@open-mercato/shared 0.8.1-develop.7241.1.fad7b2ce2a → 0.8.1-develop.7254.1.ab24f26208

package/dist/lib/di/container.js

@@ -157,12 +157,21 @@ async function createRequestContainer() {
     // registrations override this default via Awilix replace semantics —
     // see the enterprise `record_locks` module for the canonical override.
     // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md
+    // `.proxy()` is load-bearing, not stylistic. The container runs in CLASSIC
+    // injection mode, where Awilix resolves dependencies by parsing PARAMETER
+    // NAMES out of the function source. A bundler that renames `em` to `em2` —
+    // Turbopack does, on a scope collision — makes Awilix look up a registration
+    // that does not exist, and `resolveCrudMutationGuardService` swallows the
+    // AwilixResolutionError and returns null, so `bridgeLegacyGuard` silently
+    // drops the guard and every mutation runs with optimistic locking NOT
+    // enforced. Reading `cradle.em` resolves by property name, which survives
+    // mangling. Pinned by `di-injection-mode.test.ts`.
     crudMutationGuardService: asFunction(
-      (em2) => createOptimisticLockGuardService({
-        getEm: () => em2,
+      (cradle) => createOptimisticLockGuardService({
+        getEm: () => cradle.em,
         readers: getAllOptimisticLockReaders()
       })
-    ).scoped(),
+    ).scoped().proxy(),
     // Default OSS command-level optimistic-lock guard, awaited by
     // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.
     // Header/explicit-token compare only (no `resolveExpected`), so it is

package/dist/lib/di/container.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/di/container.ts"],
-  "sourcesContent": ["import { asFunction, createContainer, asValue, AwilixContainer, InjectionMode, type Resolver } from 'awilix'\nimport { RequestContext } from '@mikro-orm/core'\nimport { getOrm } from '@open-mercato/shared/lib/db/mikro'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'\nimport { DefaultDataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { commandRegistry, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overrides'\nimport { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isTenantDataEncryptionEnabled } from '../encryption/toggles'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'di' })\n\ntype DynamicCradle = Record<string, any>\n\nexport type AppContainer = AwilixContainer<DynamicCradle>\nexport type DiRegistrar = (container: AppContainer) => void\nexport type AppDiRegistrar = (container: AppContainer) => void | Promise<void>\n\n// Registration pattern for publishable packages\n// Use globalThis to survive tsx/esbuild module duplication issue where the same\n// file can be loaded as multiple module instances when mixing dynamic and static imports\nconst GLOBAL_KEY = '__openMercatoDiRegistrars__'\nconst APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'\nconst APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'\nconst APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'\n// Set once the legacy `@/di` fallback proves the specifier is unresolvable in this process.\n// Worker/CLI processes run against built package output where the app's `@/` alias does not\n// exist, so retrying the import per request container only repeats a failed module resolution\n// (and its log line) once per job.\nconst APP_DI_MODULE_UNRESOLVABLE_KEY = '__openMercatoAppDiModuleUnresolvable__'\n// Phase 5 \u2014 process-scoped bootstrap cache. The cache/event-bus/encryption\n// services bootstrap() creates are inherently process-scoped (they hold\n// state across requests). Caching them on globalThis after the first\n// successful bootstrap call lets every subsequent request skip the\n// `await bootstrap(container)` body and just re-register the cached\n// instances. Same globalThis pattern as registerDiRegistrars so HMR\n// keeps working.\nconst BOOTSTRAP_CACHE_KEY = '__openMercatoBootstrapCache__'\nconst ENCRYPTION_ENABLED_KEY = '__openMercatoEncryptionEnabledCache__'\n\nconst BOOTSTRAP_CACHE_KEYS = [\n  'cache',\n  'eventBus',\n  'kmsService',\n  'tenantEncryptionService',\n  'rateLimiterService',\n  'searchModuleConfigs',\n  'searchIndexer',\n] as const\n\ntype BootstrapCacheEntry = Partial<Record<(typeof BOOTSTRAP_CACHE_KEYS)[number], unknown>>\n\n// Phase 5 is opt-in. Some bootstrap services close over per-request state\n// (e.g. tenantEncryptionService captures the first request's `em.fork`, the\n// event-bus's resolver closes over the first container) so naively replaying\n// them on later requests yields stale references \u2014 observed as a 500 from\n// CRUD list endpoints in `next start`. Default OFF preserves develop's\n// per-request bootstrap. Set `OM_BOOTSTRAP_CACHE=1` to opt in once each\n// cached service is verified safe for cross-request reuse.\nfunction isBootstrapCacheEnabled(): boolean {\n  const raw = process.env.OM_BOOTSTRAP_CACHE\n  if (raw === undefined) return false\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return false\n  if (normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no') return false\n  return true\n}\n\nfunction getBootstrapCache(): BootstrapCacheEntry | null {\n  if (!isBootstrapCacheEnabled()) return null\n  const existing = (globalThis as any)[BOOTSTRAP_CACHE_KEY]\n  return existing && typeof existing === 'object' ? (existing as BootstrapCacheEntry) : null\n}\n\nfunction setBootstrapCache(entry: BootstrapCacheEntry): void {\n  if (!isBootstrapCacheEnabled()) return\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = entry\n}\n\nfunction harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry {\n  const entry: BootstrapCacheEntry = {}\n  for (const key of BOOTSTRAP_CACHE_KEYS) {\n    try {\n      const value: unknown = container.resolve(key as never)\n      if (value !== undefined && value !== null) entry[key] = value\n    } catch {\n      // not registered \u2014 skip\n    }\n  }\n  return entry\n}\n\n// Caches the STATIC config toggle only. It deliberately does not consult\n// `tenantEncryptionService.isEnabled()`, which ANDs the toggle with the\n// volatile `kms.isHealthy()` \u2014 memoizing that for the process lifetime pinned a\n// transient Vault outage into a permanent \"encryption off\" verdict, so the\n// subscriber was never registered again until a restart (#5948). KMS health is\n// re-checked by the subscriber on every read/write instead.