@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/lib/data/engine.js

@@ -113,7 +113,8 @@ class DefaultDataEngine {
       organizationId,
       tenantId,
       values: sanitizedValues,
-      encryptionService
+      encryptionService,
+      pinOrganizationId: opts.pinOrganizationId === true
     });
     if (opts.notify !== false) {
       let bus = null;
@@ -261,8 +262,12 @@ class DefaultDataEngine {
         organizationId: orgId,
         tenantId,
         values: normalizeCustomFieldValues(sanitizedValues),
-        notify: opts.notify
+        notify: opts.notify,
         // defaults to true
+        // custom_entities_storage upserts on (entity_type, entity_id, organization_id),
+        // so `id` is unique only within this organization, not across organizations —
+        // pin the reconciling delete/lookup to this organization (#6034 review).
+        pinOrganizationId: true
       });
     }
     return { id };
@@ -323,8 +328,12 @@ class DefaultDataEngine {
         organizationId: orgId,
         tenantId,
         values: normalizeCustomFieldValues(sanitizedValues),
-        notify: opts.notify
+        notify: opts.notify,
         // defaults to true
+        // custom_entities_storage upserts on (entity_type, entity_id, organization_id),
+        // so `id` is unique only within this organization, not across organizations —
+        // pin the reconciling delete/lookup to this organization (#6034 review).
+        pinOrganizationId: true
       });
     }
   }

package/dist/lib/data/engine.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/data/engine.ts"],
-  "sourcesContent": ["import type { EntityData, EntityName, FilterQuery, RequiredEntityData } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { type Kysely, sql } from 'kysely'\nimport { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'\nimport { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'\nimport { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'\nimport type { EventBus } from '@open-mercato/events/types'\nimport {\n  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n  type CrudEventAction,\n  type CrudEventsConfig,\n  type CrudIndexerConfig,\n  type CrudEntityIdentifiers,\n} from '../crud/types'\nimport type { BulkImportSuppression } from '../commands/types'\nimport { CrudHttpError } from '../crud/errors'\nimport { resolveRegisteredEntityTableName } from '../query/engine'\nimport { getEntityIds } from '../encryption/entityIds'\nimport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nimport { parseBooleanToken } from '../boolean'\nimport { isReadProjectionAlwaysConsistent } from './consistency'\nimport { isEventDeclared } from '../../modules/events'\nimport { createLogger } from '../logger'\nimport { createBoundedTtlMemo } from '../query/bounded-ttl-memo'\n\nconst logger = createLogger('shared').child({ component: 'data-engine' })\n\nconst undeclaredEventWarned = new Set<string>()\n\nfunction warnIfUndeclaredEvent(eventName: string, context: string): void {\n  if (isEventDeclared(eventName)) return\n  if (undeclaredEventWarned.has(eventName)) return\n  undeclaredEventWarned.add(eventName)\n  logger.warn('Emitting undeclared event \u2014 declare it in the owning module events.ts (createModuleEvents) so the event registry stays authoritative', { context, eventName })\n}\n\n/** Internal: clear the undeclared-event warning cache. Exposed for tests. */\nexport function __resetUndeclaredEventWarningsForTests(): void {\n  undeclaredEventWarned.clear()\n}\n\n/** Only `true` is cached: a cached `false` would keep this failing after a migration creates the table. */\nconst tableExistsCache = createBoundedTtlMemo<true>({\n  ttlEnv: 'OM_DATA_ENGINE_TABLE_EXISTS_CACHE_MS',\n  defaultTtlMs: 3_600_000,\n  defaultMaxEntries: 1_000,\n})\n\n/** Test-only: the module-scoped memo would otherwise leak state across specs. */\nexport function clearDataEngineTableExistsCache(): void {\n  tableExistsCache.clear()\n}\n\nconst COVERAGE_REFRESH_INTERVAL_MS = 5 * 60 * 1000\nconst coverageRefreshTracker = new Map<string, number>()\n\nfunction shouldTriggerCoverageRefresh(entityType: string | undefined, tenantId: string | null): boolean {\n  if (!entityType) return false\n  const key = `${entityType}|${tenantId ?? '__null__'}`\n  const now = Date.now()\n  const last = coverageRefreshTracker.get(key) ?? 0\n  if (now - last < COVERAGE_REFRESH_INTERVAL_MS) return false\n  coverageRefreshTracker.set(key, now)\n  return true\n}\n\ntype CustomEntityValues = Record<string, unknown>\n\ntype QueuedCrudSideEffect = {\n  action: CrudEventAction\n  entity: unknown\n  identifiers: CrudEntityIdentifiers\n  syncOrigin?: string | null\n  actorUserId?: string | null\n  events?: CrudEventsConfig<unknown>\n  indexer?: CrudIndexerConfig<unknown>\n}\n\n/**\n * A `makeCrudRoute` route-level `indexer:` declaration, handed to the data engine for the\n * duration of one command-bus write. Command handlers own the side-effect mark on the\n * `actions.*` path, and most of them mark `events:` only \u2014 without this the route's\n * declaration would reach no code at all. `entityClass` scopes the default to the route's\n * own ORM entity so a handler that also marks a sibling entity in the same request (a tag\n * assignment alongside a tag, say) is never indexed under the route's `entityType`.\n */\nexport type DefaultCrudIndexerConfig = {\n  indexer: CrudIndexerConfig<unknown>\n  entityClass: abstract new (...args: never[]) => object\n}\n\nexport interface DataEngine {\n  setCustomFields(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: Record<string, string | number | boolean | null | undefined | Array<string | number | boolean | null | undefined>>\n    notify?: boolean // default true -> emit '<module>.<entity>.updated'\n  }): Promise<void>\n\n  // Storage for user-defined entities (doc-based)\n  createCustomEntityRecord(opts: {\n    entityId: string // '<module>:<entity>'\n    recordId?: string // optional; auto-generate if not provided\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<{ id: string }>\n\n  updateCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<void>\n\n  deleteCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    soft?: boolean // default true: sets deleted_at\n    notify?: boolean // keep event emitting as it is (no extra events here)\n  }): Promise<void>\n\n  // Generic ORM-backed entity operations used by CrudFactory\n  createOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    data: EntityData<T>\n  }): Promise<T>\n\n  updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null>\n\n  deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null>\n\n  emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    /** Bulk-import deferral: skip the domain event and/or inline reindex for this emit. */\n    suppress?: BulkImportSuppression\n  }): Promise<void>\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void\n\n  /**\n   * Drain queued side effects. When `suppress` is passed (a bulk-import backfill), the\n   * flagged per-record events / reindex are skipped for every drained entry; the caller\n   * is responsible for rebuilding the `query_index` afterwards.\n   */\n  flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void>\n\n  /**\n   * Declare the indexer a CRUD route configured, for marks made during one command-bus\n   * write that do not carry an indexer of their own. Pass `null` to clear it. Optional so\n   * third-party `DataEngine` implementations stay valid; callers invoke it with `?.`.\n   */\n  setDefaultIndexerConfig?(config: DefaultCrudIndexerConfig | null): void\n\n  /**\n   * Whether any side effect drained since the current default was declared carried an\n   * indexer for that default's entity class \u2014 false means the declared query-index\n   * obligation was discharged by nobody. Optional for the same reason as the setter.\n   */\n  hasIndexedDefaultEntityClass?(): boolean\n}\n\nexport const SYSTEM_ENTITY_RECORDS_BLOCKED_CODE = 'system_entity_records_blocked'\n\n/**\n * A system entity for doc-storage purposes is an id that modules declare in the\n * generated entity-id registry AND that resolves to a registered ORM table. Both\n * conditions matter: `resolveRegisteredEntityTableName` matches class-name candidates\n * from the entity segment alone, so a runtime-registered custom entity whose name\n * happens to collide with some ORM class (e.g. `user:todo` vs the example module's\n * `Todo`) must never be classified as system. When the registry is not populated\n * (exotic bootstraps, unit harnesses) the check conservatively falls back to the\n * ORM-table match alone so the #2939 protection never switches off.\n */\nexport function isOrmBackedSystemEntityId(em: EntityManager, entityId: string): boolean {\n  const registry = getEntityIds(false)\n  const moduleIds = Object.values(registry).flatMap((moduleEntities) => Object.values(moduleEntities ?? {}))\n  if (moduleIds.length > 0 && !moduleIds.includes(entityId)) return false\n  return resolveRegisteredEntityTableName(em, entityId) !== null\n}\n\n/**\n * Doc storage (`custom_entities_storage`) is for custom entities only. A system\n * entity's records live in its own module tables/APIs \u2014 writing doc rows for it\n * poisons read-path classification (#2939) and must be rejected at the deepest\n * seam so no caller (API, AI tool, workflow) can do it.\n */\nexport function assertCustomEntityStorageEntityId(em: EntityManager, entityId: string): void {\n  if (isOrmBackedSystemEntityId(em, entityId)) {\n    throw new CrudHttpError(400, {\n      error: 'Records are available for custom entities only',\n      code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE,\n      entityId,\n    })\n  }\n}\n\nexport class DefaultDataEngine implements DataEngine {\n  private pendingSideEffects = new Map<string, QueuedCrudSideEffect>()\n  private defaultIndexer: DefaultCrudIndexerConfig | null = null\n  private indexedDefaultEntityClass = false\n  constructor(private em: EntityManager, private container: AwilixContainer) {}\n\n  /**\n   * Per-command state, deliberately held on the engine instance rather than threaded through\n   * `CommandRuntimeContext` the way the bulk-import flags are. That is sound only because\n   * `createRequestContainer()` registers `dataEngine` per request (`lib/di/container.ts`), so\n   * one engine instance never spans two requests, and no `makeCrudRoute` verb runs two commands\n   * concurrently against it. An application that re-registers `dataEngine` as a transient would\n   * break both assumptions: the command would mark on a different instance than the route\n   * declared on, so nothing is indexed and every write logs the undischarged-declaration warning.\n   */\n  setDefaultIndexerConfig(config: DefaultCrudIndexerConfig | null): void {\n    this.defaultIndexer = config\n    this.indexedDefaultEntityClass = false\n  }\n\n  hasIndexedDefaultEntityClass(): boolean {\n    return this.indexedDefaultEntityClass\n  }\n\n  private matchesDefaultEntityClass(entity: unknown): boolean {\n    const declared = this.defaultIndexer?.entityClass\n    // `OrmEntityConfig.entity` is `any` and this repository treats `EntitySchema` instances as a\n    // first-class entity shape (`lib/bootstrap/types.ts`). An `EntitySchema` is an object rather\n    // than a constructor, so `instanceof` against it throws \u2014 and it would throw inside\n    // `markOrmEntityChange`, outside the best-effort try/catch that guards the flush, turning\n    // every write on such a route into a 500.\n    if (typeof declared !== 'function') return false\n    return entity instanceof declared\n  }\n\n  private resolveDefaultIndexer(entity: unknown): CrudIndexerConfig<unknown> | undefined {\n    return this.matchesDefaultEntityClass(entity) ? this.defaultIndexer?.indexer : undefined\n  }\n\n  async setCustomFields(opts: Parameters<DataEngine['setCustomFields']>[0]): Promise<void> {\n    const { entityId, recordId, organizationId = null, tenantId = null, values } = opts\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values,\n    })\n    await this.validateCustomFieldValues(entityId, organizationId, tenantId, sanitizedValues as Record<string, unknown>)\n    let encryptionService: any = null\n    try {\n      encryptionService = this.container.resolve('tenantEncryptionService') as any\n    } catch {\n      encryptionService = null\n    }\n    await setRecordCustomFields(this.em, {\n      entityId,\n      recordId,\n      organizationId,\n      tenantId,\n      values: sanitizedValues,\n      encryptionService,\n    })\n    if (opts.notify !== false) {\n      let bus: EventBus | null = null\n      try {\n        bus = (this.container.resolve('eventBus') as EventBus)\n      } catch {\n        bus = null\n      }\n      if (bus) {\n        const [mod, ent] = (entityId || '').split(':')\n        if (mod && ent) {\n          const eventName = `${mod}.${ent}.updated`\n          warnIfUndeclaredEvent(eventName, 'setCustomFields')\n          try {\n            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, {\n              persistent: true,\n              tenantId,\n              organizationId,\n              emitterModuleId: mod,\n            })\n          } catch {\n            // non-blocking\n          }\n        }\n      }\n    }\n  }\n\n  private normalizeDocValues(values: CustomEntityValues): CustomEntityValues {\n    const out: CustomEntityValues = {}\n    for (const [k, v] of Object.entries(values || {})) {\n      // Never allow callers to override reserved identifiers in the doc\n      if (k === 'id' || k === 'entity_id' || k === 'entityId') continue\n      // Accept both 'cf_<key>' and 'cf:<key>' inputs and normalize to 'cf:<key>'\n      if (k.startsWith('cf_')) out[`cf:${k.slice(3)}`] = v\n      else out[k] = v\n    }\n    return out\n  }\n\n  private backcompatEavEnabled(): boolean {\n    try {\n      return parseBooleanToken(process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM ?? '') === true\n    } catch { return false }\n  }\n\n  private getKysely(): Kysely<any> {\n    return this.em.getKysely<any>()\n  }\n\n  private async ensureStorageTableExists(): Promise<void> {\n    const cacheKey = 'custom_entities_storage'\n    if (tableExistsCache.get(cacheKey)) return\n    const db = this.getKysely()\n    const exists = await db\n      .selectFrom('information_schema.tables' as any)\n      .select(sql`1`.as('present'))\n      .where('table_name' as any, '=', 'custom_entities_storage')\n      .executeTakeFirst()\n    if (!exists) {\n      throw new Error('custom_entities_storage table is missing. Run migrations (yarn db:migrate).')\n    }\n    tableExistsCache.set(cacheKey, true)\n  }\n\n  private normalizeValuesForValidation(values: Record<string, unknown> | undefined | null): Record<string, unknown> {\n    if (!values) return {}\n    const out: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(values)) {\n      if (value === undefined) continue\n      if (key.startsWith('cf_') || key.startsWith('cf:')) {\n        const normalized = key.slice(3)\n        if (normalized) out[normalized] = value\n        continue\n      }\n      out[key] = value\n    }\n    return out\n  }\n\n  private async validateCustomFieldValues(\n    entityId: string,\n    organizationId: string | null,\n    tenantId: string | null,\n    values: Record<string, unknown> | undefined | null,\n  ): Promise<void> {\n    const prepared = this.normalizeValuesForValidation(values)\n    if (!entityId || Object.keys(prepared).length === 0) return\n    const result = await validateCustomFieldValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values: prepared,\n    })\n    if (!result.ok) {\n      throw new CrudHttpError(400, { error: 'Validation failed', fields: result.fieldErrors })\n    }\n  }\n\n  async createCustomEntityRecord(opts: Parameters<DataEngine['createCustomEntityRecord']>[0]): Promise<{ id: string }> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    await this.ensureStorageTableExists()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const rawId = String(opts.recordId ?? '').trim()\n    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(rawId)\n    const sentinel = rawId.toLowerCase()\n    const shouldGenerate = !rawId || !isUuid || sentinel === 'create' || sentinel === 'new' || sentinel === 'null' || sentinel === 'undefined'\n    const id = shouldGenerate ? ((): string => {\n      const g = globalThis as { crypto?: { randomUUID?: () => string } }\n      if (g.crypto?.randomUUID) return g.crypto.randomUUID()\n      // Fallback UUIDv4 generator\n      return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n        const r = (Math.random() * 16) | 0\n        const v = c === 'x' ? r : (r & 0x3) | 0x8\n        return v.toString(16)\n      })\n    })() : rawId\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const doc: Record<string, unknown> = { id, ...this.normalizeDocValues(sanitizedValues || {}) }\n\n    const now = sql`now()`\n    const payload = {\n      entity_type: opts.entityId,\n      entity_id: id,\n      organization_id: orgId,\n      tenant_id: tenantId,\n      doc: sql`${JSON.stringify(doc)}::jsonb`,\n      updated_at: now,\n      created_at: now,\n      deleted_at: null,\n    }\n\n    // Upsert by scoped uniqueness\n    try {\n      await db\n        .insertInto('custom_entities_storage' as any)\n        .values(payload as any)\n        .onConflict((oc) => oc\n          .columns(['entity_type', 'entity_id', 'organization_id'])\n          .doUpdateSet({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any))\n        .execute()\n    } catch {\n      // Fallback for global scope uniqueness\n      try {\n        const updated = await db\n          .updateTable('custom_entities_storage' as any)\n          .set({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any)\n          .where('entity_type' as any, '=', opts.entityId)\n          .where('entity_id' as any, '=', id)\n          .where('organization_id' as any, orgId === null ? 