<T>\n\n  updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null>\n\n  deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null>\n\n  emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    /** Bulk-import deferral: skip the domain event and/or inline reindex for this emit. */\n    suppress?: BulkImportSuppression\n  }): Promise<void>\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void\n\n  /**\n   * Drain queued side effects. When `suppress` is passed (a bulk-import backfill), the\n   * flagged per-record events / reindex are skipped for every drained entry; the caller\n   * is responsible for rebuilding the `query_index` afterwards.\n   */\n  flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void>\n}\n\nexport const SYSTEM_ENTITY_RECORDS_BLOCKED_CODE = 'system_entity_records_blocked'\n\n/**\n * A system entity for doc-storage purposes is an id that modules declare in the\n * generated entity-id registry AND that resolves to a registered ORM table. Both\n * conditions matter: `resolveRegisteredEntityTableName` matches class-name candidates\n * from the entity segment alone, so a runtime-registered custom entity whose name\n * happens to collide with some ORM class (e.g. `user:todo` vs the example module's\n * `Todo`) must never be classified as system. When the registry is not populated\n * (exotic bootstraps, unit harnesses) the check conservatively falls back to the\n * ORM-table match alone so the #2939 protection never switches off.\n */\nexport function isOrmBackedSystemEntityId(em: EntityManager, entityId: string): boolean {\n  const registry = getEntityIds(false)\n  const moduleIds = Object.values(registry).flatMap((moduleEntities) => Object.values(moduleEntities ?? {}))\n  if (moduleIds.length > 0 && !moduleIds.includes(entityId)) return false\n  return resolveRegisteredEntityTableName(em, entityId) !== null\n}\n\n/**\n * Doc storage (`custom_entities_storage`) is for custom entities only. A system\n * entity's records live in its own module tables/APIs \u2014 writing doc rows for it\n * poisons read-path classification (#2939) and must be rejected at the deepest\n * seam so no caller (API, AI tool, workflow) can do it.\n */\nexport function assertCustomEntityStorageEntityId(em: EntityManager, entityId: string): void {\n  if (isOrmBackedSystemEntityId(em, entityId)) {\n    throw new CrudHttpError(400, {\n      error: 'Records are available for custom entities only',\n      code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE,\n      entityId,\n    })\n  }\n}\n\nexport class DefaultDataEngine implements DataEngine {\n  private pendingSideEffects = new Map<string, QueuedCrudSideEffect>()\n  constructor(private em: EntityManager, private container: AwilixContainer) {}\n\n  async setCustomFields(opts: Parameters<DataEngine['setCustomFields']>[0]): Promise<void> {\n    const { entityId, recordId, organizationId = null, tenantId = null, values } = opts\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values,\n    })\n    await this.validateCustomFieldValues(entityId, organizationId, tenantId, sanitizedValues as Record<string, unknown>)\n    let encryptionService: any = null\n    try {\n      encryptionService = this.container.resolve('tenantEncryptionService') as any\n    } catch {\n      encryptionService = null\n    }\n    await setRecordCustomFields(this.em, {\n      entityId,\n      recordId,\n      organizationId,\n      tenantId,\n      values: sanitizedValues,\n      encryptionService,\n    })\n    if (opts.notify !== false) {\n      let bus: EventBus | null = null\n      try {\n        bus = (this.container.resolve('eventBus') as EventBus)\n      } catch {\n        bus = null\n      }\n      if (bus) {\n        const [mod, ent] = (entityId || '').split(':')\n        if (mod && ent) {\n          const eventName = `${mod}.${ent}.updated`\n          warnIfUndeclaredEvent(eventName, 'setCustomFields')\n          try {\n            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, { persistent: true })\n          } catch {\n            // non-blocking\n          }\n        }\n      }\n    }\n  }\n\n  private normalizeDocValues(values: CustomEntityValues): CustomEntityValues {\n    const out: CustomEntityValues = {}\n    for (const [k, v] of Object.entries(values || {})) {\n      // Never allow callers to override reserved identifiers in the doc\n      if (k === 'id' || k === 'entity_id' || k === 'entityId') continue\n      // Accept both 'cf_<key>' and 'cf:<key>' inputs and normalize to 'cf:<key>'\n      if (k.startsWith('cf_')) out[`cf:${k.slice(3)}`] = v\n      else out[k] = v\n    }\n    return out\n  }\n\n  private backcompatEavEnabled(): boolean {\n    try {\n      return parseBooleanToken(process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM ?? '') === true\n    } catch { return false }\n  }\n\n  private getKysely(): Kysely<any> {\n    return this.em.getKysely<any>()\n  }\n\n  private async ensureStorageTableExists(): Promise<void> {\n    const db = this.getKysely()\n    const exists = await db\n      .selectFrom('information_schema.tables' as any)\n      .select(sql`1`.as('present'))\n      .where('table_name' as any, '=', 'custom_entities_storage')\n      .executeTakeFirst()\n    if (!exists) {\n      throw new Error('custom_entities_storage table is missing. Run migrations (yarn db:migrate).')\n    }\n  }\n\n  private normalizeValuesForValidation(values: Record<string, unknown> | undefined | null): Record<string, unknown> {\n    if (!values) return {}\n    const out: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(values)) {\n      if (value === undefined) continue\n      if (key.startsWith('cf_') || key.startsWith('cf:')) {\n        const normalized = key.slice(3)\n        if (normalized) out[normalized] = value\n        continue\n      }\n      out[key] = value\n    }\n    return out\n  }\n\n  private async validateCustomFieldValues(\n    entityId: string,\n    organizationId: string | null,\n    tenantId: string | null,\n    values: Record<string, unknown> | undefined | null,\n  ): Promise<void> {\n    const prepared = this.normalizeValuesForValidation(values)\n    if (!entityId || Object.keys(prepared).length === 0) return\n    const result = await validateCustomFieldValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values: prepared,\n    })\n    if (!result.ok) {\n      throw new CrudHttpError(400, { error: 'Validation failed', fields: result.fieldErrors })\n    }\n  }\n\n  async createCustomEntityRecord(opts: Parameters<DataEngine['createCustomEntityRecord']>[0]): Promise<{ id: string }> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    await this.ensureStorageTableExists()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const rawId = String(opts.recordId ?? '').trim()\n    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(rawId)\n    const sentinel = rawId.toLowerCase()\n    const shouldGenerate = !rawId || !isUuid || sentinel === 'create' || sentinel === 'new' || sentinel === 'null' || sentinel === 'undefined'\n    const id = shouldGenerate ? ((): string => {\n      const g = globalThis as { crypto?: { randomUUID?: () => string } }\n      if (g.crypto?.randomUUID) return g.crypto.randomUUID()\n      // Fallback UUIDv4 generator\n      return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n        const r = (Math.random() * 16) | 0\n        const v = c === 'x' ? r : (r & 0x3) | 0x8\n        return v.toString(16)\n      })\n    })() : rawId\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const doc: Record<string, unknown> = { id, ...this.normalizeDocValues(sanitizedValues || {}) }\n\n    const now = sql`now()`\n    const payload = {\n      entity_type: opts.entityId,\n      entity_id: id,\n      organization_id: orgId,\n      tenant_id: tenantId,\n      doc: sql`${JSON.stringify(doc)}::jsonb`,\n      updated_at: now,\n      created_at: now,\n      deleted_at: null,\n    }\n\n    // Upsert by scoped uniqueness\n    try {\n      await db\n        .insertInto('custom_entities_storage' as any)\n        .values(payload as any)\n        .onConflict((oc) => oc\n          .columns(['entity_type', 'entity_id', 'organization_id'])\n          .doUpdateSet({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any))\n        .execute()\n    } catch {\n      // Fallback for global scope uniqueness\n      try {\n        const updated = await db\n          .updateTable('custom_entities_storage' as any)\n          .set({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any)\n          .where('entity_type' as any, '=', opts.entityId)\n          .where('entity_id' as any, '=', id)\n          .where('organization_id' as any, orgId === null ? 'is' : '=', orgId as any)\n          .where('tenant_id' as any, tenantId === null ? 