\nfunction getCachedEncryptionConfigured(): boolean {\n  const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]\n  if (typeof cached === 'boolean') return cached\n  const result = isTenantDataEncryptionEnabled()\n  ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result\n  return result\n}\n\nfunction getGlobalRegistrars(): DiRegistrar[] | null {\n  return (globalThis as any)[GLOBAL_KEY] ?? null\n}\n\nfunction setGlobalRegistrars(registrars: DiRegistrar[]): void {\n  (globalThis as any)[GLOBAL_KEY] = registrars\n}\n\nexport function registerDiRegistrars(registrars: DiRegistrar[]) {\n  const existing = getGlobalRegistrars()\n  if (existing !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('DI registrars re-registered (this may occur during HMR)')\n  }\n  setGlobalRegistrars(registrars)\n  // Force re-bootstrap on HMR \u2014 module subscribers may have changed.\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  // An app that gains a src/di.ts mid-session reloads through here, so the negative\n  // resolution result must not outlive the reload.\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nexport function getDiRegistrars(): DiRegistrar[] {\n  const registrars = getGlobalRegistrars()\n  if (!registrars) {\n    throw new Error('[Bootstrap] DI registrars not registered. Call registerDiRegistrars() at bootstrap.')\n  }\n  return registrars\n}\n\nfunction getAppDiRegistrar(): AppDiRegistrar | null {\n  const registrar = (globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY]\n  return typeof registrar === 'function' ? registrar as AppDiRegistrar : null\n}\n\nexport function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar\n}\n\n/** Test-only helper to drop process-scoped request-container state. */\nexport function resetBootstrapCache(): void {\n  (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nfunction isAppDiModuleUnresolvable(): boolean {\n  return (globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] === true\n}\n\nfunction markAppDiModuleUnresolvable(): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = true\n}\n\nfunction isAppDiModuleNotFound(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const { code, message } = error as { code?: unknown; message?: unknown }\n  const text = typeof message === 'string' ? message : ''\n  const moduleNotFound =\n    code === 'MODULE_NOT_FOUND'\n    || code === 'ERR_MODULE_NOT_FOUND'\n    || text.startsWith('Cannot find module')\n    || text.startsWith('Cannot find package')\n  return moduleNotFound && /(?:module|package) ['\"]@\\/di['\"]/.test(text)\n}\n\nfunction warnAppDiFailureOnce(\n  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,\n  message: string,\n  error: unknown,\n): void {\n  const globalScope = globalThis as Record<string, unknown>\n  if (globalScope[key] === true) return\n  globalScope[key] = true\n  logger.warn(message, { err: error })\n}\n\nfunction isAwilixResolver(value: unknown): value is Resolver<unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as { resolve?: unknown }).resolve === 'function')\n}\n\nfunction toAwilixRegistrations(registrations: Record<string, unknown>): Record<string, Resolver<any>> {\n  return Object.fromEntries(\n    Object.entries(registrations).map(([key, value]) => [\n      key,\n      isAwilixResolver(value) ? value : asValue(value),\n    ]),\n  )\n}\n\nexport async function createRequestContainer(): Promise<AppContainer> {\n  const diRegistrars = getDiRegistrars()\n  const orm = await getOrm()\n  // Use a fresh event manager so request-level subscribers (e.g., encryption) don't pile up globally\n  const baseEm = (RequestContext.getEntityManager() as any) ?? orm.em\n  const em = baseEm.fork({ clear: true, freshEventManager: true, useContext: true }) as unknown as EntityManager\n  const container = createContainer<DynamicCradle>({ injectionMode: InjectionMode.CLASSIC })\n  // Core registrations\n  container.register({\n    em: asValue(em),\n    queryEngine: asValue(new BasicQueryEngine(em, undefined, () => {\n      try { return container.resolve('tenantEncryptionService') as any } catch { return null }\n    })),\n    dataEngine: asValue(new DefaultDataEngine(em, container as any)),\n    commandRegistry: asValue(commandRegistry),\n    commandBus: asValue(new CommandBus()),\n    // Default OSS optimistic-lock guard. Reads from the global reader store\n    // (populated by `makeCrudRoute` auto-registration + any module-DI\n    // hand-wired calls to `registerOptimisticLockReaders`). Service is\n    // strictly additive: when `OM_OPTIMISTIC_LOCK=off` (or no header is\n    // sent) it short-circuits at validateMutation. Module-level di.ts\n    // registrations override this default via Awilix replace semantics \u2014\n    // see the enterprise `record_locks` module for the canonical override.\n    // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md\n    crudMutationGuardService: asFunction((em: EntityManager) =>\n      createOptimisticLockGuardService({\n        getEm: () => em,\n        readers: getAllOptimisticLockReaders(),\n      }),\n    ).scoped(),\n    // Default OSS command-level optimistic-lock guard, awaited by\n    // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.\n    // Header/explicit-token compare only (no `resolveExpected`), so it is\n    // behaviourally identical to calling `enforceCommandOptimisticLock`\n    // directly. The enterprise `record_locks` module overrides this DI key\n    // with a lock-backed `resolveExpected` via Awilix replace semantics.\n    // Spec: .ai/specs/enterprise/2026-06-09-record-locks-unified-coverage.md (Phase 0)\n    commandOptimisticLockGuardService: asFunction(() =>\n      createCommandOptimisticLockGuardService(),\n    ).scoped(),\n  })\n  // Allow modules to override/extend. Fail-open by design (one broken module's\n  // di.ts must not take down every request container), but never silently: the\n  // module's services would otherwise vanish with no trace until an unrelated\n  // Awilix resolution error surfaces much later.\n  for (const [registrarIndex, reg] of diRegistrars.entries()) {\n    try { reg?.