'is' : '=', orgId as any)\n          .where('tenant_id' as any, tenantId === null ? 'is' : '=', tenantId as any)\n          .executeTakeFirst()\n        if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {\n          await db.insertInto('custom_entities_storage' as any).values(payload as any).execute()\n        }\n      } catch (err) {\n        // Surface a clear error so it doesn't silently fall back only to EAV\n        throw err\n      }\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n      })\n    }\n\n    return { id }\n  }\n\n  async updateCustomEntityRecord(opts: Parameters<DataEngine['updateCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n\n    // Merge doc shallowly: load existing doc and overlay\n    await this.ensureStorageTableExists()\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n    const row = await applyScope(\n      db.selectFrom('custom_entities_storage' as any).select(['doc' as any])\n    ).executeTakeFirst()\n    const prevDoc: Record<string, unknown> = (row as any)?.doc || { id }\n    const nextDoc: Record<string, unknown> = { ...prevDoc, ...this.normalizeDocValues(sanitizedValues || {}), id }\n    try {\n      const updated = await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any) as any\n      ).executeTakeFirst()\n      if (!updated || Number((updated as any).numUpdatedRows ?? 0) === 0) {\n        await db.insertInto('custom_entities_storage' as any).values({\n          entity_type: opts.entityId,\n          entity_id: id,\n          organization_id: orgId,\n          tenant_id: tenantId,\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          created_at: sql`now()`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any).execute()\n      }\n    } catch (err) {\n      throw err\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n      })\n    }\n  }\n\n  async deleteCustomEntityRecord(opts: Parameters<DataEngine['deleteCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const soft = opts.soft !== false\n\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n\n    if (soft) {\n      await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          deleted_at: sql`now()`,\n          updated_at: sql`now()`,\n        } as any) as any\n      ).execute()\n    } else {\n      await applyScope(db.deleteFrom('custom_entities_storage' as any) as any).execute()\n    }\n\n    // Soft-delete EAV values to preserve current behavior\n    try {\n      const { CustomFieldValue } = await import('@open-mercato/core/modules/entities/data/entities')\n      const values = await this.em.find(CustomFieldValue, {\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: opts.tenantId ?? null,\n      })\n      const now = new Date()\n      const mutated = values.filter((record) => {\n        if (record.deletedAt) return false\n        record.deletedAt = now\n        return true\n      })\n      if (mutated.length) {\n        for (const record of values) this.em.persist(record)\n        await this.em.flush()\n      }\n    } catch { /* non-blocking */ }\n  }\n\n  async createOrmEntity<T extends object>(opts: { entity: EntityName<T>; data: EntityData<T> }): Promise<T> {\n    const entity = this.em.create(\n      opts.entity as EntityName<T>,\n      opts.data as unknown as RequiredEntityData<T>\n    )\n    await this.em.persist(entity).flush()\n    return entity\n  }\n\n  async updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    await opts.apply(current)\n    await this.em.persist(current).flush()\n    return current\n  }\n\n  async deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    if (opts.soft !== false) {\n      const field = opts.softDeleteField || ('deletedAt' as keyof T & string)\n      if (typeof current === 'object' && current !== null) {\n        ;(current as Record<string, unknown>)[field] = new Date()\n        await this.em.persist(current).flush()\n      }\n    } else {\n      await this.em.remove(current).flush()\n    }\n    return current\n  }\n\n  async emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    suppress?: BulkImportSuppression\n  }): Promise<void> {\n    const { action, entity, events, indexer, identifiers, syncOrigin, suppress } = opts\n    // Bulk-import deferral: an entry may suppress its domain event and/or inline reindex. When both\n    // the config is absent AND (for the present one) suppressed, there is nothing left to do.\n    const emitEvents = !!events && !suppress?.skipEvents\n    const runIndexer = !!indexer && !suppress?.skipReindex\n    if (!emitEvents && !runIndexer) return\n    if (!identifiers?.id) return\n\n    let bus: EventBus | null = null\n    try {\n      bus = (this.container.resolve('eventBus') as EventBus)\n    } catch {\n      bus = null\n    }\n    if (!bus) return\n\n    const ctx = {\n      action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n\n    if (events && !suppress?.skipEvents) {\n      const eventName = `${events.module}.${events.entity}.${action}`\n      warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')\n      const builtPayload = events.buildPayload\n        ? events.buildPayload(ctx)\n        : {\n            id: ctx.identifiers.id,\n            organizationId: ctx.identifiers.organizationId,\n            tenantId: ctx.identifiers.tenantId,\n            ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),\n          }\n      // A configured indexer means this data-engine call owns the query-index\n      // decision, including an explicit skipReindex suppression. Mark object\n      // payloads so the legacy domain-event bridge does not enqueue the same\n      // record a second time. Keep the marker non-enumerable so client broadcasts\n      // and persisted domain payloads retain their existing public shape.\n      // Primitive custom payloads cannot be bridged in any case because they do\n      // not expose the record id.\n      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)\n        ? Object.defineProperty(\n            { ...(builtPayload as Record<string, unknown>) },\n            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n            { value: true, enumerable: false },\n          )\n        : builtPayload\n      try {\n        await bus.emitEvent(eventName, payload, {\n          persistent: !!events.persistent,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: ctx.identifiers.organizationId ?? null,\n          emitterModuleId: events.module,\n        })\n      } catch {\n        // non-blocking\n      }\n    }\n\n    if (indexer && !suppress?.skipReindex) {\n      const alwaysConsistent = isReadProjectionAlwaysConsistent()\n      const resolveCoverageBaseDelta = (): number | undefined => {\n        if (action === 'created') return 1\n        if (action === 'deleted') return -1\n        return undefined\n      }\n      const coverageBaseDelta = resolveCoverageBaseDelta()\n\n      if (action === 'deleted') {\n        const payload = indexer.buildDeletePayload\n          ? indexer.buildDeletePayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the index update so query-index reads (the `customValues`/scalar\n        // projection that list endpoints serve) are consistent the moment the write\n        // returns. The subscriber removes the projection row + tokens synchronously and\n        // defers the coverage recompute + fulltext delete, so this stays bounded.\n        // Errors are logged, not thrown \u2014 index drift never fails the originating write.\n        // Always-consistent mode rethrows so drift is loud and retryable.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.delete_one emit failed', { err })\n          })\n        }\n      } else {\n        const payload = indexer.buildUpsertPayload\n          ? indexer.buildUpsertPayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the projection upsert so list reads observe the new doc immediately\n        // (see delete_one above). The subscriber updates `entity_indexes` synchronously\n        // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +\n        // tokenize + DELETE + chunked INSERT) so write latency stays bounded.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.upsert_one emit failed', { err })\n          })\n        }\n      }\n\n      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {\n        const coveragePayload = {\n          entityType: indexer.entityType,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: null,\n          delayMs: 0,\n        }\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })\n        } else {\n          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)\n        }\n      }\n    }\n  }\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void {\n    const { entity, identifiers } = opts\n    if (!entity) return\n    if (!identifiers?.id) return\n    // A command handler that marks `events:` only still discharges the route's declared\n    // query-index obligation \u2014 the route hands its `indexer:` down as the default so the\n    // handler's own entity and identifiers (the accurate ones) drive the projection write.\n    const indexer = opts.indexer ?? this.resolveDefaultIndexer(entity)\n    const key = this.buildSideEffectKey(opts.action, identifiers)\n    const existing = this.pendingSideEffects.get(key)\n    if (existing) {\n      existing.entity = entity\n      existing.identifiers = {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      }\n      existing.syncOrigin = opts.syncOrigin ?? null\n      existing.actorUserId = opts.actorUserId ?? null\n      if (opts.events) existing.events = opts.events as CrudEventsConfig<unknown>\n      // Explicit always wins, on the merge branch too: a second `events:`-only mark on the same\n      // key must not let the route default overwrite the `indexer:` an earlier mark installed,\n      // which would silently drop that handler's own `buildUpsertPayload`.\n      if (opts.indexer) existing.indexer = opts.indexer as CrudIndexerConfig<unknown>\n      else if (!existing.indexer && indexer) existing.indexer = indexer\n      this.pendingSideEffects.set(key, existing)\n      return\n    }\n    const entry: QueuedCrudSideEffect = {\n      action: opts.action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: opts.syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n    if (opts.events) entry.events = opts.events as CrudEventsConfig<unknown>\n    if (indexer) entry.indexer = indexer\n    this.pendingSideEffects.set(key, entry)\n  }\n\n  async flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void> {\n    if (!this.pendingSideEffects.size) return\n    const entries = Array.from(this.pendingSideEffects.values())\n    this.pendingSideEffects.clear()\n    for (const entry of entries) {\n      if (entry.indexer && !suppress?.skipReindex && this.matchesDefaultEntityClass(entry.entity)) {\n        this.indexedDefaultEntityClass = true\n      }\n      try {\n        await this.emitOrmEntityEvent({\n          action: entry.action,\n          entity: entry.entity,\n          identifiers: entry.identifiers,\n          syncOrigin: entry.syncOrigin ?? null,\n          actorUserId: entry.actorUserId ?? null,\n          events: entry.events as CrudEventsConfig<unknown>,\n          indexer: entry.indexer as CrudIndexerConfig<unknown>,\n          suppress,\n        })\n      } catch (error) {\n        if (isReadProjectionAlwaysConsistent()) {\n          throw error\n        }\n        // best-effort; continue with remaining side effects\n      }\n    }\n  }\n\n  private buildSideEffectKey(action: CrudEventAction, identifiers: CrudEntityIdentifiers): string {\n    const id = identifiers.id ?? ''\n    const org = identifiers.organizationId ?? ''\n    const tenant = identifiers.tenantId ?? ''\n    return [action, id, org, tenant].join('|')\n  }\n}\n"],
-  "mappings": "AAGA,SAAsB,WAAW;AACjC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAChD,SAAS,mDAAmD;AAE5D;AAAA,EACE;AAAA,OAKK;AAEP,SAAS,qBAAqB;AAC9B,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,yBAAyB;AAClC,SAAS,wCAAwC;AACjD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AAErC,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAExE,MAAM,wBAAwB,oBAAI,IAAY;AAE9C,SAAS,sBAAsB,WAAmB,SAAuB;AACvE,MAAI,gBAAgB,SAAS,EAAG;AAChC,MAAI,sBAAsB,IAAI,SAAS,EAAG;AAC1C,wBAAsB,IAAI,SAAS;AACnC,SAAO,KAAK,6IAAwI,EAAE,SAAS,UAAU,CAAC;AAC5K;AAGO,SAAS,yCAA+C;AAC7D,wBAAsB,MAAM;AAC9B;AAGA,MAAM,mBAAmB,qBAA2B;AAAA,EAClD,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,mBAAmB;AACrB,CAAC;AAGM,SAAS,kCAAwC;AACtD,mBAAiB,MAAM;AACzB;AAEA,MAAM,+BAA+B,IAAI,KAAK;AAC9C,MAAM,yBAAyB,oBAAI,IAAoB;AAEvD,SAAS,6BAA6B,YAAgC,UAAkC;AACtG,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,UAAU;AACnD,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAO,uBAAuB,IAAI,GAAG,KAAK;AAChD,MAAI,MAAM,OAAO,6BAA8B,QAAO;AACtD,yBAAuB,IAAI,KAAK,GAAG;AACnC,SAAO;AACT;AAgIO,MAAM,qCAAqC;AAY3C,SAAS,0BAA0B,IAAmB,UAA2B;AACtF,QAAM,WAAW,aAAa,KAAK;AACnC,QAAM,YAAY,OAAO,OAAO,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,OAAO,OAAO,kBAAkB,CAAC,CAAC,CAAC;AACzG,MAAI,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,QAAQ,EAAG,QAAO;AAClE,SAAO,iCAAiC,IAAI,QAAQ,MAAM;AAC5D;AAQO,SAAS,kCAAkC,IAAmB,UAAwB;AAC3F,MAAI,0BAA0B,IAAI,QAAQ,GAAG;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,MAAM,kBAAwC;AAAA,EAInD,YAAoB,IAA2B,WAA4B;AAAvD;AAA2B;AAH/C,SAAQ,qBAAqB,oBAAI,IAAkC;AACnE,SAAQ,iBAAkD;AAC1D,SAAQ,4BAA4B;AAAA,EACwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5E,wBAAwB,QAA+C;AACrE,SAAK,iBAAiB;AACtB,SAAK,4BAA4B;AAAA,EACnC;AAAA,EAEA,+BAAwC;AACtC,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,0BAA0B,QAA0B;AAC1D,UAAM,WAAW,KAAK,gBAAgB;AAMtC,QAAI,OAAO,aAAa,WAAY,QAAO;AAC3C,WAAO,kBAAkB;AAAA,EAC3B;AAAA,EAEQ,sBAAsB,QAAyD;AACrF,WAAO,KAAK,0BAA0B,MAAM,IAAI,KAAK,gBAAgB,UAAU;AAAA,EACjF;AAAA,EAEA,MAAM,gBAAgB,MAAmE;AACvF,UAAM,EAAE,UAAU,UAAU,iBAAiB,MAAM,WAAW,MAAM,OAAO,IAAI;AAC/E,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,KAAK,0BAA0B,UAAU,gBAAgB,UAAU,eAA0C;AACnH,QAAI,oBAAyB;AAC7B,QAAI;AACF,0BAAoB,KAAK,UAAU,QAAQ,yBAAyB;AAAA,IACtE,QAAQ;AACN,0BAAoB;AAAA,IACtB;AACA,UAAM,sBAAsB,KAAK,IAAI;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,OAAO;AACzB,UAAI,MAAuB;AAC3B,UAAI;AACF,cAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,MAC1C,QAAQ;AACN,cAAM;AAAA,MACR;AACA,UAAI,KAAK;AACP,cAAM,CAAC,KAAK,GAAG,KAAK,YAAY,IAAI,MAAM,GAAG;AAC7C,YAAI,OAAO,KAAK;AACd,gBAAM,YAAY,GAAG,GAAG,IAAI,GAAG;AAC/B,gCAAsB,WAAW,iBAAiB;AAClD,cAAI;AACF,kBAAM,IAAI,UAAU,WAAW,EAAE,IAAI,UAAU,gBAAgB,SAAS,GAAG;AAAA,cACzE,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACA,iBAAiB;AAAA,YACnB,CAAC;AAAA,UACH,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAgD;AACzE,UAAM,MAA0B,CAAC;AACjC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC,GAAG;AAEjD,UAAI,MAAM,QAAQ,MAAM,eAAe,MAAM,WAAY;AAEzD,UAAI,EAAE,WAAW,KAAK,EAAG,KAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI;AAAA,UAC9C,KAAI,CAAC,IAAI;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAgC;AACtC,QAAI;AACF,aAAO,kBAAkB,QAAQ,IAAI,sCAAsC,EAAE,MAAM;AAAA,IACrF,QAAQ;AAAE,aAAO;AAAA,IAAM;AAAA,EACzB;AAAA,EAEQ,YAAyB;AAC/B,WAAO,KAAK,GAAG,UAAe;AAAA,EAChC;AAAA,EAEA,MAAc,2BAA0C;AACtD,UAAM,WAAW;AACjB,QAAI,iBAAiB,IAAI,QAAQ,EAAG;AACpC,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAClB,WAAW,2BAAkC,EAC7C,OAAO,OAAO,GAAG,SAAS,CAAC,EAC3B,MAAM,cAAqB,KAAK,yBAAyB,EACzD,iBAAiB;AACpB,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,MAAM,6EAA6E;AAAA,IAC/F;AACA,qBAAiB,IAAI,UAAU,IAAI;AAAA,EACrC;AAAA,EAEQ,6BAA6B,QAA6E;AAChH,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,UAAU,OAAW;AACzB,UAAI,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG;AAClD,cAAM,aAAa,IAAI,MAAM,CAAC;AAC9B,YAAI,WAAY,KAAI,