@open-mercato/shared 0.7.1-develop.7194.1.ab4fc81f82 → 0.7.1-develop.7200.1.8ba2d93d3f

package/dist/lib/di/container.js

@@ -8,6 +8,7 @@ import { applyDiOverridesToContainer } from "@open-mercato/shared/modules/overri
 import { createOptimisticLockGuardService } from "@open-mercato/shared/lib/crud/optimistic-lock";
 import { getAllOptimisticLockReaders } from "@open-mercato/shared/lib/crud/optimistic-lock-store";
 import { createCommandOptimisticLockGuardService } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isTenantDataEncryptionEnabled } from "../encryption/toggles.js";
 import { createLogger } from "../logger/index.js";
 const logger = createLogger("shared").child({ component: "di" });
 const GLOBAL_KEY = "__openMercatoDiRegistrars__";
@@ -54,17 +55,12 @@ function harvestBootstrapCache(container) {
   }
   return entry;
 }
-function getCachedEncryptionEnabled(service) {
-  if (!service || typeof service.isEnabled !== "function") return false;
+function getCachedEncryptionConfigured() {
   const cached = globalThis[ENCRYPTION_ENABLED_KEY];
   if (typeof cached === "boolean") return cached;
-  try {
-    const result = !!service.isEnabled();
-    globalThis[ENCRYPTION_ENABLED_KEY] = result;
-    return result;
-  } catch {
-    return null;
-  }
+  const result = isTenantDataEncryptionEnabled();
+  globalThis[ENCRYPTION_ENABLED_KEY] = result;
+  return result;
 }
 function getGlobalRegistrars() {
   return globalThis[GLOBAL_KEY] ?? null;
@@ -247,7 +243,8 @@ async function createRequestContainer() {
   try {
     const emForEnc = container.resolve("em");
     const tenantEncryptionService = container.hasRegistration("tenantEncryptionService") ? container.resolve("tenantEncryptionService") : null;
-    if (emForEnc && tenantEncryptionService && getCachedEncryptionEnabled(tenantEncryptionService) === true) {
+    const serviceCanReportEnabled = typeof tenantEncryptionService?.isEnabled === "function";
+    if (emForEnc && serviceCanReportEnabled && getCachedEncryptionConfigured()) {
       const { registerTenantEncryptionSubscriber } = await import("@open-mercato/shared/lib/encryption/subscriber");
       registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService);
     }