(container) } catch (error) {\n      logger.error('Module DI registrar failed', { registrarIndex, err: error })\n    }\n  }\n  // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)\n  // Phase 5 \u2014 process-scoped once-guard. The first request runs the full\n  // bootstrap() body; later requests re-register the cached services\n  // directly on this request's container without re-importing or\n  // re-initializing anything. HMR clears the cache (see\n  // registerDiRegistrars). Skippable if a caller already wired eventBus.\n  const alreadyBootstrappedOnThisContainer = !!container.registrations?.eventBus\n  if (!alreadyBootstrappedOnThisContainer) {\n    const cached = getBootstrapCache()\n    if (cached) {\n      const replay: Record<string, any> = {}\n      for (const [key, value] of Object.entries(cached)) {\n        if (value !== undefined && value !== null) replay[key] = asValue(value)\n      }\n      if (Object.keys(replay).length > 0) container.register(replay)\n    } else {\n      try {\n        const { bootstrap } = await import('@open-mercato/core/bootstrap') as any\n        if (bootstrap && typeof bootstrap === 'function') {\n          await bootstrap(container)\n          setBootstrapCache(harvestBootstrapCache(container))\n        }\n      } catch { /* optional */ }\n    }\n  }\n  // App-level DI override. Scaffolded apps register this callback explicitly\n  // from their own bootstrap module so app aliases resolve in app context.\n  const appDiRegistrar = getAppDiRegistrar()\n  if (appDiRegistrar) {\n    try {\n      await appDiRegistrar(container)\n    } catch (error) {\n      logger.error('App-level DI registrar failed', { err: error })\n    }\n  } else if (!isAppDiModuleUnresolvable()) {\n    // Backward-compatible fallback for apps that have not adopted explicit wiring.\n    try {\n      // @ts-ignore - @/di only exists in app context, not in packages\n      const appDi = await import('@/di') as any\n      if (appDi?.register) {\n        try {\n          const maybe = appDi.register(container)\n          if (maybe && typeof maybe.then === 'function') await maybe\n        } catch (err) {\n          warnAppDiFailureOnce(\n            APP_DI_REGISTER_WARNING_KEY,\n            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',\n            err,\n          )\n        }\n      }\n    } catch (err) {\n      if (isAppDiModuleNotFound(err)) {\n        markAppDiModuleUnresolvable()\n        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })\n      } else {\n        warnAppDiFailureOnce(\n          APP_DI_LOAD_WARNING_KEY,\n          'App-level DI override module (@/di) failed to load; its registrations are skipped',\n          err,\n        )\n      }\n    }\n  }\n  applyDiOverridesToContainer({\n    register: (registrations) => container.register(toAwilixRegistrations(registrations)),\n    unregister: (key) => container.register({ [key]: asValue(undefined) }),\n  })\n  // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM\n  // Phase 5 \u2014 cache the tenant-encryption config toggle for the process\n  // lifetime. That toggle does not change at runtime, so reading it once skips\n  // a config lookup per request; KMS health is NOT part of this decision.\n  try {\n    const emForEnc = container.resolve('em') as any\n    const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')\n      ? (container.resolve('tenantEncryptionService') as any)\n      : null\n    // The subscriber calls `service.isEnabled()` on every read/write, so a DI\n    // override supplying a service without it would throw per operation. Keep\n    // the shape check that the old health-probe helper performed.\n    const serviceCanReportEnabled = typeof tenantEncryptionService?.isEnabled === 'function'\n    if (emForEnc && serviceCanReportEnabled && getCachedEncryptionConfigured()) {\n      const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')\n      registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)\n    }\n  } catch {\n    // best-effort; do not block container creation\n  }\n  return container\n}\ntry {\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  require('server-only')\n} catch {\n  // allow CLI/generator usage where Next server-only is not present\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,iBAAiB,SAA0B,qBAAoC;AACpG,SAAS,sBAAsB;AAC/B,SAAS,cAAc;AAEvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+CAA+C;AACxD,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AAW/D,MAAM,aAAa;AACnB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B;AAKpC,MAAM,iCAAiC;AAQvC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,MAAI,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe,KAAM,QAAO;AACxG,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,QAAM,WAAY,WAAmB,mBAAmB;AACxD,SAAO,YAAY,OAAO,aAAa,WAAY,WAAmC;AACxF;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,MAAI,CAAC,wBAAwB,EAAG;AAC/B,EAAC,WAAmB,mBAAmB,IAAI;AAC9C;AAEA,SAAS,sBAAsB,WAAiD;AAC9E,QAAM,QAA6B,CAAC;AACpC,aAAW,OAAO,sBAAsB;AACtC,QAAI;AACF,YAAM,QAAiB,UAAU,QAAQ,GAAY;AACrD,UAAI,UAAU,UAAa,UAAU,KAAM,OAAM,GAAG,IAAI;AAAA,IAC1D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,gCAAyC;AAChD,QAAM,SAAU,WAAuC,sBAAsB;AAC7E,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,SAAS,8BAA8B;AAC5C,EAAC,WAAuC,sBAAsB,IAAI;AACnE,SAAO;AACT;AAEA,SAAS,sBAA4C;AACnD,SAAQ,WAAmB,UAAU,KAAK;AAC5C;AAEA,SAAS,oBAAoB,YAAiC;AAC5D,EAAC,WAAmB,UAAU,IAAI;AACpC;AAEO,SAAS,qBAAqB,YAA2B;AAC9D,QAAM,WAAW,oBAAoB;AACrC,MAAI,aAAa,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC/D,WAAO,MAAM,yDAAyD;AAAA,EACxE;AACA,sBAAoB,UAAU;AAE7B,EAAC,WAAmB,mBAAmB,IAAI;AAC3C,EAAC,WAAmB,sBAAsB,IAAI;AAG9C,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEO,SAAS,kBAAiC;AAC/C,QAAM,aAAa,oBAAoB;AACvC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,oBAA2C;AAClD,QAAM,YAAa,WAAuC,oBAAoB;AAC9E,SAAO,OAAO,cAAc,aAAa,YAA8B;AACzE;AAEO,SAAS,uBAAuB,WAAwC;AAC7E;AAAC,EAAC,WAAuC,oBAAoB,IAAI;AACnE;AAGO,SAAS,sBAA4B;AAC1C,EAAC,WAAmB,mBAAmB,IAAI;AAC1C,EAAC,WAAmB,sBAAsB,IAAI;AAC9C,EAAC,WAAuC,uBAAuB,IAAI;AACnE,EAAC,WAAuC,2BAA2B,IAAI;AACvE,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,4BAAqC;AAC5C,SAAQ,WAAuC,8BAA8B,MAAM;AACrF;AAEA,SAAS,8BAAoC;AAC3C;AAAC,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,sBAAsB,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,QAAM,OAAO,OAAO,YAAY,WAAW,UAAU;AACrD,QAAM,iBACJ,SAAS,sBACN,SAAS,0BACT,KAAK,WAAW,oBAAoB,KACpC,KAAK,WAAW,qBAAqB;AAC1C,SAAO,kBAAkB,mCAAmC,KAAK,IAAI;AACvE;AAEA,SAAS,qBACP,KACA,SACA,OACM;AACN,QAAM,cAAc;AACpB,MAAI,YAAY,GAAG,MAAM,KAAM;AAC/B,cAAY,GAAG,IAAI;AACnB,SAAO,KAAK,SAAS,EAAE,KAAK,MAAM,CAAC;AACrC;AAEA,SAAS,iBAAiB,OAA