'is' : '=', tenantId as any)\n          .executeTakeFirst()\n        if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {\n          await db.insertInto('custom_entities_storage' as any).values(payload as any).execute()\n        }\n      } catch (err) {\n        // Surface a clear error so it doesn't silently fall back only to EAV\n        throw err\n      }\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n      })\n    }\n\n    return { id }\n  }\n\n  async updateCustomEntityRecord(opts: Parameters<DataEngine['updateCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n\n    // Merge doc shallowly: load existing doc and overlay\n    await this.ensureStorageTableExists()\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n    const row = await applyScope(\n      db.selectFrom('custom_entities_storage' as any).select(['doc' as any])\n    ).executeTakeFirst()\n    const prevDoc: Record<string, unknown> = (row as any)?.doc || { id }\n    const nextDoc: Record<string, unknown> = { ...prevDoc, ...this.normalizeDocValues(sanitizedValues || {}), id }\n    try {\n      const updated = await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any) as any\n      ).executeTakeFirst()\n      if (!updated || Number((updated as any).numUpdatedRows ?? 0) === 0) {\n        await db.insertInto('custom_entities_storage' as any).values({\n          entity_type: opts.entityId,\n          entity_id: id,\n          organization_id: orgId,\n          tenant_id: tenantId,\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          created_at: sql`now()`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any).execute()\n      }\n    } catch (err) {\n      throw err\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n      })\n    }\n  }\n\n  async deleteCustomEntityRecord(opts: Parameters<DataEngine['deleteCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const soft = opts.soft !== false\n\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n\n    if (soft) {\n      await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          deleted_at: sql`now()`,\n          updated_at: sql`now()`,\n        } as any) as any\n      ).execute()\n    } else {\n      await applyScope(db.deleteFrom('custom_entities_storage' as any) as any).execute()\n    }\n\n    // Soft-delete EAV values to preserve current behavior\n    try {\n      const { CustomFieldValue } = await import('@open-mercato/core/modules/entities/data/entities')\n      const values = await this.em.find(CustomFieldValue, {\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: opts.tenantId ?? null,\n      })\n      const now = new Date()\n      const mutated = values.filter((record) => {\n        if (record.deletedAt) return false\n        record.deletedAt = now\n        return true\n      })\n      if (mutated.length) {\n        for (const record of values) this.em.persist(record)\n        await this.em.flush()\n      }\n    } catch { /* non-blocking */ }\n  }\n\n  async createOrmEntity<T extends object>(opts: { entity: EntityName<T>; data: EntityData<T> }): Promise<T> {\n    const entity = this.em.create(\n      opts.entity as EntityName<T>,\n      opts.data as unknown as RequiredEntityData<T>\n    )\n    await this.em.persist(entity).flush()\n    return entity\n  }\n\n  async updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    await opts.apply(current)\n    await this.em.persist(current).flush()\n    return current\n  }\n\n  async deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    if (opts.soft !== false) {\n      const field = opts.softDeleteField || ('deletedAt' as keyof T & string)\n      if (typeof current === 'object' && current !== null) {\n        ;(current as Record<string, unknown>)[field] = new Date()\n        await this.em.persist(current).flush()\n      }\n    } else {\n      await this.em.remove(current).flush()\n    }\n    return current\n  }\n\n  async emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    suppress?: BulkImportSuppression\n  }): Promise<void> {\n    const { action, entity, events, indexer, identifiers, syncOrigin, suppress } = opts\n    // Bulk-import deferral: an entry may suppress its domain event and/or inline reindex. When both\n    // the config is absent AND (for the present one) suppressed, there is nothing left to do.\n    const emitEvents = !!events && !suppress?.skipEvents\n    const runIndexer = !!indexer && !suppress?.skipReindex\n    if (!emitEvents && !runIndexer) return\n    if (!identifiers?.id) return\n\n    let bus: EventBus | null = null\n    try {\n      bus = (this.container.resolve('eventBus') as EventBus)\n    } catch {\n      bus = null\n    }\n    if (!bus) return\n\n    const ctx = {\n      action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n\n    if (events && !suppress?.skipEvents) {\n      const eventName = `${events.module}.${events.entity}.${action}`\n      warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')\n      const builtPayload = events.buildPayload\n        ? events.buildPayload(ctx)\n        : {\n            id: ctx.identifiers.id,\n            organizationId: ctx.identifiers.organizationId,\n            tenantId: ctx.identifiers.tenantId,\n            ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),\n          }\n      // A configured indexer means this data-engine call owns the query-index\n      // decision, including an explicit skipReindex suppression. Mark object\n      // payloads so the legacy domain-event bridge does not enqueue the same\n      // record a second time. Keep the marker non-enumerable so client broadcasts\n      // and persisted domain payloads retain their existing public shape.\n      // Primitive custom payloads cannot be bridged in any case because they do\n      // not expose the record id.\n      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)\n        ? Object.defineProperty(\n            { ...(builtPayload as Record<string, unknown>) },\n            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n            { value: true, enumerable: false },\n          )\n        : builtPayload\n      try {\n        await bus.emitEvent(eventName, payload, {\n          persistent: !!events.persistent,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: ctx.identifiers.organizationId ?? null,\n        })\n      } catch {\n        // non-blocking\n      }\n    }\n\n    if (indexer && !suppress?.skipReindex) {\n      const alwaysConsistent = isReadProjectionAlwaysConsistent()\n      const resolveCoverageBaseDelta = (): number | undefined => {\n        if (action === 'created') return 1\n        if (action === 'deleted') return -1\n        return undefined\n      }\n      const coverageBaseDelta = resolveCoverageBaseDelta()\n\n      if (action === 'deleted') {\n        const payload = indexer.buildDeletePayload\n          ? indexer.buildDeletePayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the index update so query-index reads (the `customValues`/scalar\n        // projection that list endpoints serve) are consistent the moment the write\n        // returns. The subscriber removes the projection row + tokens synchronously and\n        // defers the coverage recompute + fulltext delete, so this stays bounded.\n        // Errors are logged, not thrown \u2014 index drift never fails the originating write.\n        // Always-consistent mode rethrows so drift is loud and retryable.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.delete_one emit failed', { err })\n          })\n        }\n      } else {\n        const payload = indexer.buildUpsertPayload\n          ? indexer.buildUpsertPayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the projection upsert so list reads observe the new doc immediately\n        // (see delete_one above). The subscriber updates `entity_indexes` synchronously\n        // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +\n        // tokenize + DELETE + chunked INSERT) so write latency stays bounded.