package/dist/lib/di/container.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/di/container.ts"],
-  "sourcesContent": ["import { asFunction, createContainer, asValue, AwilixContainer, InjectionMode, type Resolver } from 'awilix'\nimport { RequestContext } from '@mikro-orm/core'\nimport { getOrm } from '@open-mercato/shared/lib/db/mikro'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'\nimport { DefaultDataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { commandRegistry, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overrides'\nimport { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'di' })\n\ntype DynamicCradle = Record<string, any>\n\nexport type AppContainer = AwilixContainer<DynamicCradle>\nexport type DiRegistrar = (container: AppContainer) => void\nexport type AppDiRegistrar = (container: AppContainer) => void | Promise<void>\n\n// Registration pattern for publishable packages\n// Use globalThis to survive tsx/esbuild module duplication issue where the same\n// file can be loaded as multiple module instances when mixing dynamic and static imports\nconst GLOBAL_KEY = '__openMercatoDiRegistrars__'\nconst APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'\nconst APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'\nconst APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'\n// Set once the legacy `@/di` fallback proves the specifier is unresolvable in this process.\n// Worker/CLI processes run against built package output where the app's `@/` alias does not\n// exist, so retrying the import per request container only repeats a failed module resolution\n// (and its log line) once per job.\nconst APP_DI_MODULE_UNRESOLVABLE_KEY = '__openMercatoAppDiModuleUnresolvable__'\n// Phase 5 \u2014 process-scoped bootstrap cache. The cache/event-bus/encryption\n// services bootstrap() creates are inherently process-scoped (they hold\n// state across requests). Caching them on globalThis after the first\n// successful bootstrap call lets every subsequent request skip the\n// `await bootstrap(container)` body and just re-register the cached\n// instances. Same globalThis pattern as registerDiRegistrars so HMR\n// keeps working.\nconst BOOTSTRAP_CACHE_KEY = '__openMercatoBootstrapCache__'\nconst ENCRYPTION_ENABLED_KEY = '__openMercatoEncryptionEnabledCache__'\n\nconst BOOTSTRAP_CACHE_KEYS = [\n  'cache',\n  'eventBus',\n  'kmsService',\n  'tenantEncryptionService',\n  'rateLimiterService',\n  'searchModuleConfigs',\n  'searchIndexer',\n] as const\n\ntype BootstrapCacheEntry = Partial<Record<(typeof BOOTSTRAP_CACHE_KEYS)[number], unknown>>\n\n// Phase 5 is opt-in. Some bootstrap services close over per-request state\n// (e.g. tenantEncryptionService captures the first request's `em.fork`, the\n// event-bus's resolver closes over the first container) so naively replaying\n// them on later requests yields stale references \u2014 observed as a 500 from\n// CRUD list endpoints in `next start`. Default OFF preserves develop's\n// per-request bootstrap. Set `OM_BOOTSTRAP_CACHE=1` to opt in once each\n// cached service is verified safe for cross-request reuse.\nfunction isBootstrapCacheEnabled(): boolean {\n  const raw = process.env.OM_BOOTSTRAP_CACHE\n  if (raw === undefined) return false\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return false\n  if (normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no') return false\n  return true\n}\n\nfunction getBootstrapCache(): BootstrapCacheEntry | null {\n  if (!isBootstrapCacheEnabled()) return null\n  const existing = (globalThis as any)[BOOTSTRAP_CACHE_KEY]\n  return existing && typeof existing === 'object' ? (existing as BootstrapCacheEntry) : null\n}\n\nfunction setBootstrapCache(entry: BootstrapCacheEntry): void {\n  if (!isBootstrapCacheEnabled()) return\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = entry\n}\n\nfunction harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry {\n  const entry: BootstrapCacheEntry = {}\n  for (const key of BOOTSTRAP_CACHE_KEYS) {\n    try {\n      const value: unknown = container.resolve(key as never)\n      if (value !== undefined && value !== null) entry[key] = value\n    } catch {\n      // not registered \u2014 skip\n    }\n  }\n  return entry\n}\n\ntype EncryptionEnabledProbe = { isEnabled?: () => boolean } | null | undefined\n\nfunction getCachedEncryptionEnabled(service: EncryptionEnabledProbe): boolean | null {\n  if (!service || typeof service.isEnabled !== 'function') return false\n  const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]\n  if (typeof cached === 'boolean') return cached\n  try {\n    const result = !!service.isEnabled()\n    ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result\n    return result\n  } catch {\n    return null\n  }\n}\n\nfunction getGlobalRegistrars(): DiRegistrar[] | null {\n  return (globalThis as any)[GLOBAL_KEY] ?? null\n}\n\nfunction setGlobalRegistrars(registrars: DiRegistrar[]): void {\n  (globalThis as any)[GLOBAL_KEY] = registrars\n}\n\nexport function registerDiRegistrars(registrars: DiRegistrar[]) {\n  const existing = getGlobalRegistrars()\n  if (existing !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('DI registrars re-registered (this may occur during HMR)')\n  }\n  setGlobalRegistrars(registrars)\n  // Force re-bootstrap on HMR \u2014 module subscribers may have changed.\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  // An app that gains a src/di.ts mid-session reloads through here, so the negative\n  // resolution result must not outlive the reload.\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nexport function getDiRegistrars(): DiRegistrar[] {\n  const registrars = getGlobalRegistrars()\n  if (!registrars) {\n    throw new Error('[Bootstrap] DI registrars not registered. Call registerDiRegistrars() at bootstrap.')\n  }\n  return registrars\n}\n\nfunction getAppDiRegistrar(): AppDiRegistrar | null {\n  const registrar = (globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY]\n  return typeof registrar === 'function' ? registrar as AppDiRegistrar : null\n}\n\nexport function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar\n}\n\n/** Test-only helper to drop process-scoped request-container state. */\nexport function resetBootstrapCache(): void {\n  (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nfunction isAppDiModuleUnresolvable(): boolean {\n  return (globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] === true\n}\n\nfunction markAppDiModuleUnresolvable(): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = true\n}\n\nfunction isAppDiModuleNotFound(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const { code, message } = error as { code?: unknown; message?: unknown }\n  const text = typeof message === 'string' ? message : ''\n  const moduleNotFound =\n    code === 'MODULE_NOT_FOUND'\n    || code === 'ERR_MODULE_NOT_FOUND'\n    || text.startsWith('Cannot find module')\n    || text.startsWith('Cannot find package')\n  return moduleNotFound && /(?:module|package) ['\"]@\\/di['\"]/.test(text)\n}\n\nfunction warnAppDiFailureOnce(\n  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,\n  message: string,\n  error: unknown,\n): void {\n  const globalScope = globalThis as Record<string, unknown>\n  if (globalScope[key] === true) return\n  globalScope[key] = true\n  logger.warn(message, { err: error })\n}\n\nfunction isAwilixResolver(value: unknown): value is Resolver<unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as { resolve?: unknown }).resolve === 'function')\n}\n\nfunction toAwilixRegistrations(registrations: Record<string, unknown>): Record<string, Resolver<any>> {\n  return Object.fromEntries(\n    Object.entries(registrations).map(([key, value]) => [\n      key,\n      isAwilixResolver(value) ? value : asValue(value),\n    ]),\n  )\n}\n\nexport async function createRequestContainer(): Promise<AppContainer> {\n  const diRegistrars = getDiRegistrars()\n  const orm = await getOrm()\n  // Use a fresh event manager so request-level subscribers (e.g., encryption) don't pile up globally\n  const baseEm = (RequestContext.getEntityManager() as any) ?? orm.em\n  const em = baseEm.fork({ clear: true, freshEventManager: true, useContext: true }) as unknown as EntityManager\n  const container = createContainer<DynamicCradle>({ injectionMode: InjectionMode.CLASSIC })\n  // Core registrations\n  container.register({\n    em: asValue(em),\n    queryEngine: asValue(new BasicQueryEngine(em, undefined, () => {\n      try { return container.resolve('tenantEncryptionService') as any } catch { return null }\n    })),\n    dataEngine: asValue(new DefaultDataEngine(em, container as any)),\n    commandRegistry: asValue(commandRegistry),\n    commandBus: asValue(new CommandBus()),\n    // Default OSS optimistic-lock guard. Reads from the global reader store\n    // (populated by `makeCrudRoute` auto-registration + any module-DI\n    // hand-wired calls to `registerOptimisticLockReaders`). Service is\n    // strictly additive: when `OM_OPTIMISTIC_LOCK=off` (or no header is\n    // sent) it short-circuits at validateMutation. Module-level di.ts\n    // registrations override this default via Awilix replace semantics \u2014\n    // see the enterprise `record_locks` module for the canonical override.\n    // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md\n    crudMutationGuardService: asFunction((em: EntityManager) =>\n      createOptimisticLockGuardService({\n        getEm: () => em,\n        readers: getAllOptimisticLockReaders(),\n      }),\n    ).scoped(),\n    // Default OSS command-level optimistic-lock guard, awaited by\n    // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.\n    // Header/explicit-token compare only (no `resolveExpected`), so it is\n    // behaviourally identical to calling `enforceCommandOptimisticLock`\n    // directly. The enterprise `record_locks` module overrides this DI key\n    // with a lock-backed `resolveExpected` via Awilix replace semantics.\n    // Spec: .ai/specs/enterprise/2026-06-09-record-locks-unified-coverage.md (Phase 0)\n    commandOptimisticLockGuardService: asFunction(() =>\n      createCommandOptimisticLockGuardService(),\n    ).scoped(),\n  })\n  // Allow modules to override/extend. Fail-open by design (one broken module's\n  // di.ts must not take down every request container), but never silently: the\n  // module's services would otherwise vanish with no trace until an unrelated\n  // Awilix resolution error surfaces much later.\n  for (const [registrarIndex, reg] of diRegistrars.entries()) {\n    try { reg?.(container) } catch (error) {\n      logger.error('Module DI registrar failed', { registrarIndex, err: error })\n    }\n  }\n  // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)\n  // Phase 5 \u2014 process-scoped once-guard. The first request runs the full\n  // bootstrap() body; later requests re-register the cached services\n  // directly on this request's container without re-importing or\n  // re-initializing anything. HMR clears the cache (see\n  // registerDiRegistrars). Skippable if a caller already wired eventBus.\n  const alreadyBootstrappedOnThisContainer = !!container.registrations?.eventBus\n  if (!alreadyBootstrappedOnThisContainer) {\n    const cached = getBootstrapCache()\n    if (cached) {\n      const replay: Record<string, any> = {}\n      for (const [key, value] of Object.entries(cached)) {\n        if (value !== undefined && value !== null) replay[key] = asValue(value)\n      }\n      if (Object.keys(replay).length > 0) container.register(replay)\n    } else {\n      try {\n        const { bootstrap } = await import('@open-mercato/core/bootstrap') as any\n        if (bootstrap && typeof bootstrap === 'function') {\n          await bootstrap(container)\n          setBootstrapCache(harvestBootstrapCache(container))\n        }\n      } catch { /* optional */ }\n    }\n  }\n  // App-level DI override. Scaffolded apps register this callback explicitly\n  // from their own bootstrap module so app aliases resolve in app context.\n  const appDiRegistrar = getAppDiRegistrar()\n  if (appDiRegistrar) {\n    try {\n      await appDiRegistrar(container)\n    } catch (error) {\n      logger.error('App-level DI registrar failed', { err: error })\n    }\n  } else if (!isAppDiModuleUnresolvable()) {\n    // Backward-compatible fallback for apps that have not adopted explicit wiring.\n    try {\n      // @ts-ignore - @/di only exists in app context, not in packages\n      const appDi = await import('@/di') as any\n      if (appDi?.register) {\n        try {\n          const maybe = appDi.register(container)\n          if (maybe && typeof maybe.then === 'function') await maybe\n        } catch (err) {\n          warnAppDiFailureOnce(\n            APP_DI_REGISTER_WARNING_KEY,\n            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',\n            err,\n          )\n        }\n      }\n    } catch (err) {\n      if (isAppDiModuleNotFound(err)) {\n        markAppDiModuleUnresolvable()\n        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })\n      } else {\n        warnAppDiFailureOnce(\n          APP_DI_LOAD_WARNING_KEY,\n          'App-level DI override module (@/di) failed to load; its registrations are skipped',\n          err,\n        )\n      }\n    }\n  }\n  applyDiOverridesToContainer({\n    register: (registrations) => container.register(toAwilixRegistrations(registrations)),\n    unregister: (key) => container.register({ [key]: asValue(undefined) }),\n  })\n  // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM\n  // Phase 5 \u2014 cache `tenantEncryptionService.isEnabled()` for the process\n  // lifetime. The result depends only on config that does not change at\n  // runtime, so reading it once skips a config lookup per request.\n  try {\n    const emForEnc = container.resolve('em') as any\n    const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')\n      ? (container.resolve('tenantEncryptionService') as any)\n      : null\n    if (emForEnc && tenantEncryptionService && getCachedEncryptionEnabled(tenantEncryptionService) === true) {\n      const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')\n      registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)\n    }\n  } catch {\n    // best-effort; do not block container creation\n  }\n  return container\n}\ntry {\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  require('server-only')\n} catch {\n  // allow CLI/generator usage where Next server-only is not present\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,iBAAiB,SAA0B,qBAAoC;AACpG,SAAS,sBAAsB;AAC/B,SAAS,cAAc;AAEvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+CAA+C;AACxD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AAW/D,MAAM,aAAa;AACnB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B;AAKpC,MAAM,iCAAiC;AAQvC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,MAAI,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe,KAAM,QAAO;AACxG,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,QAAM,WAAY,WAAmB,mBAAmB;AACxD,SAAO,YAAY,OAAO,aAAa,WAAY,WAAmC;AACxF;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,MAAI,CAAC,wBAAwB,EAAG;AAC/B,EAAC,WAAmB,mBAAmB,IAAI;AAC9C;AAEA,SAAS,sBAAsB,WAAiD;AAC9E,QAAM,QAA6B,CAAC;AACpC,aAAW,OAAO,sBAAsB;AACtC,QAAI;AACF,YAAM,QAAiB,UAAU,QAAQ,GAAY;AACrD,UAAI,UAAU,UAAa,UAAU,KAAM,OAAM,GAAG,IAAI;AAAA,IAC1D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,2BAA2B,SAAiD;AACnF,MAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,WAAY,QAAO;AAChE,QAAM,SAAU,WAAuC,sBAAsB;AAC7E,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,MAAI;AACF,UAAM,SAAS,CAAC,CAAC,QAAQ,UAAU;AAClC,IAAC,WAAuC,sBAAsB,IAAI;AACnE,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAA4C;AACnD,SAAQ,WAAmB,UAAU,KAAK;AAC5C;AAEA,SAAS,oBAAoB,YAAiC;AAC5D,EAAC,WAAmB,UAAU,IAAI;AACpC;AAEO,SAAS,qBAAqB,YAA2B;AAC9D,QAAM,WAAW,oBAAoB;AACrC,MAAI,aAAa,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC/D,WAAO,MAAM,yDAAyD;AAAA,EACxE;AACA,sBAAoB,UAAU;AAE7B,EAAC,WAAmB,mBAAmB,IAAI;AAC3C,EAAC,WAAmB,sBAAsB,IAAI;AAG9C,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEO,SAAS,kBAAiC;AAC/C,QAAM,aAAa,oBAAoB;AACvC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,oBAA2C;AAClD,QAAM,YAAa,WAAuC,oBAAoB;AAC9E,SAAO,OAAO,cAAc,aAAa,YAA8B;AACzE;AAEO,SAAS,uBAAuB,WAAwC;AAC7E;AAAC,EAAC,WAAuC,oBAAoB,IAAI;AACnE;AAGO,SAAS,sBAA4B;AAC1C,EAAC,WAAmB,mBAAmB,IAAI;AAC1C,EAAC,WAAmB,sBAAsB,IAAI;AAC9C,EAAC,WAAuC,uBAAuB,IAAI;AACnE,EAAC,WAAuC,2BAA2B,IAAI;AACvE,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,4BAAqC;AAC5C,SAAQ,WAAuC,8BAA8B,MAAM;AACrF;AAEA,SAAS,8BAAoC;AAC3C;AAAC,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,sBAAsB,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,QAAM,OAAO,OAAO,YAAY,WAAW,UAAU;AACrD,QAAM,iBACJ,SAAS,sBACN,SAAS,0BACT,KAAK,WAAW,oBAAoB,KACpC,KAAK,WAAW,qBAAqB;AAC1C,SAAO,kBAAkB,mCAAmC,KAAK,IAAI;AACvE;AAEA,SAAS,qBACP,KACA,SACA,OACM;AACN,QAAM,cAAc;AACpB,MAAI,YAAY,GAAG,MAAM,KAAM;AAC/B,cAAY,GAAG,IAAI;AACnB,SAAO,KAAK,SAAS,EAAE,KAAK,MAAM,CAAC;AACrC;AAEA,SAAS,iBAAiB,OAA4C;AACpE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACrH;AAEA,SAAS,sBAAsB,eAAuE;AACpG,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAClD;AAAA,MACA,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,yBAAgD;AACpE,QAAM,eAAe,gBAAgB;AACrC,QAAM,MAAM,MAAM,OAAO;AAEzB,QAAM,SAAU,eAAe,iBAAiB,KAAa,IAAI;AACjE,QAAM,KAAK,OAAO,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjF,QAAM,YAAY,gBAA+B,EAAE,eAAe,cAAc,QAAQ,CAAC;AAEzF,YAAU,SAAS;AAAA,IACjB,IAAI,QAAQ,EAAE;AAAA,IACd,aAAa,QAAQ,IAAI,iBAAiB,IAAI,QAAW,MAAM;AAC7D,UAAI;AAAE,eAAO,UAAU,QAAQ,yBAAyB;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACzF,CAAC,CAAC;AAAA,IACF,YAAY,QAAQ,IAAI,kBAAkB,IAAI,SAAgB,CAAC;AAAA,IAC/D,iBAAiB,QAAQ,eAAe;AAAA,IACxC,YAAY,QAAQ,IAAI,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASpC,0BAA0B;AAAA,MAAW,CAACA,QACpC,iCAAiC;AAAA,QAC/B,OAAO,MAAMA;AAAA,QACb,SAAS,4BAA4B;AAAA,MACvC,CAAC;AAAA,IACH,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQT,mCAAmC;AAAA,MAAW,MAC5C,wCAAwC;AAAA,IAC1C,EAAE,OAAO;AAAA,EACX,CAAC;AAKD,aAAW,CAAC,gBAAgB,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1D,QAAI;AAAE,YAAM,SAAS;AAAA,IAAE,SAAS,OAAO;AACrC,aAAO,MAAM,8BAA8B,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,IAC3E;AAAA,EACF;AAOA,QAAM,qCAAqC,CAAC,CAAC,UAAU,eAAe;AACtE,MAAI,CAAC,oCAAoC;AACvC,UAAM,SAAS,kBAAkB;AACjC,QAAI,QAAQ;AACV,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM,QAAO,GAAG,IAAI,QAAQ,KAAK;AAAA,MACxE;AACA,UAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,WAAU,SAAS,MAAM;AAAA,IAC/D,OAAO;AACL,UAAI;AACF,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,8BAA8B;AACjE,YAAI,aAAa,OAAO,cAAc,YAAY;AAChD,gBAAM,UAAU,SAAS;AACzB,4BAAkB,sBAAsB,SAAS,CAAC;AAAA,QACpD;AAAA,MACF,QAAQ;AAAA,MAAiB;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,SAAS;AAAA,IAChC,SAAS,OAAO;AACd,aAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC9D;AAAA,EACF,WAAW,CAAC,0BAA0B,GAAG;AAEvC,QAAI;AAEF,YAAM,QAAQ,MAAM,OAAO,MAAM;AACjC,UAAI,OAAO,UAAU;AACnB,YAAI;AACF,gBAAM,QAAQ,MAAM,SAAS,SAAS;AACtC,cAAI,SAAS,OAAO,MAAM,SAAS,WAAY,OAAM;AAAA,QACvD,SAAS,KAAK;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,sBAAsB,GAAG,GAAG;AAC9B,oCAA4B;AAC5B,eAAO,MAAM,gEAAgE,EAAE,IAAI,CAAC;AAAA,MACtF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,8BAA4B;AAAA,IAC1B,UAAU,CAAC,kBAAkB,UAAU,SAAS,sBAAsB,aAAa,CAAC;AAAA,IACpF,YAAY,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,GAAG,QAAQ,MAAS,EAAE,CAAC;AAAA,EACvE,CAAC;AAKD,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,IAAI;AACvC,UAAM,0BAA0B,UAAU,gBAAgB,yBAAyB,IAC9E,UAAU,QAAQ,yBAAyB,IAC5C;AACJ,QAAI,YAAY,2BAA2B,2BAA2B,uBAAuB,MAAM,MAAM;AACvG,YAAM,EAAE,mCAAmC,IAAI,MAAM,OAAO,gDAAgD;AAC5G,yCAAmC,UAAU,uBAAuB;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AACA,IAAI;AAEF,UAAQ,aAAa;AACvB,QAAQ;AAER;",
+  "sourcesContent": ["import { asFunction, createContainer, asValue, AwilixContainer, InjectionMode, type Resolver } from 'awilix'\nimport { RequestContext } from '@mikro-orm/core'\nimport { getOrm } from '@open-mercato/shared/lib/db/mikro'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'\nimport { DefaultDataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { commandRegistry, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overrides'\nimport { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isTenantDataEncryptionEnabled } from '../encryption/toggles'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'di' })\n\ntype DynamicCradle = Record<string, any>\n\nexport type AppContainer = AwilixContainer<DynamicCradle>\nexport type DiRegistrar = (container: AppContainer) => void\nexport type AppDiRegistrar = (container: AppContainer) => void | Promise<void>\n\n// Registration pattern for publishable packages\n// Use globalThis to survive tsx/esbuild module duplication issue where the same\n// file can be loaded as multiple module instances when mixing dynamic and static imports\nconst GLOBAL_KEY = '__openMercatoDiRegistrars__'\nconst APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'\nconst APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'\nconst APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'\n// Set once the legacy `@/di` fallback proves the specifier is unresolvable in this process.\n// Worker/CLI processes run against built package output where the app's `@/` alias does not\n// exist, so retrying the import per request container only repeats a failed module resolution\n// (and its log line) once per job.\nconst APP_DI_MODULE_UNRESOLVABLE_KEY = '__openMercatoAppDiModuleUnresolvable__'\n// Phase 5 \u2014 process-scoped bootstrap cache. The cache/event-bus/encryption\n// services bootstrap() creates are inherently process-scoped (they hold\n// state across requests). Caching them on globalThis after the first\n// successful bootstrap call lets every subsequent request skip the\n// `await bootstrap(container)` body and just re-register the cached\n// instances. Same globalThis pattern as registerDiRegistrars so HMR\n// keeps working.\nconst BOOTSTRAP_CACHE_KEY = '__openMercatoBootstrapCache__'\nconst ENCRYPTION_ENABLED_KEY = '__openMercatoEncryptionEnabledCache__'\n\nconst BOOTSTRAP_CACHE_KEYS = [\n  'cache',\n  'eventBus',\n  'kmsService',\n  'tenantEncryptionService',\n  'rateLimiterService',\n  'searchModuleConfigs',\n  'searchIndexer',\n] as const\n\ntype BootstrapCacheEntry = Partial<Record<(typeof BOOTSTRAP_CACHE_KEYS)[number], unknown>>\n\n// Phase 5 is opt-in. Some bootstrap services close over per-request state\n// (e.g. tenantEncryptionService captures the first request's `em.fork`, the\n// event-bus's resolver closes over the first container) so naively replaying\n// them on later requests yields stale references \u2014 observed as a 500 from\n// CRUD list endpoints in `next start`. Default OFF preserves develop's\n// per-request bootstrap. Set `OM_BOOTSTRAP_CACHE=1` to opt in once each\n// cached service is verified safe for cross-request reuse.\nfunction isBootstrapCacheEnabled(): boolean {\n  const raw = process.env.OM_BOOTSTRAP_CACHE\n  if (raw === undefined) return false\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return false\n  if (normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no') return false\n  return true\n}\n\nfunction getBootstrapCache(): BootstrapCacheEntry | null {\n  if (!isBootstrapCacheEnabled()) return null\n  const existing = (globalThis as any)[BOOTSTRAP_CACHE_KEY]\n  return existing && typeof existing === 'object' ? (existing as BootstrapCacheEntry) : null\n}\n\nfunction setBootstrapCache(entry: BootstrapCacheEntry): void {\n  if (!isBootstrapCacheEnabled()) return\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = entry\n}\n\nfunction harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry {\n  const entry: BootstrapCacheEntry = {}\n  for (const key of BOOTSTRAP_CACHE_KEYS) {\n    try {\n      const value: unknown = container.resolve(key as never)\n      if (value !== undefined && value !== null) entry[key] = value\n    } catch {\n      // not registered \u2014 skip\n    }\n  }\n  return entry\n}\n\n// Caches the STATIC config toggle only. It deliberately does not consult\n// `tenantEncryptionService.isEnabled()`, which ANDs the toggle with the\n// volatile `kms.isHealthy()` \u2014 memoizing that for the process lifetime pinned a\n// transient Vault outage into a permanent \"encryption off\" verdict, so the\n// subscriber was never registered again until a restart (#5948). KMS health is\n// re-checked by the subscriber on every read/write instead.\nfunction getCachedEncryptionConfigured(): boolean {\n  const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]\n  if (typeof cached === 'boolean') return cached\n  const result = isTenantDataEncryptionEnabled()\n  ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result\n  return result\n}\n\nfunction getGlobalRegistrars(): DiRegistrar[] | null {\n  return (globalThis as any)[GLOBAL_KEY] ?? null\n}\n\nfunction setGlobalRegistrars(registrars: DiRegistrar[]): void {\n  (globalThis as any)[GLOBAL_KEY] = registrars\n}\n\nexport function registerDiRegistrars(registrars: DiRegistrar[]) {\n  const existing = getGlobalRegistrars()\n  if (existing !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('DI registrars re-registered (this may occur during HMR)')\n  }\n  setGlobalRegistrars(registrars)\n  // Force re-bootstrap on HMR \u2014 module subscribers may have changed.\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  // An app that gains a src/di.ts mid-session reloads through here, so the negative\n  // resolution result must not outlive the reload.\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nexport function getDiRegistrars(): DiRegistrar[] {\n  const registrars = getGlobalRegistrars()\n  if (!registrars) {\n    throw new Error('[Bootstrap] DI registrars not registered. Call registerDiRegistrars() at bootstrap.')\n  }\n  return registrars\n}\n\nfunction getAppDiRegistrar(): AppDiRegistrar | null {\n  const registrar = (globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY]\n  return typeof registrar === 'function' ? registrar as AppDiRegistrar : null\n}\n\nexport function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar\n}\n\n/** Test-only helper to drop process-scoped request-container state. */\nexport function resetBootstrapCache(): void {\n  (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nfunction isAppDiModuleUnresolvable(): boolean {\n  return (globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] === true\n}\n\nfunction markAppDiModuleUnresolvable(): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = true\n}\n\nfunction isAppDiModuleNotFound(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const { code, message } = error as { code?: unknown; message?: unknown }\n  const text = typeof message === 'string' ? message : ''\n  const moduleNotFound =\n    code === 'MODULE_NOT_FOUND'\n    || code === 'ERR_MODULE_NOT_FOUND'\n    || text.startsWith('Cannot find module')\n    || text.startsWith('Cannot find package')\n  return moduleNotFound && /(?:module|package) ['\"]@\\/di['\"]/.test(text)\n}\n\nfunction warnAppDiFailureOnce(\n  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,\n  message: string,\n  error: unknown,\n): void {\n  const globalScope = globalThis as Record<string, unknown>\n  if (globalScope[key] === true) return\n  globalScope[key] = true\n  logger.warn(message, { err: error })\n}\n\nfunction isAwilixResolver(value: unknown): value is Resolver<unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as { resolve?: unknown }).resolve === 'function')\n}\n\nfunction toAwilixRegistrations(registrations: Record<string, unknown>): Record<string, Resolver<any>> {\n  return Object.fromEntries(\n    Object.entries(registrations).map(([key, value]) => [\n      key,\n      isAwilixResolver(value) ? value : asValue(value),\n    ]),\n  )\n}\n\nexport async function createRequestContainer(): Promise<AppContainer> {\n  const diRegistrars = getDiRegistrars()\n  const orm = await getOrm()\n  // Use a fresh event manager so request-level subscribers (e.g., encryption) don't pile up globally\n  const baseEm = (RequestContext.getEntityManager() as any) ?? orm.em\n  const em = baseEm.fork({ clear: true, freshEventManager: true, useContext: true }) as unknown as EntityManager\n  const container = createContainer<DynamicCradle>({ injectionMode: InjectionMode.CLASSIC })\n  // Core registrations\n  container.register({\n    em: asValue(em),\n    queryEngine: asValue(new BasicQueryEngine(em, undefined, () => {\n      try { return container.resolve('tenantEncryptionService') as any } catch { return null }\n    })),\n    dataEngine: asValue(new DefaultDataEngine(em, container as any)),\n    commandRegistry: asValue(commandRegistry),\n    commandBus: asValue(new CommandBus()),\n    // Default OSS optimistic-lock guard. Reads from the global reader store\n    // (populated by `makeCrudRoute` auto-registration + any module-DI\n    // hand-wired calls to `registerOptimisticLockReaders`). Service is\n    // strictly additive: when `OM_OPTIMISTIC_LOCK=off` (or no header is\n    // sent) it short-circuits at validateMutation. Module-level di.ts\n    // registrations override this default via Awilix replace semantics \u2014\n    // see the enterprise `record_locks` module for the canonical override.\n    // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md\n    crudMutationGuardService: asFunction((em: EntityManager) =>\n      createOptimisticLockGuardService({\n        getEm: () => em,\n        readers: getAllOptimisticLockReaders(),\n      }),\n    ).scoped(),\n    // Default OSS command-level optimistic-lock guard, awaited by\n    // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.\n    // Header/explicit-token compare only (no `resolveExpected`), so it is\n    // behaviourally identical to calling `enforceCommandOptimisticLock`\n    // directly. The enterprise `record_locks` module overrides this DI key\n    // with a lock-backed `resolveExpected` via Awilix replace semantics.\n    // Spec: .ai/specs/enterprise/2026-06-09-record-locks-unified-coverage.md (Phase 0)\n    commandOptimisticLockGuardService: asFunction(() =>\n      createCommandOptimisticLockGuardService(),\n    ).scoped(),\n  })\n  // Allow modules to override/extend. Fail-open by design (one broken module's\n  // di.ts must not take down every request container), but never silently: the\n  // module's services would otherwise vanish with no trace until an unrelated\n  // Awilix resolution error surfaces much later.\n  for (const [registrarIndex, reg] of diRegistrars.entries()) {\n    try { reg?.(container) } catch (error) {\n      logger.error('Module DI registrar failed', { registrarIndex, err: error })\n    }\n  }\n  // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)\n  // Phase 5 \u2014 process-scoped once-guard. The first request runs the full\n  // bootstrap() body; later requests re-register the cached services\n  // directly on this request's container without re-importing or\n  // re-initializing anything. HMR clears the cache (see\n  // registerDiRegistrars). Skippable if a caller already wired eventBus.\n  const alreadyBootstrappedOnThisContainer = !!container.registrations?.eventBus\n  if (!alreadyBootstrappedOnThisContainer) {\n    const cached = getBootstrapCache()\n    if (cached) {\n      const replay: Record<string, any> = {}\n      for (const [key, value] of Object.entries(cached)) {\n        if (value !== undefined && value !== null) replay[key] = asValue(value)\n      }\n      if (Object.keys(replay).length > 0) container.register(replay)\n    } else {\n      try {\n        const { bootstrap } = await import('@open-mercato/core/bootstrap') as any\n        if (bootstrap && typeof bootstrap === 'function') {\n          await bootstrap(container)\n          setBootstrapCache(harvestBootstrapCache(container))\n        }\n      } catch { /* optional */ }\n    }\n  }\n  // App-level DI override. Scaffolded apps register this callback explicitly\n  // from their own bootstrap module so app aliases resolve in app context.\n  const appDiRegistrar = getAppDiRegistrar()\n  if (appDiRegistrar) {\n    try {\n      await appDiRegistrar(container)\n    } catch (error) {\n      logger.error('App-level DI registrar failed', { err: error })\n    }\n  } else if (!isAppDiModuleUnresolvable()) {\n    // Backward-compatible fallback for apps that have not adopted explicit wiring.\n    try {\n      // @ts-ignore - @/di only exists in app context, not in packages\n      const appDi = await import('@/di') as any\n      if (appDi?.register) {\n        try {\n          const maybe = appDi.register(container)\n          if (maybe && typeof maybe.then === 'function') await maybe\n        } catch (err) {\n          warnAppDiFailureOnce(\n            APP_DI_REGISTER_WARNING_KEY,\n            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',\n            err,\n          )\n        }\n      }\n    } catch (err) {\n      if (isAppDiModuleNotFound(err)) {\n        markAppDiModuleUnresolvable()\n        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })\n      } else {\n        warnAppDiFailureOnce(\n          APP_DI_LOAD_WARNING_KEY,\n          'App-level DI override module (@/di) failed to load; its registrations are skipped',\n          err,\n        )\n      }\n    }\n  }\n  applyDiOverridesToContainer({\n    register: (registrations) => container.register(toAwilixRegistrations(registrations)),\n    unregister: (key) => container.register({ [key]: asValue(undefined) }),\n  })\n  // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM\n  // Phase 5 \u2014 cache the tenant-encryption config toggle for the process\n  // lifetime. That toggle does not change at runtime, so reading it once skips\n  // a config lookup per request; KMS health is NOT part of this decision.\n  try {\n    const emForEnc = container.resolve('em') as any\n    const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')\n      ? (container.resolve('tenantEncryptionService') as any)\n      : null\n    // The subscriber calls `service.isEnabled()` on every read/write, so a DI\n    // override supplying a service without it would throw per operation. Keep\n    // the shape check that the old health-probe helper performed.\n    const serviceCanReportEnabled = typeof tenantEncryptionService?.isEnabled === 'function'\n    if (emForEnc && serviceCanReportEnabled && getCachedEncryptionConfigured()) {\n      const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')\n      registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)\n    }\n  } catch {\n    // best-effort; do not block container creation\n  }\n  return container\n}\ntry {\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  require('server-only')\n} catch {\n  // allow CLI/generator usage where Next server-only is not present\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,iBAAiB,SAA0B,qBAAoC;AACpG,SAAS,sBAAsB;AAC/B,SAAS,cAAc;AAEvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+CAA+C;AACxD,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AAW/D,MAAM,aAAa;AACnB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B;AAKpC,MAAM,iCAAiC;AAQvC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,MAAI,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe,KAAM,QAAO;AACxG,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,QAAM,WAAY,WAAmB,mBAAmB;AACxD,SAAO,YAAY,OAAO,aAAa,WAAY,WAAmC;AACxF;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,MAAI,CAAC,wBAAwB,EAAG;AAC/B,EAAC,WAAmB,mBAAmB,IAAI;AAC9C;AAEA,SAAS,sBAAsB,WAAiD;AAC9E,QAAM,QAA6B,CAAC;AACpC,aAAW,OAAO,sBAAsB;AACtC,QAAI;AACF,YAAM,QAAiB,UAAU,QAAQ,GAAY;AACrD,UAAI,UAAU,UAAa,UAAU,KAAM,OAAM,GAAG,IAAI;AAAA,IAC1D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,gCAAyC;AAChD,QAAM,SAAU,WAAuC,sBAAsB;AAC7E,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,SAAS,8BAA8B;AAC5C,EAAC,WAAuC,sBAAsB,IAAI;AACnE,SAAO;AACT;AAEA,SAAS,sBAA4C;AACnD,SAAQ,WAAmB,UAAU,KAAK;AAC5C;AAEA,SAAS,oBAAoB,YAAiC;AAC5D,EAAC,WAAmB,UAAU,IAAI;AACpC;AAEO,SAAS,qBAAqB,YAA2B;AAC9D,QAAM,WAAW,oBAAoB;AACrC,MAAI,aAAa,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC/D,WAAO,MAAM,yDAAyD;AAAA,EACxE;AACA,sBAAoB,UAAU;AAE7B,EAAC,WAAmB,mBAAmB,IAAI;AAC3C,EAAC,WAAmB,sBAAsB,IAAI;AAG9C,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEO,SAAS,kBAAiC;AAC/C,QAAM,aAAa,oBAAoB;AACvC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,oBAA2C;AAClD,QAAM,YAAa,WAAuC,oBAAoB;AAC9E,SAAO,OAAO,cAAc,aAAa,YAA8B;AACzE;AAEO,SAAS,uBAAuB,WAAwC;AAC7E;AAAC,EAAC,WAAuC,oBAAoB,IAAI;AACnE;AAGO,SAAS,sBAA4B;AAC1C,EAAC,WAAmB,mBAAmB,IAAI;AAC1C,EAAC,WAAmB,sBAAsB,IAAI;AAC9C,EAAC,WAAuC,uBAAuB,IAAI;AACnE,EAAC,WAAuC,2BAA2B,IAAI;AACvE,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,4BAAqC;AAC5C,SAAQ,WAAuC,8BAA8B,MAAM;AACrF;AAEA,SAAS,8BAAoC;AAC3C;AAAC,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,sBAAsB,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,QAAM,OAAO,OAAO,YAAY,WAAW,UAAU;AACrD,QAAM,iBACJ,SAAS,sBACN,SAAS,0BACT,KAAK,WAAW,oBAAoB,KACpC,KAAK,WAAW,qBAAqB;AAC1C,SAAO,kBAAkB,mCAAmC,KAAK,IAAI;AACvE;AAEA,SAAS,qBACP,KACA,SACA,OACM;AACN,QAAM,cAAc;AACpB,MAAI,YAAY,GAAG,MAAM,KAAM;AAC/B,cAAY,GAAG,IAAI;AACnB,SAAO,KAAK,SAAS,EAAE,KAAK,MAAM,CAAC;AACrC;AAEA,SAAS,iBAAiB,OAA4C;AACpE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACrH;AAEA,SAAS,sBAAsB,eAAuE;AACpG,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAClD;AAAA,MACA,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,yBAAgD;AACpE,QAAM,eAAe,gBAAgB;AACrC,QAAM,MAAM,MAAM,OAAO;AAEzB,QAAM,SAAU,eAAe,iBAAiB,KAAa,IAAI;AACjE,QAAM,KAAK,OAAO,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjF,QAAM,YAAY,gBAA+B,EAAE,eAAe,cAAc,QAAQ,CAAC;AAEzF,YAAU,SAAS;AAAA,IACjB,IAAI,QAAQ,EAAE;AAAA,IACd,aAAa,QAAQ,IAAI,iBAAiB,IAAI,QAAW,MAAM;AAC7D,UAAI;AAAE,eAAO,UAAU,QAAQ,yBAAyB;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACzF,CAAC,CAAC;AAAA,IACF,YAAY,QAAQ,IAAI,kBAAkB,IAAI,SAAgB,CAAC;AAAA,IAC/D,iBAAiB,QAAQ,eAAe;AAAA,IACxC,YAAY,QAAQ,IAAI,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASpC,0BAA0B;AAAA,MAAW,CAACA,QACpC,iCAAiC;AAAA,QAC/B,OAAO,MAAMA;AAAA,QACb,SAAS,4BAA4B;AAAA,MACvC,CAAC;AAAA,IACH,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQT,mCAAmC;AAAA,MAAW,MAC5C,wCAAwC;AAAA,IAC1C,EAAE,OAAO;AAAA,EACX,CAAC;AAKD,aAAW,CAAC,gBAAgB,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1D,QAAI;AAAE,YAAM,SAAS;AAAA,IAAE,SAAS,OAAO;AACrC,aAAO,MAAM,8BAA8B,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,IAC3E;AAAA,EACF;AAOA,QAAM,qCAAqC,CAAC,CAAC,UAAU,eAAe;AACtE,MAAI,CAAC,oCAAoC;AACvC,UAAM,SAAS,kBAAkB;AACjC,QAAI,QAAQ;AACV,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM,QAAO,GAAG,IAAI,QAAQ,KAAK;AAAA,MACxE;AACA,UAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,WAAU,SAAS,MAAM;AAAA,IAC/D,OAAO;AACL,UAAI;AACF,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,8BAA8B;AACjE,YAAI,aAAa,OAAO,cAAc,YAAY;AAChD,gBAAM,UAAU,SAAS;AACzB,4BAAkB,sBAAsB,SAAS,CAAC;AAAA,QACpD;AAAA,MACF,QAAQ;AAAA,MAAiB;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,SAAS;AAAA,IAChC,SAAS,OAAO;AACd,aAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC9D;AAAA,EACF,WAAW,CAAC,0BAA0B,GAAG;AAEvC,QAAI;AAEF,YAAM,QAAQ,MAAM,OAAO,MAAM;AACjC,UAAI,OAAO,UAAU;AACnB,YAAI;AACF,gBAAM,QAAQ,MAAM,SAAS,SAAS;AACtC,cAAI,SAAS,OAAO,MAAM,SAAS,WAAY,OAAM;AAAA,QACvD,SAAS,KAAK;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,sBAAsB,GAAG,GAAG;AAC9B,oCAA4B;AAC5B,eAAO,MAAM,gEAAgE,EAAE,IAAI,CAAC;AAAA,MACtF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,8BAA4B;AAAA,IAC1B,UAAU,CAAC,kBAAkB,UAAU,SAAS,sBAAsB,aAAa,CAAC;AAAA,IACpF,YAAY,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,GAAG,QAAQ,MAAS,EAAE,CAAC;AAAA,EACvE,CAAC;AAKD,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,IAAI;AACvC,UAAM,0BAA0B,UAAU,gBAAgB,yBAAyB,IAC9E,UAAU,QAAQ,yBAAyB,IAC5C;AAIJ,UAAM,0BAA0B,OAAO,yBAAyB,cAAc;AAC9E,QAAI,YAAY,2BAA2B,8BAA8B,GAAG;AAC1E,YAAM,EAAE,mCAAmC,IAAI,MAAM,OAAO,gDAAgD;AAC5G,yCAAmC,UAAU,uBAAuB;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AACA,IAAI;AAEF,UAAQ,aAAa;AACvB,QAAQ;AAER;",
   "names": ["em"]
 }