4C;AACpE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACrH;AAEA,SAAS,sBAAsB,eAAuE;AACpG,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAClD;AAAA,MACA,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,yBAAgD;AACpE,QAAM,eAAe,gBAAgB;AACrC,QAAM,MAAM,MAAM,OAAO;AAEzB,QAAM,SAAU,eAAe,iBAAiB,KAAa,IAAI;AACjE,QAAM,KAAK,OAAO,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjF,QAAM,YAAY,gBAA+B,EAAE,eAAe,cAAc,QAAQ,CAAC;AAEzF,YAAU,SAAS;AAAA,IACjB,IAAI,QAAQ,EAAE;AAAA,IACd,aAAa,QAAQ,IAAI,iBAAiB,IAAI,QAAW,MAAM;AAC7D,UAAI;AAAE,eAAO,UAAU,QAAQ,yBAAyB;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACzF,CAAC,CAAC;AAAA,IACF,YAAY,QAAQ,IAAI,kBAAkB,IAAI,SAAgB,CAAC;AAAA,IAC/D,iBAAiB,QAAQ,eAAe;AAAA,IACxC,YAAY,QAAQ,IAAI,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASpC,0BAA0B;AAAA,MAAW,CAACA,QACpC,iCAAiC;AAAA,QAC/B,OAAO,MAAMA;AAAA,QACb,SAAS,4BAA4B;AAAA,MACvC,CAAC;AAAA,IACH,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQT,mCAAmC;AAAA,MAAW,MAC5C,wCAAwC;AAAA,IAC1C,EAAE,OAAO;AAAA,EACX,CAAC;AAKD,aAAW,CAAC,gBAAgB,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1D,QAAI;AAAE,YAAM,SAAS;AAAA,IAAE,SAAS,OAAO;AACrC,aAAO,MAAM,8BAA8B,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,IAC3E;AAAA,EACF;AAOA,QAAM,qCAAqC,CAAC,CAAC,UAAU,eAAe;AACtE,MAAI,CAAC,oCAAoC;AACvC,UAAM,SAAS,kBAAkB;AACjC,QAAI,QAAQ;AACV,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM,QAAO,GAAG,IAAI,QAAQ,KAAK;AAAA,MACxE;AACA,UAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,WAAU,SAAS,MAAM;AAAA,IAC/D,OAAO;AACL,UAAI;AACF,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,8BAA8B;AACjE,YAAI,aAAa,OAAO,cAAc,YAAY;AAChD,gBAAM,UAAU,SAAS;AACzB,4BAAkB,sBAAsB,SAAS,CAAC;AAAA,QACpD;AAAA,MACF,QAAQ;AAAA,MAAiB;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,SAAS;AAAA,IAChC,SAAS,OAAO;AACd,aAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC9D;AAAA,EACF,WAAW,CAAC,0BAA0B,GAAG;AAEvC,QAAI;AAEF,YAAM,QAAQ,MAAM,OAAO,MAAM;AACjC,UAAI,OAAO,UAAU;AACnB,YAAI;AACF,gBAAM,QAAQ,MAAM,SAAS,SAAS;AACtC,cAAI,SAAS,OAAO,MAAM,SAAS,WAAY,OAAM;AAAA,QACvD,SAAS,KAAK;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,sBAAsB,GAAG,GAAG;AAC9B,oCAA4B;AAC5B,eAAO,MAAM,gEAAgE,EAAE,IAAI,CAAC;AAAA,MACtF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,8BAA4B;AAAA,IAC1B,UAAU,CAAC,kBAAkB,UAAU,SAAS,sBAAsB,aAAa,CAAC;AAAA,IACpF,YAAY,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,GAAG,QAAQ,MAAS,EAAE,CAAC;AAAA,EACvE,CAAC;AAKD,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,IAAI;AACvC,UAAM,0BAA0B,UAAU,gBAAgB,yBAAyB,IAC9E,UAAU,QAAQ,yBAAyB,IAC5C;AAIJ,UAAM,0BAA0B,OAAO,yBAAyB,cAAc;AAC9E,QAAI,YAAY,2BAA2B,8BAA8B,GAAG;AAC1E,YAAM,EAAE,mCAAmC,IAAI,MAAM,OAAO,gDAAgD;AAC5G,yCAAmC,UAAU,uBAAuB;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AACA,IAAI;AAEF,UAAQ,aAAa;AACvB,QAAQ;AAER;",
-  "names": ["em"]
+  "sourcesContent": ["import { asFunction, createContainer, asValue, AwilixContainer, InjectionMode, type Resolver } from 'awilix'\nimport { RequestContext } from '@mikro-orm/core'\nimport { getOrm } from '@open-mercato/shared/lib/db/mikro'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'\nimport { DefaultDataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { commandRegistry, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overrides'\nimport { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'\nimport { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'\nimport { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isTenantDataEncryptionEnabled } from '../encryption/toggles'\nimport { createLogger } from '../logger'\n\nconst logger = createLogger('shared').child({ component: 'di' })\n\ntype DynamicCradle = Record<string, any>\n\nexport type AppContainer = AwilixContainer<DynamicCradle>\nexport type DiRegistrar = (container: AppContainer) => void\nexport type AppDiRegistrar = (container: AppContainer) => void | Promise<void>\n\n// Registration pattern for publishable packages\n// Use globalThis to survive tsx/esbuild module duplication issue where the same\n// file can be loaded as multiple module instances when mixing dynamic and static imports\nconst GLOBAL_KEY = '__openMercatoDiRegistrars__'\nconst APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'\nconst APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'\nconst APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'\n// Set once the legacy `@/di` fallback proves the specifier is unresolvable in this process.\n// Worker/CLI processes run against built package output where the app's `@/` alias does not\n// exist, so retrying the import per request container only repeats a failed module resolution\n// (and its log line) once per job.\nconst APP_DI_MODULE_UNRESOLVABLE_KEY = '__openMercatoAppDiModuleUnresolvable__'\n// Phase 5 \u2014 process-scoped bootstrap cache. The cache/event-bus/encryption\n// services bootstrap() creates are inherently process-scoped (they hold\n// state across requests). Caching them on globalThis after the first\n// successful bootstrap call lets every subsequent request skip the\n// `await bootstrap(container)` body and just re-register the cached\n// instances. Same globalThis pattern as registerDiRegistrars so HMR\n// keeps working.\nconst BOOTSTRAP_CACHE_KEY = '__openMercatoBootstrapCache__'\nconst ENCRYPTION_ENABLED_KEY = '__openMercatoEncryptionEnabledCache__'\n\nconst BOOTSTRAP_CACHE_KEYS = [\n  'cache',\n  'eventBus',\n  'kmsService',\n  'tenantEncryptionService',\n  'rateLimiterService',\n  'searchModuleConfigs',\n  'searchIndexer',\n] as const\n\ntype BootstrapCacheEntry = Partial<Record<(typeof BOOTSTRAP_CACHE_KEYS)[number], unknown>>\n\n// Phase 5 is opt-in. Some bootstrap services close over per-request state\n// (e.g. tenantEncryptionService captures the first request's `em.fork`, the\n// event-bus's resolver closes over the first container) so naively replaying\n// them on later requests yields stale references \u2014 observed as a 500 from\n// CRUD list endpoints in `next start`. Default OFF preserves develop's\n// per-request bootstrap. Set `OM_BOOTSTRAP_CACHE=1` to opt in once each\n// cached service is verified safe for cross-request reuse.