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.upsert_one emit failed', { err })\n          })\n        }\n      }\n\n      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {\n        const coveragePayload = {\n          entityType: indexer.entityType,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: null,\n          delayMs: 0,\n        }\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })\n        } else {\n          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)\n        }\n      }\n    }\n  }\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void {\n    const { entity, identifiers } = opts\n    if (!entity) return\n    if (!identifiers?.id) return\n    const key = this.buildSideEffectKey(opts.action, identifiers)\n    const existing = this.pendingSideEffects.get(key)\n    if (existing) {\n      existing.entity = entity\n      existing.identifiers = {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      }\n      existing.syncOrigin = opts.syncOrigin ?? null\n      existing.actorUserId = opts.actorUserId ?? null\n      if (opts.events) existing.events = opts.events as CrudEventsConfig<unknown>\n      if (opts.indexer) existing.indexer = opts.indexer as CrudIndexerConfig<unknown>\n      this.pendingSideEffects.set(key, existing)\n      return\n    }\n    const entry: QueuedCrudSideEffect = {\n      action: opts.action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: opts.syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n    if (opts.events) entry.events = opts.events as CrudEventsConfig<unknown>\n    if (opts.indexer) entry.indexer = opts.indexer as CrudIndexerConfig<unknown>\n    this.pendingSideEffects.set(key, entry)\n  }\n\n  async flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void> {\n    if (!this.pendingSideEffects.size) return\n    const entries = Array.from(this.pendingSideEffects.values())\n    this.pendingSideEffects.clear()\n    for (const entry of entries) {\n      try {\n        await this.emitOrmEntityEvent({\n          action: entry.action,\n          entity: entry.entity,\n          identifiers: entry.identifiers,\n          syncOrigin: entry.syncOrigin ?? null,\n          actorUserId: entry.actorUserId ?? null,\n          events: entry.events as CrudEventsConfig<unknown>,\n          indexer: entry.indexer as CrudIndexerConfig<unknown>,\n          suppress,\n        })\n      } catch (error) {\n        if (isReadProjectionAlwaysConsistent()) {\n          throw error\n        }\n        // best-effort; continue with remaining side effects\n      }\n    }\n  }\n\n  private buildSideEffectKey(action: CrudEventAction, identifiers: CrudEntityIdentifiers): string {\n    const id = identifiers.id ?? ''\n    const org = identifiers.organizationId ?? ''\n    const tenant = identifiers.tenantId ?? ''\n    return [action, id, org, tenant].join('|')\n  }\n}\n"],
-  "mappings": "AAGA,SAAsB,WAAW;AACjC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAChD,SAAS,mDAAmD;AAE5D;AAAA,EACE;AAAA,OAKK;AAEP,SAAS,qBAAqB;AAC9B,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,yBAAyB;AAClC,SAAS,wCAAwC;AACjD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAExE,MAAM,wBAAwB,oBAAI,IAAY;AAE9C,SAAS,sBAAsB,WAAmB,SAAuB;AACvE,MAAI,gBAAgB,SAAS,EAAG;AAChC,MAAI,sBAAsB,IAAI,SAAS,EAAG;AAC1C,wBAAsB,IAAI,SAAS;AACnC,SAAO,KAAK,6IAAwI,EAAE,SAAS,UAAU,CAAC;AAC5K;AAGO,SAAS,yCAA+C;AAC7D,wBAAsB,MAAM;AAC9B;AAEA,MAAM,+BAA+B,IAAI,KAAK;AAC9C,MAAM,yBAAyB,oBAAI,IAAoB;AAEvD,SAAS,6BAA6B,YAAgC,UAAkC;AACtG,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,UAAU;AACnD,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAO,uBAAuB,IAAI,GAAG,KAAK;AAChD,MAAI,MAAM,OAAO,6BAA8B,QAAO;AACtD,yBAAuB,IAAI,KAAK,GAAG;AACnC,SAAO;AACT;AAqGO,MAAM,qCAAqC;AAY3C,SAAS,0BAA0B,IAAmB,UAA2B;AACtF,QAAM,WAAW,aAAa,KAAK;AACnC,QAAM,YAAY,OAAO,OAAO,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,OAAO,OAAO,kBAAkB,CAAC,CAAC,CAAC;AACzG,MAAI,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,QAAQ,EAAG,QAAO;AAClE,SAAO,iCAAiC,IAAI,QAAQ,MAAM;AAC5D;AAQO,SAAS,kCAAkC,IAAmB,UAAwB;AAC3F,MAAI,0BAA0B,IAAI,QAAQ,GAAG;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,MAAM,kBAAwC;AAAA,EAEnD,YAAoB,IAA2B,WAA4B;AAAvD;AAA2B;AAD/C,SAAQ,qBAAqB,oBAAI,IAAkC;AAAA,EACS;AAAA,EAE5E,MAAM,gBAAgB,MAAmE;AACvF,UAAM,EAAE,UAAU,UAAU,iBAAiB,MAAM,WAAW,MAAM,OAAO,IAAI;AAC/E,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,KAAK,0BAA0B,UAAU,gBAAgB,UAAU,eAA0C;AACnH,QAAI,oBAAyB;AAC7B,QAAI;AACF,0BAAoB,KAAK,UAAU,QAAQ,yBAAyB;AAAA,IACtE,QAAQ;AACN,0BAAoB;AAAA,IACtB;AACA,UAAM,sBAAsB,KAAK,IAAI;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,OAAO;AACzB,UAAI,MAAuB;AAC3B,UAAI;AACF,cAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,MAC1C,QAAQ;AACN,cAAM;AAAA,MACR;AACA,UAAI,KAAK;AACP,cAAM,CAAC,KAAK,GAAG,KAAK,YAAY,IAAI,MAAM,GAAG;AAC7C,YAAI,OAAO,KAAK;AACd,gBAAM,YAAY,GAAG,GAAG,IAAI,GAAG;AAC/B,gCAAsB,WAAW,iBAAiB;AAClD,cAAI;AACF,kBAAM,IAAI,UAAU,WAAW,EAAE,IAAI,UAAU,gBAAgB,SAAS,GAAG,EAAE,YAAY,KAAK,CAAC;AAAA,UACjG,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAgD;AACzE,UAAM,MAA0B,CAAC;AACjC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC,GAAG;AAEjD,UAAI,MAAM,QAAQ,MAAM,eAAe,MAAM,WAAY;AAEzD,UAAI,EAAE,WAAW,KAAK,EAAG,KAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI;AAAA,UAC9C,KAAI,CAAC,IAAI;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAgC;AACtC,QAAI;AACF,aAAO,kBAAkB,QAAQ,IAAI,sCAAsC,EAAE,MAAM;AAAA,IACrF,QAAQ;AAAE,aAAO;AAAA,IAAM;AAAA,EACzB;AAAA,EAEQ,YAAyB;AAC/B,WAAO,KAAK,GAAG,UAAe;AAAA,EAChC;AAAA,EAEA,MAAc,2BAA0C;AACtD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAClB,WAAW,2BAAkC,EAC7C,OAAO,OAAO,GAAG,SAAS,CAAC,EAC3B,MAAM,cAAqB,KAAK,yBAAyB,EACzD,iBAAiB;AACpB,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,MAAM,6EAA6E;AAAA,IAC/F;AAAA,EACF;AAAA,EAEQ,6BAA6B,QAA6E;AAChH,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,UAAU,OAAW;AACzB,UAAI,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG;AAClD,cAAM,aAAa,IAAI,MAAM,CAAC;AAC9B,YAAI,WAAY,KAAI,UAAU,IAAI;AAClC;AAAA,MACF;AACA,UAAI,GAAG,IAAI;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0BACZ,UACA,gBACA,UACA,QACe;AACf,UAAM,WAAW,KAAK,6BAA6B,MAAM;AACzD,QAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG;AACrD,UAAM,SAAS,MAAM,gCAAgC,KAAK,IAAI;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,QAAQ,OAAO,YAAY,CAAC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAAsF;AACnH,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,yBAAyB;AACpC,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,QAAQ,OAAO,KAAK,YAAY,EAAE,EAAE,KAAK;AAC/C,UAAM,SAAS,6EAA6E,KAAK,KAAK;AACtG,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,CAAC,SAAS,CAAC,UAAU,aAAa,YAAY,aAAa,SAAS,aAAa,UAAU,aAAa;AAC/H,UAAM,KAAK,kBAAkB,MAAc;AACzC,YAAM,IAAI;AACV,UAAI,EAAE,QAAQ,WAAY,QAAO,EAAE,OAAO,WAAW;AAErD,aAAO,uCAAuC,QAAQ,SAAS,CAAC,MAAM;AACpE,cAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,cAAM,IAAI,MAAM,MAAM,IAAK,IAAI,IAAO;AACtC,eAAO,EAAE,SAAS,EAAE;AAAA,MACtB,CAAC;AAAA,IACH,GAAG,IAAI;AACP,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,MAA+B,EAAE,IAAI,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,EAAE;AAE7F,UAAM,MAAM;AACZ,UAAM,UAAU;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9B,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AAGA,QAAI;AACF,YAAM,GACH,WAAW,yBAAgC,EAC3C,OAAO,OAAc,EACrB,WAAW,CAAC,OAAO,GACjB,QAAQ,CAAC,eAAe,aAAa,iBAAiB,CAAC,EACvD,YAAY;AAAA,QACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd,CAAQ,CAAC,EACV,QAAQ;AAAA,IACb,QAAQ;AAEN,UAAI;AACF,cAAM,UAAU,MAAM,GACnB,YAAY,yBAAgC,EAC5C,IAAI;AAAA,UACH,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,UAC9B,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EACP,MAAM,eAAsB,KAAK,KAAK,QAAQ,EAC9C,MAAM,aAAoB,KAAK,EAAE,EACjC,MAAM,mBAA0B,UAAU,OAAO,OAAO,KAAK,KAAY,EACzE,MAAM,aAAoB,aAAa,OAAO,OAAO,KAAK,QAAe,EACzE,iBAAiB;AACpB,YAAI,CAAC,WAAW,OAAO,QAAQ,kBAAkB,CAAC,MAAM,GAAG;AACzD,gBAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO,OAAc,EAAE,QAAQ;AAAA,QACvF;AAAA,MACF,SAAS,KAAK;AAEZ,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA,MACf,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,GAAG;AAAA,EACd;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAGlC,UAAM,KAAK,yBAAyB;AACpC,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,WAAW,yBAAgC,EAAE,OAAO,CAAC,KAAY,CAAC;AAAA,IACvE,EAAE,iBAAiB;AACnB,UAAM,UAAoC,KAAa,OAAO,EAAE,GAAG;AACnE,UAAM,UAAmC,EAAE,GAAG,SAAS,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,GAAG,GAAG;AAC7G,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,iBAAiB;AACnB,UAAI,CAAC,WAAW,OAAQ,QAAgB,kBAAkB,CAAC,MAAM,GAAG;AAClE,cAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO;AAAA,UAC3D,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,iBAAiB;AAAA,UACjB,WAAW;AAAA,UACX,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EAAE,QAAQ;AAAA,MACpB;AAAA,IACF,SAAS,KAAK;AACZ,YAAM;AAAA,IACR;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,OAAO,KAAK,SAAS;AAE3B,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AAEA,QAAI,MAAM;AACR,YAAM;AAAA,QACJ,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,QAAQ;AAAA,IACZ,OAAO;AACL,YAAM,WAAW,GAAG,WAAW,yBAAgC,CAAQ,EAAE,QAAQ;AAAA,IACnF;AAGA,QAAI;AACF,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mDAAmD;AAC7F,YAAM,SAAS,MAAM,KAAK,GAAG,KAAK,kBAAkB;AAAA,QAClD,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK,YAAY;AAAA,MAC7B,CAAC;AACD,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,UAAU,OAAO,OAAO,CAAC,WAAW;AACxC,YAAI,OAAO,UAAW,QAAO;AAC7B,eAAO,YAAY;AACnB,eAAO;AAAA,MACT,CAAC;AACD,UAAI,QAAQ,QAAQ;AAClB,mBAAW,UAAU,OAAQ,MAAK,GAAG,QAAQ,MAAM;AACnD,cAAM,KAAK,GAAG,MAAM;AAAA,MACtB;AAAA,IACF,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AAAA,EAEA,MAAM,gBAAkC,MAAkE;AACxG,UAAM,SAAS,KAAK,GAAG;AAAA,MACrB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAIlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,KAAK,MAAM,OAAO;AACxB,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAKlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,KAAK,SAAS,OAAO;AACvB,YAAM,QAAQ,KAAK,mBAAoB;AACvC,UAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD;AAAC,QAAC,QAAoC,KAAK,IAAI,oBAAI,KAAK;AACxD,cAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AAAA,MACvC;AAAA,IACF,OAAO;AACL,YAAM,KAAK,GAAG,OAAO,OAAO,EAAE,MAAM;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBAAsB,MASV;AAChB,UAAM,EAAE,QAAQ,QAAQ,QAAQ,SAAS,aAAa,YAAY,SAAS,IAAI;AAG/E,UAAM,aAAa,CAAC,CAAC,UAAU,CAAC,UAAU;AAC1C,UAAM,aAAa,CAAC,CAAC,WAAW,CAAC,UAAU;AAC3C,QAAI,CAAC,cAAc,CAAC,WAAY;AAChC,QAAI,CAAC,aAAa,GAAI;AAEtB,QAAI,MAAuB;AAC3B,QAAI;AACF,YAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,IAC1C,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAK;AAEV,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,cAAc;AAAA,MAC1B,aAAa,KAAK,eAAe;AAAA,IACnC;AAEA,QAAI,UAAU,CAAC,UAAU,YAAY;AACnC,YAAM,YAAY,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,MAAM;AAC7D,4BAAsB,WAAW,oBAAoB;AACrD,YAAM,eAAe,OAAO,eACxB,OAAO,aAAa,GAAG,IACvB;AAAA,QACE,IAAI,IAAI,YAAY;AAAA,QACpB,gBAAgB,IAAI,YAAY;AAAA,QAChC,UAAU,IAAI,YAAY;AAAA,QAC1B,GAAI,IAAI,aAAa,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;AAAA,MACzD;AAQJ,YAAM,UAAU,WAAW,gBAAgB,OAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ,YAAY,IACtG,OAAO;AAAA,QACL,EAAE,GAAI,aAAyC;AAAA,QAC/C;AAAA,QACA,EAAE,OAAO,MAAM,YAAY,MAAM;AAAA,MACnC,IACA;AACJ,UAAI;AACF,cAAM,IAAI,UAAU,WAAW,SAAS;AAAA,UACtC,YAAY,CAAC,CAAC,OAAO;AAAA,UACrB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB,IAAI,YAAY,kBAAkB;AAAA,QACpD,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,WAAW,CAAC,UAAU,aAAa;AACrC,YAAM,mBAAmB,iCAAiC;AAC1D,YAAM,2BAA2B,MAA0B;AACzD,YAAI,WAAW,UAAW,QAAO;AACjC,YAAI,WAAW,UAAW,QAAO;AACjC,eAAO;AAAA,MACT;AACA,YAAM,oBAAoB,yBAAyB;AAEnD,UAAI,WAAW,WAAW;AACxB,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAOrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF,OAAO;AACL,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAKrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,oBAAoB,6BAA6B,QAAQ,YAAY,IAAI,YAAY,YAAY,IAAI,GAAG;AAC1G,cAAM,kBAAkB;AAAA,UACtB,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB;AAAA,UAChB,SAAS;AAAA,QACX;AACA,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,gCAAgC,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QACrG,OAAO;AACL,eAAK,IAAI,UAAU,gCAAgC,eAAe,EAAE,MAAM,MAAM,MAAS;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAuB,MAQd;AACP,UAAM,EAAE,QAAQ,YAAY,IAAI;AAChC,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,aAAa,GAAI;AACtB,UAAM,MAAM,KAAK,mBAAmB,KAAK,QAAQ,WAAW;AAC5D,UAAM,WAAW,KAAK,mBAAmB,IAAI,GAAG;AAChD,QAAI,UAAU;AACZ,eAAS,SAAS;AAClB,eAAS,cAAc;AAAA,QACrB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AACA,eAAS,aAAa,KAAK,cAAc;AACzC,eAAS,cAAc,KAAK,eAAe;AAC3C,UAAI,KAAK,OAAQ,UAAS,SAAS,KAAK;AACxC,UAAI,KAAK,QAAS,UAAS,UAAU,KAAK;AAC1C,WAAK,mBAAmB,IAAI,KAAK,QAAQ;AACzC;AAAA,IACF;AACA,UAAM,QAA8B;AAAA,MAClC,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,QAAI,KAAK,QAAS,OAAM,UAAU,KAAK;AACvC,SAAK,mBAAmB,IAAI,KAAK,KAAK;AAAA,EACxC;AAAA,EAEA,MAAM,sBAAsB,UAAiD;AAC3E,QAAI,CAAC,KAAK,mBAAmB,KAAM;AACnC,UAAM,UAAU,MAAM,KAAK,KAAK,mBAAmB,OAAO,CAAC;AAC3D,SAAK,mBAAmB,MAAM;AAC9B,eAAW,SAAS,SAAS;AAC3B,UAAI;AACF,cAAM,KAAK,mBAAmB;AAAA,UAC5B,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,YAAY,MAAM,cAAc;AAAA,UAChC,aAAa,MAAM,eAAe;AAAA,UAClC,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iCAAiC,GAAG;AACtC,gBAAM;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAyB,aAA4C;AAC9F,UAAM,KAAK,YAAY,MAAM;AAC7B,UAAM,MAAM,YAAY,kBAAkB;AAC1C,UAAM,SAAS,YAAY,YAAY;AACvC,WAAO,CAAC,QAAQ,IAAI,KAAK,MAAM,EAAE,KAAK,GAAG;AAAA,EAC3C;AACF;",
+  "sourcesContent": ["import type { EntityData, EntityName, FilterQuery, RequiredEntityData } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { type Kysely, sql } from 'kysely'\nimport { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'\nimport { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'\nimport { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'\nimport type { EventBus } from '@open-mercato/events/types'\nimport {\n  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n  type CrudEventAction,\n  type CrudEventsConfig,\n  type CrudIndexerConfig,\n  type CrudEntityIdentifiers,\n} from '../crud/types'\nimport type { BulkImportSuppression } from '../commands/types'\nimport { CrudHttpError } from '../crud/errors'\nimport { resolveRegisteredEntityTableName } from '../query/engine'\nimport { getEntityIds } from '../encryption/entityIds'\nimport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nimport { parseBooleanToken } from '../boolean'\nimport { isReadProjectionAlwaysConsistent } from './consistency'\nimport { isEventDeclared } from '../../modules/events'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'data-engine' })\n\nconst undeclaredEventWarned = new Set<string>()\n\nfunction warnIfUndeclaredEvent(eventName: string, context: string): void {\n  if (isEventDeclared(eventName)) return\n  if (undeclaredEventWarned.has(eventName)) return\n  undeclaredEventWarned.add(eventName)\n  logger.warn('Emitting undeclared event \u2014 declare it in the owning module events.ts (createModuleEvents) so the event registry stays authoritative', { context, eventName })\n}\n\n/** Internal: clear the undeclared-event warning cache. Exposed for tests. */\nexport function __resetUndeclaredEventWarningsForTests(): void {\n  undeclaredEventWarned.clear()\n}\n\nconst COVERAGE_REFRESH_INTERVAL_MS = 5 * 60 * 1000\nconst coverageRefreshTracker = new Map<string, number>()\n\nfunction shouldTriggerCoverageRefresh(entityType: string | undefined, tenantId: string | null): boolean {\n  if (!entityType) return false\n  const key = `${entityType}|${tenantId ?? '__null__'}`\n  const now = Date.now()\n  const last = coverageRefreshTracker.get(key) ?? 0\n  if (now - last < COVERAGE_REFRESH_INTERVAL_MS) return false\n  coverageRefreshTracker.set(key, now)\n  return true\n}\n\ntype CustomEntityValues = Record<string, unknown>\n\ntype QueuedCrudSideEffect = {\n  action: CrudEventAction\n  entity: unknown\n  identifiers: CrudEntityIdentifiers\n  syncOrigin?: string | null\n  actorUserId?: string | null\n  events?: CrudEventsConfig<unknown>\n  indexer?: CrudIndexerConfig<unknown>\n}\n\nexport interface DataEngine {\n  setCustomFields(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: Record<string, string | number | boolean | null | undefined | Array<string | number | boolean | null | undefined>>\n    notify?: boolean // default true -> emit '<module>.<entity>.updated'\n  }): Promise<void>\n\n  // Storage for user-defined entities (doc-based)\n  createCustomEntityRecord(opts: {\n    entityId: string // '<module>:<entity>'\n    recordId?: string // optional; auto-generate if not provided\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<{ id: string }>\n\n  updateCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<void>\n\n  deleteCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    soft?: boolean // default true: sets deleted_at\n    notify?: boolean // keep event emitting as it is (no extra events here)\n  }): Promise<void>\n\n  // Generic ORM-backed entity operations used by CrudFactory\n  createOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    data: EntityData<T>\n  }): Promise<T>\n\n  updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null>\n\n  deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null>\n\n  emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    /** Bulk-import deferral: skip the domain event and/or inline reindex for this emit. */\n    suppress?: BulkImportSuppression\n  }): Promise<void>\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void\n\n  /**\n   * Drain queued side effects. When `suppress` is passed (a bulk-import backfill), the\n   * flagged per-record events / reindex are skipped for every drained entry; the caller\n   * is responsible for rebuilding the `query_index` afterwards.\n   */\n  flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void>\n}\n\nexport const SYSTEM_ENTITY_RECORDS_BLOCKED_CODE = 'system_entity_records_blocked'\n\n/**\n * A system entity for doc-storage purposes is an id that modules declare in the\n * generated entity-id registry AND that resolves to a registered ORM table. Both\n * conditions matter: `resolveRegisteredEntityTableName` matches class-name candidates\n * from the entity segment alone, so a runtime-registered custom entity whose name\n * happens to collide with some ORM class (e.g. `user:todo` vs the example module's\n * `Todo`) must never be classified as system. When the registry is not populated\n * (exotic bootstraps, unit harnesses) the check conservatively falls back to the\n * ORM-table match alone so the #2939 protection never switches off.