package/dist/lib/encryption/subscriber.js

@@ -32,6 +32,23 @@ function isJsonColumnProperty(prop) {
   const customTypeName = candidate.customType?.constructor?.name;
   return typeof customTypeName === "string" && customTypeName.toLowerCase().includes("json");
 }
+const ENCRYPTION_PAUSED_WARN_INTERVAL_MS = 6e4;
+let lastEncryptionPausedWarnAt = 0;
+function warnEncryptionPaused(entity) {
+  const now = Date.now();
+  if (lastEncryptionPausedWarnAt && now - lastEncryptionPausedWarnAt < ENCRYPTION_PAUSED_WARN_INTERVAL_MS) return;
+  lastEncryptionPausedWarnAt = now;
+  try {
+    logger.warn(
+      "Tenant data encryption is enabled but the KMS is unavailable - entity writes persist as plaintext until it recovers",
+      { entity }
+    );
+  } catch {
+  }
+}
+function resetEncryptionPausedWarnThrottle() {
+  lastEncryptionPausedWarnAt = 0;
+}
 const registeredEventManagers = /* @__PURE__ */ new WeakSet();
 const subscribersByService = /* @__PURE__ */ new WeakMap();
 function getSubscriberForService(service) {
@@ -160,8 +177,10 @@ class TenantEncryptionSubscriber {
     return helper.__touched === true;
   }
   async encrypt(target, meta, em, changeSet) {
-    if (!isTenantDataEncryptionEnabled() || !this.service.isEnabled()) {
+    const encryptionConfigured = isTenantDataEncryptionEnabled();
+    if (!encryptionConfigured || !this.service.isEnabled()) {
       debug("\u26AA\uFE0F subscriber.skip", { reason: "disabled", entity: meta?.className || meta?.name });
+      if (encryptionConfigured) warnEncryptionPaused(meta?.className || meta?.name);
       return;
     }
     const resolvedMeta = this.resolveMeta(meta, target, em);
@@ -383,6 +402,7 @@ async function decryptEntitiesWithFallbackScope(targets, {
 export {
   TenantEncryptionSubscriber,
   decryptEntitiesWithFallbackScope,
-  registerTenantEncryptionSubscriber
+  registerTenantEncryptionSubscriber,
+  resetEncryptionPausedWarnThrottle
 };
 //# sourceMappingURL=subscriber.js.map