UAAU,IAAI;AAClC;AAAA,MACF;AACA,UAAI,GAAG,IAAI;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0BACZ,UACA,gBACA,UACA,QACe;AACf,UAAM,WAAW,KAAK,6BAA6B,MAAM;AACzD,QAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG;AACrD,UAAM,SAAS,MAAM,gCAAgC,KAAK,IAAI;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,QAAQ,OAAO,YAAY,CAAC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAAsF;AACnH,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,yBAAyB;AACpC,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,QAAQ,OAAO,KAAK,YAAY,EAAE,EAAE,KAAK;AAC/C,UAAM,SAAS,6EAA6E,KAAK,KAAK;AACtG,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,CAAC,SAAS,CAAC,UAAU,aAAa,YAAY,aAAa,SAAS,aAAa,UAAU,aAAa;AAC/H,UAAM,KAAK,kBAAkB,MAAc;AACzC,YAAM,IAAI;AACV,UAAI,EAAE,QAAQ,WAAY,QAAO,EAAE,OAAO,WAAW;AAErD,aAAO,uCAAuC,QAAQ,SAAS,CAAC,MAAM;AACpE,cAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,cAAM,IAAI,MAAM,MAAM,IAAK,IAAI,IAAO;AACtC,eAAO,EAAE,SAAS,EAAE;AAAA,MACtB,CAAC;AAAA,IACH,GAAG,IAAI;AACP,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,MAA+B,EAAE,IAAI,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,EAAE;AAE7F,UAAM,MAAM;AACZ,UAAM,UAAU;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9B,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AAGA,QAAI;AACF,YAAM,GACH,WAAW,yBAAgC,EAC3C,OAAO,OAAc,EACrB,WAAW,CAAC,OAAO,GACjB,QAAQ,CAAC,eAAe,aAAa,iBAAiB,CAAC,EACvD,YAAY;AAAA,QACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd,CAAQ,CAAC,EACV,QAAQ;AAAA,IACb,QAAQ;AAEN,UAAI;AACF,cAAM,UAAU,MAAM,GACnB,YAAY,yBAAgC,EAC5C,IAAI;AAAA,UACH,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,UAC9B,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EACP,MAAM,eAAsB,KAAK,KAAK,QAAQ,EAC9C,MAAM,aAAoB,KAAK,EAAE,EACjC,MAAM,mBAA0B,UAAU,OAAO,OAAO,KAAK,KAAY,EACzE,MAAM,aAAoB,aAAa,OAAO,OAAO,KAAK,QAAe,EACzE,iBAAiB;AACpB,YAAI,CAAC,WAAW,OAAO,QAAQ,kBAAkB,CAAC,MAAM,GAAG;AACzD,gBAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO,OAAc,EAAE,QAAQ;AAAA,QACvF;AAAA,MACF,SAAS,KAAK;AAEZ,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA,MACf,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,GAAG;AAAA,EACd;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAGlC,UAAM,KAAK,yBAAyB;AACpC,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,WAAW,yBAAgC,EAAE,OAAO,CAAC,KAAY,CAAC;AAAA,IACvE,EAAE,iBAAiB;AACnB,UAAM,UAAoC,KAAa,OAAO,EAAE,GAAG;AACnE,UAAM,UAAmC,EAAE,GAAG,SAAS,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,GAAG,GAAG;AAC7G,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,iBAAiB;AACnB,UAAI,CAAC,WAAW,OAAQ,QAAgB,kBAAkB,CAAC,MAAM,GAAG;AAClE,cAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO;AAAA,UAC3D,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,iBAAiB;AAAA,UACjB,WAAW;AAAA,UACX,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EAAE,QAAQ;AAAA,MACpB;AAAA,IACF,SAAS,KAAK;AACZ,YAAM;AAAA,IACR;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,OAAO,KAAK,SAAS;AAE3B,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AAEA,QAAI,MAAM;AACR,YAAM;AAAA,QACJ,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,QAAQ;AAAA,IACZ,OAAO;AACL,YAAM,WAAW,GAAG,WAAW,yBAAgC,CAAQ,EAAE,QAAQ;AAAA,IACnF;AAGA,QAAI;AACF,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mDAAmD;AAC7F,YAAM,SAAS,MAAM,KAAK,GAAG,KAAK,kBAAkB;AAAA,QAClD,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK,YAAY;AAAA,MAC7B,CAAC;AACD,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,UAAU,OAAO,OAAO,CAAC,WAAW;AACxC,YAAI,OAAO,UAAW,QAAO;AAC7B,eAAO,YAAY;AACnB,eAAO;AAAA,MACT,CAAC;AACD,UAAI,QAAQ,QAAQ;AAClB,mBAAW,UAAU,OAAQ,MAAK,GAAG,QAAQ,MAAM;AACnD,cAAM,KAAK,GAAG,MAAM;AAAA,MACtB;AAAA,IACF,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AAAA,EAEA,MAAM,gBAAkC,MAAkE;AACxG,UAAM,SAAS,KAAK,GAAG;AAAA,MACrB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAIlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,KAAK,MAAM,OAAO;AACxB,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAKlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,KAAK,SAAS,OAAO;AACvB,YAAM,QAAQ,KAAK,mBAAoB;AACvC,UAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD;AAAC,QAAC,QAAoC,KAAK,IAAI,oBAAI,KAAK;AACxD,cAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AAAA,MACvC;AAAA,IACF,OAAO;AACL,YAAM,KAAK,GAAG,OAAO,OAAO,EAAE,MAAM;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBAAsB,MASV;AAChB,UAAM,EAAE,QAAQ,QAAQ,QAAQ,SAAS,aAAa,YAAY,SAAS,IAAI;AAG/E,UAAM,aAAa,CAAC,CAAC,UAAU,CAAC,UAAU;AAC1C,UAAM,aAAa,CAAC,CAAC,WAAW,CAAC,UAAU;AAC3C,QAAI,CAAC,cAAc,CAAC,WAAY;AAChC,QAAI,CAAC,aAAa,GAAI;AAEtB,QAAI,MAAuB;AAC3B,QAAI;AACF,YAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,IAC1C,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAK;AAEV,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,cAAc;AAAA,MAC1B,aAAa,KAAK,eAAe;AAAA,IACnC;AAEA,QAAI,UAAU,CAAC,UAAU,YAAY;AACnC,YAAM,YAAY,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,MAAM;AAC7D,4BAAsB,WAAW,oBAAoB;AACrD,YAAM,eAAe,OAAO,eACxB,OAAO,aAAa,GAAG,IACvB;AAAA,QACE,IAAI,IAAI,YAAY;AAAA,QACpB,gBAAgB,IAAI,YAAY;AAAA,QAChC,UAAU,IAAI,YAAY;AAAA,QAC1B,GAAI,IAAI,aAAa,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;AAAA,MACzD;AAQJ,YAAM,UAAU,WAAW,gBAAgB,OAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ,YAAY,IACtG,OAAO;AAAA,QACL,EAAE,GAAI,aAAyC;AAAA,QAC/C;AAAA,QACA,EAAE,OAAO,MAAM,YAAY,MAAM;AAAA,MACnC,IACA;AACJ,UAAI;AACF,cAAM,IAAI,UAAU,WAAW,SAAS;AAAA,UACtC,YAAY,CAAC,CAAC,OAAO;AAAA,UACrB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB,IAAI,YAAY,kBAAkB;AAAA,UAClD,iBAAiB,OAAO;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,WAAW,CAAC,UAAU,aAAa;AACrC,YAAM,mBAAmB,iCAAiC;AAC1D,YAAM,2BAA2B,MAA0B;AACzD,YAAI,WAAW,UAAW,QAAO;AACjC,YAAI,WAAW,UAAW,QAAO;AACjC,eAAO;AAAA,MACT;AACA,YAAM,oBAAoB,yBAAyB;AAEnD,UAAI,WAAW,WAAW;AACxB,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAOrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF,OAAO;AACL,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAKrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,oBAAoB,6BAA6B,QAAQ,YAAY,IAAI,YAAY,YAAY,IAAI,GAAG;AAC1G,cAAM,kBAAkB;AAAA,UACtB,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB;AAAA,UAChB,SAAS;AAAA,QACX;AACA,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,gCAAgC,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QACrG,OAAO;AACL,eAAK,IAAI,UAAU,gCAAgC,eAAe,EAAE,MAAM,MAAM,MAAS;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAuB,MAQd;AACP,UAAM,EAAE,QAAQ,YAAY,IAAI;AAChC,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,aAAa,GAAI;AAItB,UAAM,UAAU,KAAK,WAAW,KAAK,sBAAsB,MAAM;AACjE,UAAM,MAAM,KAAK,mBAAmB,KAAK,QAAQ,WAAW;AAC5D,UAAM,WAAW,KAAK,mBAAmB,IAAI,GAAG;AAChD,QAAI,UAAU;AACZ,eAAS,SAAS;AAClB,eAAS,cAAc;AAAA,QACrB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AACA,eAAS,aAAa,KAAK,cAAc;AACzC,eAAS,cAAc,KAAK,eAAe;AAC3C,UAAI,KAAK,OAAQ,UAAS,SAAS,KAAK;AAIxC,UAAI,KAAK,QAAS,UAAS,UAAU,KAAK;AAAA,eACjC,CAAC,SAAS,WAAW,QAAS,UAAS,UAAU;AAC1D,WAAK,mBAAmB,IAAI,KAAK,QAAQ;AACzC;AAAA,IACF;AACA,UAAM,QAA8B;AAAA,MAClC,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,QAAI,QAAS,OAAM,UAAU;AAC7B,SAAK,mBAAmB,IAAI,KAAK,KAAK;AAAA,EACxC;AAAA,EAEA,MAAM,sBAAsB,UAAiD;AAC3E,QAAI,CAAC,KAAK,mBAAmB,KAAM;AACnC,UAAM,UAAU,MAAM,KAAK,KAAK,mBAAmB,OAAO,CAAC;AAC3D,SAAK,mBAAmB,MAAM;AAC9B,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,WAAW,CAAC,UAAU,eAAe,KAAK,0BAA0B,MAAM,MAAM,GAAG;AAC3F,aAAK,4BAA4B;AAAA,MACnC;AACA,UAAI;AACF,cAAM,KAAK,mBAAmB;AAAA,UAC5B,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,YAAY,MAAM,cAAc;AAAA,UAChC,aAAa,MAAM,eAAe;AAAA,UAClC,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iCAAiC,GAAG;AACtC,gBAAM;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAyB,aAA4C;AAC9F,UAAM,KAAK,YAAY,MAAM;AAC7B,UAAM,MAAM,YAAY,kBAAkB;AAC1C,UAAM,SAAS,YAAY,YAAY;AACvC,WAAO,CAAC,QAAQ,IAAI,KAAK,MAAM,EAAE,KAAK,GAAG;AAAA,EAC3C;AACF;",
+  "sourcesContent": ["import type { EntityData, EntityName, FilterQuery, RequiredEntityData } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { type Kysely, sql } from 'kysely'\nimport { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'\nimport { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'\nimport { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'\nimport type { EventBus } from '@open-mercato/events/types'\nimport {\n  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n  type CrudEventAction,\n  type CrudEventsConfig,\n  type CrudIndexerConfig,\n  type CrudEntityIdentifiers,\n} from '../crud/types'\nimport type { BulkImportSuppression } from '../commands/types'\nimport { CrudHttpError } from '../crud/errors'\nimport { resolveRegisteredEntityTableName } from '../query/engine'\nimport { getEntityIds } from '../encryption/entityIds'\nimport { normalizeCustomFieldValues } from '../custom-fields/normalize'\nimport { parseBooleanToken } from '../boolean'\nimport { isReadProjectionAlwaysConsistent } from './consistency'\nimport { isEventDeclared } from '../../modules/events'\nimport { createLogger } from '../logger'\nimport { createBoundedTtlMemo } from '../query/bounded-ttl-memo'\n\nconst logger = createLogger('shared').child({ component: 'data-engine' })\n\nconst undeclaredEventWarned = new Set<string>()\n\nfunction warnIfUndeclaredEvent(eventName: string, context: string): void {\n  if (isEventDeclared(eventName)) return\n  if (undeclaredEventWarned.has(eventName)) return\n  undeclaredEventWarned.add(eventName)\n  logger.warn('Emitting undeclared event \u2014 declare it in the owning module events.ts (createModuleEvents) so the event registry stays authoritative', { context, eventName })\n}\n\n/** Internal: clear the undeclared-event warning cache. Exposed for tests. */\nexport function __resetUndeclaredEventWarningsForTests(): void {\n  undeclaredEventWarned.clear()\n}\n\n/** Only `true` is cached: a cached `false` would keep this failing after a migration creates the table. */\nconst tableExistsCache = createBoundedTtlMemo<true>({\n  ttlEnv: 'OM_DATA_ENGINE_TABLE_EXISTS_CACHE_MS',\n  defaultTtlMs: 3_600_000,\n  defaultMaxEntries: 1_000,\n})\n\n/** Test-only: the module-scoped memo would otherwise leak state across specs. */\nexport function clearDataEngineTableExistsCache(): void {\n  tableExistsCache.clear()\n}\n\nconst COVERAGE_REFRESH_INTERVAL_MS = 5 * 60 * 1000\nconst coverageRefreshTracker = new Map<string, number>()\n\nfunction shouldTriggerCoverageRefresh(entityType: string | undefined, tenantId: string | null): boolean {\n  if (!entityType) return false\n  const key = `${entityType}|${tenantId ?? '__null__'}`\n  const now = Date.now()\n  const last = coverageRefreshTracker.get(key) ?? 0\n  if (now - last < COVERAGE_REFRESH_INTERVAL_MS) return false\n  coverageRefreshTracker.set(key, now)\n  return true\n}\n\ntype CustomEntityValues = Record<string, unknown>\n\ntype QueuedCrudSideEffect = {\n  action: CrudEventAction\n  entity: unknown\n  identifiers: CrudEntityIdentifiers\n  syncOrigin?: string | null\n  actorUserId?: string | null\n  events?: CrudEventsConfig<unknown>\n  indexer?: CrudIndexerConfig<unknown>\n}\n\n/**\n * A `makeCrudRoute` route-level `indexer:` declaration, handed to the data engine for the\n * duration of one command-bus write. Command handlers own the side-effect mark on the\n * `actions.*` path, and most of them mark `events:` only \u2014 without this the route's\n * declaration would reach no code at all. `entityClass` scopes the default to the route's\n * own ORM entity so a handler that also marks a sibling entity in the same request (a tag\n * assignment alongside a tag, say) is never indexed under the route's `entityType`.\n */\nexport type DefaultCrudIndexerConfig = {\n  indexer: CrudIndexerConfig<unknown>\n  entityClass: abstract new (...args: never[]) => object\n}\n\nexport interface DataEngine {\n  setCustomFields(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: Record<string, string | number | boolean | null | undefined | Array<string | number | boolean | null | undefined>>\n    notify?: boolean // default true -> emit '<module>.<entity>.updated'\n    // Forwarded to `setRecordCustomFields` \u2014 see its doc for when a caller must pass\n    // true (a recordId that is not unique across organizations for this entityId).\n    pinOrganizationId?: boolean\n  }): Promise<void>\n\n  // Storage for user-defined entities (doc-based)\n  createCustomEntityRecord(opts: {\n    entityId: string // '<module>:<entity>'\n    recordId?: string // optional; auto-generate if not provided\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<{ id: string }>\n\n  updateCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: CustomEntityValues\n    notify?: boolean // keep event emitting as it is via setCustomFields (updated)\n  }): Promise<void>\n\n  deleteCustomEntityRecord(opts: {\n    entityId: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    soft?: boolean // default true: sets deleted_at\n    notify?: boolean // keep event emitting as it is (no extra events here)\n  }): Promise<void>\n\n  // Generic ORM-backed entity operations used by CrudFactory\n  createOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    data: EntityData<T>\n  }): Promise<T>\n\n  updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null>\n\n  deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null>\n\n  emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    /** Bulk-import deferral: skip the domain event and/or inline reindex for this emit. */\n    suppress?: BulkImportSuppression\n  }): Promise<void>\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void\n\n  /**\n   * Drain queued side effects. When `suppress` is passed (a bulk-import backfill), the\n   * flagged per-record events / reindex are skipped for every drained entry; the caller\n   * is responsible for rebuilding the `query_index` afterwards.\n   */\n  flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void>\n\n  /**\n   * Declare the indexer a CRUD route configured, for marks made during one command-bus\n   * write that do not carry an indexer of their own. Pass `null` to clear it. Optional so\n   * third-party `DataEngine` implementations stay valid; callers invoke it with `?.`.\n   */\n  setDefaultIndexerConfig?(config: DefaultCrudIndexerConfig | null): void\n\n  /**\n   * Whether any side effect drained since the current default was declared carried an\n   * indexer for that default's entity class \u2014 false means the declared query-index\n   * obligation was discharged by nobody. Optional for the same reason as the setter.\n   */\n  hasIndexedDefaultEntityClass?(): boolean\n}\n\nexport const SYSTEM_ENTITY_RECORDS_BLOCKED_CODE = 'system_entity_records_blocked'\n\n/**\n * A system entity for doc-storage purposes is an id that modules declare in the\n * generated entity-id registry AND that resolves to a registered ORM table. Both\n * conditions matter: `resolveRegisteredEntityTableName` matches class-name candidates\n * from the entity segment alone, so a runtime-registered custom entity whose name\n * happens to collide with some ORM class (e.g. `user:todo` vs the example module's\n * `Todo`) must never be classified as system. When the registry is not populated\n * (exotic bootstraps, unit harnesses) the check conservatively falls back to the\n * ORM-table match alone so the #2939 protection never switches off.\n */\nexport function isOrmBackedSystemEntityId(em: EntityManager, entityId: string): boolean {\n  const registry = getEntityIds(false)\n  const moduleIds = Object.values(registry).flatMap((moduleEntities) => Object.values(moduleEntities ?? {}))\n  if (moduleIds.length > 0 && !moduleIds.includes(entityId)) return false\n  return resolveRegisteredEntityTableName(em, entityId) !== null\n}\n\n/**\n * Doc storage (`custom_entities_storage`) is for custom entities only. A system\n * entity's records live in its own module tables/APIs \u2014 writing doc rows for it\n * poisons read-path classification (#2939) and must be rejected at the deepest\n * seam so no caller (API, AI tool, workflow) can do it.\n */\nexport function assertCustomEntityStorageEntityId(em: EntityManager, entityId: string): void {\n  if (isOrmBackedSystemEntityId(em, entityId)) {\n    throw new CrudHttpError(400, {\n      error: 'Records are available for custom entities only',\n      code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE,\n      entityId,\n    })\n  }\n}\n\nexport class DefaultDataEngine implements DataEngine {\n  private pendingSideEffects = new Map<string, QueuedCrudSideEffect>()\n  private defaultIndexer: DefaultCrudIndexerConfig | null = null\n  private indexedDefaultEntityClass = false\n  constructor(private em: EntityManager, private container: AwilixContainer) {}\n\n  /**\n   * Per-command state, deliberately held on the engine instance rather than threaded through\n   * `CommandRuntimeContext` the way the bulk-import flags are. That is sound only because\n   * `createRequestContainer()` registers `dataEngine` per request (`lib/di/container.ts`), so\n   * one engine instance never spans two requests, and no `makeCrudRoute` verb runs two commands\n   * concurrently against it. An application that re-registers `dataEngine` as a transient would\n   * break both assumptions: the command would mark on a different instance than the route\n   * declared on, so nothing is indexed and every write logs the undischarged-declaration warning.