\nfunction isBootstrapCacheEnabled(): boolean {\n  const raw = process.env.OM_BOOTSTRAP_CACHE\n  if (raw === undefined) return false\n  const normalized = raw.trim().toLowerCase()\n  if (!normalized.length) return false\n  if (normalized === '0' || normalized === 'off' || normalized === 'false' || normalized === 'no') return false\n  return true\n}\n\nfunction getBootstrapCache(): BootstrapCacheEntry | null {\n  if (!isBootstrapCacheEnabled()) return null\n  const existing = (globalThis as any)[BOOTSTRAP_CACHE_KEY]\n  return existing && typeof existing === 'object' ? (existing as BootstrapCacheEntry) : null\n}\n\nfunction setBootstrapCache(entry: BootstrapCacheEntry): void {\n  if (!isBootstrapCacheEnabled()) return\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = entry\n}\n\nfunction harvestBootstrapCache(container: AwilixContainer): BootstrapCacheEntry {\n  const entry: BootstrapCacheEntry = {}\n  for (const key of BOOTSTRAP_CACHE_KEYS) {\n    try {\n      const value: unknown = container.resolve(key as never)\n      if (value !== undefined && value !== null) entry[key] = value\n    } catch {\n      // not registered \u2014 skip\n    }\n  }\n  return entry\n}\n\n// Caches the STATIC config toggle only. It deliberately does not consult\n// `tenantEncryptionService.isEnabled()`, which ANDs the toggle with the\n// volatile `kms.isHealthy()` \u2014 memoizing that for the process lifetime pinned a\n// transient Vault outage into a permanent \"encryption off\" verdict, so the\n// subscriber was never registered again until a restart (#5948). KMS health is\n// re-checked by the subscriber on every read/write instead.\nfunction getCachedEncryptionConfigured(): boolean {\n  const cached = (globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY]\n  if (typeof cached === 'boolean') return cached\n  const result = isTenantDataEncryptionEnabled()\n  ;(globalThis as Record<string, unknown>)[ENCRYPTION_ENABLED_KEY] = result\n  return result\n}\n\nfunction getGlobalRegistrars(): DiRegistrar[] | null {\n  return (globalThis as any)[GLOBAL_KEY] ?? null\n}\n\nfunction setGlobalRegistrars(registrars: DiRegistrar[]): void {\n  (globalThis as any)[GLOBAL_KEY] = registrars\n}\n\nexport function registerDiRegistrars(registrars: DiRegistrar[]) {\n  const existing = getGlobalRegistrars()\n  if (existing !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('DI registrars re-registered (this may occur during HMR)')\n  }\n  setGlobalRegistrars(registrars)\n  // Force re-bootstrap on HMR \u2014 module subscribers may have changed.\n  ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  // An app that gains a src/di.ts mid-session reloads through here, so the negative\n  // resolution result must not outlive the reload.\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nexport function getDiRegistrars(): DiRegistrar[] {\n  const registrars = getGlobalRegistrars()\n  if (!registrars) {\n    throw new Error('[Bootstrap] DI registrars not registered. Call registerDiRegistrars() at bootstrap.')\n  }\n  return registrars\n}\n\nfunction getAppDiRegistrar(): AppDiRegistrar | null {\n  const registrar = (globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY]\n  return typeof registrar === 'function' ? registrar as AppDiRegistrar : null\n}\n\nexport function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar\n}\n\n/** Test-only helper to drop process-scoped request-container state. */\nexport function resetBootstrapCache(): void {\n  (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null\n  ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined\n}\n\nfunction isAppDiModuleUnresolvable(): boolean {\n  return (globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] === true\n}\n\nfunction markAppDiModuleUnresolvable(): void {\n  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = true\n}\n\nfunction isAppDiModuleNotFound(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const { code, message } = error as { code?: unknown; message?: unknown }\n  const text = typeof message === 'string' ? message : ''\n  const moduleNotFound =\n    code === 'MODULE_NOT_FOUND'\n    || code === 'ERR_MODULE_NOT_FOUND'\n    || text.startsWith('Cannot find module')\n    || text.startsWith('Cannot find package')\n  return moduleNotFound && /(?:module|package) ['\"]@\\/di['\"]/.test(text)\n}\n\nfunction warnAppDiFailureOnce(\n  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,\n  message: string,\n  error: unknown,\n): void {\n  const globalScope = globalThis as Record<string, unknown>\n  if (globalScope[key] === true) return\n  globalScope[key] = true\n  logger.warn(message, { err: error })\n}\n\nfunction isAwilixResolver(value: unknown): value is Resolver<unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as { resolve?: unknown }).resolve === 'function')\n}\n\nfunction toAwilixRegistrations(registrations: Record<string, unknown>): Record<string, Resolver<any>> {\n  return Object.fromEntries(\n    Object.entries(registrations).map(([key, value]) => [\n      key,\n      isAwilixResolver(value) ? value : asValue(value),\n    ]),\n  )\n}\n\nexport async function createRequestContainer(): Promise<AppContainer> {\n  const diRegistrars = getDiRegistrars()\n  const orm = await getOrm()\n  // Use a fresh event manager so request-level subscribers (e.g., encryption) don't pile up globally\n  const baseEm = (RequestContext.getEntityManager() as any) ?? orm.em\n  const em = baseEm.fork({ clear: true, freshEventManager: true, useContext: true }) as unknown as EntityManager\n  const container = createContainer<DynamicCradle>({ injectionMode: InjectionMode.CLASSIC })\n  // Core registrations\n  container.register({\n    em: asValue(em),\n    queryEngine: asValue(new BasicQueryEngine(em, undefined, () => {\n      try { return container.resolve('tenantEncryptionService') as any } catch { return null }\n    })),\n    dataEngine: asValue(new DefaultDataEngine(em, container as any)),\n    commandRegistry: asValue(commandRegistry),\n    commandBus: asValue(new CommandBus()),\n    // Default OSS optimistic-lock guard. Reads from the global reader store\n    // (populated by `makeCrudRoute` auto-registration + any module-DI\n    // hand-wired calls to `registerOptimisticLockReaders`). Service is\n    // strictly additive: when `OM_OPTIMISTIC_LOCK=off` (or no header is\n    // sent) it short-circuits at validateMutation. Module-level di.ts\n    // registrations override this default via Awilix replace semantics \u2014\n    // see the enterprise `record_locks` module for the canonical override.