package/dist/lib/encryption/subscriber.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/subscriber.ts"],
-  "sourcesContent": ["import type { EntityMetadata, EventArgs, EventSubscriber } from '@mikro-orm/core'\nimport { ReferenceKind } from '@mikro-orm/core'\nimport { resolveEntityIdFromMetadata } from './entityIds'\nimport { TenantDataEncryptionService, parseDecryptedFieldValue } from './tenantDataEncryptionService'\nimport { isTenantDataEncryptionEnabled } from './toggles'\nimport { isEncryptionDebugEnabled } from './toggles'\nimport { resolveTenantEncryptionService } from './customFieldValues'\nimport { createLogger } from '../logger'\nimport { listEntityMetadataFromRegistry } from '../db/entityMetadata'\n\nconst logger = createLogger('shared').child({ component: 'encryption' })\n\ntype Scoped = {\n  tenantId?: string | null\n  tenant_id?: string | null\n  tenant?: { id?: string | null } | null\n  organizationId?: string | null\n  organization_id?: string | null\n  organization?: { id?: string | null } | null\n}\n\ntype Scope = { tenantId: string | null; organizationId: string | null }\n\nfunction resolveScope(entity: Scoped): Scope {\n  const tenantId = entity.tenantId ?? entity.tenant_id ?? entity.tenant?.id ?? null\n  const organizationId = entity.organizationId ?? entity.organization_id ?? entity.organization?.id ?? null\n  return {\n    tenantId: tenantId ? String(tenantId) : null,\n    organizationId: organizationId ? String(organizationId) : null,\n  }\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    logger.debug(event, payload)\n  } catch {\n    // ignore\n  }\n}\n\nfunction isJsonColumnProperty(prop: unknown): boolean {\n  if (!prop || typeof prop !== 'object') return false\n  const candidate = prop as Record<string, unknown>\n  const type = typeof candidate.type === 'string' ? candidate.type.toLowerCase() : ''\n  if (type === 'json' || type === 'jsonb') return true\n  const columnTypes = Array.isArray(candidate.columnTypes) ? candidate.columnTypes : []\n  if (columnTypes.some((value) => typeof value === 'string' && value.toLowerCase().includes('json'))) return true\n  const customTypeName = (candidate.customType as { constructor?: { name?: string } } | undefined)?.constructor?.name\n  return typeof customTypeName === 'string' && customTypeName.toLowerCase().includes('json')\n}\n\nconst registeredEventManagers = new WeakSet<object>()\n\nconst subscribersByService = new WeakMap<TenantDataEncryptionService, TenantEncryptionSubscriber>()\n\nfunction getSubscriberForService(service: TenantDataEncryptionService): TenantEncryptionSubscriber {\n  const existing = subscribersByService.get(service)\n  if (existing) return existing\n  const subscriber = new TenantEncryptionSubscriber(service)\n  subscribersByService.set(service, subscriber)\n  return subscriber\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nexport class TenantEncryptionSubscriber implements EventSubscriber<any> {\n  constructor(private readonly service: TenantDataEncryptionService) {}\n\n  getSubscribedEntities() {\n    return [] // listen to all entities\n  }\n\n  private resolveMeta(\n    meta: EntityMetadata<any> | undefined,\n    entity: Record<string, unknown>,\n    em?: { getMetadata?: () => any },\n  ): EntityMetadata<any> | undefined {\n    if (meta) return meta\n    const ctor = (entity as any)?.constructor\n    const name = ctor?.name\n    const registry = em?.getMetadata?.()\n    if (!registry || !name) return meta\n    try { return registry.find?.(name) } catch {}\n    try { return registry.find?.(ctor) } catch {}\n    try { return registry.get?.(name) } catch {}\n    try { return registry.get?.(ctor) } catch {}\n    try {\n      const entries = listEntityMetadataFromRegistry(registry)\n      const match = entries.find(\n        (m: any) =>\n          m?.className === name ||\n          m?.name === name ||\n          m?.entityName === name ||\n          m?.collection === ctor?.prototype?.__meta?.tableName ||\n          m?.tableName === ctor?.prototype?.__meta?.tableName,\n      )\n      if (match) return match as EntityMetadata<any>\n    } catch {\n      // best-effort\n    }\n    return meta\n  }\n\n  private resolveEntityId(meta: EntityMetadata<any> | undefined): string | null {\n    try {\n      return resolveEntityIdFromMetadata(meta)\n    } catch {\n      return null\n    }\n  }\n\n  private restoreDecryptedJsonColumns(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n  ) {\n    const properties = meta?.properties\n    if (!properties || typeof properties !== 'object') return\n    for (const [propertyName, prop] of Object.entries(properties)) {\n      if (!isJsonColumnProperty(prop)) continue\n      const value = target[propertyName]\n      if (typeof value !== 'string') continue\n      const parsed = parseDecryptedFieldValue(value)\n      if (parsed !== value) target[propertyName] = parsed\n    }\n  }\n\n  private syncOriginalEntityData(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getComparator?: () => any },\n  ) {\n    const helper = (target as any)?.__helper\n    if (!helper || typeof helper !== 'object') return\n\n    // Prefer MikroORM comparator snapshot so change detection uses the expected shape.\n    try {\n      const comparator = em?.getComparator?.()\n      if (comparator?.prepareEntity) {\n        helper.__originalEntityData = comparator.prepareEntity(target)\n        helper.__touched = false\n        return\n      }\n    } catch (err) {\n      debug('\u26AA\uFE0F subscriber.sync_original.comparator_failed', {\n        entity: meta?.className || meta?.name,\n        message: (err as Error)?.message ?? String(err),\n      })\n    }\n\n    // Fallback: shallow snapshot of scalar/owner props to keep entities clean without comparator.\n    const properties = meta?.properties ? Object.values(meta.properties) : []\n    if (properties.length === 0) return\n    const snapshot: Record<string, unknown> = { ...(helper.__originalEntityData ?? {}) }\n    for (const prop of properties) {\n      if ([ReferenceKind.ONE_TO_MANY, ReferenceKind.MANY_TO_MANY].includes((prop as any).kind)) continue\n      const name = (prop as any).name\n      if (typeof name !== 'string' || !name.length) continue\n      snapshot[name] = (target as Record<string, unknown>)[name]\n    }\n    helper.__originalEntityData = snapshot\n    helper.__touched = false\n  }\n\n  /**\n   * Reports whether a managed entity currently carries un-flushed changes relative to its load\n   * baseline, using MikroORM's own comparator so the verdict matches the change-set computer that\n   * runs at flush time. Used to avoid re-baselining (and thereby discarding) pending writes when a\n   * decrypt pass traverses back into an entity a command already mutated.\n   */\n  private hasPendingChanges(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getComparator?: () => any },\n  ): boolean {\n    const helper = (target as any)?.__helper\n    if (!helper || typeof helper !== 'object') return false\n    const original = helper.__originalEntityData\n    if (!original) return false\n    const entityName = meta?.className || meta?.name\n    try {\n      const comparator = em?.getComparator?.()\n      if (entityName && comparator?.prepareEntity) {\n        const current = comparator.prepareEntity(target)\n        if (typeof comparator.matching === 'function') {\n          return !comparator.matching(entityName, original, current)\n        }\n        if (typeof comparator.diffEntities === 'function') {\n          const diff = comparator.diffEntities(entityName, original, current)\n          return !!diff && Object.keys(diff).length > 0\n        }\n      }\n    } catch (err) {\n      debug('\u26AA\uFE0F subscriber.pending_changes.compare_failed', {\n        entity: entityName,\n        message: (err as Error)?.message ?? String(err),\n      })\n    }\n    return helper.__touched === true\n  }\n\n  private async encrypt(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getMetadata?: () => any; getComparator?: () => any },\n    changeSet?: { payload?: Record<string, unknown> },\n  ) {\n    if (!isTenantDataEncryptionEnabled() || !this.service.isEnabled()) {\n      debug('\u26AA\uFE0F subscriber.skip', { reason: 'disabled', entity: meta?.className || meta?.name })\n      return\n    }\n    const resolvedMeta = this.resolveMeta(meta, target, em)\n    const entityId = this.resolveEntityId(resolvedMeta)\n    if (!entityId) {\n      debug('\u26A0\uFE0F subscriber.decrypt.skip.entity_id_missing', {\n        metaName: resolvedMeta?.className || resolvedMeta?.name,\n        table: (resolvedMeta as any)?.tableName,\n      })\n      return\n    }\n    const { tenantId, organizationId } = resolveScope(target)\n    const encrypted = await this.service.encryptEntityPayload(entityId, target, tenantId, organizationId)\n    const metaProps: Record<string, unknown> = resolvedMeta?.properties && typeof resolvedMeta.properties === 'object'\n      ? resolvedMeta.properties\n      : {}\n    const payloadObj: Record<string, unknown> | null =\n      changeSet && typeof changeSet === 'object'\n        ? (typeof changeSet.payload === 'object' && changeSet.payload\n            ? (changeSet.payload as Record<string, unknown>)\n            : ((changeSet.payload = {}) as Record<string, unknown>))\n        : null\n    const updates: Record<string, unknown> = {}\n    const columnNameFor = (propKey: string, prop: Record<string, unknown> | undefined): string => {\n      try {\n        if (prop && typeof prop === 'object') {\n          const explicit = (prop as any)?.fieldName\n          if (typeof explicit === 'string' && explicit.length) return explicit\n          const name = (prop as any)?.name\n          if (typeof name === 'string' && name.length) return name\n        }\n      } catch (err) {\n        debug('\u26A0\uFE0F subscriber.column_name.resolve', {\n          entityId,\n          propKey,\n          message: (err as Error)?.message ?? String(err),\n        })\n      }\n      return toSnakeCase(propKey)\n    }\n\n    for (const [key, value] of Object.entries(encrypted)) {\n      const prop = (metaProps as Record<string, any>)[key]\n      if (!prop || typeof prop !== 'object') continue\n      if ((target as Record<string, unknown>)[key] === value) continue\n      updates[key] = value\n    }\n    if (Object.keys(updates).length === 0) return\n    Object.assign(target, updates)\n    if (payloadObj) {\n      try {\n        const ensureColumnKey = (propKey: string, value: unknown) => {\n          const columnName = columnNameFor(propKey, (metaProps as Record<string, any>)[propKey])\n          const canonicalKey = columnName || toSnakeCase(propKey)\n          const aliases = new Set(\n            [propKey, toSnakeCase(propKey), columnName, columnName ? toSnakeCase(columnName) : undefined].filter(\n              (v): v is string => typeof v === 'string' && v.length > 0,\n            ),\n          )\n          for (const alias of aliases) {\n            if (Object.prototype.hasOwnProperty.call(payloadObj, alias)) delete payloadObj[alias]\n          }\n          const finalKey = columnName || toSnakeCase(propKey)\n          payloadObj[finalKey] = value\n        }\n        for (const key of Object.keys(updates)) {\n          ensureColumnKey(key, updates[key])\n        }\n      } catch (err) {\n        debug('\u26A0\uFE0F subscriber.payload.normalize.error', {\n          entityId,\n          message: (err as Error)?.message ?? String(err),\n        })\n      }\n    }\n  }\n\n  async decryptEntityGraph(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getMetadata?: () => any; getComparator?: () => any },\n    opts: { syncOriginal?: boolean; seen?: WeakSet<object>; fallbackScope?: Scope } = {},\n  ) {\n    await this.decrypt(target, meta, em, opts)\n  }\n\n  private async decrypt(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getMetadata?: () => any; getComparator?: () => any },\n    {\n      syncOriginal = false,\n      seen,\n      fallbackScope,\n    }: { syncOriginal?: boolean; seen?: WeakSet<object>; fallbackScope?: Scope } = {},\n  ) {\n    const visited = seen ?? new WeakSet<object>()\n    if (visited.has(target as object)) return\n    visited.add(target as object)\n    if (!isTenantDataEncryptionEnabled() || !this.service.isEnabled()) {\n      debug('\u26AA\uFE0F subscriber.skip', { reason: 'disabled', entity: meta?.className || meta?.name })\n      return\n    }\n    const resolvedMeta = this.resolveMeta(meta, target, em)\n    const entityId = this.resolveEntityId(resolvedMeta)\n    if (!entityId) return\n    const { tenantId, organizationId } = resolveScope(target)\n    const scopedTenantId = tenantId ?? fallbackScope?.tenantId ?? null\n    const scopedOrgId = organizationId ?? fallbackScope?.organizationId ?? null\n    // Capture pending (un-flushed) changes BEFORE decrypt mutates the target. Re-baselining a\n    // managed entity that a command already mutated would clear its dirty changeset and silently\n    // drop the pending write (e.g. an undo handler that mutates an entity, then loads a related\n    // encrypted entity whose deep-decrypt recurses back into the still-dirty entity before flush).\n    const hadPendingChanges = syncOriginal ? this.hasPendingChanges(target, resolvedMeta, em as any) : false\n    const decrypted = await this.service.decryptEntityPayload(entityId, target, scopedTenantId, scopedOrgId)\n    Object.assign(target, decrypted)\n    this.restoreDecryptedJsonColumns(target, resolvedMeta)\n    if (syncOriginal && !hadPendingChanges) {\n      this.syncOriginalEntityData(target, resolvedMeta, em as any)\n    }\n    const nextFallback =\n      fallbackScope ??\n      (tenantId || organizationId\n        ? { tenantId: tenantId ?? null, organizationId: organizationId ?? null }\n        : { tenantId: scopedTenantId, organizationId: scopedOrgId })\n    // Best-effort deep decrypt for loaded relations so populated graphs get cleaned too.\n    try {\n      const extractEntities = (value: any): any[] => {\n        if (!value) return []\n        // MikroORM Collection wrapper \u2014 MUST be checked before the Reference branch: both wrappers\n        // expose isInitialized(), but only a Collection exposes getItems(). Matching the Reference\n        // branch first returned the Collection wrapper itself instead of its items, so collection\n        // relations were never deep-decrypted and leaked ciphertext (issue #2744).\n        if (typeof value === 'object' && typeof (value as any).isInitialized === 'function' && typeof (value as any).getItems === 'function') {\n          try {\n            return (value as any).isInitialized() ? (value as any).getItems() ?? [] : []\n          } catch {\n            return []\n          }\n        }\n        // MikroORM Reference wrapper\n        if (typeof value === 'object' && typeof (value as any).isInitialized === 'function') {\n          try {\n            if ((value as any).isInitialized()) {\n              const unwrapped = typeof (value as any).unwrap === 'function' ? (value as any).unwrap() : (value as any).__entity ?? (value as any)\n              if (unwrapped && typeof unwrapped === 'object') return [unwrapped]\n            }\n          } catch {\n            // ignore\n          }\n          return []\n        }\n        if (Array.isArray(value)) return value\n        if (typeof value === 'object') return [value]\n        return []\n      }\n      const props = resolvedMeta?.properties ? Object.values(resolvedMeta.properties) : []\n      for (const prop of props) {\n        const kind = (prop as any)?.kind\n        const name = (prop as any)?.name\n        if (typeof name !== 'string' || !name.length) continue\n        const value = (target as any)[name]\n        if (!value) continue\n        // Single-valued relation\n        if ([ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(kind)) {\n          const nestedEntities = extractEntities(value)\n          for (const nested of nestedEntities) {\n            const nestedMeta = this.resolveMeta((nested as any).__meta ?? (nested as any).__helper?.__meta, nested, em)\n            await this.decrypt(nested as Record<string, unknown>, nestedMeta, em, {\n              syncOriginal: true,\n              seen: visited,\n              fallbackScope: nextFallback,\n            })\n          }\n          continue\n        }\n        // Collections\n        if ([ReferenceKind.ONE_TO_MANY, ReferenceKind.MANY_TO_MANY].includes(kind)) {\n          const items = extractEntities(value)\n          for (const item of items) {\n            if (!item || typeof item !== 'object') continue\n            const nestedMeta = this.resolveMeta((item as any).__meta ?? (item as any).__helper?.__meta, item, em)\n            await this.decrypt(item as Record<string, unknown>, nestedMeta, em, {\n              syncOriginal: true,\n              seen: visited,\n              fallbackScope: nextFallback,\n            })\n          }\n        }\n      }\n    } catch (err) {\n      debug('\u26A0\uFE0F subscriber.deep_decrypt.error', {\n        entityId,\n        message: (err as Error)?.message ?? String(err),\n      })\n    }\n  }\n\n  async beforeCreate(args: EventArgs<any>) {\n    await this.encrypt(args.entity as Record<string, unknown>, args.meta, args.em, args.changeSet as any)\n  }\n\n  async beforeUpdate(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em)\n    await this.encrypt(args.entity as Record<string, unknown>, args.meta, args.em, args.changeSet as any)\n  }\n\n  async afterCreate(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async afterUpdate(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async afterUpsert(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async onLoad(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async afterFind(args: EventArgs<any> & { entities?: unknown[] }) {\n    const entities = Array.isArray(args.entities) ? args.entities : []\n    for (const entity of entities) {\n      await this.decrypt(entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n    }\n  }\n}\n\nexport function registerTenantEncryptionSubscriber(\n  em: { getEventManager?: () => { registerSubscriber?: (subscriber: EventSubscriber<any>) => void } } | null | undefined,\n  service: TenantDataEncryptionService,\n): void {\n  const eventManager = em?.getEventManager?.()\n  if (!eventManager || typeof eventManager.registerSubscriber !== 'function') return\n  if (registeredEventManagers.has(eventManager)) return\n  eventManager.registerSubscriber(new TenantEncryptionSubscriber(service))\n  registeredEventManagers.add(eventManager)\n}\n\nexport async function decryptEntitiesWithFallbackScope(\n  targets: unknown | unknown[],\n  {\n    em,\n    tenantId,\n    organizationId,\n    encryptionService,\n  }: {\n    em: { getMetadata?: () => any; getComparator?: () => any }\n    tenantId?: string | null\n    organizationId?: string | null\n    encryptionService?: TenantDataEncryptionService | null\n  },\n): Promise<void> {\n  if (!isTenantDataEncryptionEnabled()) return\n  const list = Array.isArray(targets) ? targets : [targets]\n  if (!list.length) return\n  const service = encryptionService ?? resolveTenantEncryptionService(em as any)\n  if (!service || !service.isEnabled()) return\n  const subscriber = getSubscriberForService(service)\n  const fallback: Scope | undefined =\n    tenantId || organizationId\n      ? {\n          tenantId: tenantId ?? null,\n          organizationId: organizationId ?? null,\n        }\n      : undefined\n  for (const entity of list) {\n    if (!entity || typeof entity !== 'object') continue\n    const meta = (entity as any).__meta ?? (entity as any).__helper?.__meta\n    await subscriber.decryptEntityGraph(entity as Record<string, unknown>, meta, em as any, {\n      syncOriginal: true,\n      fallbackScope: fallback,\n    })\n  }\n}\n"],