\n */\nexport function isOrmBackedSystemEntityId(em: EntityManager, entityId: string): boolean {\n  const registry = getEntityIds(false)\n  const moduleIds = Object.values(registry).flatMap((moduleEntities) => Object.values(moduleEntities ?? {}))\n  if (moduleIds.length > 0 && !moduleIds.includes(entityId)) return false\n  return resolveRegisteredEntityTableName(em, entityId) !== null\n}\n\n/**\n * Doc storage (`custom_entities_storage`) is for custom entities only. A system\n * entity's records live in its own module tables/APIs \u2014 writing doc rows for it\n * poisons read-path classification (#2939) and must be rejected at the deepest\n * seam so no caller (API, AI tool, workflow) can do it.\n */\nexport function assertCustomEntityStorageEntityId(em: EntityManager, entityId: string): void {\n  if (isOrmBackedSystemEntityId(em, entityId)) {\n    throw new CrudHttpError(400, {\n      error: 'Records are available for custom entities only',\n      code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE,\n      entityId,\n    })\n  }\n}\n\nexport class DefaultDataEngine implements DataEngine {\n  private pendingSideEffects = new Map<string, QueuedCrudSideEffect>()\n  constructor(private em: EntityManager, private container: AwilixContainer) {}\n\n  async setCustomFields(opts: Parameters<DataEngine['setCustomFields']>[0]): Promise<void> {\n    const { entityId, recordId, organizationId = null, tenantId = null, values } = opts\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values,\n    })\n    await this.validateCustomFieldValues(entityId, organizationId, tenantId, sanitizedValues as Record<string, unknown>)\n    let encryptionService: any = null\n    try {\n      encryptionService = this.container.resolve('tenantEncryptionService') as any\n    } catch {\n      encryptionService = null\n    }\n    await setRecordCustomFields(this.em, {\n      entityId,\n      recordId,\n      organizationId,\n      tenantId,\n      values: sanitizedValues,\n      encryptionService,\n    })\n    if (opts.notify !== false) {\n      let bus: EventBus | null = null\n      try {\n        bus = (this.container.resolve('eventBus') as EventBus)\n      } catch {\n        bus = null\n      }\n      if (bus) {\n        const [mod, ent] = (entityId || '').split(':')\n        if (mod && ent) {\n          const eventName = `${mod}.${ent}.updated`\n          warnIfUndeclaredEvent(eventName, 'setCustomFields')\n          try {\n            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, {\n              persistent: true,\n              tenantId,\n              organizationId,\n              emitterModuleId: mod,\n            })\n          } catch {\n            // non-blocking\n          }\n        }\n      }\n    }\n  }\n\n  private normalizeDocValues(values: CustomEntityValues): CustomEntityValues {\n    const out: CustomEntityValues = {}\n    for (const [k, v] of Object.entries(values || {})) {\n      // Never allow callers to override reserved identifiers in the doc\n      if (k === 'id' || k === 'entity_id' || k === 'entityId') continue\n      // Accept both 'cf_<key>' and 'cf:<key>' inputs and normalize to 'cf:<key>'\n      if (k.startsWith('cf_')) out[`cf:${k.slice(3)}`] = v\n      else out[k] = v\n    }\n    return out\n  }\n\n  private backcompatEavEnabled(): boolean {\n    try {\n      return parseBooleanToken(process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM ?? '') === true\n    } catch { return false }\n  }\n\n  private getKysely(): Kysely<any> {\n    return this.em.getKysely<any>()\n  }\n\n  private async ensureStorageTableExists(): Promise<void> {\n    const db = this.getKysely()\n    const exists = await db\n      .selectFrom('information_schema.tables' as any)\n      .select(sql`1`.as('present'))\n      .where('table_name' as any, '=', 'custom_entities_storage')\n      .executeTakeFirst()\n    if (!exists) {\n      throw new Error('custom_entities_storage table is missing. Run migrations (yarn db:migrate).')\n    }\n  }\n\n  private normalizeValuesForValidation(values: Record<string, unknown> | undefined | null): Record<string, unknown> {\n    if (!values) return {}\n    const out: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(values)) {\n      if (value === undefined) continue\n      if (key.startsWith('cf_') || key.startsWith('cf:')) {\n        const normalized = key.slice(3)\n        if (normalized) out[normalized] = value\n        continue\n      }\n      out[key] = value\n    }\n    return out\n  }\n\n  private async validateCustomFieldValues(\n    entityId: string,\n    organizationId: string | null,\n    tenantId: string | null,\n    values: Record<string, unknown> | undefined | null,\n  ): Promise<void> {\n    const prepared = this.normalizeValuesForValidation(values)\n    if (!entityId || Object.keys(prepared).length === 0) return\n    const result = await validateCustomFieldValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values: prepared,\n    })\n    if (!result.ok) {\n      throw new CrudHttpError(400, { error: 'Validation failed', fields: result.fieldErrors })\n    }\n  }\n\n  async createCustomEntityRecord(opts: Parameters<DataEngine['createCustomEntityRecord']>[0]): Promise<{ id: string }> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    await this.ensureStorageTableExists()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const rawId = String(opts.recordId ?? '').trim()\n    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(rawId)\n    const sentinel = rawId.toLowerCase()\n    const shouldGenerate = !rawId || !isUuid || sentinel === 'create' || sentinel === 'new' || sentinel === 'null' || sentinel === 'undefined'\n    const id = shouldGenerate ? ((): string => {\n      const g = globalThis as { crypto?: { randomUUID?: () => string } }\n      if (g.crypto?.randomUUID) return g.crypto.randomUUID()\n      // Fallback UUIDv4 generator\n      return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n        const r = (Math.random() * 16) | 0\n        const v = c === 'x' ? r : (r & 0x3) | 0x8\n        return v.toString(16)\n      })\n    })() : rawId\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const doc: Record<string, unknown> = { id, ...this.normalizeDocValues(sanitizedValues || {}) }\n\n    const now = sql`now()`\n    const payload = {\n      entity_type: opts.entityId,\n      entity_id: id,\n      organization_id: orgId,\n      tenant_id: tenantId,\n      doc: sql`${JSON.stringify(doc)}::jsonb`,\n      updated_at: now,\n      created_at: now,\n      deleted_at: null,\n    }\n\n    // Upsert by scoped uniqueness\n    try {\n      await db\n        .insertInto('custom_entities_storage' as any)\n        .values(payload as any)\n        .onConflict((oc) => oc\n          .columns(['entity_type', 'entity_id', 'organization_id'])\n          .doUpdateSet({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any))\n        .execute()\n    } catch {\n      // Fallback for global scope uniqueness\n      try {\n        const updated = await db\n          .updateTable('custom_entities_storage' as any)\n          .set({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any)\n          .where('entity_type' as any, '=', opts.entityId)\n          .where('entity_id' as any, '=', id)\n          .where('organization_id' as any, orgId === null ? 'is' : '=', orgId as any)\n          .where('tenant_id' as any, tenantId === null ? 'is' : '=', tenantId as any)\n          .executeTakeFirst()\n        if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {\n          await db.insertInto('custom_entities_storage' as any).values(payload as any).execute()\n        }\n      } catch (err) {\n        // Surface a clear error so it doesn't silently fall back only to EAV\n        throw err\n      }\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n      })\n    }\n\n    return { id }\n  }\n\n  async updateCustomEntityRecord(opts: Parameters<DataEngine['updateCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n\n    // Merge doc shallowly: load existing doc and overlay\n    await this.ensureStorageTableExists()\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n    const row = await applyScope(\n      db.selectFrom('custom_entities_storage' as any).select(['doc' as any])\n    ).executeTakeFirst()\n    const prevDoc: Record<string, unknown> = (row as any)?.doc || { id }\n    const nextDoc: Record<string, unknown> = { ...prevDoc, ...this.normalizeDocValues(sanitizedValues || {}), id }\n    try {\n      const updated = await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any) as any\n      ).executeTakeFirst()\n      if (!updated || Number((updated as any).numUpdatedRows ?? 