\n   */\n  setDefaultIndexerConfig(config: DefaultCrudIndexerConfig | null): void {\n    this.defaultIndexer = config\n    this.indexedDefaultEntityClass = false\n  }\n\n  hasIndexedDefaultEntityClass(): boolean {\n    return this.indexedDefaultEntityClass\n  }\n\n  private matchesDefaultEntityClass(entity: unknown): boolean {\n    const declared = this.defaultIndexer?.entityClass\n    // `OrmEntityConfig.entity` is `any` and this repository treats `EntitySchema` instances as a\n    // first-class entity shape (`lib/bootstrap/types.ts`). An `EntitySchema` is an object rather\n    // than a constructor, so `instanceof` against it throws \u2014 and it would throw inside\n    // `markOrmEntityChange`, outside the best-effort try/catch that guards the flush, turning\n    // every write on such a route into a 500.\n    if (typeof declared !== 'function') return false\n    return entity instanceof declared\n  }\n\n  private resolveDefaultIndexer(entity: unknown): CrudIndexerConfig<unknown> | undefined {\n    return this.matchesDefaultEntityClass(entity) ? this.defaultIndexer?.indexer : undefined\n  }\n\n  async setCustomFields(opts: Parameters<DataEngine['setCustomFields']>[0]): Promise<void> {\n    const { entityId, recordId, organizationId = null, tenantId = null, values } = opts\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values,\n    })\n    await this.validateCustomFieldValues(entityId, organizationId, tenantId, sanitizedValues as Record<string, unknown>)\n    let encryptionService: any = null\n    try {\n      encryptionService = this.container.resolve('tenantEncryptionService') as any\n    } catch {\n      encryptionService = null\n    }\n    await setRecordCustomFields(this.em, {\n      entityId,\n      recordId,\n      organizationId,\n      tenantId,\n      values: sanitizedValues,\n      encryptionService,\n      pinOrganizationId: opts.pinOrganizationId === true,\n    })\n    if (opts.notify !== false) {\n      let bus: EventBus | null = null\n      try {\n        bus = (this.container.resolve('eventBus') as EventBus)\n      } catch {\n        bus = null\n      }\n      if (bus) {\n        const [mod, ent] = (entityId || '').split(':')\n        if (mod && ent) {\n          const eventName = `${mod}.${ent}.updated`\n          warnIfUndeclaredEvent(eventName, 'setCustomFields')\n          try {\n            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, {\n              persistent: true,\n              tenantId,\n              organizationId,\n              emitterModuleId: mod,\n            })\n          } catch {\n            // non-blocking\n          }\n        }\n      }\n    }\n  }\n\n  private normalizeDocValues(values: CustomEntityValues): CustomEntityValues {\n    const out: CustomEntityValues = {}\n    for (const [k, v] of Object.entries(values || {})) {\n      // Never allow callers to override reserved identifiers in the doc\n      if (k === 'id' || k === 'entity_id' || k === 'entityId') continue\n      // Accept both 'cf_<key>' and 'cf:<key>' inputs and normalize to 'cf:<key>'\n      if (k.startsWith('cf_')) out[`cf:${k.slice(3)}`] = v\n      else out[k] = v\n    }\n    return out\n  }\n\n  private backcompatEavEnabled(): boolean {\n    try {\n      return parseBooleanToken(process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM ?? '') === true\n    } catch { return false }\n  }\n\n  private getKysely(): Kysely<any> {\n    return this.em.getKysely<any>()\n  }\n\n  private async ensureStorageTableExists(): Promise<void> {\n    const cacheKey = 'custom_entities_storage'\n    if (tableExistsCache.get(cacheKey)) return\n    const db = this.getKysely()\n    const exists = await db\n      .selectFrom('information_schema.tables' as any)\n      .select(sql`1`.as('present'))\n      .where('table_name' as any, '=', 'custom_entities_storage')\n      .executeTakeFirst()\n    if (!exists) {\n      throw new Error('custom_entities_storage table is missing. Run migrations (yarn db:migrate).')\n    }\n    tableExistsCache.set(cacheKey, true)\n  }\n\n  private normalizeValuesForValidation(values: Record<string, unknown> | undefined | null): Record<string, unknown> {\n    if (!values) return {}\n    const out: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(values)) {\n      if (value === undefined) continue\n      if (key.startsWith('cf_') || key.startsWith('cf:')) {\n        const normalized = key.slice(3)\n        if (normalized) out[normalized] = value\n        continue\n      }\n      out[key] = value\n    }\n    return out\n  }\n\n  private async validateCustomFieldValues(\n    entityId: string,\n    organizationId: string | null,\n    tenantId: string | null,\n    values: Record<string, unknown> | undefined | null,\n  ): Promise<void> {\n    const prepared = this.normalizeValuesForValidation(values)\n    if (!entityId || Object.keys(prepared).length === 0) return\n    const result = await validateCustomFieldValuesServer(this.em, {\n      entityId,\n      organizationId,\n      tenantId,\n      values: prepared,\n    })\n    if (!result.ok) {\n      throw new CrudHttpError(400, { error: 'Validation failed', fields: result.fieldErrors })\n    }\n  }\n\n  async createCustomEntityRecord(opts: Parameters<DataEngine['createCustomEntityRecord']>[0]): Promise<{ id: string }> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    await this.ensureStorageTableExists()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const rawId = String(opts.recordId ?? '').trim()\n    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(rawId)\n    const sentinel = rawId.toLowerCase()\n    const shouldGenerate = !rawId || !isUuid || sentinel === 'create' || sentinel === 'new' || sentinel === 'null' || sentinel === 'undefined'\n    const id = shouldGenerate ? ((): string => {\n      const g = globalThis as { crypto?: { randomUUID?: () => string } }\n      if (g.crypto?.randomUUID) return g.crypto.randomUUID()\n      // Fallback UUIDv4 generator\n      return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n        const r = (Math.random() * 16) | 0\n        const v = c === 'x' ? r : (r & 0x3) | 0x8\n        return v.toString(16)\n      })\n    })() : rawId\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const doc: Record<string, unknown> = { id, ...this.normalizeDocValues(sanitizedValues || {}) }\n\n    const now = sql`now()`\n    const payload = {\n      entity_type: opts.entityId,\n      entity_id: id,\n      organization_id: orgId,\n      tenant_id: tenantId,\n      doc: sql`${JSON.stringify(doc)}::jsonb`,\n      updated_at: now,\n      created_at: now,\n      deleted_at: null,\n    }\n\n    // Upsert by scoped uniqueness\n    try {\n      await db\n        .insertInto('custom_entities_storage' as any)\n        .values(payload as any)\n        .onConflict((oc) => oc\n          .columns(['entity_type', 'entity_id', 'organization_id'])\n          .doUpdateSet({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any))\n        .execute()\n    } catch {\n      // Fallback for global scope uniqueness\n      try {\n        const updated = await db\n          .updateTable('custom_entities_storage' as any)\n          .set({\n            doc: sql`${JSON.stringify(doc)}::jsonb`,\n            updated_at: sql`now()`,\n            deleted_at: null,\n          } as any)\n          .where('entity_type' as any, '=', opts.entityId)\n          .where('entity_id' as any, '=', id)\n          .where('organization_id' as any, orgId === null ? 'is' : '=', orgId as any)\n          .where('tenant_id' as any, tenantId === null ? 'is' : '=', tenantId as any)\n          .executeTakeFirst()\n        if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {\n          await db.insertInto('custom_entities_storage' as any).values(payload as any).execute()\n        }\n      } catch (err) {\n        // Surface a clear error so it doesn't silently fall back only to EAV\n        throw err\n      }\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n        // custom_entities_storage upserts on (entity_type, entity_id, organization_id),\n        // so `id` is unique only within this organization, not across organizations \u2014\n        // pin the reconciling delete/lookup to this organization (#6034 review).\n        pinOrganizationId: true,\n      })\n    }\n\n    return { id }\n  }\n\n  async updateCustomEntityRecord(opts: Parameters<DataEngine['updateCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const sanitizedValues = await sanitizeCustomFieldHtmlRichTextValuesServer(this.em, {\n      entityId: opts.entityId,\n      organizationId: opts.organizationId ?? null,\n      tenantId: opts.tenantId ?? null,\n      values: opts.values || {},\n    })\n    await this.validateCustomFieldValues(opts.entityId, opts.organizationId ?? null, opts.tenantId ?? null, sanitizedValues)\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n\n    // Merge doc shallowly: load existing doc and overlay\n    await this.ensureStorageTableExists()\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n    const row = await applyScope(\n      db.selectFrom('custom_entities_storage' as any).select(['doc' as any])\n    ).executeTakeFirst()\n    const prevDoc: Record<string, unknown> = (row as any)?.doc || { id }\n    const nextDoc: Record<string, unknown> = { ...prevDoc, ...this.normalizeDocValues(sanitizedValues || {}), id }\n    try {\n      const updated = await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any) as any\n      ).executeTakeFirst()\n      if (!updated || Number((updated as any).numUpdatedRows ?? 0) === 0) {\n        await db.insertInto('custom_entities_storage' as any).values({\n          entity_type: opts.entityId,\n          entity_id: id,\n          organization_id: orgId,\n          tenant_id: tenantId,\n          doc: sql`${JSON.stringify(nextDoc)}::jsonb`,\n          created_at: sql`now()`,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any).execute()\n      }\n    } catch (err) {\n      throw err\n    }\n\n    // Optional EAV backward compatibility (disabled by default)\n    if (this.backcompatEavEnabled() && sanitizedValues && Object.keys(sanitizedValues).length > 0) {\n      await this.setCustomFields({\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: tenantId,\n        values: normalizeCustomFieldValues(sanitizedValues),\n        notify: opts.notify, // defaults to true\n        // custom_entities_storage upserts on (entity_type, entity_id, organization_id),\n        // so `id` is unique only within this organization, not across organizations \u2014\n        // pin the reconciling delete/lookup to this organization (#6034 review).\n        pinOrganizationId: true,\n      })\n    }\n  }\n\n  async deleteCustomEntityRecord(opts: Parameters<DataEngine['deleteCustomEntityRecord']>[0]): Promise<void> {\n    assertCustomEntityStorageEntityId(this.em, opts.entityId)\n    const db = this.getKysely()\n    const id = String(opts.recordId)\n    const orgId = opts.organizationId ?? null\n    const tenantId = opts.tenantId ?? null\n    const soft = opts.soft !== false\n\n    const applyScope = <T extends { where: (col: any, op: any, val?: any) => T }>(q: T) => {\n      let chain = q.where('entity_type' as any, '=', opts.entityId)\n      chain = chain.where('entity_id' as any, '=', id)\n      chain = orgId === null\n        ? chain.where('organization_id' as any, 'is', null as any)\n        : chain.where('organization_id' as any, '=', orgId)\n      chain = tenantId === null\n        ? chain.where('tenant_id' as any, 'is', null as any)\n        : chain.where('tenant_id' as any, '=', tenantId)\n      return chain\n    }\n\n    if (soft) {\n      await applyScope(\n        db.updateTable('custom_entities_storage' as any).set({\n          deleted_at: sql`now()`,\n          updated_at: sql`now()`,\n        } as any) as any\n      ).execute()\n    } else {\n      await applyScope(db.deleteFrom('custom_entities_storage' as any) as any).execute()\n    }\n\n    // Soft-delete EAV values to preserve current behavior\n    try {\n      const { CustomFieldValue } = await import('@open-mercato/core/modules/entities/data/entities')\n      const values = await this.em.find(CustomFieldValue, {\n        entityId: opts.entityId,\n        recordId: id,\n        organizationId: orgId,\n        tenantId: opts.tenantId ?? null,\n      })\n      const now = new Date()\n      const mutated = values.filter((record) => {\n        if (record.deletedAt) return false\n        record.deletedAt = now\n        return true\n      })\n      if (mutated.length) {\n        for (const record of values) this.em.persist(record)\n        await this.em.flush()\n      }\n    } catch { /* non-blocking */ }\n  }\n\n  async createOrmEntity<T extends object>(opts: { entity: EntityName<T>; data: EntityData<T> }): Promise<T> {\n    const entity = this.em.create(\n      opts.entity as EntityName<T>,\n      opts.data as unknown as RequiredEntityData<T>\n    )\n    await this.em.persist(entity).flush()\n    return entity\n  }\n\n  async updateOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    apply: (current: T) => Promise<void> | void\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    await opts.apply(current)\n    await this.em.persist(current).flush()\n    return current\n  }\n\n  async deleteOrmEntity<T extends object>(opts: {\n    entity: EntityName<T>\n    where: FilterQuery<T>\n    soft?: boolean\n    softDeleteField?: keyof T & string\n  }): Promise<T | null> {\n    const current = await this.em.findOne(opts.entity as EntityName<T>, opts.where as FilterQuery<NoInfer<T>>)\n    if (!current) return null\n    if (opts.soft !== false) {\n      const field = opts.softDeleteField || ('deletedAt' as keyof T & string)\n      if (typeof current === 'object' && current !== null) {\n        ;(current as Record<string, unknown>)[field] = new Date()\n        await this.em.persist(current).flush()\n      }\n    } else {\n      await this.em.remove(current).flush()\n    }\n    return current\n  }\n\n  async emitOrmEntityEvent<T>(opts: {\n    action: CrudEventAction\n    entity: T\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n    suppress?: BulkImportSuppression\n  }): Promise<void> {\n    const { action, entity, events, indexer, identifiers, syncOrigin, suppress } = opts\n    // Bulk-import deferral: an entry may suppress its domain event and/or inline reindex. When both\n    // the config is absent AND (for the present one) suppressed, there is nothing left to do.\n    const emitEvents = !!events && !suppress?.skipEvents\n    const runIndexer = !!indexer && !suppress?.skipReindex\n    if (!emitEvents && !runIndexer) return\n    if (!identifiers?.id) return\n\n    let bus: EventBus | null = null\n    try {\n      bus = (this.container.resolve('eventBus') as EventBus)\n    } catch {\n      bus = null\n    }\n    if (!bus) return\n\n    const ctx = {\n      action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n\n    if (events && !suppress?.skipEvents) {\n      const eventName = `${events.module}.${events.entity}.${action}`\n      warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')\n      const builtPayload = events.buildPayload\n        ? events.buildPayload(ctx)\n        : {\n            id: ctx.identifiers.id,\n            organizationId: ctx.identifiers.organizationId,\n            tenantId: ctx.identifiers.tenantId,\n            ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),\n          }\n      // A configured indexer means this data-engine call owns the query-index\n      // decision, including an explicit skipReindex suppression. Mark object\n      // payloads so the legacy domain-event bridge does not enqueue the same\n      // record a second time. Keep the marker non-enumerable so client broadcasts\n      // and persisted domain payloads retain their existing public shape.\n      // Primitive custom payloads cannot be bridged in any case because they do\n      // not expose the record id.\n      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)\n        ? Object.defineProperty(\n            { ...