-  "mappings": "AACA,SAAS,qBAAqB;AAC9B,SAAS,mCAAmC;AAC5C,SAAsC,gCAAgC;AACtE,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB;AAC7B,SAAS,sCAAsC;AAE/C,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAavE,SAAS,aAAa,QAAuB;AAC3C,QAAM,WAAW,OAAO,YAAY,OAAO,aAAa,OAAO,QAAQ,MAAM;AAC7E,QAAM,iBAAiB,OAAO,kBAAkB,OAAO,mBAAmB,OAAO,cAAc,MAAM;AACrG,SAAO;AAAA,IACL,UAAU,WAAW,OAAO,QAAQ,IAAI;AAAA,IACxC,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,EAC5D;AACF;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AACF,WAAO,MAAM,OAAO,OAAO;AAAA,EAC7B,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,qBAAqB,MAAwB;AACpD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,YAAY;AAClB,QAAM,OAAO,OAAO,UAAU,SAAS,WAAW,UAAU,KAAK,YAAY,IAAI;AACjF,MAAI,SAAS,UAAU,SAAS,QAAS,QAAO;AAChD,QAAM,cAAc,MAAM,QAAQ,UAAU,WAAW,IAAI,UAAU,cAAc,CAAC;AACpF,MAAI,YAAY,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,YAAY,EAAE,SAAS,MAAM,CAAC,EAAG,QAAO;AAC3G,QAAM,iBAAkB,UAAU,YAAgE,aAAa;AAC/G,SAAO,OAAO,mBAAmB,YAAY,eAAe,YAAY,EAAE,SAAS,MAAM;AAC3F;AAEA,MAAM,0BAA0B,oBAAI,QAAgB;AAEpD,MAAM,uBAAuB,oBAAI,QAAiE;AAElG,SAAS,wBAAwB,SAAkE;AACjG,QAAM,WAAW,qBAAqB,IAAI,OAAO;AACjD,MAAI,SAAU,QAAO;AACrB,QAAM,aAAa,IAAI,2BAA2B,OAAO;AACzD,uBAAqB,IAAI,SAAS,UAAU;AAC5C,SAAO;AACT;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAE5D,MAAM,2BAA2D;AAAA,EACtE,YAA6B,SAAsC;AAAtC;AAAA,EAAuC;AAAA,EAEpE,wBAAwB;AACtB,WAAO,CAAC;AAAA,EACV;AAAA,EAEQ,YACN,MACA,QACA,IACiC;AACjC,QAAI,KAAM,QAAO;AACjB,UAAM,OAAQ,QAAgB;AAC9B,UAAM,OAAO,MAAM;AACnB,UAAM,WAAW,IAAI,cAAc;AACnC,QAAI,CAAC,YAAY,CAAC,KAAM,QAAO;AAC/B,QAAI;AAAE,aAAO,SAAS,OAAO,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC5C,QAAI;AAAE,aAAO,SAAS,OAAO,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC5C,QAAI;AAAE,aAAO,SAAS,MAAM,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC3C,QAAI;AAAE,aAAO,SAAS,MAAM,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC3C,QAAI;AACF,YAAM,UAAU,+BAA+B,QAAQ;AACvD,YAAM,QAAQ,QAAQ;AAAA,QACpB,CAAC,MACC,GAAG,cAAc,QACjB,GAAG,SAAS,QACZ,GAAG,eAAe,QAClB,GAAG,eAAe,MAAM,WAAW,QAAQ,aAC3C,GAAG,cAAc,MAAM,WAAW,QAAQ;AAAA,MAC9C;AACA,UAAI,MAAO,QAAO;AAAA,IACpB,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAsD;AAC5E,QAAI;AACF,aAAO,4BAA4B,IAAI;AAAA,IACzC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,4BACN,QACA,MACA;AACA,UAAM,aAAa,MAAM;AACzB,QAAI,CAAC,cAAc,OAAO,eAAe,SAAU;AACnD,eAAW,CAAC,cAAc,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC7D,UAAI,CAAC,qBAAqB,IAAI,EAAG;AACjC,YAAM,QAAQ,OAAO,YAAY;AACjC,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,SAAS,yBAAyB,KAAK;AAC7C,UAAI,WAAW,MAAO,QAAO,YAAY,IAAI;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,uBACN,QACA,MACA,IACA;AACA,UAAM,SAAU,QAAgB;AAChC,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAG3C,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,UAAI,YAAY,eAAe;AAC7B,eAAO,uBAAuB,WAAW,cAAc,MAAM;AAC7D,eAAO,YAAY;AACnB;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,2DAAiD;AAAA,QACrD,QAAQ,MAAM,aAAa,MAAM;AAAA,QACjC,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,MAChD,CAAC;AAAA,IACH;AAGA,UAAM,aAAa,MAAM,aAAa,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC;AACxE,QAAI,WAAW,WAAW,EAAG;AAC7B,UAAM,WAAoC,EAAE,GAAI,OAAO,wBAAwB,CAAC,EAAG;AACnF,eAAW,QAAQ,YAAY;AAC7B,UAAI,CAAC,cAAc,aAAa,cAAc,YAAY,EAAE,SAAU,KAAa,IAAI,EAAG;AAC1F,YAAM,OAAQ,KAAa;AAC3B,UAAI,OAAO,SAAS,YAAY,CAAC,KAAK,OAAQ;AAC9C,eAAS,IAAI,IAAK,OAAmC,IAAI;AAAA,IAC3D;AACA,WAAO,uBAAuB;AAC9B,WAAO,YAAY;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBACN,QACA,MACA,IACS;AACT,UAAM,SAAU,QAAgB;AAChC,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,UAAM,WAAW,OAAO;AACxB,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,aAAa,MAAM,aAAa,MAAM;AAC5C,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,UAAI,cAAc,YAAY,eAAe;AAC3C,cAAM,UAAU,WAAW,cAAc,MAAM;AAC/C,YAAI,OAAO,WAAW,aAAa,YAAY;AAC7C,iBAAO,CAAC,WAAW,SAAS,YAAY,UAAU,OAAO;AAAA,QAC3D;AACA,YAAI,OAAO,WAAW,iBAAiB,YAAY;AACjD,gBAAM,OAAO,WAAW,aAAa,YAAY,UAAU,OAAO;AAClE,iBAAO,CAAC,CAAC,QAAQ,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAC9C;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,0DAAgD;AAAA,QACpD,QAAQ;AAAA,QACR,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO,OAAO,cAAc;AAAA,EAC9B;AAAA,EAEA,MAAc,QACZ,QACA,MACA,IACA,WACA;AACA,QAAI,CAAC,8BAA8B,KAAK,CAAC,KAAK,QAAQ,UAAU,GAAG;AACjE,YAAM,gCAAsB,EAAE,QAAQ,YAAY,QAAQ,MAAM,aAAa,MAAM,KAAK,CAAC;AACzF;AAAA,IACF;AACA,UAAM,eAAe,KAAK,YAAY,MAAM,QAAQ,EAAE;AACtD,UAAM,WAAW,KAAK,gBAAgB,YAAY;AAClD,QAAI,CAAC,UAAU;AACb,YAAM,0DAAgD;AAAA,QACpD,UAAU,cAAc,aAAa,cAAc;AAAA,QACnD,OAAQ,cAAsB;AAAA,MAChC,CAAC;AACD;AAAA,IACF;AACA,UAAM,EAAE,UAAU,eAAe,IAAI,aAAa,MAAM;AACxD,UAAM,YAAY,MAAM,KAAK,QAAQ,qBAAqB,UAAU,QAAQ,UAAU,cAAc;AACpG,UAAM,YAAqC,cAAc,cAAc,OAAO,aAAa,eAAe,WACtG,aAAa,aACb,CAAC;AACL,UAAM,aACJ,aAAa,OAAO,cAAc,WAC7B,OAAO,UAAU,YAAY,YAAY,UAAU,UAC/C,UAAU,UACT,UAAU,UAAU,CAAC,IAC3B;AACN,UAAM,UAAmC,CAAC;AAC1C,UAAM,gBAAgB,CAAC,SAAiB,SAAsD;AAC5F,UAAI;AACF,YAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,gBAAM,WAAY,MAAc;AAChC,cAAI,OAAO,aAAa,YAAY,SAAS,OAAQ,QAAO;AAC5D,gBAAM,OAAQ,MAAc;AAC5B,cAAI,OAAO,SAAS,YAAY,KAAK,OAAQ,QAAO;AAAA,QACtD;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,+CAAqC;AAAA,UACzC;AAAA,UACA;AAAA,UACA,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,QAChD,CAAC;AAAA,MACH;AACA,aAAO,YAAY,OAAO;AAAA,IAC5B;AAEA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,YAAM,OAAQ,UAAkC,GAAG;AACnD,UAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAK,OAAmC,GAAG,MAAM,MAAO;AACxD,cAAQ,GAAG,IAAI;AAAA,IACjB;AACA,QAAI,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG;AACvC,WAAO,OAAO,QAAQ,OAAO;AAC7B,QAAI,YAAY;AACd,UAAI;AACF,cAAM,kBAAkB,CAAC,SAAiB,UAAmB;AAC3D,gBAAM,aAAa,cAAc,SAAU,UAAkC,OAAO,CAAC;AACrF,gBAAM,eAAe,cAAc,YAAY,OAAO;AACtD,gBAAM,UAAU,IAAI;AAAA,YAClB,CAAC,SAAS,YAAY,OAAO,GAAG,YAAY,aAAa,YAAY,UAAU,IAAI,MAAS,EAAE;AAAA,cAC5F,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAAA,YAC1D;AAAA,UACF;AACA,qBAAW,SAAS,SAAS;AAC3B,gBAAI,OAAO,UAAU,eAAe,KAAK,YAAY,KAAK,EAAG,QAAO,WAAW,KAAK;AAAA,UACtF;AACA,gBAAM,WAAW,cAAc,YAAY,OAAO;AAClD,qBAAW,QAAQ,IAAI;AAAA,QACzB;AACA,mBAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,0BAAgB,KAAK,QAAQ,GAAG,CAAC;AAAA,QACnC;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,mDAAyC;AAAA,UAC7C;AAAA,UACA,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,QACA,MACA,IACA,OAAkF,CAAC,GACnF;AACA,UAAM,KAAK,QAAQ,QAAQ,MAAM,IAAI,IAAI;AAAA,EAC3C;AAAA,EAEA,MAAc,QACZ,QACA,MACA,IACA;AAAA,IACE,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,IAA+E,CAAC,GAChF;AACA,UAAM,UAAU,QAAQ,oBAAI,QAAgB;AAC5C,QAAI,QAAQ,IAAI,MAAgB,EAAG;AACnC,YAAQ,IAAI,MAAgB;AAC5B,QAAI,CAAC,8BAA8B,KAAK,CAAC,KAAK,QAAQ,UAAU,GAAG;AACjE,YAAM,gCAAsB,EAAE,QAAQ,YAAY,QAAQ,MAAM,aAAa,MAAM,KAAK,CAAC;AACzF;AAAA,IACF;AACA,UAAM,eAAe,KAAK,YAAY,MAAM,QAAQ,EAAE;AACtD,UAAM,WAAW,KAAK,gBAAgB,YAAY;AAClD,QAAI,CAAC,SAAU;AACf,UAAM,EAAE,UAAU,eAAe,IAAI,aAAa,MAAM;AACxD,UAAM,iBAAiB,YAAY,eAAe,YAAY;AAC9D,UAAM,cAAc,kBAAkB,eAAe,kBAAkB;AAKvE,UAAM,oBAAoB,eAAe,KAAK,kBAAkB,QAAQ,cAAc,EAAS,IAAI;AACnG,UAAM,YAAY,MAAM,KAAK,QAAQ,qBAAqB,UAAU,QAAQ,gBAAgB,WAAW;AACvG,WAAO,OAAO,QAAQ,SAAS;AAC/B,SAAK,4BAA4B,QAAQ,YAAY;AACrD,QAAI,gBAAgB,CAAC,mBAAmB;AACtC,WAAK,uBAAuB,QAAQ,cAAc,EAAS;AAAA,IAC7D;AACA,UAAM,eACJ,kBACC,YAAY,iBACT,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,IACrE,EAAE,UAAU,gBAAgB,gBAAgB,YAAY;AAE9D,QAAI;AACF,YAAM,kBAAkB,CAAC,UAAsB;AAC7C,YAAI,CAAC,MAAO,QAAO,CAAC;AAKpB,YAAI,OAAO,UAAU,YAAY,OAAQ,MAAc,kBAAkB,cAAc,OAAQ,MAAc,aAAa,YAAY;AACpI,cAAI;AACF,mBAAQ,MAAc,cAAc,IAAK,MAAc,SAAS,KAAK,CAAC,IAAI,CAAC;AAAA,UAC7E,QAAQ;AACN,mBAAO,CAAC;AAAA,UACV;AAAA,QACF;AAEA,YAAI,OAAO,UAAU,YAAY,OAAQ,MAAc,kBAAkB,YAAY;AACnF,cAAI;AACF,gBAAK,MAAc,cAAc,GAAG;AAClC,oBAAM,YAAY,OAAQ,MAAc,WAAW,aAAc,MAAc,OAAO,IAAK,MAAc,YAAa;AACtH,kBAAI,aAAa,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AAAA,YACnE;AAAA,UACF,QAAQ;AAAA,UAER;AACA,iBAAO,CAAC;AAAA,QACV;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,YAAI,OAAO,UAAU,SAAU,QAAO,CAAC,KAAK;AAC5C,eAAO,CAAC;AAAA,MACV;AACA,YAAM,QAAQ,cAAc,aAAa,OAAO,OAAO,aAAa,UAAU,IAAI,CAAC;AACnF,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAQ,MAAc;AAC5B,cAAM,OAAQ,MAAc;AAC5B,YAAI,OAAO,SAAS,YAAY,CAAC,KAAK,OAAQ;AAC9C,cAAM,QAAS,OAAe,IAAI;AAClC,YAAI,CAAC,MAAO;AAEZ,YAAI,CAAC,cAAc,aAAa,cAAc,UAAU,EAAE,SAAS,IAAI,GAAG;AACxE,gBAAM,iBAAiB,gBAAgB,KAAK;AAC5C,qBAAW,UAAU,gBAAgB;AACnC,kBAAM,aAAa,KAAK,YAAa,OAAe,UAAW,OAAe,UAAU,QAAQ,QAAQ,EAAE;AAC1G,kBAAM,KAAK,QAAQ,QAAmC,YAAY,IAAI;AAAA,cACpE,cAAc;AAAA,cACd,MAAM;AAAA,cACN,eAAe;AAAA,YACjB,CAAC;AAAA,UACH;AACA;AAAA,QACF;AAEA,YAAI,CAAC,cAAc,aAAa,cAAc,YAAY,EAAE,SAAS,IAAI,GAAG;AAC1E,gBAAM,QAAQ,gBAAgB,KAAK;AACnC,qBAAW,QAAQ,OAAO;AACxB,gBAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,kBAAM,aAAa,KAAK,YAAa,KAAa,UAAW,KAAa,UAAU,QAAQ,MAAM,EAAE;AACpG,kBAAM,KAAK,QAAQ,MAAiC,YAAY,IAAI;AAAA,cAClE,cAAc;AAAA,cACd,MAAM;AAAA,cACN,eAAe;AAAA,YACjB,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,8CAAoC;AAAA,QACxC;AAAA,QACA,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,MAAsB;AACvC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,KAAK,SAAgB;AAAA,EACtG;AAAA,EAEA,MAAM,aAAa,MAAsB;AACvC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,EAAE;AAC7E,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,KAAK,SAAgB;AAAA,EACtG;AAAA,EAEA,MAAM,YAAY,MAAsB;AACtC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,YAAY,MAAsB;AACtC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,YAAY,MAAsB;AACtC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,OAAO,MAAsB;AACjC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,UAAU,MAAiD;AAC/D,UAAM,WAAW,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK,WAAW,CAAC;AACjE,eAAW,UAAU,UAAU;AAC7B,YAAM,KAAK,QAAQ,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEO,SAAS,mCACd,IACA,SACM;AACN,QAAM,eAAe,IAAI,kBAAkB;AAC3C,MAAI,CAAC,gBAAgB,OAAO,aAAa,uBAAuB,WAAY;AAC5E,MAAI,wBAAwB,IAAI,YAAY,EAAG;AAC/C,eAAa,mBAAmB,IAAI,2BAA2B,OAAO,CAAC;AACvE,0BAAwB,IAAI,YAAY;AAC1C;AAEA,eAAsB,iCACpB,SACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMe;AACf,MAAI,CAAC,8BAA8B,EAAG;AACtC,QAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,MAAI,CAAC,KAAK,OAAQ;AAClB,QAAM,UAAU,qBAAqB,+BAA+B,EAAS;AAC7E,MAAI,CAAC,WAAW,CAAC,QAAQ,UAAU,EAAG;AACtC,QAAM,aAAa,wBAAwB,OAAO;AAClD,QAAM,WACJ,YAAY,iBACR;AAAA,IACE,UAAU,YAAY;AAAA,IACtB,gBAAgB,kBAAkB;AAAA,EACpC,IACA;AACN,aAAW,UAAU,MAAM;AACzB,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAC3C,UAAM,OAAQ,OAAe,UAAW,OAAe,UAAU;AACjE,UAAM,WAAW,mBAAmB,QAAmC,MAAM,IAAW;AAAA,MACtF,cAAc;AAAA,MACd,eAAe;AAAA,IACjB,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import type { EntityMetadata, EventArgs, EventSubscriber } from '@mikro-orm/core'\nimport { ReferenceKind } from '@mikro-orm/core'\nimport { resolveEntityIdFromMetadata } from './entityIds'\nimport { TenantDataEncryptionService, parseDecryptedFieldValue } from './tenantDataEncryptionService'\nimport { isTenantDataEncryptionEnabled } from './toggles'\nimport { isEncryptionDebugEnabled } from './toggles'\nimport { resolveTenantEncryptionService } from './customFieldValues'\nimport { createLogger } from '../logger'\nimport { listEntityMetadataFromRegistry } from '../db/entityMetadata'\n\nconst logger = createLogger('shared').child({ component: 'encryption' })\n\ntype Scoped = {\n  tenantId?: string | null\n  tenant_id?: string | null\n  tenant?: { id?: string | null } | null\n  organizationId?: string | null\n  organization_id?: string | null\n  organization?: { id?: string | null } | null\n}\n\ntype Scope = { tenantId: string | null; organizationId: string | null }\n\nfunction resolveScope(entity: Scoped): Scope {\n  const tenantId = entity.tenantId ?? entity.tenant_id ?? entity.tenant?.id ?? null\n  const organizationId = entity.organizationId ?? entity.organization_id ?? entity.organization?.id ?? null\n  return {\n    tenantId: tenantId ? String(tenantId) : null,\n    organizationId: organizationId ? String(organizationId) : null,\n  }\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    logger.debug(event, payload)\n  } catch {\n    // ignore\n  }\n}\n\nfunction isJsonColumnProperty(prop: unknown): boolean {\n  if (!prop || typeof prop !== 'object') return false\n  const candidate = prop as Record<string, unknown>\n  const type = typeof candidate.type === 'string' ? candidate.type.toLowerCase() : ''\n  if (type === 'json' || type === 'jsonb') return true\n  const columnTypes = Array.isArray(candidate.columnTypes) ? candidate.columnTypes : []\n  if (columnTypes.some((value) => typeof value === 'string' && value.toLowerCase().includes('json'))) return true\n  const customTypeName = (candidate.customType as { constructor?: { name?: string } } | undefined)?.constructor?.name\n  return typeof customTypeName === 'string' && customTypeName.toLowerCase().includes('json')\n}\n\n// Encryption is configured on but the service reports disabled \u2014 the KMS is\n// unreachable, so this write lands as plaintext. Throttle the warning so a long\n// outage does not flood the log while still leaving an ongoing signal that the\n// fail-open window is open (#5948).\nconst ENCRYPTION_PAUSED_WARN_INTERVAL_MS = 60_000\nlet lastEncryptionPausedWarnAt = 0\n\nfunction warnEncryptionPaused(entity: string | undefined): void {\n  const now = Date.now()\n  if (lastEncryptionPausedWarnAt && now - lastEncryptionPausedWarnAt < ENCRYPTION_PAUSED_WARN_INTERVAL_MS) return\n  lastEncryptionPausedWarnAt = now\n  try {\n    logger.warn(\n      'Tenant data encryption is enabled but the KMS is unavailable - entity writes persist as plaintext until it recovers',\n      { entity },\n    )\n  } catch {\n    // ignore\n  }\n}\n\nexport function resetEncryptionPausedWarnThrottle(): void {\n  lastEncryptionPausedWarnAt = 0\n}\n\nconst registeredEventManagers = new WeakSet<object>()\n\nconst subscribersByService = new WeakMap<TenantDataEncryptionService, TenantEncryptionSubscriber>()\n\nfunction getSubscriberForService(service: TenantDataEncryptionService): TenantEncryptionSubscriber {\n  const existing = subscribersByService.get(service)\n  if (existing) return existing\n  const subscriber = new TenantEncryptionSubscriber(service)\n  subscribersByService.set(service, subscriber)\n  return subscriber\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nexport class TenantEncryptionSubscriber implements EventSubscriber<any> {\n  constructor(private readonly service: TenantDataEncryptionService) {}\n\n  getSubscribedEntities() {\n    return [] // listen to all entities\n  }\n\n  private resolveMeta(\n    meta: EntityMetadata<any> | undefined,\n    entity: Record<string, unknown>,\n    em?: { getMetadata?: () => any },\n  ): EntityMetadata<any> | undefined {\n    if (meta) return meta\n    const ctor = (entity as any)?.constructor\n    const name = ctor?.name\n    const registry = em?.getMetadata?.()\n    if (!registry || !name) return meta\n    try { return registry.find?.(name) } catch {}\n    try { return registry.find?.(ctor) } catch {}\n    try { return registry.get?.(name) } catch {}\n    try { return registry.get?.(ctor) } catch {}\n    try {\n      const entries = listEntityMetadataFromRegistry(registry)\n      const match = entries.find(\n        (m: any) =>\n          m?.className === name ||\n          m?.name === name ||\n          m?.entityName === name ||\n          m?.collection === ctor?.prototype?.__meta?.tableName ||\n          m?.tableName === ctor?.prototype?.__meta?.tableName,\n      )\n      if (match) return match as EntityMetadata<any>\n    } catch {\n      // best-effort\n    }\n    return meta\n  }\n\n  private resolveEntityId(meta: EntityMetadata<any> | undefined): string | null {\n    try {\n      return resolveEntityIdFromMetadata(meta)\n    } catch {\n      return null\n    }\n  }\n\n  private restoreDecryptedJsonColumns(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n  ) {\n    const properties = meta?.properties\n    if (!properties || typeof properties !== 'object') return\n    for (const [propertyName, prop] of Object.entries(properties)) {\n      if (!isJsonColumnProperty(prop)) continue\n      const value = target[propertyName]\n      if (typeof value !== 'string') continue\n      const parsed = parseDecryptedFieldValue(value)\n      if (parsed !== value) target[propertyName] = parsed\n    }\n  }\n\n  private syncOriginalEntityData(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getComparator?: () => any },\n  ) {\n    const helper = (target as any)?.__helper\n    if (!helper || typeof helper !== 'object') return\n\n    // Prefer MikroORM comparator snapshot so change detection uses the expected shape.\n    try {\n      const comparator = em?.getComparator?.()\n      if (comparator?.prepareEntity) {\n        helper.__originalEntityData = comparator.prepareEntity(target)\n        helper.__touched = false\n        return\n      }\n    } catch (err) {\n      debug('\u26AA\uFE0F subscriber.sync_original.comparator_failed', {\n        entity: meta?.className || meta?.name,\n        message: (err as Error)?.message ?? String(err),\n      })\n    }\n\n    // Fallback: shallow snapshot of scalar/owner props to keep entities clean without comparator.\n    const properties = meta?.properties ? Object.values(meta.properties) : []\n    if (properties.length === 0) return\n    const snapshot: Record<string, unknown> = { ...(helper.__originalEntityData ?? {}) }\n    for (const prop of properties) {\n      if ([ReferenceKind.ONE_TO_MANY, ReferenceKind.MANY_TO_MANY].includes((prop as any).kind)) continue\n      const name = (prop as any).name\n      if (typeof name !== 'string' || !name.length) continue\n      snapshot[name] = (target as Record<string, unknown>)[name]\n    }\n    helper.__originalEntityData = snapshot\n    helper.__touched = false\n  }\n\n  /**\n   * Reports whether a managed entity currently carries un-flushed changes relative to its load\n   * baseline, using MikroORM's own comparator so the verdict matches the change-set computer that\n   * runs at flush time. Used to avoid re-baselining (and thereby discarding) pending writes when a\n   * decrypt pass traverses back into an entity a command already mutated.\n   */\n  private hasPendingChanges(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getComparator?: () => any },\n  ): boolean {\n    const helper = (target as any)?.__helper\n    if (!helper || typeof helper !== 'object') return false\n    const original = helper.__originalEntityData\n    if (!original) return false\n    const entityName = meta?.className || meta?.name\n    try {\n      const comparator = em?.getComparator?.()\n      if (entityName && comparator?.prepareEntity) {\n        const current = comparator.prepareEntity(target)\n        if (typeof comparator.matching === 'function') {\n          return !comparator.matching(entityName, original, current)\n        }\n        if (typeof comparator.diffEntities === 'function') {\n          const diff = comparator.diffEntities(entityName, original, current)\n          return !!diff && Object.keys(diff).length > 0\n        }\n      }\n    } catch (err) {\n      debug('\u26AA\uFE0F subscriber.pending_changes.compare_failed', {\n        entity: entityName,\n        message: (err as Error)?.message ?? String(err),\n      })\n    }\n    return helper.__touched === true\n  }\n\n  private async encrypt(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getMetadata?: () => any; getComparator?: () => any },\n    changeSet?: { payload?: Record<string, unknown> },\n  ) {\n    const encryptionConfigured = isTenantDataEncryptionEnabled()\n    if (!encryptionConfigured || !this.service.isEnabled()) {\n      debug('\u26AA\uFE0F subscriber.skip', { reason: 'disabled', entity: meta?.className || meta?.name })\n      if (encryptionConfigured) warnEncryptionPaused(meta?.className || meta?.name)\n      return\n    }\n    const resolvedMeta = this.resolveMeta(meta, target, em)\n    const entityId = this.resolveEntityId(resolvedMeta)\n    if (!entityId) {\n      debug('\u26A0\uFE0F subscriber.decrypt.skip.entity_id_missing', {\n        metaName: resolvedMeta?.className || resolvedMeta?.name,\n        table: (resolvedMeta as any)?.tableName,\n      })\n      return\n    }\n    const { tenantId, organizationId } = resolveScope(target)\n    const encrypted = await this.service.encryptEntityPayload(entityId, target, tenantId, organizationId)\n    const metaProps: Record<string, unknown> = resolvedMeta?.properties && typeof resolvedMeta.properties === 'object'\n      ? resolvedMeta.properties\n      : {}\n    const payloadObj: Record<string, unknown> | null =\n      changeSet && typeof changeSet === 'object'\n        ? (typeof changeSet.payload === 'object' && changeSet.payload\n            ? (changeSet.payload as Record<string, unknown>)\n            : ((changeSet.payload = {}) as Record<string, unknown>))\n        : null\n    const updates: Record<string, unknown> = {}\n    const columnNameFor = (propKey: string, prop: Record<string, unknown> | undefined): string => {\n      try {\n        if (prop && typeof prop === 'object') {\n          const explicit = (prop as any)?.fieldName\n          if (typeof explicit === 'string' && explicit.length) return explicit\n          const name = (prop as any)?.name\n          if (typeof name === 'string' && name.length) return name\n        }\n      } catch (err) {\n        debug('\u26A0\uFE0F subscriber.column_name.resolve', {\n          entityId,\n          propKey,\n          message: (err as Error)?.message ?? String(err),\n        })\n      }\n      return toSnakeCase(propKey)\n    }\n\n    for (const [key, value] of Object.entries(encrypted)) {\n      const prop = (metaProps as Record<string, any>)[key]\n      if (!prop || typeof prop !