0) === 0) {\n        await db.insertInto('custom_entities_storage' as any).values({\n          entity_type: opts.entityId,\n          entity_id: id,\n          organization_id: orgId,\n          tenant_id: tenantId,\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          created_at: sql`now()`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any).execute()\n      }\n    } catch (err) {\n      throw err\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n      })\n    }\n  }\n\n  async deleteCustomEntityRecord(opts: Parameters<DataEngine['deleteCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const soft = opts.soft !== false\n\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n\n    if (soft) {\n      await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          deleted_at: sql`now()`,\n          updated_at: sql`now()`,\n        } as any) as any\n      ).execute()\n    } else {\n      await applyScope(db.deleteFrom('custom_entities_storage' as any) as any).execute()\n    }\n\n    // Soft-delete EAV values to preserve current behavior\n    try {\n      const { CustomFieldValue } = await import('@open-mercato/core/modules/entities/data/entities')\n      const values = await this.em.find(CustomFieldValue, {\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: opts.tenantId ?? null,\n      })\n      const now = new Date()\n      const mutated = values.filter((record) => {\n        if (record.deletedAt) return false\n        record.deletedAt = now\n        return true\n      })\n      if (mutated.length) {\n        for (const record of values) this.em.persist(record)\n        await this.em.flush()\n      }\n    } catch { /* non-blocking */ }\n  }\n\n  async createOrmEntity<T extends object>(opts: { entity: EntityName<T>; data: EntityData<T> }): Promise<T> {\n    const entity = this.em.create(\n      opts.entity as EntityName<T>,\n      opts.data as unknown as RequiredEntityData<T>\n    )\n    await this.em.persist(entity).flush()\n    return entity\n  }\n\n  async updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    await opts.apply(current)\n    await this.em.persist(current).flush()\n    return current\n  }\n\n  async deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    if (opts.soft !== false) {\n      const field = opts.softDeleteField || ('deletedAt' as keyof T & string)\n      if (typeof current === 'object' && current !== null) {\n        ;(current as Record<string, unknown>)[field] = new Date()\n        await this.em.persist(current).flush()\n      }\n    } else {\n      await this.em.remove(current).flush()\n    }\n    return current\n  }\n\n  async emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    suppress?: BulkImportSuppression\n  }): Promise<void> {\n    const { action, entity, events, indexer, identifiers, syncOrigin, suppress } = opts\n    // Bulk-import deferral: an entry may suppress its domain event and/or inline reindex. When both\n    // the config is absent AND (for the present one) suppressed, there is nothing left to do.\n    const emitEvents = !!events && !suppress?.skipEvents\n    const runIndexer = !!indexer && !suppress?.skipReindex\n    if (!emitEvents && !runIndexer) return\n    if (!identifiers?.id) return\n\n    let bus: EventBus | null = null\n    try {\n      bus = (this.container.resolve('eventBus') as EventBus)\n    } catch {\n      bus = null\n    }\n    if (!bus) return\n\n    const ctx = {\n      action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n\n    if (events && !suppress?.skipEvents) {\n      const eventName = `${events.module}.${events.entity}.${action}`\n      warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')\n      const builtPayload = events.buildPayload\n        ? events.buildPayload(ctx)\n        : {\n            id: ctx.identifiers.id,\n            organizationId: ctx.identifiers.organizationId,\n            tenantId: ctx.identifiers.tenantId,\n            ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),\n          }\n      // A configured indexer means this data-engine call owns the query-index\n      // decision, including an explicit skipReindex suppression. Mark object\n      // payloads so the legacy domain-event bridge does not enqueue the same\n      // record a second time. Keep the marker non-enumerable so client broadcasts\n      // and persisted domain payloads retain their existing public shape.\n      // Primitive custom payloads cannot be bridged in any case because they do\n      // not expose the record id.\n      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)\n        ? Object.defineProperty(\n            { ...(builtPayload as Record<string, unknown>) },\n            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n            { value: true, enumerable: false },\n          )\n        : builtPayload\n      try {\n        await bus.emitEvent(eventName, payload, {\n          persistent: !!events.persistent,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: ctx.identifiers.organizationId ?? null,\n          emitterModuleId: events.module,\n        })\n      } catch {\n        // non-blocking\n      }\n    }\n\n    if (indexer && !suppress?.skipReindex) {\n      const alwaysConsistent = isReadProjectionAlwaysConsistent()\n      const resolveCoverageBaseDelta = (): number | undefined => {\n        if (action === 'created') return 1\n        if (action === 'deleted') return -1\n        return undefined\n      }\n      const coverageBaseDelta = resolveCoverageBaseDelta()\n\n      if (action === 'deleted') {\n        const payload = indexer.buildDeletePayload\n          ? indexer.buildDeletePayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the index update so query-index reads (the `customValues`/scalar\n        // projection that list endpoints serve) are consistent the moment the write\n        // returns. The subscriber removes the projection row + tokens synchronously and\n        // defers the coverage recompute + fulltext delete, so this stays bounded.\n        // Errors are logged, not thrown \u2014 index drift never fails the originating write.\n        // Always-consistent mode rethrows so drift is loud and retryable.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.delete_one emit failed', { err })\n          })\n        }\n      } else {\n        const payload = indexer.buildUpsertPayload\n          ? indexer.buildUpsertPayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the projection upsert so list reads observe the new doc immediately\n        // (see delete_one above). The subscriber updates `entity_indexes` synchronously\n        // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +\n        // tokenize + DELETE + chunked INSERT) so write latency stays bounded.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.upsert_one emit failed', { err })\n          })\n        }\n      }\n\n      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {\n        const coveragePayload = {\n          entityType: indexer.entityType,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: null,\n          delayMs: 0,\n        }\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })\n        } else {\n          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)\n        }\n      }\n    }\n  }\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void {\n    const { entity, identifiers } = opts\n    if (!entity) return\n    if (!identifiers?.id) return\n    const key = this.buildSideEffectKey(opts.action, identifiers)\n    const existing = this.pendingSideEffects.get(key)\n    if (existing) {\n      existing.entity = entity\n      existing.identifiers = {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      }\n      existing.syncOrigin = opts.syncOrigin ?? null\n      existing.actorUserId = opts.actorUserId ?? null\n      if (opts.events) existing.events = opts.events as CrudEventsConfig<unknown>\n      if (opts.indexer) existing.indexer = opts.indexer as CrudIndexerConfig<unknown>\n      this.pendingSideEffects.set(key, existing)\n      return\n    }\n    const entry: QueuedCrudSideEffect = {\n      action: opts.action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: opts.syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n    if (opts.events) entry.events = opts.events as CrudEventsConfig<unknown>\n    if (opts.indexer) entry.indexer = opts.indexer as CrudIndexerConfig<unknown>\n    this.pendingSideEffects.set(key, entry)\n  }\n\n  async flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void> {\n    if (!this.pendingSideEffects.size) return\n    const entries = Array.from(this.pendingSideEffects.values())\n    this.pendingSideEffects.clear()\n    for (const entry of entries) {\n      try {\n        await this.emitOrmEntityEvent({\n          action: entry.action,\n          entity: entry.entity,\n          identifiers: entry.identifiers,\n          syncOrigin: entry.syncOrigin ?? null,\n          actorUserId: entry.actorUserId ?? null,\n          events: entry.events as CrudEventsConfig<unknown>,\n          indexer: entry.indexer as CrudIndexerConfig<unknown>,\n          suppress,\n        })\n      } catch (error) {\n        if (isReadProjectionAlwaysConsistent()) {\n          throw error\n        }\n        // best-effort; continue with remaining side effects\n      }\n    }\n  }\n\n  private buildSideEffectKey(action: CrudEventAction, identifiers: CrudEntityIdentifiers): string {\n    const id = identifiers.id ?? ''\n    const org = identifiers.organizationId ?? ''\n    const tenant = identifiers.tenantId ?? ''\n    return [action, id, org, tenant].join('|')\n  }\n}\n"],