(builtPayload as Record<string, unknown>) },\n            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,\n            { value: true, enumerable: false },\n          )\n        : builtPayload\n      try {\n        await bus.emitEvent(eventName, payload, {\n          persistent: !!events.persistent,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: ctx.identifiers.organizationId ?? null,\n          emitterModuleId: events.module,\n        })\n      } catch {\n        // non-blocking\n      }\n    }\n\n    if (indexer && !suppress?.skipReindex) {\n      const alwaysConsistent = isReadProjectionAlwaysConsistent()\n      const resolveCoverageBaseDelta = (): number | undefined => {\n        if (action === 'created') return 1\n        if (action === 'deleted') return -1\n        return undefined\n      }\n      const coverageBaseDelta = resolveCoverageBaseDelta()\n\n      if (action === 'deleted') {\n        const payload = indexer.buildDeletePayload\n          ? indexer.buildDeletePayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the index update so query-index reads (the `customValues`/scalar\n        // projection that list endpoints serve) are consistent the moment the write\n        // returns. The subscriber removes the projection row + tokens synchronously and\n        // defers the coverage recompute + fulltext delete, so this stays bounded.\n        // Errors are logged, not thrown \u2014 index drift never fails the originating write.\n        // Always-consistent mode rethrows so drift is loud and retryable.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.delete_one emit failed', { err })\n          })\n        }\n      } else {\n        const payload = indexer.buildUpsertPayload\n          ? indexer.buildUpsertPayload(ctx)\n          : {\n              entityType: indexer.entityType,\n              recordId: ctx.identifiers.id,\n              organizationId: ctx.identifiers.organizationId,\n              tenantId: ctx.identifiers.tenantId,\n            }\n        const enrichedPayload = payload as Record<string, unknown>\n        enrichedPayload.crudAction = action\n        if (coverageBaseDelta !== undefined) enrichedPayload.coverageBaseDelta = coverageBaseDelta\n        if (ctx.syncOrigin) enrichedPayload.syncOrigin = ctx.syncOrigin\n        // Await the projection upsert so list reads observe the new doc immediately\n        // (see delete_one above). The subscriber updates `entity_indexes` synchronously\n        // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +\n        // tokenize + DELETE + chunked INSERT) so write latency stays bounded.\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })\n        } else {\n          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {\n            logger.error('query_index.upsert_one emit failed', { err })\n          })\n        }\n      }\n\n      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {\n        const coveragePayload = {\n          entityType: indexer.entityType,\n          tenantId: ctx.identifiers.tenantId ?? null,\n          organizationId: null,\n          delayMs: 0,\n        }\n        if (alwaysConsistent) {\n          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })\n        } else {\n          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)\n        }\n      }\n    }\n  }\n\n  markOrmEntityChange<T>(opts: {\n    action: CrudEventAction\n    entity: T | null | undefined\n    events?: CrudEventsConfig<T>\n    indexer?: CrudIndexerConfig<T>\n    identifiers: CrudEntityIdentifiers\n    syncOrigin?: string | null\n    actorUserId?: string | null\n  }): void {\n    const { entity, identifiers } = opts\n    if (!entity) return\n    if (!identifiers?.id) return\n    // A command handler that marks `events:` only still discharges the route's declared\n    // query-index obligation \u2014 the route hands its `indexer:` down as the default so the\n    // handler's own entity and identifiers (the accurate ones) drive the projection write.\n    const indexer = opts.indexer ?? this.resolveDefaultIndexer(entity)\n    const key = this.buildSideEffectKey(opts.action, identifiers)\n    const existing = this.pendingSideEffects.get(key)\n    if (existing) {\n      existing.entity = entity\n      existing.identifiers = {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      }\n      existing.syncOrigin = opts.syncOrigin ?? null\n      existing.actorUserId = opts.actorUserId ?? null\n      if (opts.events) existing.events = opts.events as CrudEventsConfig<unknown>\n      // Explicit always wins, on the merge branch too: a second `events:`-only mark on the same\n      // key must not let the route default overwrite the `indexer:` an earlier mark installed,\n      // which would silently drop that handler's own `buildUpsertPayload`.\n      if (opts.indexer) existing.indexer = opts.indexer as CrudIndexerConfig<unknown>\n      else if (!existing.indexer && indexer) existing.indexer = indexer\n      this.pendingSideEffects.set(key, existing)\n      return\n    }\n    const entry: QueuedCrudSideEffect = {\n      action: opts.action,\n      entity,\n      identifiers: {\n        id: identifiers.id,\n        organizationId: identifiers.organizationId ?? null,\n        tenantId: identifiers.tenantId ?? null,\n      },\n      syncOrigin: opts.syncOrigin ?? null,\n      actorUserId: opts.actorUserId ?? null,\n    }\n    if (opts.events) entry.events = opts.events as CrudEventsConfig<unknown>\n    if (indexer) entry.indexer = indexer\n    this.pendingSideEffects.set(key, entry)\n  }\n\n  async flushOrmEntityChanges(suppress?: BulkImportSuppression): Promise<void> {\n    if (!this.pendingSideEffects.size) return\n    const entries = Array.from(this.pendingSideEffects.values())\n    this.pendingSideEffects.clear()\n    for (const entry of entries) {\n      if (entry.indexer && !suppress?.skipReindex && this.matchesDefaultEntityClass(entry.entity)) {\n        this.indexedDefaultEntityClass = true\n      }\n      try {\n        await this.emitOrmEntityEvent({\n          action: entry.action,\n          entity: entry.entity,\n          identifiers: entry.identifiers,\n          syncOrigin: entry.syncOrigin ?? null,\n          actorUserId: entry.actorUserId ?? null,\n          events: entry.events as CrudEventsConfig<unknown>,\n          indexer: entry.indexer as CrudIndexerConfig<unknown>,\n          suppress,\n        })\n      } catch (error) {\n        if (isReadProjectionAlwaysConsistent()) {\n          throw error\n        }\n        // best-effort; continue with remaining side effects\n      }\n    }\n  }\n\n  private buildSideEffectKey(action: CrudEventAction, identifiers: CrudEntityIdentifiers): string {\n    const id = identifiers.id ?? ''\n    const org = identifiers.organizationId ?? ''\n    const tenant = identifiers.tenantId ?? ''\n    return [action, id, org, tenant].join('|')\n  }\n}\n"],
+  "mappings": "AAGA,SAAsB,WAAW;AACjC,SAAS,6BAA6B;AACtC,SAAS,uCAAuC;AAChD,SAAS,mDAAmD;AAE5D;AAAA,EACE;AAAA,OAKK;AAEP,SAAS,qBAAqB;AAC9B,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,yBAAyB;AAClC,SAAS,wCAAwC;AACjD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AAErC,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAExE,MAAM,wBAAwB,oBAAI,IAAY;AAE9C,SAAS,sBAAsB,WAAmB,SAAuB;AACvE,MAAI,gBAAgB,SAAS,EAAG;AAChC,MAAI,sBAAsB,IAAI,SAAS,EAAG;AAC1C,wBAAsB,IAAI,SAAS;AACnC,SAAO,KAAK,6IAAwI,EAAE,SAAS,UAAU,CAAC;AAC5K;AAGO,SAAS,yCAA+C;AAC7D,wBAAsB,MAAM;AAC9B;AAGA,MAAM,mBAAmB,qBAA2B;AAAA,EAClD,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,mBAAmB;AACrB,CAAC;AAGM,SAAS,kCAAwC;AACtD,mBAAiB,MAAM;AACzB;AAEA,MAAM,+BAA+B,IAAI,KAAK;AAC9C,MAAM,yBAAyB,oBAAI,IAAoB;AAEvD,SAAS,6BAA6B,YAAgC,UAAkC;AACtG,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,UAAU;AACnD,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAO,uBAAuB,IAAI,GAAG,KAAK;AAChD,MAAI,MAAM,OAAO,6BAA8B,QAAO;AACtD,yBAAuB,IAAI,KAAK,GAAG;AACnC,SAAO;AACT;AAmIO,MAAM,qCAAqC;AAY3C,SAAS,0BAA0B,IAAmB,UAA2B;AACtF,QAAM,WAAW,aAAa,KAAK;AACnC,QAAM,YAAY,OAAO,OAAO,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,OAAO,OAAO,kBAAkB,CAAC,CAAC,CAAC;AACzG,MAAI,UAAU,SAAS,KAAK,CAAC,UAAU,SAAS,QAAQ,EAAG,QAAO;AAClE,SAAO,iCAAiC,IAAI,QAAQ,MAAM;AAC5D;AAQO,SAAS,kCAAkC,IAAmB,UAAwB;AAC3F,MAAI,0BAA0B,IAAI,QAAQ,GAAG;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,MAAM,kBAAwC;AAAA,EAInD,YAAoB,IAA2B,WAA4B;AAAvD;AAA2B;AAH/C,SAAQ,qBAAqB,oBAAI,IAAkC;AACnE,SAAQ,iBAAkD;AAC1D,SAAQ,4BAA4B;AAAA,EACwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5E,wBAAwB,QAA+C;AACrE,SAAK,iBAAiB;AACtB,SAAK,4BAA4B;AAAA,EACnC;AAAA,EAEA,+BAAwC;AACtC,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,0BAA0B,QAA0B;AAC1D,UAAM,WAAW,KAAK,gBAAgB;AAMtC,QAAI,OAAO,aAAa,WAAY,QAAO;AAC3C,WAAO,kBAAkB;AAAA,EAC3B;AAAA,EAEQ,sBAAsB,QAAyD;AACrF,WAAO,KAAK,0BAA0B,MAAM,IAAI,KAAK,gBAAgB,UAAU;AAAA,EACjF;AAAA,EAEA,MAAM,gBAAgB,MAAmE;AACvF,UAAM,EAAE,UAAU,UAAU,iBAAiB,MAAM,WAAW,MAAM,OAAO,IAAI;AAC/E,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,KAAK,0BAA0B,UAAU,gBAAgB,UAAU,eAA0C;AACnH,QAAI,oBAAyB;AAC7B,QAAI;AACF,0BAAoB,KAAK,UAAU,QAAQ,yBAAyB;AAAA,IACtE,QAAQ;AACN,0BAAoB;AAAA,IACtB;AACA,UAAM,sBAAsB,KAAK,IAAI;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,mBAAmB,KAAK,sBAAsB;AAAA,IAChD,CAAC;AACD,QAAI,KAAK,WAAW,OAAO;AACzB,UAAI,MAAuB;AAC3B,UAAI;AACF,cAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,MAC1C,QAAQ;AACN,cAAM;AAAA,MACR;AACA,UAAI,KAAK;AACP,cAAM,CAAC,KAAK,GAAG,KAAK,YAAY,IAAI,MAAM,GAAG;AAC7C,YAAI,OAAO,KAAK;AACd,gBAAM,YAAY,GAAG,GAAG,IAAI,GAAG;AAC/B,gCAAsB,WAAW,iBAAiB;AAClD,cAAI;AACF,kBAAM,IAAI,UAAU,WAAW,EAAE,IAAI,UAAU,gBAAgB,SAAS,GAAG;AAAA,cACzE,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACA,iBAAiB;AAAA,YACnB,CAAC;AAAA,UACH,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAgD;AACzE,UAAM,MAA0B,CAAC;AACjC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC,GAAG;AAEjD,UAAI,MAAM,QAAQ,MAAM,eAAe,MAAM,WAAY;AAEzD,UAAI,EAAE,WAAW,KAAK,EAAG,KAAI,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI;AAAA,UAC9C,KAAI,CAAC,IAAI;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAgC;AACtC,QAAI;AACF,aAAO,kBAAkB,QAAQ,IAAI,sCAAsC,EAAE,MAAM;AAAA,IACrF,QAAQ;AAAE,aAAO;AAAA,IAAM;AAAA,EACzB;AAAA,EAEQ,YAAyB;AAC/B,WAAO,KAAK,GAAG,UAAe;AAAA,EAChC;AAAA,EAEA,MAAc,2BAA0C;AACtD,UAAM,WAAW;AACjB,QAAI,iBAAiB,IAAI,QAAQ,EAAG;AACpC,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAClB,WAAW,2BAAkC,EAC7C,OAAO,OAAO,GAAG,SAAS,CAAC,EAC3B,MAAM,cAAqB,KAAK,yBAAyB,EACzD,iBAAiB;AACpB,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,MAAM,6EAA6E;AAAA,IAC/F;AACA,qBAAiB,IAAI,UAAU,IAAI;AAAA,EACrC;AAAA,EAEQ,6BAA6B,QAA6E;AAChH,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,UAAU,OAAW;AACzB,UAAI,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG;AAClD,cAAM,aAAa,IAAI,MAAM,CAAC;AAC9B,YAAI,WAAY,KAAI,UAAU,IAAI;AAClC;AAAA,MACF;AACA,UAAI,GAAG,IAAI;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,0BACZ,UACA,gBACA,UACA,QACe;AACf,UAAM,WAAW,KAAK,6BAA6B,MAAM;AACzD,QAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG;AACrD,UAAM,SAAS,MAAM,gCAAgC,KAAK,IAAI;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,QAAQ,OAAO,YAAY,CAAC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAAsF;AACnH,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,yBAAyB;AACpC,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,QAAQ,OAAO,KAAK,YAAY,EAAE,EAAE,KAAK;AAC/C,UAAM,SAAS,6EAA6E,KAAK,KAAK;AACtG,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,CAAC,SAAS,CAAC,UAAU,aAAa,YAAY,aAAa,SAAS,aAAa,UAAU,aAAa;AAC/H,UAAM,KAAK,kBAAkB,MAAc;AACzC,YAAM,IAAI;AACV,UAAI,EAAE,QAAQ,WAAY,QAAO,EAAE,OAAO,WAAW;AAErD,aAAO,uCAAuC,QAAQ,SAAS,CAAC,MAAM;AACpE,cAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,cAAM,IAAI,MAAM,MAAM,IAAK,IAAI,IAAO;AACtC,eAAO,EAAE,SAAS,EAAE;AAAA,MACtB,CAAC;AAAA,IACH,GAAG,IAAI;AACP,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,MAA+B,EAAE,IAAI,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,EAAE;AAE7F,UAAM,MAAM;AACZ,UAAM,UAAU;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9B,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,IACd;AAGA,QAAI;AACF,YAAM,GACH,WAAW,yBAAgC,EAC3C,OAAO,OAAc,EACrB,WAAW,CAAC,OAAO,GACjB,QAAQ,CAAC,eAAe,aAAa,iBAAiB,CAAC,EACvD,YAAY;AAAA,QACX,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd,CAAQ,CAAC,EACV,QAAQ;AAAA,IACb,QAAQ;AAEN,UAAI;AACF,cAAM,UAAU,MAAM,GACnB,YAAY,yBAAgC,EAC5C,IAAI;AAAA,UACH,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,UAC9B,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EACP,MAAM,eAAsB,KAAK,KAAK,QAAQ,EAC9C,MAAM,aAAoB,KAAK,EAAE,EACjC,MAAM,mBAA0B,UAAU,OAAO,OAAO,KAAK,KAAY,EACzE,MAAM,aAAoB,aAAa,OAAO,OAAO,KAAK,QAAe,EACzE,iBAAiB;AACpB,YAAI,CAAC,WAAW,OAAO,QAAQ,kBAAkB,CAAC,MAAM,GAAG;AACzD,gBAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO,OAAc,EAAE,QAAQ;AAAA,QACvF;AAAA,MACF,SAAS,KAAK;AAEZ,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,QAIb,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,GAAG;AAAA,EACd;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,kBAAkB,MAAM,4CAA4C,KAAK,IAAI;AAAA,MACjF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,MAC3B,QAAQ,KAAK,UAAU,CAAC;AAAA,IAC1B,CAAC;AACD,UAAM,KAAK,0BAA0B,KAAK,UAAU,KAAK,kBAAkB,MAAM,KAAK,YAAY,MAAM,eAAe;AACvH,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAGlC,UAAM,KAAK,yBAAyB;AACpC,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,WAAW,yBAAgC,EAAE,OAAO,CAAC,KAAY,CAAC;AAAA,IACvE,EAAE,iBAAiB;AACnB,UAAM,UAAoC,KAAa,OAAO,EAAE,GAAG;AACnE,UAAM,UAAmC,EAAE,GAAG,SAAS,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,GAAG,GAAG;AAC7G,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,iBAAiB;AACnB,UAAI,CAAC,WAAW,OAAQ,QAAgB,kBAAkB,CAAC,MAAM,GAAG;AAClE,cAAM,GAAG,WAAW,yBAAgC,EAAE,OAAO;AAAA,UAC3D,aAAa,KAAK;AAAA,UAClB,WAAW;AAAA,UACX,iBAAiB;AAAA,UACjB,WAAW;AAAA,UACX,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AAAA,UAClC,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ,EAAE,QAAQ;AAAA,MACpB;AAAA,IACF,SAAS,KAAK;AACZ,YAAM;AAAA,IACR;AAGA,QAAI,KAAK,qBAAqB,KAAK,mBAAmB,OAAO,KAAK,eAAe,EAAE,SAAS,GAAG;AAC7F,YAAM,KAAK,gBAAgB;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,QAAQ,2BAA2B,eAAe;AAAA,QAClD,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,QAIb,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,yBAAyB,MAA4E;AACzG,sCAAkC,KAAK,IAAI,KAAK,QAAQ;AACxD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,KAAK,OAAO,KAAK,QAAQ;AAC/B,UAAM,QAAQ,KAAK,kBAAkB;AACrC,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,OAAO,KAAK,SAAS;AAE3B,UAAM,aAAa,CAA2D,MAAS;AACrF,UAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,QAAQ;AAC5D,cAAQ,MAAM,MAAM,aAAoB,KAAK,EAAE;AAC/C,cAAQ,UAAU,OACd,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK;AACpD,cAAQ,aAAa,OACjB,MAAM,MAAM,aAAoB,MAAM,IAAW,IACjD,MAAM,MAAM,aAAoB,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT;AAEA,QAAI,MAAM;AACR,YAAM;AAAA,QACJ,GAAG,YAAY,yBAAgC,EAAE,IAAI;AAAA,UACnD,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAQ;AAAA,MACV,EAAE,QAAQ;AAAA,IACZ,OAAO;AACL,YAAM,WAAW,GAAG,WAAW,yBAAgC,CAAQ,EAAE,QAAQ;AAAA,IACnF;AAGA,QAAI;AACF,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mDAAmD;AAC7F,YAAM,SAAS,MAAM,KAAK,GAAG,KAAK,kBAAkB;AAAA,QAClD,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK,YAAY;AAAA,MAC7B,CAAC;AACD,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,UAAU,OAAO,OAAO,CAAC,WAAW;AACxC,YAAI,OAAO,UAAW,QAAO;AAC7B,eAAO,YAAY;AACnB,eAAO;AAAA,MACT,CAAC;AACD,UAAI,QAAQ,QAAQ;AAClB,mBAAW,UAAU,OAAQ,MAAK,GAAG,QAAQ,MAAM;AACnD,cAAM,KAAK,GAAG,MAAM;AAAA,MACtB;AAAA,IACF,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AAAA,EAEA,MAAM,gBAAkC,MAAkE;AACxG,UAAM,SAAS,KAAK,GAAG;AAAA,MACrB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAIlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,KAAK,MAAM,OAAO;AACxB,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAkC,MAKlB;AACpB,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAyB,KAAK,KAAgC;AACzG,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,KAAK,SAAS,OAAO;AACvB,YAAM,QAAQ,KAAK,mBAAoB;AACvC,UAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD;AAAC,QAAC,QAAoC,KAAK,IAAI,oBAAI,KAAK;AACxD,cAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AAAA,MACvC;AAAA,IACF,OAAO;AACL,YAAM,KAAK,GAAG,OAAO,OAAO,EAAE,MAAM;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBAAsB,MASV;AAChB,UAAM,EAAE,QAAQ,QAAQ,QAAQ,SAAS,aAAa,YAAY,SAAS,IAAI;AAG/E,UAAM,aAAa,CAAC,CAAC,UAAU,CAAC,UAAU;AAC1C,UAAM,aAAa,CAAC,CAAC,WAAW,CAAC,UAAU;AAC3C,QAAI,CAAC,cAAc,CAAC,WAAY;AAChC,QAAI,CAAC,aAAa,GAAI;AAEtB,QAAI,MAAuB;AAC3B,QAAI;AACF,YAAO,KAAK,UAAU,QAAQ,UAAU;AAAA,IAC1C,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAK;AAEV,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,cAAc;AAAA,MAC1B,aAAa,KAAK,eAAe;AAAA,IACnC;AAEA,QAAI,UAAU,CAAC,UAAU,YAAY;AACnC,YAAM,YAAY,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,MAAM;AAC7D,4BAAsB,WAAW,oBAAoB;AACrD,YAAM,eAAe,OAAO,eACxB,OAAO,aAAa,GAAG,IACvB;AAAA,QACE,IAAI,IAAI,YAAY;AAAA,QACpB,gBAAgB,IAAI,YAAY;AAAA,QAChC,UAAU,IAAI,YAAY;AAAA,QAC1B,GAAI,IAAI,aAAa,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;AAAA,MACzD;AAQJ,YAAM,UAAU,WAAW,gBAAgB,OAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ,YAAY,IACtG,OAAO;AAAA,QACL,EAAE,GAAI,aAAyC;AAAA,QAC/C;AAAA,QACA,EAAE,OAAO,MAAM,YAAY,MAAM;AAAA,MACnC,IACA;AACJ,UAAI;AACF,cAAM,IAAI,UAAU,WAAW,SAAS;AAAA,UACtC,YAAY,CAAC,CAAC,OAAO;AAAA,UACrB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB,IAAI,YAAY,kBAAkB;AAAA,UAClD,iBAAiB,OAAO;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,WAAW,CAAC,UAAU,aAAa;AACrC,YAAM,mBAAmB,iCAAiC;AAC1D,YAAM,2BAA2B,MAA0B;AACzD,YAAI,WAAW,UAAW,QAAO;AACjC,YAAI,WAAW,UAAW,QAAO;AACjC,eAAO;AAAA,MACT;AACA,YAAM,oBAAoB,yBAAyB;AAEnD,UAAI,WAAW,WAAW;AACxB,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAOrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF,OAAO;AACL,cAAM,UAAU,QAAQ,qBACpB,QAAQ,mBAAmB,GAAG,IAC9B;AAAA,UACE,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY;AAAA,UAC1B,gBAAgB,IAAI,YAAY;AAAA,UAChC,UAAU,IAAI,YAAY;AAAA,QAC5B;AACJ,cAAM,kBAAkB;AACxB,wBAAgB,aAAa;AAC7B,YAAI,sBAAsB,OAAW,iBAAgB,oBAAoB;AACzE,YAAI,IAAI,WAAY,iBAAgB,aAAa,IAAI;AAKrD,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,0BAA0B,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QAC/F,OAAO;AACL,gBAAM,IAAI,UAAU,0BAA0B,eAAe,EAAE,MAAM,CAAC,QAAiB;AACrF,mBAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAAA,UAC5D,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,oBAAoB,6BAA6B,QAAQ,YAAY,IAAI,YAAY,YAAY,IAAI,GAAG;AAC1G,cAAM,kBAAkB;AAAA,UACtB,YAAY,QAAQ;AAAA,UACpB,UAAU,IAAI,YAAY,YAAY;AAAA,UACtC,gBAAgB;AAAA,UAChB,SAAS;AAAA,QACX;AACA,YAAI,kBAAkB;AACpB,gBAAM,IAAI,UAAU,gCAAgC,iBAAiB,EAAE,sBAAsB,KAAK,CAAC;AAAA,QACrG,OAAO;AACL,eAAK,IAAI,UAAU,gCAAgC,eAAe,EAAE,MAAM,MAAM,MAAS;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAuB,MAQd;AACP,UAAM,EAAE,QAAQ,YAAY,IAAI;AAChC,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,aAAa,GAAI;AAItB,UAAM,UAAU,KAAK,WAAW,KAAK,sBAAsB,MAAM;AACjE,UAAM,MAAM,KAAK,mBAAmB,KAAK,QAAQ,WAAW;AAC5D,UAAM,WAAW,KAAK,mBAAmB,IAAI,GAAG;AAChD,QAAI,UAAU;AACZ,eAAS,SAAS;AAClB,eAAS,cAAc;AAAA,QACrB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AACA,eAAS,aAAa,KAAK,cAAc;AACzC,eAAS,cAAc,KAAK,eAAe;AAC3C,UAAI,KAAK,OAAQ,UAAS,SAAS,KAAK;AAIxC,UAAI,KAAK,QAAS,UAAS,UAAU,KAAK;AAAA,eACjC,CAAC,SAAS,WAAW,QAAS,UAAS,UAAU;AAC1D,WAAK,mBAAmB,IAAI,KAAK,QAAQ;AACzC;AAAA,IACF;AACA,UAAM,QAA8B;AAAA,MAClC,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,UAAU,YAAY,YAAY;AAAA,MACpC;AAAA,MACA,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,QAAI,QAAS,OAAM,UAAU;AAC7B,SAAK,mBAAmB,IAAI,KAAK,KAAK;AAAA,EACxC;AAAA,EAEA,MAAM,sBAAsB,UAAiD;AAC3E,QAAI,CAAC,KAAK,mBAAmB,KAAM;AACnC,UAAM,UAAU,MAAM,KAAK,KAAK,mBAAmB,OAAO,CAAC;AAC3D,SAAK,mBAAmB,MAAM;AAC9B,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,WAAW,CAAC,UAAU,eAAe,KAAK,0BAA0B,MAAM,MAAM,GAAG;AAC3F,aAAK,4BAA4B;AAAA,MACnC;AACA,UAAI;AACF,cAAM,KAAK,mBAAmB;AAAA,UAC5B,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,YAAY,MAAM,cAAc;AAAA,UAChC,aAAa,MAAM,eAAe;AAAA,UAClC,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iCAAiC,GAAG;AACtC,gBAAM;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAyB,aAA4C;AAC9F,UAAM,KAAK,YAAY,MAAM;AAC7B,UAAM,MAAM,YAAY,kBAAkB;AAC1C,UAAM,SAAS,YAAY,YAAY;AACvC,WAAO,CAAC,QAAQ,IAAI,KAAK,MAAM,EAAE,KAAK,GAAG;AAAA,EAC3C;AACF;",
   "names": []
 }

package/dist/lib/db/accentInsensitiveSearch.js

@@ -0,0 +1,21 @@
+const IMMUTABLE_UNACCENT_FUNCTION = "public.om_immutable_unaccent";
+const buildImmutableUnaccentFunctionSql = () => `create or replace function ${IMMUTABLE_UNACCENT_FUNCTION}(text)
+returns text as $$
+  select public.unaccent('public.unaccent'::regdictionary, $1)
+$$ language sql immutable parallel safe strict;`;
+const buildAccentInsensitiveSearchExpression = (columns) => {
+  if (!columns.length) throw new Error("[internal] buildAccentInsensitiveSearchExpression requires at least one column");
+  const concatenated = columns.map((column) => `coalesce("${column}", '')`).join(` || ' ' || `);
+  return `${IMMUTABLE_UNACCENT_FUNCTION}(${concatenated})`;
+};
+const buildAccentInsensitivePatternSql = () => `${IMMUTABLE_UNACCENT_FUNCTION}(?)`;
+const escapeLikeMetacharactersSql = (expression) => `replace(replace(replace(${expression}, chr(92), chr(92) || chr(92)), '%', chr(92) || '%'), '_', chr(92) || '_')`;
+const buildAccentInsensitiveContainsPatternSql = () => `'%' || ${escapeLikeMetacharactersSql(`${IMMUTABLE_UNACCENT_FUNCTION}(?)`)} || '%'`;
+export {
+  IMMUTABLE_UNACCENT_FUNCTION,
+  buildAccentInsensitiveContainsPatternSql,
+  buildAccentInsensitivePatternSql,
+  buildAccentInsensitiveSearchExpression,
+  buildImmutableUnaccentFunctionSql
+};
+//# sourceMappingURL=accentInsensitiveSearch.js.map

package/dist/lib/db/accentInsensitiveSearch.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/db/accentInsensitiveSearch.ts"],
+  "sourcesContent": ["/**\n * SQL text for accent-insensitive `ILIKE` matching in PostgreSQL.\n *\n * A query predicate and the expression index backing it must be spelled\n * identically or the planner silently ignores the index, so both sides build\n * their SQL from the helpers here instead of repeating the literal. These are\n * pure string builders \u2014 they assume nothing about which migration installed\n * the function, only that both sides agree on its name.\n *\n * The function itself is created by a migration (currently\n * `packages/core/src/modules/catalog/migrations/`); promote that migration to a\n * platform-level one when a second module needs the same matching.\n */\n\n/**\n * Schema-qualified name of the IMMUTABLE `unaccent()` wrapper the expressions\n * below call.\n *\n * PostgreSQL's built-in `unaccent()` is STABLE, because the single-argument form\n * resolves its text-search dictionary through `search_path`, and a STABLE\n * function cannot appear in an index expression. The wrapper pins the dictionary\n * with `'public.unaccent'::regdictionary` so it is genuinely immutable rather\n * than merely declared so \u2014 but the wrapper's own *call site* is still resolved\n * through `search_path` unless it is schema-qualified too, so both the index\n * expression and the runtime query predicate reference `public.` explicitly\n * rather than relying on the caller's `search_path` containing it.\n */\nexport const IMMUTABLE_UNACCENT_FUNCTION = 'public.om_immutable_unaccent'\n\n/** DDL creating the wrapper. Kept here so the migration and the query agree. */\nexport const buildImmutableUnaccentFunctionSql = (): string =>\n  `create or replace function ${IMMUTABLE_UNACCENT_FUNCTION}(text)\nreturns text as $$\n  select public.unaccent('public.unaccent'::regdictionary, $1)\n$$ language sql immutable parallel safe strict;`\n\n/**\n * `unaccent`ed concatenation of `columns`, NULL-safe and space-separated.\n *\n * Column names are quoted but not table-qualified: the caller's query must\n * reference a single table, which is also what the index expression sees.\n */\nexport const buildAccentInsensitiveSearchExpression = (columns: readonly string[]): string => {\n  if (!columns.length) throw new Error('[internal] buildAccentInsensitiveSearchExpression requires at least one column')\n  const concatenated = columns.map((column) => `coalesce(\"${column}\", '')`).join(` || ' ' || `)\n  return `${IMMUTABLE_UNACCENT_FUNCTION}(${concatenated})`\n}\n\n/**\n * Right-hand side of the comparison: the bound pattern, unaccented the same way.\n *\n * @deprecated `unaccent` folds look-alikes such as fullwidth `\uFF05 \uFF3F \uFF3C` into the\n * ASCII LIKE metacharacters, so a pattern escaped before this call comes out of\n * it with live wildcards (#6465). Use `buildAccentInsensitiveContainsPatternSql`,\n * which binds the raw term and escapes it after folding.\n */\nexport const buildAccentInsensitivePatternSql = (): string => `${IMMUTABLE_UNACCENT_FUNCTION}(?)`\n\nconst escapeLikeMetacharactersSql = (expression: string): string =>\n  `replace(replace(replace(${expression}, chr(92), chr(92) || chr(92)), '%', chr(92) || '%'), '_', chr(92) || '_')`\n\n/**\n * Right-hand side of a \"contains\" comparison for a RAW (unescaped) search term\n * bound as the single `?`: the term is unaccented first and only then\n * LIKE-escaped, so characters that `unaccent` folds into `%`, `_` or `\\` are\n * matched literally. `chr(92)` spells the backslash independently of\n * `standard_conforming_strings`.\n */\nexport const buildAccentInsensitiveContainsPatternSql = (): string =>\n  `'%' || ${escapeLikeMetacharactersSql(`${IMMUTABLE_UNACCENT_FUNCTION}(?)`)} || '%'`\n"],
+  "mappings": "AA2BO,MAAM,8BAA8B;AAGpC,MAAM,oCAAoC,MAC/C,8BAA8B,2BAA2B;AAAA;AAAA;AAAA;AAWpD,MAAM,yCAAyC,CAAC,YAAuC;AAC5F,MAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,gFAAgF;AACrH,QAAM,eAAe,QAAQ,IAAI,CAAC,WAAW,aAAa,MAAM,QAAQ,EAAE,KAAK,aAAa;AAC5F,SAAO,GAAG,2BAA2B,IAAI,YAAY;AACvD;AAUO,MAAM,mCAAmC,MAAc,GAAG,2BAA2B;AAE5F,MAAM,8BAA8B,CAAC,eACnC,2BAA2B,UAAU;AAShC,MAAM,2CAA2C,MACtD,UAAU,4BAA4B,GAAG,2BAA2B,KAAK,CAAC;",
+  "names": []
+}

package/dist/lib/encryption/kms.js

@@ -299,15 +299,11 @@ class HashicorpVaultKmsService {
   }
 }
 let loggedDerivedKeyFallbackBanner = false;
-function fingerprintSecret(secret) {
-  return crypto.createHash("sha256").update(secret, "utf8").digest("hex").slice(0, 16);
-}
 function buildDerivedKeyFallbackBannerLines(opts) {
   const sourceLine = opts.source === "explicit" ? `Source: ${opts.envName}` : "Source: dev default secret (do NOT use in production)";
   return [
     "\u{1F6A8} Using derived tenant encryption keys (Vault unavailable / no DEK)",
     sourceLine,
-    `Secret fingerprint (sha256, truncated): ${fingerprintSecret(opts.secret)}`,
     "Persist this secret securely. Without it, encrypted tenant data cannot be recovered after restart."
   ];
 }
@@ -327,7 +323,7 @@ function logDerivedKeyFallbackBanner(opts) {
   ];
   process.stderr.write(bannerLines.join("\n") + "\n");
   logger.warn("Using derived tenant encryption keys (Vault unavailable / no DEK)", {
-    secretFingerprint: fingerprintSecret(opts.secret)
+    fallbackSource: opts.envName
   });
 }
 function resolveEncryptionMode(kms) {

package/dist/lib/encryption/kms.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/kms.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport { generateDek, hashForLookup } from './aes'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from './toggles'\nimport { parseBooleanToken } from '../boolean'\nimport { createLogger } from '../logger'\nimport { fetchWithTimeout, resolveTimeoutMs } from '../http/fetchWithTimeout'\n\nconst logger = createLogger('shared').child({ component: 'kms' })\n\nconst DEFAULT_VAULT_REQUEST_TIMEOUT_MS = 1_000\nconst DEFAULT_VAULT_RECOVERY_COOLDOWN_MS = 30_000\n\nfunction resolveVaultRequestTimeoutMs(): number {\n  const raw = process.env.VAULT_REQUEST_TIMEOUT_MS\n  const parsed = raw ? Number.parseInt(raw, 10) : undefined\n  return resolveTimeoutMs(parsed, DEFAULT_VAULT_REQUEST_TIMEOUT_MS)\n}\n\nfunction resolveVaultRecoveryCooldownMs(): number {\n  const raw = process.env.VAULT_RECOVERY_COOLDOWN_MS\n  const parsed = raw ? Number.parseInt(raw, 10) : undefined\n  return resolveTimeoutMs(parsed, DEFAULT_VAULT_RECOVERY_COOLDOWN_MS)\n}\n\nexport type TenantDek = {\n  tenantId: string\n  key: string // base64\n  fetchedAt: number\n}\n\nexport interface KmsService {\n  getTenantDek(tenantId: string): Promise<TenantDek | null>\n  createTenantDek(tenantId: string): Promise<TenantDek | null>\n  isHealthy(): boolean\n  invalidateDek?(tenantId: string): void\n}\n\nclass FallbackKmsService implements KmsService {\n  private notified = false\n  constructor(\n    private readonly primary: KmsService,\n    private readonly fallback: KmsService | null,\n    private readonly onFallback?: () => void,\n  ) {}\n\n  isHealthy(): boolean {\n    return this.primary.isHealthy() || Boolean(this.fallback?.isHealthy?.())\n  }\n\n  private notifyFallback() {\n    if (this.notified) return\n    this.notified = true\n    this.onFallback?.()\n  }\n\n  private async fromPrimary<T>(op: () => Promise<T | null>): Promise<T | null> {\n    try {\n      return await op()\n    } catch (err) {\n      logger.warn('Primary KMS failed, will try fallback', { err })\n      return null\n    }\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.getTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.getTenantDek(tenantId)\n    }\n    return null\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.createTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.createTenantDek(tenantId)\n    }\n    return null\n  }\n\n  invalidateDek(tenantId: string): void {\n    this.primary.invalidateDek?.(tenantId)\n    this.fallback?.invalidateDek?.(tenantId)\n  }\n}\n\ntype VaultClientOpts = {\n  vaultAddr?: string\n  vaultToken?: string\n  mountPath?: string\n  ttlMs?: number\n  requestTimeoutMs?: number\n  recoveryCooldownMs?: number\n}\n\ntype VaultReadResponse = {\n  data?: { data?: { key?: string; version?: number }; metadata?: Record<string, unknown> }\n}\n\n// 'conflict' = a check-and-set write lost to a concurrent writer (normal race\n// outcome, Vault still healthy); 'error' = the write genuinely failed.\ntype VaultWriteOutcome = 'ok' | 'conflict' | 'error'\n\nfunction normalizeEnv(value: string | undefined): string {\n  if (!value) return ''\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\ntype DerivedSecret = { secret: string; source: 'explicit' | 'dev-default'; envName: string }\n\nfunction resolveDerivedKeySecret(): DerivedSecret | null {\n  const candidates: Array<{ value: string | null; envName: string }> = [\n    { value: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_FALLBACK_KEY' },\n    { value: process.env.TENANT_DATA_ENCRYPTION_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_KEY' },\n  ]\n  for (const raw of candidates) {\n    const normalized = normalizeEnv(raw.value ?? undefined)\n    if (normalized) return { secret: normalized, source: 'explicit', envName: raw.envName }\n  }\n  if (\n    process.env.NODE_ENV !== 'production'\n    && parseBooleanToken(process.env.ALLOW_DERIVED_KMS_FALLBACK) === true\n  ) {\n    return { secret: 'om-dev-tenant-encryption', source: 'dev-default', envName: 'DEV_DEFAULT' }\n  }\n  return null\n}\n\nexport class NoopKmsService implements KmsService {\n  isHealthy(): boolean { return !isTenantDataEncryptionEnabled() }\n  async getTenantDek(): Promise<TenantDek | null> { return null }\n  async createTenantDek(): Promise<TenantDek | null> { return null }\n}\n\nclass DerivedKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    // Derive a stable root key from the provided secret so derived tenant keys are deterministic\n    this.root = crypto.createHash('sha256').update(secret).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nexport class HashicorpVaultKmsService implements KmsService {\n  private cache = new Map<string, TenantDek>()\n  private readonly vaultAddr: string\n  private readonly vaultToken: string\n  private readonly mountPath: string\n  private readonly ttlMs: number\n  private readonly requestTimeoutMs: number\n  private readonly recoveryCooldownMs: number\n  private healthy = true\n  // Sticky terminal failure (missing VAULT_ADDR/VAULT_TOKEN): no amount of\n  // re-probing fixes a misconfiguration, so this never self-heals \u2014 only a\n  // restart with corrected config does.\n  private misconfigured = false\n  // Timestamp of the last transient failure (timeout / network blip / 5xx).\n  // Drives the half-open circuit breaker in isHealthy(): after the cooldown the\n  // instance reports healthy again so the next call re-probes Vault.\n  private lastTransientFailureAt: number | null = null\n  private readonly debugEnabled: boolean\n  private static loggedInit = false\n\n  constructor(opts: VaultClientOpts = {}) {\n    this.vaultAddr = normalizeEnv(opts.vaultAddr || process.env.VAULT_ADDR || '')\n    this.vaultToken = normalizeEnv(opts.vaultToken || process.env.VAULT_TOKEN || '')\n    this.mountPath = (opts.mountPath || process.env.VAULT_KV_PATH || 'secret/data').replace(/\\/+$/, '')\n    this.ttlMs = opts.ttlMs ?? 15 * 60 * 1000\n    this.requestTimeoutMs = resolveTimeoutMs(opts.requestTimeoutMs, resolveVaultRequestTimeoutMs())\n    this.recoveryCooldownMs = resolveTimeoutMs(opts.recoveryCooldownMs, resolveVaultRecoveryCooldownMs())\n    this.debugEnabled = isEncryptionDebugEnabled()\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      this.misconfigured = true\n      if (this.debugEnabled) {\n        logger.warn('Vault misconfigured (missing VAULT_ADDR or VAULT_TOKEN)')\n      }\n    }\n    if (this.healthy && !HashicorpVaultKmsService.loggedInit && this.debugEnabled) {\n      HashicorpVaultKmsService.loggedInit = true\n      if (this.debugEnabled) {\n        logger.info('Hashicorp Vault KMS enabled')\n      }\n    }\n  }\n\n  isHealthy(): boolean {\n    // A missing-config failure is terminal \u2014 never report healthy again.\n    if (this.misconfigured) return false\n    if (this.healthy) return true\n    // Half-open circuit breaker: once the cooldown since the last transient\n    // failure has elapsed, report healthy so the next read/write re-probes\n    // Vault. A successful probe flips `healthy` back on; a failing one records a\n    // fresh failure timestamp and re-opens the breaker for another cooldown.