\n    // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md\n    // `.proxy()` is load-bearing, not stylistic. The container runs in CLASSIC\n    // injection mode, where Awilix resolves dependencies by parsing PARAMETER\n    // NAMES out of the function source. A bundler that renames `em` to `em2` \u2014\n    // Turbopack does, on a scope collision \u2014 makes Awilix look up a registration\n    // that does not exist, and `resolveCrudMutationGuardService` swallows the\n    // AwilixResolutionError and returns null, so `bridgeLegacyGuard` silently\n    // drops the guard and every mutation runs with optimistic locking NOT\n    // enforced. Reading `cradle.em` resolves by property name, which survives\n    // mangling. Pinned by `di-injection-mode.test.ts`.\n    crudMutationGuardService: asFunction((cradle: { em: EntityManager }) =>\n      createOptimisticLockGuardService({\n        getEm: () => cradle.em,\n        readers: getAllOptimisticLockReaders(),\n      }),\n    ).scoped().proxy(),\n    // Default OSS command-level optimistic-lock guard, awaited by\n    // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.\n    // Header/explicit-token compare only (no `resolveExpected`), so it is\n    // behaviourally identical to calling `enforceCommandOptimisticLock`\n    // directly. The enterprise `record_locks` module overrides this DI key\n    // with a lock-backed `resolveExpected` via Awilix replace semantics.\n    // Spec: .ai/specs/enterprise/2026-06-09-record-locks-unified-coverage.md (Phase 0)\n    commandOptimisticLockGuardService: asFunction(() =>\n      createCommandOptimisticLockGuardService(),\n    ).scoped(),\n  })\n  // Allow modules to override/extend. Fail-open by design (one broken module's\n  // di.ts must not take down every request container), but never silently: the\n  // module's services would otherwise vanish with no trace until an unrelated\n  // Awilix resolution error surfaces much later.\n  for (const [registrarIndex, reg] of diRegistrars.entries()) {\n    try { reg?.(container) } catch (error) {\n      logger.error('Module DI registrar failed', { registrarIndex, err: error })\n    }\n  }\n  // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)\n  // Phase 5 \u2014 process-scoped once-guard. The first request runs the full\n  // bootstrap() body; later requests re-register the cached services\n  // directly on this request's container without re-importing or\n  // re-initializing anything. HMR clears the cache (see\n  // registerDiRegistrars). Skippable if a caller already wired eventBus.\n  const alreadyBootstrappedOnThisContainer = !!container.registrations?.eventBus\n  if (!alreadyBootstrappedOnThisContainer) {\n    const cached = getBootstrapCache()\n    if (cached) {\n      const replay: Record<string, any> = {}\n      for (const [key, value] of Object.entries(cached)) {\n        if (value !== undefined && value !== null) replay[key] = asValue(value)\n      }\n      if (Object.keys(replay).length > 0) container.register(replay)\n    } else {\n      try {\n        const { bootstrap } = await import('@open-mercato/core/bootstrap') as any\n        if (bootstrap && typeof bootstrap === 'function') {\n          await bootstrap(container)\n          setBootstrapCache(harvestBootstrapCache(container))\n        }\n      } catch { /* optional */ }\n    }\n  }\n  // App-level DI override. Scaffolded apps register this callback explicitly\n  // from their own bootstrap module so app aliases resolve in app context.\n  const appDiRegistrar = getAppDiRegistrar()\n  if (appDiRegistrar) {\n    try {\n      await appDiRegistrar(container)\n    } catch (error) {\n      logger.error('App-level DI registrar failed', { err: error })\n    }\n  } else if (!isAppDiModuleUnresolvable()) {\n    // Backward-compatible fallback for apps that have not adopted explicit wiring.\n    try {\n      // @ts-ignore - @/di only exists in app context, not in packages\n      const appDi = await import('@/di') as any\n      if (appDi?.register) {\n        try {\n          const maybe = appDi.register(container)\n          if (maybe && typeof maybe.then === 'function') await maybe\n        } catch (err) {\n          warnAppDiFailureOnce(\n            APP_DI_REGISTER_WARNING_KEY,\n            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',\n            err,\n          )\n        }\n      }\n    } catch (err) {\n      if (isAppDiModuleNotFound(err)) {\n        markAppDiModuleUnresolvable()\n        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })\n      } else {\n        warnAppDiFailureOnce(\n          APP_DI_LOAD_WARNING_KEY,\n          'App-level DI override module (@/di) failed to load; its registrations are skipped',\n          err,\n        )\n      }\n    }\n  }\n  applyDiOverridesToContainer({\n    register: (registrations) => container.register(toAwilixRegistrations(registrations)),\n    unregister: (key) => container.register({ [key]: asValue(undefined) }),\n  })\n  // Ensure tenant encryption subscriber is always registered on the fresh request-scoped EM\n  // Phase 5 \u2014 cache the tenant-encryption config toggle for the process\n  // lifetime. That toggle does not change at runtime, so reading it once skips\n  // a config lookup per request; KMS health is NOT part of this decision.\n  try {\n    const emForEnc = container.resolve('em') as any\n    const tenantEncryptionService = container.hasRegistration('tenantEncryptionService')\n      ? (container.resolve('tenantEncryptionService') as any)\n      : null\n    // The subscriber calls `service.isEnabled()` on every read/write, so a DI\n    // override supplying a service without it would throw per operation. Keep\n    // the shape check that the old health-probe helper performed.