+  "mappings": "AAGA,SAAsB,WAAW;AACjC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAChD,SAAS,mDAAmD;AAE5D;AAAA,EACE;AAAA,OAKK;AAEP,SAAS,qBAAqB;AAC9B,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,yBAAyB;AAClC,SAAS,wCAAwC;AACjD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAExE,MAAM,wBAAwB,oBAAI,IAAY;AAE9C,SAAS,sBAAsB,WAAmB,SAAuB;AACvE,MAAI,gBAAgB,SAAS,EAAG;AAChC,MAAI,sBAAsB,IAAI,SAAS,EAAG;AAC1C,wBAAsB,IAAI,SAAS;AACnC,SAAO,KAAK,6IAAwI,EAAE,SAAS,UAAU,CAAC;AAC5K;AAGO,SAAS,yCAA+C;AAC7D,wBAAsB,MAAM;AAC9B;AAEA,MAAM,+BAA+B,IAAI,KAAK;AAC9C,MAAM,yBAAyB,oBAAI,IAAoB;AAEvD,SAAS,6BAA6B,YAAgC,UAAkC;AACtG,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,UAAU;AACnD,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAO,uBAAuB,IAAI,GAAG,KAAK;AAChD,MAAI,MAAM,OAAO,6BAA8B,QAAO;AACtD,yBAAuB,IAAI,KAAK,GAAG;AACnC,SAAO;AACT;AAqGO,MAAM,qCAAqC;AAY3C,SAAS,0BAA0B,IAAmB,UAA2B;AACtF,QAAM,WAAW,aAAa,KAAK;AACnC,QAAM,YAAY,OAAO,OAAO,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,OAAO,OAAO,kBAAkB,CAAC,CAAC,CAAC;AACzG,MAAI,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,QAAQ,EAAG,QAAO;AAClE,SAAO,iCAAiC,IAAI,QAAQ,MAAM;AAC5D;AAQO,SAAS,kCAAkC,IAAmB,UAAwB;AAC3F,MAAI,0BAA0B,IAAI,QAAQ,GAAG;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,MAAM,kBAAwC;AAAA,EAEnD,YAAoB,IAA2B,WAA4B;AAAvD;AAA2B;AAD/C,SAAQ,qBAAqB,oBAAI,IAAkC;AAAA,EACS;AAAA,EAE5E,MAAM,gBAAgB,MAAmE;AACvF,UAAM,EAAE,UAAU,UAAU,iBAAiB,MAAM,WAAW,MAAM,OAAO,IAAI;AAC/E,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,KAAK,0BAA0B,UAAU,gBAAgB,UAAU,eAA0C;AACnH,QAAI,oBAAyB;AAC7B,QAAI;AACF,0BAAoB,KAAK,UAAU,QAAQ,yBAAyB;AAAA,IACtE,QAAQ;AACN,0BAAoB;AAAA,IACtB;AACA,UAAM,sBAAsB,KAAK,IAAI;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,OAAO;AACzB,UAAI,MAAuB;AAC3B,UAAI;AACF,cAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,MAC1C,QAAQ;AACN,cAAM;AAAA,MACR;AACA,UAAI,KAAK;AACP,cAAM,CAAC,KAAK,GAAG,KAAK,YAAY,IAAI,MAAM,GAAG;AAC7C,YAAI,OAAO,KAAK;AACd,gBAAM,YAAY,GAAG,GAAG,IAAI,GAAG;AAC/B,gCAAsB,WAAW,iBAAiB;AAClD,cAAI;AACF,kBAAM,IAAI,UAAU,WAAW,EAAE,IAAI,UAAU,gBAAgB,SAAS,GAAG;AAAA,cACzE,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACA,iBAAiB;AAAA,YACnB,CAAC;AAAA,UACH,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAgD;AACzE,UAAM,MAA0B,CAAC;AACjC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC,GAAG;AAEjD,UAAI,MAAM,QAAQ,MAAM,eAAe,MAAM,WAAY;AAEzD,UAAI,EAAE,WAAW,KAAK,EAAG,KAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI;AAAA,UAC9C,KAAI,CAAC,IAAI;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAgC;AACtC,QAAI;AACF,aAAO,kBAAkB,QAAQ,IAAI,sCAAsC,EAAE,MAAM;AAAA,IACrF,QAAQ;AAAE,aAAO;AAAA,IAAM;AAAA,EACzB;AAAA,EAEQ,YAAyB;AAC/B,WAAO,KAAK,GAAG,UAAe;AAAA,EAChC;AAAA,EAEA,MAAc,2BAA0C;AACtD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAClB,WAAW,2BAAkC,EAC7C,OAAO,OAAO,GAAG,SAAS,CAAC,EAC3B,MAAM,cAAqB,KAAK,yBAAyB,EACzD,iBAAiB;AACpB,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,MAAM,6EAA6E;AAAA,IAC/F;AAAA,EACF;AAAA,EAEQ,6BAA6B,QAA6E;AAChH,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,UAAU,OAAW;AACzB,UAAI,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG;AAClD,cAAM,aAAa,IAAI,MAAM,CAAC;AAC9B,YAAI,WAAY,KAAI,UAAU,IAAI;AAClC;AAAA,MACF;AACA,UAAI,GAAG,IAAI;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0BACZ,UACA,gBACA,UACA,QACe;AACf,UAAM,WAAW,KAAK,6BAA6B,MAAM;AACzD,QAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG;AACrD,UAAM,SAAS,MAAM,gCAAgC,KAAK,IAAI;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,QAAQ,OAAO,YAAY,CAAC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAAsF;AACnH,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,yBAAyB;AACpC,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,QAAQ,OAAO,KAAK,YAAY,EAAE,EAAE,KAAK;AAC/C,UAAM,SAAS,6EAA6E,KAAK,KAAK;AACtG,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,CAAC,SAAS,CAAC,UAAU,aAAa,YAAY,aAAa,SAAS,aAAa,UAAU,aAAa;AAC/H,UAAM,KAAK,kBAAkB,MAAc;AACzC,YAAM,IAAI;AACV,UAAI,EAAE,QAAQ,WAAY,QAAO,EAAE,OAAO,WAAW;AAErD,aAAO,uCAAuC,QAAQ,SAAS,CAAC,MAAM;AACpE,cAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,cAAM,IAAI,MAAM,MAAM,IAAK,IAAI,IAAO;AACtC,eAAO,EAAE,SAAS,EAAE;AAAA,MACtB,CAAC;AAAA,IACH,GAAG,IAAI;AACP,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,MAA+B,EAAE,IAAI,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,EAAE;AAE7F,UAAM,MAAM;AACZ,UAAM,UAAU;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9B,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AAGA,QAAI;AACF,YAAM,GACH,WAAW,yBAAgC,EAC3C,OAAO,OAAc,EACrB,WAAW,CAAC,OAAO,GACjB,QAAQ,CAAC,eAAe,aAAa,iBAAiB,CAAC,EACvD,YAAY;AAAA,QACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd,CAAQ,CAAC,EACV,QAAQ;AAAA,IACb,QAAQ;AAEN,UAAI;AACF,cAAM,UAAU,MAAM,GACnB,YAAY,yBAAgC,EAC5C,IAAI;AAAA,UACH,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,UAC9B,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EACP,MAAM,eAAsB,KAAK,KAAK,QAAQ,EAC9C,MAAM,aAAoB,KAAK,EAAE,EACjC,MAAM,mBAA0B,UAAU,OAAO,OAAO,KAAK,KAAY,EACzE,MAAM,aAAoB,aAAa,OAAO,OAAO,KAAK,QAAe,EACzE,iBAAiB;AACpB,YAAI,CAAC,WAAW,OAAO,QAAQ,kBAAkB,CAAC,MAAM,GAAG;AACzD,gBAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO,OAAc,EAAE,QAAQ;AAAA,QACvF;AAAA,MACF,SAAS,KAAK;AAEZ,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA,MACf,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,GAAG;AAAA,EACd;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAGlC,UAAM,KAAK,yBAAyB;AACpC,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,WAAW,yBAAgC,EAAE,OAAO,CAAC,KAAY,CAAC;AAAA,IACvE,EAAE,iBAAiB;AACnB,UAAM,UAAoC,KAAa,OAAO,EAAE,GAAG;AACnE,UAAM,UAAmC,EAAE,GAAG,SAAS,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,GAAG,GAAG;AAC7G,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,iBAAiB;AACnB,UAAI,CAAC,WAAW,OAAQ,QAAgB,kBAAkB,CAAC,MAAM,GAAG;AAClE,cAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO;AAAA,UAC3D,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,iBAAiB;AAAA,UACjB,WAAW;AAAA,UACX,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EAAE,QAAQ;AAAA,MACpB;AAAA,IACF,SAAS,KAAK;AACZ,YAAM;AAAA,IACR;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,OAAO,KAAK,SAAS;AAE3B,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AAEA,QAAI,MAAM;AACR,YAAM;AAAA,QACJ,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,QAAQ;AAAA,IACZ,OAAO;AACL,YAAM,WAAW,GAAG,WAAW,yBAAgC,CAAQ,EAAE,QAAQ;AAAA,IACnF;AAGA,QAAI;AACF,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mDAAmD;AAC7F,YAAM,SAAS,MAAM,KAAK,GAAG,KAAK,kBAAkB;AAAA,QAClD,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK,YAAY;AAAA,MAC7B,CAAC;AACD,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,UAAU,OAAO,OAAO,CAAC,WAAW;AACxC,YAAI,OAAO,UAAW,QAAO;AAC7B,eAAO,YAAY;AACnB,eAAO;AAAA,MACT,CAAC;AACD,UAAI,QAAQ,QAAQ;AAClB,mBAAW,UAAU,OAAQ,MAAK,GAAG,QAAQ,MAAM;AACnD,cAAM,KAAK,GAAG,MAAM;AAAA,MACtB;AAAA,IACF,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AAAA,EAEA,MAAM,gBAAkC,MAAkE;AACxG,UAAM,SAAS,KAAK,GAAG;AAAA,MACrB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAIlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,KAAK,MAAM,OAAO;AACxB,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAKlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,KAAK,SAAS,OAAO;AACvB,YAAM,QAAQ,KAAK,mBAAoB;AACvC,UAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD;AAAC,QAAC,QAAoC,KAAK,IAAI,oBAAI,KAAK;AACxD,cAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AAAA,MACvC;AAAA,IACF,OAAO;AACL,YAAM,KAAK,GAAG,OAAO,OAAO,EAAE,MAAM;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBAAsB,MASV;AAChB,UAAM,EAAE,QAAQ,QAAQ,QAAQ,SAAS,aAAa,YAAY,SAAS,IAAI;AAG/E,UAAM,aAAa,CAAC,CAAC,UAAU,CAAC,UAAU;AAC1C,UAAM,aAAa,CAAC,CAAC,WAAW,CAAC,UAAU;AAC3C,QAAI,CAAC,cAAc,CAAC,WAAY;AAChC,QAAI,CAAC,aAAa,GAAI;AAEtB,QAAI,MAAuB;AAC3B,QAAI;AACF,YAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,IAC1C,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAK;AAEV,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,cAAc;AAAA,MAC1B,aAAa,KAAK,eAAe;AAAA,IACnC;AAEA,QAAI,UAAU,CAAC,UAAU,YAAY;AACnC,YAAM,YAAY,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,MAAM;AAC7D,4BAAsB,WAAW,oBAAoB;AACrD,YAAM,eAAe,OAAO,eACxB,OAAO,aAAa,GAAG,IACvB;AAAA,QACE,IAAI,IAAI,YAAY;AAAA,QACpB,gBAAgB,IAAI,YAAY;AAAA,QAChC,UAAU,IAAI,YAAY;AAAA,QAC1B,GAAI,IAAI,aAAa,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;AAAA,MACzD;AAQJ,YAAM,UAAU,WAAW,gBAAgB,OAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ,YAAY,IACtG,OAAO;AAAA,QACL,EAAE,GAAI,aAAyC;AAAA,QAC/C;AAAA,QACA,EAAE,OAAO,MAAM,YAAY,MAAM;AAAA,MACnC,IACA;AACJ,UAAI;AACF,cAAM,IAAI,UAAU,WAAW,SAAS;AAAA,UACtC,YAAY,CAAC,CAAC,OAAO;AAAA,UACrB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB,IAAI,YAAY,kBAAkB;AAAA,UAClD,iBAAiB,OAAO;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,WAAW,CAAC,UAAU,aAAa;AACrC,YAAM,mBAAmB,iCAAiC;AAC1D,YAAM,2BAA2B,MAA0B;AACzD,YAAI,WAAW,UAAW,QAAO;AACjC,YAAI,WAAW,UAAW,QAAO;AACjC,eAAO;AAAA,MACT;AACA,YAAM,oBAAoB,yBAAyB;AAEnD,UAAI,WAAW,WAAW;AACxB,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAOrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF,OAAO;AACL,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAKrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,oBAAoB,6BAA6B,QAAQ,YAAY,IAAI,YAAY,YAAY,IAAI,GAAG;AAC1G,cAAM,kBAAkB;AAAA,UACtB,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB;AAAA,UAChB,SAAS;AAAA,QACX;AACA,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,gCAAgC,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QACrG,OAAO;AACL,eAAK,IAAI,UAAU,gCAAgC,eAAe,EAAE,MAAM,MAAM,MAAS;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAuB,MAQd;AACP,UAAM,EAAE,QAAQ,YAAY,IAAI;AAChC,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,aAAa,GAAI;AACtB,UAAM,MAAM,KAAK,mBAAmB,KAAK,QAAQ,WAAW;AAC5D,UAAM,WAAW,KAAK,mBAAmB,IAAI,GAAG;AAChD,QAAI,UAAU;AACZ,eAAS,SAAS;AAClB,eAAS,cAAc;AAAA,QACrB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AACA,eAAS,aAAa,KAAK,cAAc;AACzC,eAAS,cAAc,KAAK,eAAe;AAC3C,UAAI,KAAK,OAAQ,UAAS,SAAS,KAAK;AACxC,UAAI,KAAK,QAAS,UAAS,UAAU,KAAK;AAC1C,WAAK,mBAAmB,IAAI,KAAK,QAAQ;AACzC;AAAA,IACF;AACA,UAAM,QAA8B;AAAA,MAClC,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,QAAI,KAAK,QAAS,OAAM,UAAU,KAAK;AACvC,SAAK,mBAAmB,IAAI,KAAK,KAAK;AAAA,EACxC;AAAA,EAEA,MAAM,sBAAsB,UAAiD;AAC3E,QAAI,CAAC,KAAK,mBAAmB,KAAM;AACnC,UAAM,UAAU,MAAM,KAAK,KAAK,mBAAmB,OAAO,CAAC;AAC3D,SAAK,mBAAmB,MAAM;AAC9B,eAAW,SAAS,SAAS;AAC3B,UAAI;AACF,cAAM,KAAK,mBAAmB;AAAA,UAC5B,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,YAAY,MAAM,cAAc;AAAA,UAChC,aAAa,MAAM,eAAe;AAAA,UAClC,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iCAAiC,GAAG;AACtC,gBAAM;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAyB,aAA4C;AAC9F,UAAM,KAAK,YAAY,MAAM;AAC7B,UAAM,MAAM,YAAY,kBAAkB;AAC1C,UAAM,SAAS,YAAY,YAAY;AACvC,WAAO,CAAC,QAAQ,IAAI,KAAK,MAAM,EAAE,KAAK,GAAG;AAAA,EAC3C;AACF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.8-develop.7015.1.af90a2ddc7";
+const APP_VERSION = "0.6.8-develop.7016.1.4ed7b1e49d";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.8-develop.7015.1.af90a2ddc7';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.8-develop.7016.1.4ed7b1e49d';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/events/factory.js

@@ -20,37 +20,76 @@ function getGlobalEventBus() {
   }
   return globalEventBus;
 }
-const allDeclaredEventIds = /* @__PURE__ */ new Set();
-const allDeclaredEvents = [];
+const GLOBAL_EVENT_REGISTRY_KEY = "__openMercatoEventDefinitionRegistry__";
+const fallbackEventRegistryState = {
+  declaredEventIds: /* @__PURE__ */ new Set(),
+  declaredEvents: [],
+  registeredEventConfigs: null
+};
+function isEventRegistryState(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return candidate.declaredEventIds instanceof Set && Array.isArray(candidate.declaredEvents) && (candidate.registeredEventConfigs === null || Array.isArray(candidate.registeredEventConfigs));
+}
+function getEventRegistryState() {
+  try {
+    const globalScope = globalThis;
+    const existing = globalScope[GLOBAL_EVENT_REGISTRY_KEY];
+    if (isEventRegistryState(existing)) return existing;
+    globalScope[GLOBAL_EVENT_REGISTRY_KEY] = fallbackEventRegistryState;
+    return fallbackEventRegistryState;
+  } catch {
+    return fallbackEventRegistryState;
+  }
+}
 function addDeclaredEvent(event) {
-  allDeclaredEventIds.add(event.id);
-  if (!allDeclaredEvents.find((e) => e.id === event.id)) {
-    allDeclaredEvents.push(event);
+  const state = getEventRegistryState();
+  state.declaredEventIds.add(event.id);
+  const existingIndex = state.declaredEvents.findIndex((candidate) => candidate.id === event.id);
+  if (existingIndex < 0) {
+    state.declaredEvents.push(event);
+    return;
+  }
+  if (state.declaredEvents[existingIndex]?.module === event.module) {
+    state.declaredEvents[existingIndex] = event;
   }
 }
 function isEventDeclared(eventId) {
-  return allDeclaredEventIds.has(eventId);
+  return getEventRegistryState().declaredEventIds.has(eventId);
 }
 function getAllDeclaredEventIds() {
-  return Array.from(allDeclaredEventIds);
+  return Array.from(getEventRegistryState().declaredEventIds);
 }
 function getDeclaredEvents() {
-  return [...allDeclaredEvents];
+  return [...getEventRegistryState().declaredEvents];
 }
 function isBroadcastEvent(eventId) {
-  const event = allDeclaredEvents.find((e) => e.id === eventId);
+  const event = getEventRegistryState().declaredEvents.find((e) => e.id === eventId);
   return event?.clientBroadcast === true;
 }
+function isCrossProcessBroadcastEvent(eventId) {
+  const event = getEventRegistryState().declaredEvents.find((e) => e.id === eventId);
+  return event?.clientBroadcast === true || event?.crossProcessBroadcast === true;
+}
+function isPrivateCrossProcessBroadcastEvent(eventId) {
+  const event = getEventRegistryState().declaredEvents.find((e) => e.id === eventId);
+  return event?.crossProcessBroadcast === true && event?.clientBroadcast !== true;
+}
+function isPrivateCrossProcessEventEmitter(eventId, emitterModuleId) {
+  const event = getEventRegistryState().declaredEvents.find((e) => e.id === eventId);
+  if (event?.crossProcessBroadcast !== true) return true;
+  return typeof event.module === "string" && event.module.length > 0 && event.module === emitterModuleId;
+}
 function isPortalBroadcastEvent(eventId) {
-  const event = allDeclaredEvents.find((e) => e.id === eventId);
+  const event = getEventRegistryState().declaredEvents.find((e) => e.id === eventId);
   return event?.portalBroadcast === true;
 }
-let _registeredEventConfigs = null;
 function registerEventModuleConfigs(configs) {
-  if (_registeredEventConfigs !== null && process.env.NODE_ENV === "development") {
+  const state = getEventRegistryState();
+  if (state.registeredEventConfigs !== null && process.env.NODE_ENV === "development") {
     logger.debug("Event module configs re-registered (this may occur during HMR)");
   }
-  _registeredEventConfigs = configs;
+  state.registeredEventConfigs = configs;
   for (const config of configs) {
     for (const event of config.events) {
       addDeclaredEvent(event);
@@ -58,7 +97,7 @@ function registerEventModuleConfigs(configs) {
   }
 }
 function getEventModuleConfigs() {
-  return _registeredEventConfigs ?? [];
+  return getEventRegistryState().registeredEventConfigs ?? [];
 }
 function createModuleEvents(options) {
   const { moduleId, events, strict = false } = options;
@@ -84,7 +123,19 @@ function createModuleEvents(options) {
       logger.warn("Event bus not available, cannot emit event", { eventId });
       return;
     }
-    await eventBus.emit(eventId, payload, emitOptions);
+    const eventDefinition = fullEvents.find((event) => event.id === eventId);
+    const isClientBroadcast = eventDefinition?.clientBroadcast === true;
+    const trustedOptions = eventDefinition?.crossProcessBroadcast === true || isClientBroadcast ? {
+      ...emitOptions,
+      // Browser-broadcast module emitters historically accepted scope in
+      // their typed payload. Preserve that contract at the trusted module
+      // boundary while the event bus itself relies only on options.
+      ...isClientBroadcast && emitOptions?.tenantId === void 0 ? { tenantId: payload.tenantId ?? null } : {},
+      ...isClientBroadcast && emitOptions?.organizationId === void 0 ? { organizationId: payload.organizationId ?? null } : {},
+      ...isClientBroadcast && emitOptions?.organizationIds === void 0 && Array.isArray(payload.organizationIds) ? { organizationIds: payload.organizationIds.filter((value) => typeof value === "string") } : {},
+      emitterModuleId: moduleId
+    } : emitOptions;
+    await eventBus.emit(eventId, payload, trustedOptions);
   };
   return {
     moduleId,
@@ -99,8 +150,11 @@ export {
   getEventModuleConfigs,
   getGlobalEventBus,
   isBroadcastEvent,
+  isCrossProcessBroadcastEvent,
   isEventDeclared,
   isPortalBroadcastEvent,
+  isPrivateCrossProcessBroadcastEvent,
+  isPrivateCrossProcessEventEmitter,
   registerEventModuleConfigs,
   setGlobalEventBus
 };