\n    if (this.lastTransientFailureAt === null) return false\n    return this.now() - this.lastTransientFailureAt >= this.recoveryCooldownMs\n  }\n\n  private now(): number {\n    return Date.now()\n  }\n\n  // Vault responded successfully (or is provably reachable): close the breaker.\n  private markHealthy(): void {\n    this.healthy = true\n    this.lastTransientFailureAt = null\n  }\n\n  // Transient infra failure (timeout / network blip / 5xx): open the breaker and\n  // start the recovery cooldown so a later call can re-probe and self-heal.\n  private markTransientFailure(): void {\n    this.healthy = false\n    this.lastTransientFailureAt = this.now()\n  }\n\n  private cacheHit(tenantId: string): TenantDek | null {\n    const entry = this.cache.get(tenantId)\n    if (!entry) return null\n    if (this.now() - entry.fetchedAt > this.ttlMs) {\n      this.cache.delete(tenantId)\n      return null\n    }\n    return entry\n  }\n\n  private async readVault(path: string): Promise<VaultReadResponse | null> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      this.misconfigured = true\n      return null\n    }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'GET',\n        headers: { 'X-Vault-Token': this.vaultToken },\n        timeoutMs: this.requestTimeoutMs,\n      })\n      if (!res.ok) {\n        // 5xx = Vault down/erroring (transient). <500 (auth/not-found/etc.) means\n        // Vault is reachable and answered, so keep it healthy \u2014 a 404 for a\n        // not-yet-created tenant DEK is the normal read-before-write path.\n        if (res.status >= 500) this.markTransientFailure()\n        else this.markHealthy()\n        logger.warn('Vault read failed', { path, status: res.status })\n        return null\n      }\n      this.markHealthy()\n      if (this.debugEnabled) {\n        logger.info('Vault read ok', { path })\n      }\n      return (await res.json()) as VaultReadResponse\n    } catch (err) {\n      this.markTransientFailure()\n      logger.warn('Vault read error', { path, err, timeoutMs: this.requestTimeoutMs })\n      return null\n    }\n  }\n\n  private async writeVault(path: string, key: string, opts?: { cas?: number }): Promise<VaultWriteOutcome> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      this.misconfigured = true\n      return 'error'\n    }\n    const body: { data: { key: string }; options?: { cas: number } } = { data: { key } }\n    if (typeof opts?.cas === 'number') body.options = { cas: opts.cas }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'POST',\n        headers: {\n          'X-Vault-Token': this.vaultToken,\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      if (res.ok) {\n        this.markHealthy()\n        return 'ok'\n      }\n      // KV v2 returns 400 when a check-and-set write loses to a concurrent\n      // writer (path already at a newer version). That is a normal race outcome,\n      // not an unhealthy Vault \u2014 Vault is reachable, so close the breaker.\n      if (typeof opts?.cas === 'number' && res.status === 400) {\n        this.markHealthy()\n        logger.warn('Vault write CAS conflict (concurrent DEK create)', { path, status: res.status })\n        return 'conflict'\n      }\n      this.markTransientFailure()\n      logger.warn('Vault write failed', { path, status: res.status })\n      return 'error'\n    } catch (err) {\n      this.markTransientFailure()\n      logger.warn('Vault write error', { path, err, timeoutMs: this.requestTimeoutMs })\n      return 'error'\n    }\n  }\n\n  private buildKeyPath(tenantId: string): string {\n    const suffix = `tenant_key_${tenantId}`\n    const normalizedMount = this.mountPath.replace(/^\\/+/, '')\n    return `${normalizedMount}/${suffix}`\n  }\n\n  private remember(entry: TenantDek): TenantDek {\n    this.cache.set(entry.tenantId, entry)\n    return entry\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const cached = this.cacheHit(tenantId)\n    if (cached) return cached\n    const path = this.buildKeyPath(tenantId)\n    const res = await this.readVault(path)\n    const key = res?.data?.data?.key\n    if (!key) {\n      logger.warn('No tenant DEK found in Vault', { tenantId, path })\n      return null\n    }\n    const dek: TenantDek = { tenantId, key, fetchedAt: this.now() }\n    return this.remember(dek)\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const path = this.buildKeyPath(tenantId)\n    // Read-before-write: if a DEK already exists for this tenant (another request\n    // or process created it first), adopt it instead of overwriting the active\n    // key \u2014 overwriting orphans every row already encrypted under it (#2746).\n    const existing = await this.readVault(path)\n    const existingKey = existing?.data?.data?.key\n    if (existingKey) {\n      return this.remember({ tenantId, key: existingKey, fetchedAt: this.now() })\n    }\n    // A read failure (timeout / 5xx) flips `healthy` off; don't blind-write a new\n    // key over a possibly-existing one we just couldn't read \u2014 let the caller fall back.\n    if (!this.healthy) return null\n    const key = generateDek()\n    const outcome = await this.writeVault(path, key, { cas: 0 })\n    if (outcome === 'ok') {\n      logger.info('Stored tenant DEK in Vault', { tenantId, path })\n      return this.remember({ tenantId, key, fetchedAt: this.now() })\n    }\n    if (outcome === 'conflict') {\n      // A concurrent create won the CAS race \u2014 adopt the winner's key so both\n      // callers encrypt under the same DEK.\n      const winner = await this.readVault(path)\n      const winnerKey = winner?.data?.data?.key\n      if (winnerKey) {\n        logger.info('Adopted concurrently-created tenant DEK', { tenantId, path })\n        return this.remember({ tenantId, key: winnerKey, fetchedAt: this.now() })\n      }\n    }\n    logger.warn('Failed to store tenant DEK in Vault', { tenantId, path })\n    return null\n  }\n\n  invalidateDek(tenantId: string): void {\n    this.cache.delete(tenantId)\n  }\n}\n\nlet loggedDerivedKeyFallbackBanner = false\n\nfunction fingerprintSecret(secret: string): string {\n  return crypto.createHash('sha256').update(secret, 'utf8').digest('hex').slice(0, 16)\n}\n\nexport function buildDerivedKeyFallbackBannerLines(opts: DerivedSecret): string[] {\n  const sourceLine =\n    opts.source === 'explicit' ? `Source: ${opts.envName}` : 'Source: dev default secret (do NOT use in production)'\n  return [\n    '\uD83D\uDEA8 Using derived tenant encryption keys (Vault unavailable / no DEK)',\n    sourceLine,\n    `Secret fingerprint (sha256, truncated): ${fingerprintSecret(opts.secret)}`,\n    'Persist this secret securely. Without it, encrypted tenant data cannot be recovered after restart.',\n  ]\n}\n\nfunction logDerivedKeyFallbackBanner(opts: DerivedSecret): void {\n  if (process.env.NODE_ENV === 'test' || loggedDerivedKeyFallbackBanner) return\n  loggedDerivedKeyFallbackBanner = true\n  const redBg = '\\x1b[41m'\n  const white = '\\x1b[97m'\n  const reset = '\\x1b[0m'\n  const width = 110\n  const border = `${redBg}${white}${'\u2501'.repeat(width)}${reset}`\n  const body = buildDerivedKeyFallbackBannerLines(opts)\n  const bannerLines = [\n    border,\n    ...body.map((line) => `${redBg}${white} ${line.padEnd(width - 2, ' ')} ${reset}`),\n    border,\n  ]\n  process.stderr.write(bannerLines.join('\\n') + '\\n')\n  logger.warn('Using derived tenant encryption keys (Vault unavailable / no DEK)', {\n    secretFingerprint: fingerprintSecret(opts.secret),\n  })\n}\n\n/**\n * What the runtime should do about tenant data encryption right now.\n *\n * `isHealthy()` alone cannot answer this: {@link NoopKmsService} reports healthy precisely when\n * encryption is switched OFF, so `enabled && healthy` collapses correctly but a bare\n * `if (!kms.isHealthy())` guard reads the two opposite situations as the same one. They call for\n * opposite handling, so name them:\n *\n * - `disabled`    \u2014 the operator set `TENANT_DATA_ENCRYPTION=no`. Plaintext is the intended\n *                   outcome; degrade to it rather than failing.\n * - `active`      \u2014 encryption is on and a DEK is reachable. Encrypt.\n * - `unavailable` \u2014 encryption is on but no DEK is reachable (Vault down, no fallback secret).\n *                   Data that is meant to be ciphertext MUST NOT be written as plaintext; callers\n *                   holding secrets fail closed here (spec 2026-05-29, security finding #7).\n */\nexport type TenantDataEncryptionMode = 'disabled' | 'active' | 'unavailable'\n\nexport function resolveEncryptionMode(kms: Pick<KmsService, 'isHealthy'>): TenantDataEncryptionMode {\n  if (!isTenantDataEncryptionEnabled()) return 'disabled'\n  return kms.isHealthy() ? 'active' : 'unavailable'\n}\n\nexport function createKmsService(): KmsService {\n  if (!isTenantDataEncryptionEnabled()) return new NoopKmsService()\n  const primary = new HashicorpVaultKmsService()\n\n  const derived = resolveDerivedKeySecret()\n  const fallback = derived ? new DerivedKmsService(derived.secret) : null\n  const notifyFallback = derived\n    ? () => {\n        logDerivedKeyFallbackBanner(derived)\n      }\n    : undefined\n\n  if (!primary.isHealthy()) {\n    if (fallback) {\n      notifyFallback?.()\n      return fallback\n    }\n    logger.warn('Vault not healthy or misconfigured (missing VAULT_ADDR/VAULT_TOKEN) and no fallback secret provided; falling back to noop KMS')\n    return new NoopKmsService()\n  }\n\n  if (fallback) {\n    return new FallbackKmsService(primary, fallback, notifyFallback)\n  }\n\n  return primary\n}\n\nexport { hashForLookup }\n"],
-  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,aAAa,qBAAqB;AAC3C,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB,wBAAwB;AAEnD,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAEhE,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAE3C,SAAS,+BAAuC;AAC9C,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAChD,SAAO,iBAAiB,QAAQ,gCAAgC;AAClE;AAEA,SAAS,iCAAyC;AAChD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAChD,SAAO,iBAAiB,QAAQ,kCAAkC;AACpE;AAeA,MAAM,mBAAyC;AAAA,EAE7C,YACmB,SACA,UACA,YACjB;AAHiB;AACA;AACA;AAJnB,SAAQ,WAAW;AAAA,EAKhB;AAAA,EAEH,YAAqB;AACnB,WAAO,KAAK,QAAQ,UAAU,KAAK,QAAQ,KAAK,UAAU,YAAY,CAAC;AAAA,EACzE;AAAA,EAEQ,iBAAiB;AACvB,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,MAAc,YAAe,IAAgD;AAC3E,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,KAAK,yCAAyC,EAAE,IAAI,CAAC;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,aAAa,QAAQ,CAAC;AAC5E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,aAAa,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,gBAAgB,QAAQ,CAAC;AAC/E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,gBAAgB,QAAQ;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,UAAwB;AACpC,SAAK,QAAQ,gBAAgB,QAAQ;AACrC,SAAK,UAAU,gBAAgB,QAAQ;AAAA,EACzC;AACF;AAmBA,SAAS,aAAa,OAAmC;AACvD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAIA,SAAS,0BAAgD;AACvD,QAAM,aAA+D;AAAA,IACnE,EAAE,OAAO,QAAQ,IAAI,uCAAuC,MAAM,SAAS,sCAAsC;AAAA,IACjH,EAAE,OAAO,QAAQ,IAAI,8BAA8B,MAAM,SAAS,6BAA6B;AAAA,EACjG;AACA,aAAW,OAAO,YAAY;AAC5B,UAAM,aAAa,aAAa,IAAI,SAAS,MAAS;AACtD,QAAI,WAAY,QAAO,EAAE,QAAQ,YAAY,QAAQ,YAAY,SAAS,IAAI,QAAQ;AAAA,EACxF;AACA,MACE,QAAQ,IAAI,aAAa,gBACtB,kBAAkB,QAAQ,IAAI,0BAA0B,MAAM,MACjE;AACA,WAAO,EAAE,QAAQ,4BAA4B,QAAQ,eAAe,SAAS,cAAc;AAAA,EAC7F;AACA,SAAO;AACT;AAEO,MAAM,eAAqC;AAAA,EAChD,YAAqB;AAAE,WAAO,CAAC,8BAA8B;AAAA,EAAE;AAAA,EAC/D,MAAM,eAA0C;AAAE,WAAO;AAAA,EAAK;AAAA,EAC9D,MAAM,kBAA6C;AAAE,WAAO;AAAA,EAAK;AACnE;AAEA,MAAM,kBAAwC;AAAA,EAE5C,YAAY,QAAgB;AAE1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO;AAAA,EAChE;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEO,MAAM,yBAA+C;AAAA,EAoB1D,YAAY,OAAwB,CAAC,GAAG;AAnBxC,SAAQ,QAAQ,oBAAI,IAAuB;AAO3C,SAAQ,UAAU;AAIlB;AAAA;AAAA;AAAA,SAAQ,gBAAgB;AAIxB;AAAA;AAAA;AAAA,SAAQ,yBAAwC;AAK9C,SAAK,YAAY,aAAa,KAAK,aAAa,QAAQ,IAAI,cAAc,EAAE;AAC5E,SAAK,aAAa,aAAa,KAAK,cAAc,QAAQ,IAAI,eAAe,EAAE;AAC/E,SAAK,aAAa,KAAK,aAAa,QAAQ,IAAI,iBAAiB,eAAe,QAAQ,QAAQ,EAAE;AAClG,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,6BAA6B,CAAC;AAC9F,SAAK,qBAAqB,iBAAiB,KAAK,oBAAoB,+BAA+B,CAAC;AACpG,SAAK,eAAe,yBAAyB;AAC7C,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,WAAK,gBAAgB;AACrB,UAAI,KAAK,cAAc;AACrB,eAAO,KAAK,yDAAyD;AAAA,MACvE;AAAA,IACF;AACA,QAAI,KAAK,WAAW,CAAC,yBAAyB,cAAc,KAAK,cAAc;AAC7E,+BAAyB,aAAa;AACtC,UAAI,KAAK,cAAc;AACrB,eAAO,KAAK,6BAA6B;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AAAA,EAvBA;AAAA,SAAe,aAAa;AAAA;AAAA,EAyB5B,YAAqB;AAEnB,QAAI,KAAK,cAAe,QAAO;AAC/B,QAAI,KAAK,QAAS,QAAO;AAKzB,QAAI,KAAK,2BAA2B,KAAM,QAAO;AACjD,WAAO,KAAK,IAAI,IAAI,KAAK,0BAA0B,KAAK;AAAA,EAC1D;AAAA,EAEQ,MAAc;AACpB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA;AAAA,EAGQ,cAAoB;AAC1B,SAAK,UAAU;AACf,SAAK,yBAAyB;AAAA,EAChC;AAAA;AAAA;AAAA,EAIQ,uBAA6B;AACnC,SAAK,UAAU;AACf,SAAK,yBAAyB,KAAK,IAAI;AAAA,EACzC;AAAA,EAEQ,SAAS,UAAoC;AACnD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,OAAO;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,MAAiD;AACvE,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,WAAK,gBAAgB;AACrB,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,iBAAiB,KAAK,WAAW;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AAIX,YAAI,IAAI,UAAU,IAAK,MAAK,qBAAqB;AAAA,YAC5C,MAAK,YAAY;AACtB,eAAO,KAAK,qBAAqB,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAC7D,eAAO;AAAA,MACT;AACA,WAAK,YAAY;AACjB,UAAI,KAAK,cAAc;AACrB,eAAO,KAAK,iBAAiB,EAAE,KAAK,CAAC;AAAA,MACvC;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB,SAAS,KAAK;AACZ,WAAK,qBAAqB;AAC1B,aAAO,KAAK,oBAAoB,EAAE,MAAM,KAAK,WAAW,KAAK,iBAAiB,CAAC;AAC/E,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,MAAc,KAAa,MAAqD;AACvG,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,WAAK,gBAAgB;AACrB,aAAO;AAAA,IACT;AACA,UAAM,OAA6D,EAAE,MAAM,EAAE,IAAI,EAAE;AACnF,QAAI,OAAO,MAAM,QAAQ,SAAU,MAAK,UAAU,EAAE,KAAK,KAAK,IAAI;AAClE,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,UAAI,IAAI,IAAI;AACV,aAAK,YAAY;AACjB,eAAO;AAAA,MACT;AAIA,UAAI,OAAO,MAAM,QAAQ,YAAY,IAAI,WAAW,KAAK;AACvD,aAAK,YAAY;AACjB,eAAO,KAAK,oDAAoD,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAC5F,eAAO;AAAA,MACT;AACA,WAAK,qBAAqB;AAC1B,aAAO,KAAK,sBAAsB,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAC9D,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,WAAK,qBAAqB;AAC1B,aAAO,KAAK,qBAAqB,EAAE,MAAM,KAAK,WAAW,KAAK,iBAAiB,CAAC;AAChF,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,aAAa,UAA0B;AAC7C,UAAM,SAAS,cAAc,QAAQ;AACrC,UAAM,kBAAkB,KAAK,UAAU,QAAQ,QAAQ,EAAE;AACzD,WAAO,GAAG,eAAe,IAAI,MAAM;AAAA,EACrC;AAAA,EAEQ,SAAS,OAA6B;AAC5C,SAAK,MAAM,IAAI,MAAM,UAAU,KAAK;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,UAAM,SAAS,KAAK,SAAS,QAAQ;AACrC,QAAI,OAAQ,QAAO;AACnB,UAAM,OAAO,KAAK,aAAa,QAAQ;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,IAAI;AACrC,UAAM,MAAM,KAAK,MAAM,MAAM;AAC7B,QAAI,CAAC,KAAK;AACR,aAAO,KAAK,gCAAgC,EAAE,UAAU,KAAK,CAAC;AAC9D,aAAO;AAAA,IACT;AACA,UAAM,MAAiB,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE;AAC9D,WAAO,KAAK,SAAS,GAAG;AAAA,EAC1B;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,UAAM,OAAO,KAAK,aAAa,QAAQ;AAIvC,UAAM,WAAW,MAAM,KAAK,UAAU,IAAI;AAC1C,UAAM,cAAc,UAAU,MAAM,MAAM;AAC1C,QAAI,aAAa;AACf,aAAO,KAAK,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,IAC5E;AAGA,QAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,UAAM,MAAM,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,WAAW,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;AAC3D,QAAI,YAAY,MAAM;AACpB,aAAO,KAAK,8BAA8B,EAAE,UAAU,KAAK,CAAC;AAC5D,aAAO,KAAK,SAAS,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,IAC/D;AACA,QAAI,YAAY,YAAY;AAG1B,YAAM,SAAS,MAAM,KAAK,UAAU,IAAI;AACxC,YAAM,YAAY,QAAQ,MAAM,MAAM;AACtC,UAAI,WAAW;AACb,eAAO,KAAK,2CAA2C,EAAE,UAAU,KAAK,CAAC;AACzE,eAAO,KAAK,SAAS,EAAE,UAAU,KAAK,WAAW,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF;AACA,WAAO,KAAK,uCAAuC,EAAE,UAAU,KAAK,CAAC;AACrE,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,UAAwB;AACpC,SAAK,MAAM,OAAO,QAAQ;AAAA,EAC5B;AACF;AAEA,IAAI,iCAAiC;AAErC,SAAS,kBAAkB,QAAwB;AACjD,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,MAAM,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACrF;AAEO,SAAS,mCAAmC,MAA+B;AAChF,QAAM,aACJ,KAAK,WAAW,aAAa,WAAW,KAAK,OAAO,KAAK;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,2CAA2C,kBAAkB,KAAK,MAAM,CAAC;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,MAA2B;AAC9D,MAAI,QAAQ,IAAI,aAAa,UAAU,+BAAgC;AACvE,mCAAiC;AACjC,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAI,OAAO,KAAK,CAAC,GAAG,KAAK;AAC3D,QAAM,OAAO,mCAAmC,IAAI;AACpD,QAAM,cAAc;AAAA,IAClB;AAAA,IACA,GAAG,KAAK,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,GAAG,CAAC,IAAI,KAAK,EAAE;AAAA,IAChF;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,YAAY,KAAK,IAAI,IAAI,IAAI;AAClD,SAAO,KAAK,qEAAqE;AAAA,IAC/E,mBAAmB,kBAAkB,KAAK,MAAM;AAAA,EAClD,CAAC;AACH;AAmBO,SAAS,sBAAsB,KAA8D;AAClG,MAAI,CAAC,8BAA8B,EAAG,QAAO;AAC7C,SAAO,IAAI,UAAU,IAAI,WAAW;AACtC;AAEO,SAAS,mBAA+B;AAC7C,MAAI,CAAC,8BAA8B,EAAG,QAAO,IAAI,eAAe;AAChE,QAAM,UAAU,IAAI,yBAAyB;AAE7C,QAAM,UAAU,wBAAwB;AACxC,QAAM,WAAW,UAAU,IAAI,kBAAkB,QAAQ,MAAM,IAAI;AACnE,QAAM,iBAAiB,UACnB,MAAM;AACJ,gCAA4B,OAAO;AAAA,EACrC,IACA;AAEJ,MAAI,CAAC,QAAQ,UAAU,GAAG;AACxB,QAAI,UAAU;AACZ,uBAAiB;AACjB,aAAO;AAAA,IACT;AACA,WAAO,KAAK,+HAA+H;AAC3I,WAAO,IAAI,eAAe;AAAA,EAC5B;AAEA,MAAI,UAAU;AACZ,WAAO,IAAI,mBAAmB,SAAS,UAAU,cAAc;AAAA,EACjE;AAEA,SAAO;AACT;",