\n    const serviceCanReportEnabled = typeof tenantEncryptionService?.isEnabled === 'function'\n    if (emForEnc && serviceCanReportEnabled && getCachedEncryptionConfigured()) {\n      const { registerTenantEncryptionSubscriber } = await import('@open-mercato/shared/lib/encryption/subscriber')\n      registerTenantEncryptionSubscriber(emForEnc, tenantEncryptionService)\n    }\n  } catch {\n    // best-effort; do not block container creation\n  }\n  return container\n}\ntry {\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  require('server-only')\n} catch {\n  // allow CLI/generator usage where Next server-only is not present\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,iBAAiB,SAA0B,qBAAoC;AACpG,SAAS,sBAAsB;AAC/B,SAAS,cAAc;AAEvB,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+CAA+C;AACxD,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC;AAW/D,MAAM,aAAa;AACnB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B;AAKpC,MAAM,iCAAiC;AAQvC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,0BAAmC;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY;AAC1C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,MAAI,eAAe,OAAO,eAAe,SAAS,eAAe,WAAW,eAAe,KAAM,QAAO;AACxG,SAAO;AACT;AAEA,SAAS,oBAAgD;AACvD,MAAI,CAAC,wBAAwB,EAAG,QAAO;AACvC,QAAM,WAAY,WAAmB,mBAAmB;AACxD,SAAO,YAAY,OAAO,aAAa,WAAY,WAAmC;AACxF;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,MAAI,CAAC,wBAAwB,EAAG;AAC/B,EAAC,WAAmB,mBAAmB,IAAI;AAC9C;AAEA,SAAS,sBAAsB,WAAiD;AAC9E,QAAM,QAA6B,CAAC;AACpC,aAAW,OAAO,sBAAsB;AACtC,QAAI;AACF,YAAM,QAAiB,UAAU,QAAQ,GAAY;AACrD,UAAI,UAAU,UAAa,UAAU,KAAM,OAAM,GAAG,IAAI;AAAA,IAC1D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,gCAAyC;AAChD,QAAM,SAAU,WAAuC,sBAAsB;AAC7E,MAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAM,SAAS,8BAA8B;AAC5C,EAAC,WAAuC,sBAAsB,IAAI;AACnE,SAAO;AACT;AAEA,SAAS,sBAA4C;AACnD,SAAQ,WAAmB,UAAU,KAAK;AAC5C;AAEA,SAAS,oBAAoB,YAAiC;AAC5D,EAAC,WAAmB,UAAU,IAAI;AACpC;AAEO,SAAS,qBAAqB,YAA2B;AAC9D,QAAM,WAAW,oBAAoB;AACrC,MAAI,aAAa,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC/D,WAAO,MAAM,yDAAyD;AAAA,EACxE;AACA,sBAAoB,UAAU;AAE7B,EAAC,WAAmB,mBAAmB,IAAI;AAC3C,EAAC,WAAmB,sBAAsB,IAAI;AAG9C,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEO,SAAS,kBAAiC;AAC/C,QAAM,aAAa,oBAAoB;AACvC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,oBAA2C;AAClD,QAAM,YAAa,WAAuC,oBAAoB;AAC9E,SAAO,OAAO,cAAc,aAAa,YAA8B;AACzE;AAEO,SAAS,uBAAuB,WAAwC;AAC7E;AAAC,EAAC,WAAuC,oBAAoB,IAAI;AACnE;AAGO,SAAS,sBAA4B;AAC1C,EAAC,WAAmB,mBAAmB,IAAI;AAC1C,EAAC,WAAmB,sBAAsB,IAAI;AAC9C,EAAC,WAAuC,uBAAuB,IAAI;AACnE,EAAC,WAAuC,2BAA2B,IAAI;AACvE,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,4BAAqC;AAC5C,SAAQ,WAAuC,8BAA8B,MAAM;AACrF;AAEA,SAAS,8BAAoC;AAC3C;AAAC,EAAC,WAAuC,8BAA8B,IAAI;AAC7E;AAEA,SAAS,sBAAsB,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,EAAE,MAAM,QAAQ,IAAI;AAC1B,QAAM,OAAO,OAAO,YAAY,WAAW,UAAU;AACrD,QAAM,iBACJ,SAAS,sBACN,SAAS,0BACT,KAAK,WAAW,oBAAoB,KACpC,KAAK,WAAW,qBAAqB;AAC1C,SAAO,kBAAkB,mCAAmC,KAAK,IAAI;AACvE;AAEA,SAAS,qBACP,KACA,SACA,OACM;AACN,QAAM,cAAc;AACpB,MAAI,YAAY,GAAG,MAAM,KAAM;AAC/B,cAAY,GAAG,IAAI;AACnB,SAAO,KAAK,SAAS,EAAE,KAAK,MAAM,CAAC;AACrC;AAEA,SAAS,iBAAiB,OAA4C;AACpE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACrH;AAEA,SAAS,sBAAsB,eAAuE;AACpG,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAClD;AAAA,MACA,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,yBAAgD;AACpE,QAAM,eAAe,gBAAgB;AACrC,QAAM,MAAM,MAAM,OAAO;AAEzB,QAAM,SAAU,eAAe,iBAAiB,KAAa,IAAI;AACjE,QAAM,KAAK,OAAO,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjF,QAAM,YAAY,gBAA+B,EAAE,eAAe,cAAc,QAAQ,CAAC;AAEzF,YAAU,SAAS;AAAA,IACjB,IAAI,QAAQ,EAAE;AAAA,IACd,aAAa,QAAQ,IAAI,iBAAiB,IAAI,QAAW,MAAM;AAC7D,UAAI;AAAE,eAAO,UAAU,QAAQ,yBAAyB;AAAA,MAAS,QAAQ;AAAE,eAAO;AAAA,MAAK;AAAA,IACzF,CAAC,CAAC;AAAA,IACF,YAAY,QAAQ,IAAI,kBAAkB,IAAI,SAAgB,CAAC;AAAA,IAC/D,iBAAiB,QAAQ,eAAe;AAAA,IACxC,YAAY,QAAQ,IAAI,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBpC,0BAA0B;AAAA,MAAW,CAAC,WACpC,iCAAiC;AAAA,QAC/B,OAAO,MAAM,OAAO;AAAA,QACpB,SAAS,4BAA4B;AAAA,MACvC,CAAC;AAAA,IACH,EAAE,OAAO,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQjB,mCAAmC;AAAA,MAAW,MAC5C,wCAAwC;AAAA,IAC1C,EAAE,OAAO;AAAA,EACX,CAAC;AAKD,aAAW,CAAC,gBAAgB,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1D,QAAI;AAAE,YAAM,SAAS;AAAA,IAAE,SAAS,OAAO;AACrC,aAAO,MAAM,8BAA8B,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,IAC3E;AAAA,EACF;AAOA,QAAM,qCAAqC,CAAC,CAAC,UAAU,eAAe;AACtE,MAAI,CAAC,oCAAoC;AACvC,UAAM,SAAS,kBAAkB;AACjC,QAAI,QAAQ;AACV,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM,QAAO,GAAG,IAAI,QAAQ,KAAK;AAAA,MACxE;AACA,UAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,WAAU,SAAS,MAAM;AAAA,IAC/D,OAAO;AACL,UAAI;AACF,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,8BAA8B;AACjE,YAAI,aAAa,OAAO,cAAc,YAAY;AAChD,gBAAM,UAAU,SAAS;AACzB,4BAAkB,sBAAsB,SAAS,CAAC;AAAA,QACpD;AAAA,MACF,QAAQ;AAAA,MAAiB;AAAA,IAC3B;AAAA,EACF;AAGA,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,SAAS;AAAA,IAChC,SAAS,OAAO;AACd,aAAO,MAAM,iCAAiC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC9D;AAAA,EACF,WAAW,CAAC,0BAA0B,GAAG;AAEvC,QAAI;AAEF,YAAM,QAAQ,MAAM,OAAO,MAAM;AACjC,UAAI,OAAO,UAAU;AACnB,YAAI;AACF,gBAAM,QAAQ,MAAM,SAAS,SAAS;AACtC,cAAI,SAAS,OAAO,MAAM,SAAS,WAAY,OAAM;AAAA,QACvD,SAAS,KAAK;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,sBAAsB,GAAG,GAAG;AAC9B,oCAA4B;AAC5B,eAAO,MAAM,gEAAgE,EAAE,IAAI,CAAC;AAAA,MACtF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,8BAA4B;AAAA,IAC1B,UAAU,CAAC,kBAAkB,UAAU,SAAS,sBAAsB,aAAa,CAAC;AAAA,IACpF,YAAY,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC,GAAG,GAAG,QAAQ,MAAS,EAAE,CAAC;AAAA,EACvE,CAAC;AAKD,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,IAAI;AACvC,UAAM,0BAA0B,UAAU,gBAAgB,yBAAyB,IAC9E,UAAU,QAAQ,yBAAyB,IAC5C;AAIJ,UAAM,0BAA0B,OAAO,yBAAyB,cAAc;AAC9E,QAAI,YAAY,2BAA2B,8BAA8B,GAAG;AAC1E,YAAM,EAAE,mCAAmC,IAAI,MAAM,OAAO,gDAAgD;AAC5G,yCAAmC,UAAU,uBAAuB;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AACA,IAAI;AAEF,UAAQ,aAAa;AACvB,QAAQ;AAER;",
+  "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.8.1-develop.7241.1.fad7b2ce2a";
+const APP_VERSION = "0.8.1-develop.7254.1.ab24f26208";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.8.1-develop.7241.1.fad7b2ce2a';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.8.1-develop.7254.1.ab24f26208';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.8.1-develop.7241.1.fad7b2ce2a",
+  "version": "0.8.1-develop.7254.1.ab24f26208",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -117,7 +117,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.8.1-develop.7241.1.fad7b2ce2a",
+    "@open-mercato/cache": "0.8.1-develop.7254.1.ab24f26208",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/di/__tests__/di-injection-mode.test.ts

@@ -0,0 +1,103 @@
+/**
+ * Awilix resolves CLASSIC-mode dependencies by parsing PARAMETER NAMES out of the
+ * function source (`packages/shared/src/lib/di/container.ts` creates the container
+ * with `InjectionMode.CLASSIC`). Any bundler that renames identifiers therefore
+ * breaks resolution: Turbopack renamed `em` to `em2` in a dev chunk and Awilix
+ * looked up a registration that does not exist.