== 'object') continue\n      if ((target as Record<string, unknown>)[key] === value) continue\n      updates[key] = value\n    }\n    if (Object.keys(updates).length === 0) return\n    Object.assign(target, updates)\n    if (payloadObj) {\n      try {\n        const ensureColumnKey = (propKey: string, value: unknown) => {\n          const columnName = columnNameFor(propKey, (metaProps as Record<string, any>)[propKey])\n          const canonicalKey = columnName || toSnakeCase(propKey)\n          const aliases = new Set(\n            [propKey, toSnakeCase(propKey), columnName, columnName ? toSnakeCase(columnName) : undefined].filter(\n              (v): v is string => typeof v === 'string' && v.length > 0,\n            ),\n          )\n          for (const alias of aliases) {\n            if (Object.prototype.hasOwnProperty.call(payloadObj, alias)) delete payloadObj[alias]\n          }\n          const finalKey = columnName || toSnakeCase(propKey)\n          payloadObj[finalKey] = value\n        }\n        for (const key of Object.keys(updates)) {\n          ensureColumnKey(key, updates[key])\n        }\n      } catch (err) {\n        debug('\u26A0\uFE0F subscriber.payload.normalize.error', {\n          entityId,\n          message: (err as Error)?.message ?? String(err),\n        })\n      }\n    }\n  }\n\n  async decryptEntityGraph(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getMetadata?: () => any; getComparator?: () => any },\n    opts: { syncOriginal?: boolean; seen?: WeakSet<object>; fallbackScope?: Scope } = {},\n  ) {\n    await this.decrypt(target, meta, em, opts)\n  }\n\n  private async decrypt(\n    target: Record<string, unknown>,\n    meta: EntityMetadata<any> | undefined,\n    em?: { getMetadata?: () => any; getComparator?: () => any },\n    {\n      syncOriginal = false,\n      seen,\n      fallbackScope,\n    }: { syncOriginal?: boolean; seen?: WeakSet<object>; fallbackScope?: Scope } = {},\n  ) {\n    const visited = seen ?? new WeakSet<object>()\n    if (visited.has(target as object)) return\n    visited.add(target as object)\n    if (!isTenantDataEncryptionEnabled() || !this.service.isEnabled()) {\n      debug('\u26AA\uFE0F subscriber.skip', { reason: 'disabled', entity: meta?.className || meta?.name })\n      return\n    }\n    const resolvedMeta = this.resolveMeta(meta, target, em)\n    const entityId = this.resolveEntityId(resolvedMeta)\n    if (!entityId) return\n    const { tenantId, organizationId } = resolveScope(target)\n    const scopedTenantId = tenantId ?? fallbackScope?.tenantId ?? null\n    const scopedOrgId = organizationId ?? fallbackScope?.organizationId ?? null\n    // Capture pending (un-flushed) changes BEFORE decrypt mutates the target. Re-baselining a\n    // managed entity that a command already mutated would clear its dirty changeset and silently\n    // drop the pending write (e.g. an undo handler that mutates an entity, then loads a related\n    // encrypted entity whose deep-decrypt recurses back into the still-dirty entity before flush).\n    const hadPendingChanges = syncOriginal ? this.hasPendingChanges(target, resolvedMeta, em as any) : false\n    const decrypted = await this.service.decryptEntityPayload(entityId, target, scopedTenantId, scopedOrgId)\n    Object.assign(target, decrypted)\n    this.restoreDecryptedJsonColumns(target, resolvedMeta)\n    if (syncOriginal && !hadPendingChanges) {\n      this.syncOriginalEntityData(target, resolvedMeta, em as any)\n    }\n    const nextFallback =\n      fallbackScope ??\n      (tenantId || organizationId\n        ? { tenantId: tenantId ?? null, organizationId: organizationId ?? null }\n        : { tenantId: scopedTenantId, organizationId: scopedOrgId })\n    // Best-effort deep decrypt for loaded relations so populated graphs get cleaned too.\n    try {\n      const extractEntities = (value: any): any[] => {\n        if (!value) return []\n        // MikroORM Collection wrapper \u2014 MUST be checked before the Reference branch: both wrappers\n        // expose isInitialized(), but only a Collection exposes getItems(). Matching the Reference\n        // branch first returned the Collection wrapper itself instead of its items, so collection\n        // relations were never deep-decrypted and leaked ciphertext (issue #2744).\n        if (typeof value === 'object' && typeof (value as any).isInitialized === 'function' && typeof (value as any).getItems === 'function') {\n          try {\n            return (value as any).isInitialized() ? (value as any).getItems() ?? [] : []\n          } catch {\n            return []\n          }\n        }\n        // MikroORM Reference wrapper\n        if (typeof value === 'object' && typeof (value as any).isInitialized === 'function') {\n          try {\n            if ((value as any).isInitialized()) {\n              const unwrapped = typeof (value as any).unwrap === 'function' ? (value as any).unwrap() : (value as any).__entity ?? (value as any)\n              if (unwrapped && typeof unwrapped === 'object') return [unwrapped]\n            }\n          } catch {\n            // ignore\n          }\n          return []\n        }\n        if (Array.isArray(value)) return value\n        if (typeof value === 'object') return [value]\n        return []\n      }\n      const props = resolvedMeta?.properties ? Object.values(resolvedMeta.properties) : []\n      for (const prop of props) {\n        const kind = (prop as any)?.kind\n        const name = (prop as any)?.name\n        if (typeof name !== 'string' || !name.length) continue\n        const value = (target as any)[name]\n        if (!value) continue\n        // Single-valued relation\n        if ([ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(kind)) {\n          const nestedEntities = extractEntities(value)\n          for (const nested of nestedEntities) {\n            const nestedMeta = this.resolveMeta((nested as any).__meta ?? (nested as any).__helper?.__meta, nested, em)\n            await this.decrypt(nested as Record<string, unknown>, nestedMeta, em, {\n              syncOriginal: true,\n              seen: visited,\n              fallbackScope: nextFallback,\n            })\n          }\n          continue\n        }\n        // Collections\n        if ([ReferenceKind.ONE_TO_MANY, ReferenceKind.MANY_TO_MANY].includes(kind)) {\n          const items = extractEntities(value)\n          for (const item of items) {\n            if (!item || typeof item !== 'object') continue\n            const nestedMeta = this.resolveMeta((item as any).__meta ?? (item as any).__helper?.__meta, item, em)\n            await this.decrypt(item as Record<string, unknown>, nestedMeta, em, {\n              syncOriginal: true,\n              seen: visited,\n              fallbackScope: nextFallback,\n            })\n          }\n        }\n      }\n    } catch (err) {\n      debug('\u26A0\uFE0F subscriber.deep_decrypt.error', {\n        entityId,\n        message: (err as Error)?.message ?? String(err),\n      })\n    }\n  }\n\n  async beforeCreate(args: EventArgs<any>) {\n    await this.encrypt(args.entity as Record<string, unknown>, args.meta, args.em, args.changeSet as any)\n  }\n\n  async beforeUpdate(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em)\n    await this.encrypt(args.entity as Record<string, unknown>, args.meta, args.em, args.changeSet as any)\n  }\n\n  async afterCreate(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async afterUpdate(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async afterUpsert(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async onLoad(args: EventArgs<any>) {\n    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n  }\n\n  async afterFind(args: EventArgs<any> & { entities?: unknown[] }) {\n    const entities = Array.isArray(args.entities) ? args.entities : []\n    for (const entity of entities) {\n      await this.decrypt(entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })\n    }\n  }\n}\n\nexport function registerTenantEncryptionSubscriber(\n  em: { getEventManager?: () => { registerSubscriber?: (subscriber: EventSubscriber<any>) => void } } | null | undefined,\n  service: TenantDataEncryptionService,\n): void {\n  const eventManager = em?.getEventManager?.()\n  if (!eventManager || typeof eventManager.registerSubscriber !== 'function') return\n  if (registeredEventManagers.has(eventManager)) return\n  eventManager.registerSubscriber(new TenantEncryptionSubscriber(service))\n  registeredEventManagers.add(eventManager)\n}\n\nexport async function decryptEntitiesWithFallbackScope(\n  targets: unknown | unknown[],\n  {\n    em,\n    tenantId,\n    organizationId,\n    encryptionService,\n  }: {\n    em: { getMetadata?: () => any; getComparator?: () => any }\n    tenantId?: string | null\n    organizationId?: string | null\n    encryptionService?: TenantDataEncryptionService | null\n  },\n): Promise<void> {\n  if (!isTenantDataEncryptionEnabled()) return\n  const list = Array.isArray(targets) ? targets : [targets]\n  if (!list.length) return\n  const service = encryptionService ?? resolveTenantEncryptionService(em as any)\n  if (!service || !service.isEnabled()) return\n  const subscriber = getSubscriberForService(service)\n  const fallback: Scope | undefined =\n    tenantId || organizationId\n      ? {\n          tenantId: tenantId ?? null,\n          organizationId: organizationId ?? null,\n        }\n      : undefined\n  for (const entity of list) {\n    if (!entity || typeof entity !== 'object') continue\n    const meta = (entity as any).__meta ?? (entity as any).__helper?.__meta\n    await subscriber.decryptEntityGraph(entity as Record<string, unknown>, meta, em as any, {\n      syncOriginal: true,\n      fallbackScope: fallback,\n    })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,qBAAqB;AAC9B,SAAS,mCAAmC;AAC5C,SAAsC,gCAAgC;AACtE,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB;AAC7B,SAAS,sCAAsC;AAE/C,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAavE,SAAS,aAAa,QAAuB;AAC3C,QAAM,WAAW,OAAO,YAAY,OAAO,aAAa,OAAO,QAAQ,MAAM;AAC7E,QAAM,iBAAiB,OAAO,kBAAkB,OAAO,mBAAmB,OAAO,cAAc,MAAM;AACrG,SAAO;AAAA,IACL,UAAU,WAAW,OAAO,QAAQ,IAAI;AAAA,IACxC,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,EAC5D;AACF;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AACF,WAAO,MAAM,OAAO,OAAO;AAAA,EAC7B,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,qBAAqB,MAAwB;AACpD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,YAAY;AAClB,QAAM,OAAO,OAAO,UAAU,SAAS,WAAW,UAAU,KAAK,YAAY,IAAI;AACjF,MAAI,SAAS,UAAU,SAAS,QAAS,QAAO;AAChD,QAAM,cAAc,MAAM,QAAQ,UAAU,WAAW,IAAI,UAAU,cAAc,CAAC;AACpF,MAAI,YAAY,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,YAAY,EAAE,SAAS,MAAM,CAAC,EAAG,QAAO;AAC3G,QAAM,iBAAkB,UAAU,YAAgE,aAAa;AAC/G,SAAO,OAAO,mBAAmB,YAAY,eAAe,YAAY,EAAE,SAAS,MAAM;AAC3F;AAMA,MAAM,qCAAqC;AAC3C,IAAI,6BAA6B;AAEjC,SAAS,qBAAqB,QAAkC;AAC9D,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,8BAA8B,MAAM,6BAA6B,mCAAoC;AACzG,+BAA6B;AAC7B,MAAI;AACF,WAAO;AAAA,MACL;AAAA,MACA,EAAE,OAAO;AAAA,IACX;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,oCAA0C;AACxD,+BAA6B;AAC/B;AAEA,MAAM,0BAA0B,oBAAI,QAAgB;AAEpD,MAAM,uBAAuB,oBAAI,QAAiE;AAElG,SAAS,wBAAwB,SAAkE;AACjG,QAAM,WAAW,qBAAqB,IAAI,OAAO;AACjD,MAAI,SAAU,QAAO;AACrB,QAAM,aAAa,IAAI,2BAA2B,OAAO;AACzD,uBAAqB,IAAI,SAAS,UAAU;AAC5C,SAAO;AACT;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAE5D,MAAM,2BAA2D;AAAA,EACtE,YAA6B,SAAsC;AAAtC;AAAA,EAAuC;AAAA,EAEpE,wBAAwB;AACtB,WAAO,CAAC;AAAA,EACV;AAAA,EAEQ,YACN,MACA,QACA,IACiC;AACjC,QAAI,KAAM,QAAO;AACjB,UAAM,OAAQ,QAAgB;AAC9B,UAAM,OAAO,MAAM;AACnB,UAAM,WAAW,IAAI,cAAc;AACnC,QAAI,CAAC,YAAY,CAAC,KAAM,QAAO;AAC/B,QAAI;AAAE,aAAO,SAAS,OAAO,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC5C,QAAI;AAAE,aAAO,SAAS,OAAO,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC5C,QAAI;AAAE,aAAO,SAAS,MAAM,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC3C,QAAI;AAAE,aAAO,SAAS,MAAM,IAAI;AAAA,IAAE,QAAQ;AAAA,IAAC;AAC3C,QAAI;AACF,YAAM,UAAU,+BAA+B,QAAQ;AACvD,YAAM,QAAQ,QAAQ;AAAA,QACpB,CAAC,MACC,GAAG,cAAc,QACjB,GAAG,SAAS,QACZ,GAAG,eAAe,QAClB,GAAG,eAAe,MAAM,WAAW,QAAQ,aAC3C,GAAG,cAAc,MAAM,WAAW,QAAQ;AAAA,MAC9C;AACA,UAAI,MAAO,QAAO;AAAA,IACpB,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAsD;AAC5E,QAAI;AACF,aAAO,4BAA4B,IAAI;AAAA,IACzC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,4BACN,QACA,MACA;AACA,UAAM,aAAa,MAAM;AACzB,QAAI,CAAC,cAAc,OAAO,eAAe,SAAU;AACnD,eAAW,CAAC,cAAc,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC7D,UAAI,CAAC,qBAAqB,IAAI,EAAG;AACjC,YAAM,QAAQ,OAAO,YAAY;AACjC,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,SAAS,yBAAyB,KAAK;AAC7C,UAAI,WAAW,MAAO,QAAO,YAAY,IAAI;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,uBACN,QACA,MACA,IACA;AACA,UAAM,SAAU,QAAgB;AAChC,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAG3C,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,UAAI,YAAY,eAAe;AAC7B,eAAO,uBAAuB,WAAW,cAAc,MAAM;AAC7D,eAAO,YAAY;AACnB;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,2DAAiD;AAAA,QACrD,QAAQ,MAAM,aAAa,MAAM;AAAA,QACjC,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,MAChD,CAAC;AAAA,IACH;AAGA,UAAM,aAAa,MAAM,aAAa,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC;AACxE,QAAI,WAAW,WAAW,EAAG;AAC7B,UAAM,WAAoC,EAAE,GAAI,OAAO,wBAAwB,CAAC,EAAG;AACnF,eAAW,QAAQ,YAAY;AAC7B,UAAI,CAAC,cAAc,aAAa,cAAc,YAAY,EAAE,SAAU,KAAa,IAAI,EAAG;AAC1F,YAAM,OAAQ,KAAa;AAC3B,UAAI,OAAO,SAAS,YAAY,CAAC,KAAK,OAAQ;AAC9C,eAAS,IAAI,IAAK,OAAmC,IAAI;AAAA,IAC3D;AACA,WAAO,uBAAuB;AAC9B,WAAO,YAAY;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBACN,QACA,MACA,IACS;AACT,UAAM,SAAU,QAAgB;AAChC,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,UAAM,WAAW,OAAO;AACxB,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,aAAa,MAAM,aAAa,MAAM;AAC5C,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,UAAI,cAAc,YAAY,eAAe;AAC3C,cAAM,UAAU,WAAW,cAAc,MAAM;AAC/C,YAAI,OAAO,WAAW,aAAa,YAAY;AAC7C,iBAAO,CAAC,WAAW,SAAS,YAAY,UAAU,OAAO;AAAA,QAC3D;AACA,YAAI,OAAO,WAAW,iBAAiB,YAAY;AACjD,gBAAM,OAAO,WAAW,aAAa,YAAY,UAAU,OAAO;AAClE,iBAAO,CAAC,CAAC,QAAQ,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,QAC9C;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,0DAAgD;AAAA,QACpD,QAAQ;AAAA,QACR,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO,OAAO,cAAc;AAAA,EAC9B;AAAA,EAEA,MAAc,QACZ,QACA,MACA,IACA,WACA;AACA,UAAM,uBAAuB,8BAA8B;AAC3D,QAAI,CAAC,wBAAwB,CAAC,KAAK,QAAQ,UAAU,GAAG;AACtD,YAAM,gCAAsB,EAAE,QAAQ,YAAY,QAAQ,MAAM,aAAa,MAAM,KAAK,CAAC;AACzF,UAAI,qBAAsB,sBAAqB,MAAM,aAAa,MAAM,IAAI;AAC5E;AAAA,IACF;AACA,UAAM,eAAe,KAAK,YAAY,MAAM,QAAQ,EAAE;AACtD,UAAM,WAAW,KAAK,gBAAgB,YAAY;AAClD,QAAI,CAAC,UAAU;AACb,YAAM,0DAAgD;AAAA,QACpD,UAAU,cAAc,aAAa,cAAc;AAAA,QACnD,OAAQ,cAAsB;AAAA,MAChC,CAAC;AACD;AAAA,IACF;AACA,UAAM,EAAE,UAAU,eAAe,IAAI,aAAa,MAAM;AACxD,UAAM,YAAY,MAAM,KAAK,QAAQ,qBAAqB,UAAU,QAAQ,UAAU,cAAc;AACpG,UAAM,YAAqC,cAAc,cAAc,OAAO,aAAa,eAAe,WACtG,aAAa,aACb,CAAC;AACL,UAAM,aACJ,aAAa,OAAO,cAAc,WAC7B,OAAO,UAAU,YAAY,YAAY,UAAU,UAC/C,UAAU,UACT,UAAU,UAAU,CAAC,IAC3B;AACN,UAAM,UAAmC,CAAC;AAC1C,UAAM,gBAAgB,CAAC,SAAiB,SAAsD;AAC5F,UAAI;AACF,YAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,gBAAM,WAAY,MAAc;AAChC,cAAI,OAAO,aAAa,YAAY,SAAS,OAAQ,QAAO;AAC5D,gBAAM,OAAQ,MAAc;AAC5B,cAAI,OAAO,SAAS,YAAY,KAAK,OAAQ,QAAO;AAAA,QACtD;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,+CAAqC;AAAA,UACzC;AAAA,UACA;AAAA,UACA,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,QAChD,CAAC;AAAA,MACH;AACA,aAAO,YAAY,OAAO;AAAA,IAC5B;AAEA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,YAAM,OAAQ,UAAkC,GAAG;AACnD,UAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAK,OAAmC,GAAG,MAAM,MAAO;AACxD,cAAQ,GAAG,IAAI;AAAA,IACjB;AACA,QAAI,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG;AACvC,WAAO,OAAO,QAAQ,OAAO;AAC7B,QAAI,YAAY;AACd,UAAI;AACF,cAAM,kBAAkB,CAAC,SAAiB,UAAmB;AAC3D,gBAAM,aAAa,cAAc,SAAU,UAAkC,OAAO,CAAC;AACrF,gBAAM,eAAe,cAAc,YAAY,OAAO;AACtD,gBAAM,UAAU,IAAI;AAAA,YAClB,CAAC,SAAS,YAAY,OAAO,GAAG,YAAY,aAAa,YAAY,UAAU,IAAI,MAAS,EAAE;AAAA,cAC5F,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAAA,YAC1D;AAAA,UACF;AACA,qBAAW,SAAS,SAAS;AAC3B,gBAAI,OAAO,UAAU,eAAe,KAAK,YAAY,KAAK,EAAG,QAAO,WAAW,KAAK;AAAA,UACtF;AACA,gBAAM,WAAW,cAAc,YAAY,OAAO;AAClD,qBAAW,QAAQ,IAAI;AAAA,QACzB;AACA,mBAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,0BAAgB,KAAK,QAAQ,GAAG,CAAC;AAAA,QACnC;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,mDAAyC;AAAA,UAC7C;AAAA,UACA,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,QAChD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,QACA,MACA,IACA,OAAkF,CAAC,GACnF;AACA,UAAM,KAAK,QAAQ,QAAQ,MAAM,IAAI,IAAI;AAAA,EAC3C;AAAA,EAEA,MAAc,QACZ,QACA,MACA,IACA;AAAA,IACE,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,IAA+E,CAAC,GAChF;AACA,UAAM,UAAU,QAAQ,oBAAI,QAAgB;AAC5C,QAAI,QAAQ,IAAI,MAAgB,EAAG;AACnC,YAAQ,IAAI,MAAgB;AAC5B,QAAI,CAAC,8BAA8B,KAAK,CAAC,KAAK,QAAQ,UAAU,GAAG;AACjE,YAAM,gCAAsB,EAAE,QAAQ,YAAY,QAAQ,MAAM,aAAa,MAAM,KAAK,CAAC;AACzF;AAAA,IACF;AACA,UAAM,eAAe,KAAK,YAAY,MAAM,QAAQ,EAAE;AACtD,UAAM,WAAW,KAAK,gBAAgB,YAAY;AAClD,QAAI,CAAC,SAAU;AACf,UAAM,EAAE,UAAU,eAAe,IAAI,aAAa,MAAM;AACxD,UAAM,iBAAiB,YAAY,eAAe,YAAY;AAC9D,UAAM,cAAc,kBAAkB,eAAe,kBAAkB;AAKvE,UAAM,oBAAoB,eAAe,KAAK,kBAAkB,QAAQ,cAAc,EAAS,IAAI;AACnG,UAAM,YAAY,MAAM,KAAK,QAAQ,qBAAqB,UAAU,QAAQ,gBAAgB,WAAW;AACvG,WAAO,OAAO,QAAQ,SAAS;AAC/B,SAAK,4BAA4B,QAAQ,YAAY;AACrD,QAAI,gBAAgB,CAAC,mBAAmB;AACtC,WAAK,uBAAuB,QAAQ,cAAc,EAAS;AAAA,IAC7D;AACA,UAAM,eACJ,kBACC,YAAY,iBACT,EAAE,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,IACrE,EAAE,UAAU,gBAAgB,gBAAgB,YAAY;AAE9D,QAAI;AACF,YAAM,kBAAkB,CAAC,UAAsB;AAC7C,YAAI,CAAC,MAAO,QAAO,CAAC;AAKpB,YAAI,OAAO,UAAU,YAAY,OAAQ,MAAc,kBAAkB,cAAc,OAAQ,MAAc,aAAa,YAAY;AACpI,cAAI;AACF,mBAAQ,MAAc,cAAc,IAAK,MAAc,SAAS,KAAK,CAAC,IAAI,CAAC;AAAA,UAC7E,QAAQ;AACN,mBAAO,CAAC;AAAA,UACV;AAAA,QACF;AAEA,YAAI,OAAO,UAAU,YAAY,OAAQ,MAAc,kBAAkB,YAAY;AACnF,cAAI;AACF,gBAAK,MAAc,cAAc,GAAG;AAClC,oBAAM,YAAY,OAAQ,MAAc,WAAW,aAAc,MAAc,OAAO,IAAK,MAAc,YAAa;AACtH,kBAAI,aAAa,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AAAA,YACnE;AAAA,UACF,QAAQ;AAAA,UAER;AACA,iBAAO,CAAC;AAAA,QACV;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,YAAI,OAAO,UAAU,SAAU,QAAO,CAAC,KAAK;AAC5C,eAAO,CAAC;AAAA,MACV;AACA,YAAM,QAAQ,cAAc,aAAa,OAAO,OAAO,aAAa,UAAU,IAAI,CAAC;AACnF,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAQ,MAAc;AAC5B,cAAM,OAAQ,MAAc;AAC5B,YAAI,OAAO,SAAS,YAAY,CAAC,KAAK,OAAQ;AAC9C,cAAM,QAAS,OAAe,IAAI;AAClC,YAAI,CAAC,MAAO;AAEZ,YAAI,CAAC,cAAc,aAAa,cAAc,UAAU,EAAE,SAAS,IAAI,GAAG;AACxE,gBAAM,iBAAiB,gBAAgB,KAAK;AAC5C,qBAAW,UAAU,gBAAgB;AACnC,kBAAM,aAAa,KAAK,YAAa,OAAe,UAAW,OAAe,UAAU,QAAQ,QAAQ,EAAE;AAC1G,kBAAM,KAAK,QAAQ,QAAmC,YAAY,IAAI;AAAA,cACpE,cAAc;AAAA,cACd,MAAM;AAAA,cACN,eAAe;AAAA,YACjB,CAAC;AAAA,UACH;AACA;AAAA,QACF;AAEA,YAAI,CAAC,cAAc,aAAa,cAAc,YAAY,EAAE,SAAS,IAAI,GAAG;AAC1E,gBAAM,QAAQ,gBAAgB,KAAK;AACnC,qBAAW,QAAQ,OAAO;AACxB,gBAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,kBAAM,aAAa,KAAK,YAAa,KAAa,UAAW,KAAa,UAAU,QAAQ,MAAM,EAAE;AACpG,kBAAM,KAAK,QAAQ,MAAiC,YAAY,IAAI;AAAA,cAClE,cAAc;AAAA,cACd,MAAM;AAAA,cACN,eAAe;AAAA,YACjB,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,8CAAoC;AAAA,QACxC;AAAA,QACA,SAAU,KAAe,WAAW,OAAO,GAAG;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,MAAsB;AACvC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,KAAK,SAAgB;AAAA,EACtG;AAAA,EAEA,MAAM,aAAa,MAAsB;AACvC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,EAAE;AAC7E,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,KAAK,SAAgB;AAAA,EACtG;AAAA,EAEA,MAAM,YAAY,MAAsB;AACtC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,YAAY,MAAsB;AACtC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,YAAY,MAAsB;AACtC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,OAAO,MAAsB;AACjC,UAAM,KAAK,QAAQ,KAAK,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,EACvG;AAAA,EAEA,MAAM,UAAU,MAAiD;AAC/D,UAAM,WAAW,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK,WAAW,CAAC;AACjE,eAAW,UAAU,UAAU;AAC7B,YAAM,KAAK,QAAQ,QAAmC,KAAK,MAAM,KAAK,IAAI,EAAE,cAAc,KAAK,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEO,SAAS,mCACd,IACA,SACM;AACN,QAAM,eAAe,IAAI,kBAAkB;AAC3C,MAAI,CAAC,gBAAgB,OAAO,aAAa,uBAAuB,WAAY;AAC5E,MAAI,wBAAwB,IAAI,YAAY,EAAG;AAC/C,eAAa,mBAAmB,IAAI,2BAA2B,OAAO,CAAC;AACvE,0BAAwB,IAAI,YAAY;AAC1C;AAEA,eAAsB,iCACpB,SACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMe;AACf,MAAI,CAAC,8BAA8B,EAAG;AACtC,QAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,MAAI,CAAC,KAAK,OAAQ;AAClB,QAAM,UAAU,qBAAqB,+BAA+B,EAAS;AAC7E,MAAI,CAAC,WAAW,CAAC,QAAQ,UAAU,EAAG;AACtC,QAAM,aAAa,wBAAwB,OAAO;AAClD,QAAM,WACJ,YAAY,iBACR;AAAA,IACE,UAAU,YAAY;AAAA,IACtB,gBAAgB,kBAAkB;AAAA,EACpC,IACA;AACN,aAAW,UAAU,MAAM;AACzB,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAC3C,UAAM,OAAQ,OAAe,UAAW,OAAe,UAAU;AACjE,UAAM,WAAW,mBAAmB,QAAmC,MAAM,IAAW;AAAA,MACtF,cAAc;AAAA,MACd,eAAe;AAAA,IACjB,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.7.1-develop.7194.1.ab4fc81f82";
+const APP_VERSION = "0.7.1-develop.7200.1.8ba2d93d3f";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.7.1-develop.7194.1.ab4fc81f82';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.7.1-develop.7200.1.8ba2d93d3f';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.7.1-develop.7194.1.ab4fc81f82",
+  "version": "0.7.1-develop.7200.1.8ba2d93d3f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -113,7 +113,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.7.1-develop.7194.1.ab4fc81f82",
+    "@open-mercato/cache": "0.7.1-develop.7200.1.8ba2d93d3f",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/di/__tests__/bootstrap-cache.test.ts