+ *
+ * That failure is silent where it matters most. `resolveCrudMutationGuardService`
+ * catches the AwilixResolutionError and returns null, `bridgeLegacyGuard` returns
+ * null in turn, and the mutation proceeds with optimistic locking — and the
+ * enterprise record-lock 409 layered on top of it — NOT enforced. The write still
+ * answers 201, so nothing surfaces except a warning line.
+ *
+ * `.proxy()` makes a registration read its dependencies as PROPERTIES of the
+ * cradle (`cradle.em`), and property names survive mangling. This guard pins that
+ * every `asFunction` registration which takes an argument opts into it.
+ */
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import path from 'node:path'
+
+const repoRoot = path.resolve(__dirname, '../../../../../..')
+const scanRoots = ['packages', 'apps'].map((dir) => path.join(repoRoot, dir))
+
+function collectDiFiles(dir: string, out: string[]): void {
+  let entries: string[]
+  try {
+    entries = readdirSync(dir)
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (entry === 'node_modules' || entry === 'dist' || entry === '.next' || entry === '.mercato') continue
+    const full = path.join(dir, entry)
+    let isDir = false
+    try {
+      isDir = statSync(full).isDirectory()
+    } catch {
+      continue
+    }
+    if (isDir) {
+      collectDiFiles(full, out)
+    } else if (entry === 'di.ts' || entry === 'container.ts') {
+      out.push(full)
+    }
+  }
+}
+
+const diFiles: string[] = []
+for (const root of scanRoots) collectDiFiles(root, diFiles)
+
+const toRepoRelative = (file: string) => path.relative(repoRoot, file)
+
+/**
+ * Does this `asFunction(...)` body declare a parameter?
+ *
+ * Only INLINE function expressions can be judged statically — an arrow or a
+ * `function` expression written at the registration. A bare reference
+ * (`asFunction(createThing)`) is deliberately skipped: its signature lives in
+ * another module, and guessing would produce exactly the false positive this
+ * comment replaced.
+ */
+function declaresParameter(chunk: string): boolean {
+  const body = chunk.replace(/^\s*/, '')
+  if (body.startsWith('(')) {
+    return !/^\(\s*\)/.test(body)
+  }
+  const fn = body.match(/^(?:async\s+)?function\s*[A-Za-z0-9_$]*\s*\(([^)]*)\)/)
+  if (fn) return fn[1].trim().length > 0
+  return false
+}
+
+function stripComments(source: string): string {
+  return source.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/\/\/[^\n]*/g, ' ')
+}
+
+describe('Awilix registrations survive identifier mangling', () => {
+  it('scans the whole workspace, not a truncated slice of it', () => {
+    // A floor, because the readdir above swallows its errors: without one, a scan
+    // that collapsed to nothing would report green and the guard would pass vacuously.
+    expect(diFiles.length).toBeGreaterThan(20)
+  })
+
+  it('has no argument-taking asFunction registration that skips .proxy()', () => {
+    const offenders: string[] = []
+
+    for (const file of diFiles) {
+      const source = stripComments(readFileSync(file, 'utf8'))
+      // Split on the registration boundary so each `asFunction(...)` is checked
+      // against the `.proxy()` that belongs to it, not one later in the file.
+      const chunks = source.split(/asFunction\(/).slice(1)
+      for (const chunk of chunks) {
+        if (!declaresParameter(chunk)) continue
+        // Chunks are split at each `asFunction(`, so the only `.proxy()` a chunk
+        // can contain is the one chained onto its own registration.
+        if (!/\.proxy\(\)/.test(chunk)) {
+          offenders.push(toRepoRelative(file))
+        }
+      }
+    }
+
+    expect(Array.from(new Set(offenders))).toEqual([])
+  })
+})

package/src/lib/di/container.ts

@@ -224,12 +224,21 @@ export async function createRequestContainer(): Promise<AppContainer> {
     // registrations override this default via Awilix replace semantics —
     // see the enterprise `record_locks` module for the canonical override.
     // Spec: .ai/specs/implemented/2026-05-25-oss-optimistic-locking.md
-    crudMutationGuardService: asFunction((em: EntityManager) =>
+    // `.proxy()` is load-bearing, not stylistic. The container runs in CLASSIC
+    // injection mode, where Awilix resolves dependencies by parsing PARAMETER
+    // NAMES out of the function source. A bundler that renames `em` to `em2` —
+    // Turbopack does, on a scope collision — makes Awilix look up a registration
+    // that does not exist, and `resolveCrudMutationGuardService` swallows the
+    // AwilixResolutionError and returns null, so `bridgeLegacyGuard` silently
+    // drops the guard and every mutation runs with optimistic locking NOT
+    // enforced. Reading `cradle.em` resolves by property name, which survives
+    // mangling. Pinned by `di-injection-mode.test.ts`.
+    crudMutationGuardService: asFunction((cradle: { em: EntityManager }) =>
       createOptimisticLockGuardService({
-        getEm: () => em,
+        getEm: () => cradle.em,
         readers: getAllOptimisticLockReaders(),
       }),
-    ).scoped(),
+    ).scoped().proxy(),
     // Default OSS command-level optimistic-lock guard, awaited by
     // `enforceCommandOptimisticLockWithGuards` for Command-pattern writes.
     // Header/explicit-token compare only (no `resolveExpected`), so it is