@@ -210,7 +210,7 @@ describe('bootstrap once-guard cache', () => {
     expect(bootstrapMock).toHaveBeenCalledTimes(2)
   })
 
-  it('memoizes tenantEncryptionService.isEnabled() across requests', async () => {
+  it('registers the encryption subscriber per request without consulting tenantEncryptionService.isEnabled()', async () => {
     process.env.OM_BOOTSTRAP_CACHE = '1'
     let isEnabledCalls = 0
     bootstrapMock.mockImplementationOnce(async (container: any) => {
@@ -229,8 +229,64 @@ describe('bootstrap once-guard cache', () => {
     await createRequestContainer()
     await createRequestContainer()
     await createRequestContainer()
-    // Called once during the first bootstrap, then cached on globalThis.
-    expect(isEnabledCalls).toBe(1)
+    // The registration decision reads the static config toggle (memoized on
+    // globalThis), never the service's health-sensitive isEnabled() — see #5948.
+    expect(isEnabledCalls).toBe(0)
     expect(subscriberRegistered).toHaveBeenCalledTimes(3)
   })
+
+  // Regression for issue #5948: `isEnabled()` is `config && kms.isHealthy()`, so
+  // memoizing it for the process lifetime pinned a transient Vault outage into a
+  // permanent "encryption off" verdict — the subscriber was never registered
+  // again on any later request, and every ORM write stayed plaintext until the
+  // process restarted.
+  it('keeps registering the encryption subscriber while the KMS is unhealthy', async () => {
+    process.env.OM_BOOTSTRAP_CACHE = '1'
+    bootstrapMock.mockImplementationOnce(async (container: any) => {
+      container.register({
+        cache: asValue({ __value: 'cache-value' }),
+        eventBus: asValue({ __value: 'event-bus-value' }),
+        // KMS is down for the whole run: isEnabled() never returns true.
+        tenantEncryptionService: asValue({ isEnabled: () => false }),
+      })
+    })
+    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+    await createRequestContainer()
+    await createRequestContainer()
+
+    // Registration must not depend on live KMS health — the subscriber itself
+    // re-checks it per read/write, so it resumes encrypting on recovery.
+    expect(subscriberRegistered).toHaveBeenCalledTimes(2)
+  })
+
+  it('skips registration when the encryption service cannot report its enabled state', async () => {
+    process.env.OM_BOOTSTRAP_CACHE = '1'
+    bootstrapMock.mockImplementationOnce(async (container: any) => {
+      container.register({
+        cache: asValue({ __value: 'cache-value' }),
+        eventBus: asValue({ __value: 'event-bus-value' }),
+        // A DI override supplying a partial service: the subscriber would throw
+        // on every read/write calling isEnabled(), so it must not be registered.
+        tenantEncryptionService: asValue({ __value: 'no-isEnabled' }),
+      })
+    })
+    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+    await createRequestContainer()
+    expect(subscriberRegistered).not.toHaveBeenCalled()
+  })
+
+  it('does not register the encryption subscriber when encryption is disabled by config', async () => {
+    process.env.OM_BOOTSTRAP_CACHE = '1'
+    const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+    process.env.TENANT_DATA_ENCRYPTION = 'false'
+    try {
+      const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+      await createRequestContainer()
+      await createRequestContainer()
+      expect(subscriberRegistered).not.toHaveBeenCalled()
+    } finally {
+      if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+      else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+    }
+  })
 })

package/src/lib/di/container.ts

@@ -9,6 +9,7 @@ import { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overri
 import { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'
 import { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'
 import { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isTenantDataEncryptionEnabled } from '../encryption/toggles'
 import { createLogger } from '../logger'
 
 const logger = createLogger('shared').child({ component: 'di' })
@@ -93,19 +94,18 @@ function harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry
   return entry
 }
 
-type EncryptionEnabledProbe = { isEnabled?: () => boolean } | null | undefined
-
-function getCachedEncryptionEnabled(service: EncryptionEnabledProbe): boolean | null {
-  if (!service || typeof service.isEnabled !== 'function') return false
+// Caches the STATIC config toggle only. It deliberately does not consult
+// `tenantEncryptionService.isEnabled()`, which ANDs the toggle with the
+// volatile `kms.isHealthy()` — memoizing that for the process lifetime pinned a
+// transient Vault outage into a permanent "encryption off" verdict, so the
+// subscriber was never registered again until a restart (#5948). KMS health is
+// re-checked by the subscriber on every read/write instead.
+function getCachedEncryptionConfigured(): boolean {
   const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]
   if (typeof cached === 'boolean') return cached
-  try {
-    const result = !!service.isEnabled()
-    ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result
-    return result
-  } catch {
-    return null
-  }
+  const result = isTenantDataEncryptionEnabled()
+  ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result
+  return result
 }
 
 function getGlobalRegistrars(): DiRegistrar[] | null {
@@ -319,15 +319,19 @@ export async function createRequestContainer(): Promise<AppContainer> {
     unregister: (key) => container.register({ [key]: asValue(undefined) }),
   })
   // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM
-  // Phase 5 — cache `tenantEncryptionService.isEnabled()` for the process
-  // lifetime. The result depends only on config that does not change at
-  // runtime, so reading it once skips a config lookup per request.
+  // Phase 5 — cache the tenant-encryption config toggle for the process
+  // lifetime. That toggle does not change at runtime, so reading it once skips
+  // a config lookup per request; KMS health is NOT part of this decision.
   try {
     const emForEnc = container.resolve('em') as any
     const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')
       ? (container.resolve('tenantEncryptionService') as any)
       : null
-    if (emForEnc && tenantEncryptionService && getCachedEncryptionEnabled(tenantEncryptionService) === true) {
+    // The subscriber calls `service.isEnabled()` on every read/write, so a DI
+    // override supplying a service without it would throw per operation. Keep
+    // the shape check that the old health-probe helper performed.
+    const serviceCanReportEnabled = typeof tenantEncryptionService?.isEnabled === 'function'
+    if (emForEnc && serviceCanReportEnabled && getCachedEncryptionConfigured()) {
       const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')
       registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)
     }

package/src/lib/encryption/__tests__/subscriber.kms-recovery.test.ts

@@ -0,0 +1,112 @@
+// Regression coverage for issue #5948: registration of the tenant-encryption ORM
+// subscriber used to be gated on `kmsService.isHealthy()`, evaluated exactly once
+// at bootstrap. A KMS outage overlapping process startup therefore left the
+// subscriber unregistered — and at-rest encryption off — for the whole process
+// lifetime, recoverable only by a restart.
+//
+// The fix registers on the static config toggle alone and leans on the
+// subscriber's own per-operation `service.isEnabled()` check. These tests pin
+// that contract: a subscriber registered while the KMS is down must start
+// encrypting the moment the KMS recovers, with no re-registration, and must
+// leave an ongoing (throttled) signal while it is failing open.
+
+const warn = jest.fn()
+
+jest.mock('../../logger', () => {
+  const logger: Record<string, unknown> = {
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: (...args: unknown[]) => warn(...args),
+    error: jest.fn(),
+  }
+  logger.child = () => logger
+  return { createLogger: () => logger }
+})
+
+import { TenantEncryptionSubscriber, resetEncryptionPausedWarnThrottle } from '../subscriber'
+import { registerEntityIds } from '../entityIds'
+import type { TenantDataEncryptionService } from '../tenantDataEncryptionService'
+
+const META = {
+  className: 'Thing',
+  tableName: 'things',
+  properties: { secret: { name: 'secret', fieldName: 'secret' } },
+} as any
+
+function makeEm() {
+  return { getComparator: () => undefined, getMetadata: () => undefined }
+}
+
+// Mirrors the production service: `isEnabled()` ANDs the static config toggle
+// with the volatile KMS health flag, so it flips as Vault goes down and recovers.
+function makeService(kms: { healthy: boolean }): TenantDataEncryptionService {
+  return {
+    isEnabled: () => kms.healthy,
+    async encryptEntityPayload(_entityId: string, target: Record<string, unknown>) {
+      return { secret: `enc:${String(target.secret)}` }
+    },
+    async decryptEntityPayload() {
+      return {}
+    },
+  } as unknown as TenantDataEncryptionService
+}
+
+describe('TenantEncryptionSubscriber KMS recovery (issue #5948)', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    delete process.env.TENANT_DATA_ENCRYPTION // default => encryption enabled
+    registerEntityIds({ test: { thing: 'test:thing' } })
+    resetEncryptionPausedWarnThrottle()
+    warn.mockClear()
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+    jest.restoreAllMocks()
+  })
+
+  async function create(subscriber: TenantEncryptionSubscriber, entity: Record<string, unknown>) {
+    await subscriber.beforeCreate({ entity, meta: META, em: makeEm() } as any)
+  }
+
+  it('resumes encrypting after the KMS recovers, without re-registering the subscriber', async () => {
+    const kms = { healthy: false }
+    // The single subscriber instance a boot-time registration would have produced.
+    const subscriber = new TenantEncryptionSubscriber(makeService(kms))
+
+    const duringOutage: Record<string, unknown> = { tenantId: 't1', secret: 'plain' }
+    await create(subscriber, duringOutage)
+    expect(duringOutage.secret).toBe('plain')
+
+    // Vault comes back — the very same subscriber instance must start encrypting.
+    kms.healthy = true
+    const afterRecovery: Record<string, unknown> = { tenantId: 't1', secret: 'plain' }
+    await create(subscriber, afterRecovery)
+    expect(afterRecovery.secret).toBe('enc:plain')
+  })
+
+  it('warns while writes are failing open to plaintext, throttled to one line per window', async () => {
+    const subscriber = new TenantEncryptionSubscriber(makeService({ healthy: false }))
+
+    await create(subscriber, { tenantId: 't1', secret: 'a' })
+    await create(subscriber, { tenantId: 't1', secret: 'b' })
+    await create(subscriber, { tenantId: 't1', secret: 'c' })
+
+    expect(warn).toHaveBeenCalledTimes(1)
+    expect(warn.mock.calls[0][0]).toMatch(/KMS is unavailable/)
+    expect(warn.mock.calls[0][1]).toEqual({ entity: 'Thing' })
+  })
+
+  it('stays silent when encryption is deliberately disabled by config', async () => {
+    process.env.TENANT_DATA_ENCRYPTION = 'false'
+    const subscriber = new TenantEncryptionSubscriber(makeService({ healthy: false }))
+
+    const entity: Record<string, unknown> = { tenantId: 't1', secret: 'plain' }
+    await create(subscriber, entity)
+
+    expect(entity.secret).toBe('plain')
+    expect(warn).not.toHaveBeenCalled()
+  })
+})

package/src/lib/encryption/subscriber.ts

@@ -50,6 +50,31 @@ function isJsonColumnProperty(prop: unknown): boolean {
   return typeof customTypeName === 'string' && customTypeName.toLowerCase().includes('json')
 }
 
+// Encryption is configured on but the service reports disabled — the KMS is
+// unreachable, so this write lands as plaintext. Throttle the warning so a long
+// outage does not flood the log while still leaving an ongoing signal that the
+// fail-open window is open (#5948).
+const ENCRYPTION_PAUSED_WARN_INTERVAL_MS = 60_000
+let lastEncryptionPausedWarnAt = 0
+
+function warnEncryptionPaused(entity: string | undefined): void {
+  const now = Date.now()
+  if (lastEncryptionPausedWarnAt && now - lastEncryptionPausedWarnAt < ENCRYPTION_PAUSED_WARN_INTERVAL_MS) return
+  lastEncryptionPausedWarnAt = now
+  try {
+    logger.warn(
+      'Tenant data encryption is enabled but the KMS is unavailable - entity writes persist as plaintext until it recovers',
+      { entity },
+    )
+  } catch {
+    // ignore
+  }
+}
+
+export function resetEncryptionPausedWarnThrottle(): void {
+  lastEncryptionPausedWarnAt = 0
+}
+
 const registeredEventManagers = new WeakSet<object>()
 
 const subscribersByService = new WeakMap<TenantDataEncryptionService, TenantEncryptionSubscriber>()
@@ -206,8 +231,10 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     em?: { getMetadata?: () => any; getComparator?: () => any },
     changeSet?: { payload?: Record<string, unknown> },
   ) {
-    if (!isTenantDataEncryptionEnabled() || !this.service.isEnabled()) {
+    const encryptionConfigured = isTenantDataEncryptionEnabled()
+    if (!encryptionConfigured || !this.service.isEnabled()) {
       debug('⚪️ subscriber.skip', { reason: 'disabled', entity: meta?.className || meta?.name })
+      if (encryptionConfigured) warnEncryptionPaused(meta?.className || meta?.name)
       return
     }
     const resolvedMeta = this.resolveMeta(meta, target, em)

package/src/modules/entities.ts

@@ -66,6 +66,11 @@ export type CustomFieldDefinition = {
   formEditable?: boolean
   indexed?: boolean
   listVisible?: boolean
+  // Store the value encrypted with the tenant key. Declaring it here keeps the
+  // flag idempotent across `entities install` runs; an admin-enabled flag is
+  // never downgraded by an install that omits it (turn it off explicitly with
+  // `encrypted: false`).
+  encrypted?: boolean
   // Display order within a form/card; lower renders first. When omitted, the
   // installer derives it from the declaration order of the field set.
   priority?: number