+  "sourcesContent": ["import crypto from 'node:crypto'\nimport { generateDek, hashForLookup } from './aes'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from './toggles'\nimport { parseBooleanToken } from '../boolean'\nimport { createLogger } from '../logger'\nimport { fetchWithTimeout, resolveTimeoutMs } from '../http/fetchWithTimeout'\n\nconst logger = createLogger('shared').child({ component: 'kms' })\n\nconst DEFAULT_VAULT_REQUEST_TIMEOUT_MS = 1_000\nconst DEFAULT_VAULT_RECOVERY_COOLDOWN_MS = 30_000\n\nfunction resolveVaultRequestTimeoutMs(): number {\n  const raw = process.env.VAULT_REQUEST_TIMEOUT_MS\n  const parsed = raw ? Number.parseInt(raw, 10) : undefined\n  return resolveTimeoutMs(parsed, DEFAULT_VAULT_REQUEST_TIMEOUT_MS)\n}\n\nfunction resolveVaultRecoveryCooldownMs(): number {\n  const raw = process.env.VAULT_RECOVERY_COOLDOWN_MS\n  const parsed = raw ? Number.parseInt(raw, 10) : undefined\n  return resolveTimeoutMs(parsed, DEFAULT_VAULT_RECOVERY_COOLDOWN_MS)\n}\n\nexport type TenantDek = {\n  tenantId: string\n  key: string // base64\n  fetchedAt: number\n}\n\nexport interface KmsService {\n  getTenantDek(tenantId: string): Promise<TenantDek | null>\n  createTenantDek(tenantId: string): Promise<TenantDek | null>\n  isHealthy(): boolean\n  invalidateDek?(tenantId: string): void\n}\n\nclass FallbackKmsService implements KmsService {\n  private notified = false\n  constructor(\n    private readonly primary: KmsService,\n    private readonly fallback: KmsService | null,\n    private readonly onFallback?: () => void,\n  ) {}\n\n  isHealthy(): boolean {\n    return this.primary.isHealthy() || Boolean(this.fallback?.isHealthy?.())\n  }\n\n  private notifyFallback() {\n    if (this.notified) return\n    this.notified = true\n    this.onFallback?.()\n  }\n\n  private async fromPrimary<T>(op: () => Promise<T | null>): Promise<T | null> {\n    try {\n      return await op()\n    } catch (err) {\n      logger.warn('Primary KMS failed, will try fallback', { err })\n      return null\n    }\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.getTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.getTenantDek(tenantId)\n    }\n    return null\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.createTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.createTenantDek(tenantId)\n    }\n    return null\n  }\n\n  invalidateDek(tenantId: string): void {\n    this.primary.invalidateDek?.(tenantId)\n    this.fallback?.invalidateDek?.(tenantId)\n  }\n}\n\ntype VaultClientOpts = {\n  vaultAddr?: string\n  vaultToken?: string\n  mountPath?: string\n  ttlMs?: number\n  requestTimeoutMs?: number\n  recoveryCooldownMs?: number\n}\n\ntype VaultReadResponse = {\n  data?: { data?: { key?: string; version?: number }; metadata?: Record<string, unknown> }\n}\n\n// 'conflict' = a check-and-set write lost to a concurrent writer (normal race\n// outcome, Vault still healthy); 'error' = the write genuinely failed.\ntype VaultWriteOutcome = 'ok' | 'conflict' | 'error'\n\nfunction normalizeEnv(value: string | undefined): string {\n  if (!value) return ''\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\ntype DerivedSecret = { secret: string; source: 'explicit' | 'dev-default'; envName: string }\n\nfunction resolveDerivedKeySecret(): DerivedSecret | null {\n  const candidates: Array<{ value: string | null; envName: string }> = [\n    { value: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_FALLBACK_KEY' },\n    { value: process.env.TENANT_DATA_ENCRYPTION_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_KEY' },\n  ]\n  for (const raw of candidates) {\n    const normalized = normalizeEnv(raw.value ?? undefined)\n    if (normalized) return { secret: normalized, source: 'explicit', envName: raw.envName }\n  }\n  if (\n    process.env.NODE_ENV !== 'production'\n    && parseBooleanToken(process.env.ALLOW_DERIVED_KMS_FALLBACK) === true\n  ) {\n    return { secret: 'om-dev-tenant-encryption', source: 'dev-default', envName: 'DEV_DEFAULT' }\n  }\n  return null\n}\n\nexport class NoopKmsService implements KmsService {\n  isHealthy(): boolean { return !isTenantDataEncryptionEnabled() }\n  async getTenantDek(): Promise<TenantDek | null> { return null }\n  async createTenantDek(): Promise<TenantDek | null> { return null }\n}\n\nclass DerivedKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    // Derive a stable root key from the provided secret so derived tenant keys are deterministic\n    this.root = crypto.createHash('sha256').update(secret).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nexport class HashicorpVaultKmsService implements KmsService {\n  private cache = new Map<string, TenantDek>()\n  private readonly vaultAddr: string\n  private readonly vaultToken: string\n  private readonly mountPath: string\n  private readonly ttlMs: number\n  private readonly requestTimeoutMs: number\n  private readonly recoveryCooldownMs: number\n  private healthy = true\n  // Sticky terminal failure (missing VAULT_ADDR/VAULT_TOKEN): no amount of\n  // re-probing fixes a misconfiguration, so this never self-heals \u2014 only a\n  // restart with corrected config does.\n  private misconfigured = false\n  // Timestamp of the last transient failure (timeout / network blip / 5xx).\n  // Drives the half-open circuit breaker in isHealthy(): after the cooldown the\n  // instance reports healthy again so the next call re-probes Vault.\n  private lastTransientFailureAt: number | null = null\n  private readonly debugEnabled: boolean\n  private static loggedInit = false\n\n  constructor(opts: VaultClientOpts = {}) {\n    this.vaultAddr = normalizeEnv(opts.vaultAddr || process.env.VAULT_ADDR || '')\n    this.vaultToken = normalizeEnv(opts.vaultToken || process.env.VAULT_TOKEN || '')\n    this.mountPath = (opts.mountPath || process.env.VAULT_KV_PATH || 'secret/data').replace(/\\/+$/, '')\n    this.ttlMs = opts.ttlMs ?? 15 * 60 * 1000\n    this.requestTimeoutMs = resolveTimeoutMs(opts.requestTimeoutMs, resolveVaultRequestTimeoutMs())\n    this.recoveryCooldownMs = resolveTimeoutMs(opts.recoveryCooldownMs, resolveVaultRecoveryCooldownMs())\n    this.debugEnabled = isEncryptionDebugEnabled()\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      this.misconfigured = true\n      if (this.debugEnabled) {\n        logger.warn('Vault misconfigured (missing VAULT_ADDR or VAULT_TOKEN)')\n      }\n    }\n    if (this.healthy && !HashicorpVaultKmsService.loggedInit && this.debugEnabled) {\n      HashicorpVaultKmsService.loggedInit = true\n      if (this.debugEnabled) {\n        logger.info('Hashicorp Vault KMS enabled')\n      }\n    }\n  }\n\n  isHealthy(): boolean {\n    // A missing-config failure is terminal \u2014 never report healthy again.\n    if (this.misconfigured) return false\n    if (this.healthy) return true\n    // Half-open circuit breaker: once the cooldown since the last transient\n    // failure has elapsed, report healthy so the next read/write re-probes\n    // Vault. A successful probe flips `healthy` back on; a failing one records a\n    // fresh failure timestamp and re-opens the breaker for another cooldown.\n    if (this.lastTransientFailureAt === null) return false\n    return this.now() - this.lastTransientFailureAt >= this.recoveryCooldownMs\n  }\n\n  private now(): number {\n    return Date.now()\n  }\n\n  // Vault responded successfully (or is provably reachable): close the breaker.\n  private markHealthy(): void {\n    this.healthy = true\n    this.lastTransientFailureAt = null\n  }\n\n  // Transient infra failure (timeout / network blip / 5xx): open the breaker and\n  // start the recovery cooldown so a later call can re-probe and self-heal.\n  private markTransientFailure(): void {\n    this.healthy = false\n    this.lastTransientFailureAt = this.now()\n  }\n\n  private cacheHit(tenantId: string): TenantDek | null {\n    const entry = this.cache.get(tenantId)\n    if (!entry) return null\n    if (this.now() - entry.fetchedAt > this.ttlMs) {\n      this.cache.delete(tenantId)\n      return null\n    }\n    return entry\n  }\n\n  private async readVault(path: string): Promise<VaultReadResponse | null> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      this.misconfigured = true\n      return null\n    }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'GET',\n        headers: { 'X-Vault-Token': this.vaultToken },\n        timeoutMs: this.requestTimeoutMs,\n      })\n      if (!res.ok) {\n        // 5xx = Vault down/erroring (transient). <500 (auth/not-found/etc.) means\n        // Vault is reachable and answered, so keep it healthy \u2014 a 404 for a\n        // not-yet-created tenant DEK is the normal read-before-write path.\n        if (res.status >= 500) this.markTransientFailure()\n        else this.markHealthy()\n        logger.warn('Vault read failed', { path, status: res.status })\n        return null\n      }\n      this.markHealthy()\n      if (this.debugEnabled) {\n        logger.info('Vault read ok', { path })\n      }\n      return (await res.json()) as VaultReadResponse\n    } catch (err) {\n      this.markTransientFailure()\n      logger.warn('Vault read error', { path, err, timeoutMs: this.requestTimeoutMs })\n      return null\n    }\n  }\n\n  private async writeVault(path: string, key: string, opts?: { cas?: number }): Promise<VaultWriteOutcome> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      this.misconfigured = true\n      return 'error'\n    }\n    const body: { data: { key: string }; options?: { cas: number } } = { data: { key } }\n    if (typeof opts?.cas === 'number') body.options = { cas: opts.cas }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'POST',\n        headers: {\n          'X-Vault-Token': this.vaultToken,\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(body),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      if (res.ok) {\n        this.markHealthy()\n        return 'ok'\n      }\n      // KV v2 returns 400 when a check-and-set write loses to a concurrent\n      // writer (path already at a newer version). That is a normal race outcome,\n      // not an unhealthy Vault \u2014 Vault is reachable, so close the breaker.\n      if (typeof opts?.cas === 'number' && res.status === 400) {\n        this.markHealthy()\n        logger.warn('Vault write CAS conflict (concurrent DEK create)', { path, status: res.status })\n        return 'conflict'\n      }\n      this.markTransientFailure()\n      logger.warn('Vault write failed', { path, status: res.status })\n      return 'error'\n    } catch (err) {\n      this.markTransientFailure()\n      logger.warn('Vault write error', { path, err, timeoutMs: this.requestTimeoutMs })\n      return 'error'\n    }\n  }\n\n  private buildKeyPath(tenantId: string): string {\n    const suffix = `tenant_key_${tenantId}`\n    const normalizedMount = this.mountPath.replace(/^\\/+/, '')\n    return `${normalizedMount}/${suffix}`\n  }\n\n  private remember(entry: TenantDek): TenantDek {\n    this.cache.set(entry.tenantId, entry)\n    return entry\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const cached = this.cacheHit(tenantId)\n    if (cached) return cached\n    const path = this.buildKeyPath(tenantId)\n    const res = await this.readVault(path)\n    const key = res?.data?.data?.key\n    if (!key) {\n      logger.warn('No tenant DEK found in Vault', { tenantId, path })\n      return null\n    }\n    const dek: TenantDek = { tenantId, key, fetchedAt: this.now() }\n    return this.remember(dek)\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const path = this.buildKeyPath(tenantId)\n    // Read-before-write: if a DEK already exists for this tenant (another request\n    // or process created it first), adopt it instead of overwriting the active\n    // key \u2014 overwriting orphans every row already encrypted under it (#2746).\n    const existing = await this.readVault(path)\n    const existingKey = existing?.data?.data?.key\n    if (existingKey) {\n      return this.remember({ tenantId, key: existingKey, fetchedAt: this.now() })\n    }\n    // A read failure (timeout / 5xx) flips `healthy` off; don't blind-write a new\n    // key over a possibly-existing one we just couldn't read \u2014 let the caller fall back.\n    if (!this.healthy) return null\n    const key = generateDek()\n    const outcome = await this.writeVault(path, key, { cas: 0 })\n    if (outcome === 'ok') {\n      logger.info('Stored tenant DEK in Vault', { tenantId, path })\n      return this.remember({ tenantId, key, fetchedAt: this.now() })\n    }\n    if (outcome === 'conflict') {\n      // A concurrent create won the CAS race \u2014 adopt the winner's key so both\n      // callers encrypt under the same DEK.\n      const winner = await this.readVault(path)\n      const winnerKey = winner?.data?.data?.key\n      if (winnerKey) {\n        logger.info('Adopted concurrently-created tenant DEK', { tenantId, path })\n        return this.remember({ tenantId, key: winnerKey, fetchedAt: this.now() })\n      }\n    }\n    logger.warn('Failed to store tenant DEK in Vault', { tenantId, path })\n    return null\n  }\n\n  invalidateDek(tenantId: string): void {\n    this.cache.delete(tenantId)\n  }\n}\n\nlet loggedDerivedKeyFallbackBanner = false\n\nexport function buildDerivedKeyFallbackBannerLines(opts: DerivedSecret): string[] {\n  const sourceLine =\n    opts.source === 'explicit' ? `Source: ${opts.envName}` : 'Source: dev default secret (do NOT use in production)'\n  return [\n    '\uD83D\uDEA8 Using derived tenant encryption keys (Vault unavailable / no DEK)',\n    sourceLine,\n    'Persist this secret securely. Without it, encrypted tenant data cannot be recovered after restart.',\n  ]\n}\n\nfunction logDerivedKeyFallbackBanner(opts: DerivedSecret): void {\n  if (process.env.NODE_ENV === 'test' || loggedDerivedKeyFallbackBanner) return\n  loggedDerivedKeyFallbackBanner = true\n  const redBg = '\\x1b[41m'\n  const white = '\\x1b[97m'\n  const reset = '\\x1b[0m'\n  const width = 110\n  const border = `${redBg}${white}${'\u2501'.repeat(width)}${reset}`\n  const body = buildDerivedKeyFallbackBannerLines(opts)\n  const bannerLines = [\n    border,\n    ...body.map((line) => `${redBg}${white} ${line.padEnd(width - 2, ' ')} ${reset}`),\n    border,\n  ]\n  process.stderr.write(bannerLines.join('\\n') + '\\n')\n  logger.warn('Using derived tenant encryption keys (Vault unavailable / no DEK)', {\n    fallbackSource: opts.envName,\n  })\n}\n\n/**\n * What the runtime should do about tenant data encryption right now.\n *\n * `isHealthy()` alone cannot answer this: {@link NoopKmsService} reports healthy precisely when\n * encryption is switched OFF, so `enabled && healthy` collapses correctly but a bare\n * `if (!kms.isHealthy())` guard reads the two opposite situations as the same one. They call for\n * opposite handling, so name them:\n *\n * - `disabled`    \u2014 the operator set `TENANT_DATA_ENCRYPTION=no`. Plaintext is the intended\n *                   outcome; degrade to it rather than failing.\n * - `active`      \u2014 encryption is on and a DEK is reachable. Encrypt.\n * - `unavailable` \u2014 encryption is on but no DEK is reachable (Vault down, no fallback secret).\n *                   Data that is meant to be ciphertext MUST NOT be written as plaintext; callers\n *                   holding secrets fail closed here (spec 2026-05-29, security finding #7).\n */\nexport type TenantDataEncryptionMode = 'disabled' | 'active' | 'unavailable'\n\nexport function resolveEncryptionMode(kms: Pick<KmsService, 'isHealthy'>): TenantDataEncryptionMode {\n  if (!isTenantDataEncryptionEnabled()) return 'disabled'\n  return kms.isHealthy() ? 'active' : 'unavailable'\n}\n\nexport function createKmsService(): KmsService {\n  if (!isTenantDataEncryptionEnabled()) return new NoopKmsService()\n  const primary = new HashicorpVaultKmsService()\n\n  const derived = resolveDerivedKeySecret()\n  const fallback = derived ? new DerivedKmsService(derived.secret) : null\n  const notifyFallback = derived\n    ? () => {\n        logDerivedKeyFallbackBanner(derived)\n      }\n    : undefined\n\n  if (!primary.isHealthy()) {\n    if (fallback) {\n      notifyFallback?.()\n      return fallback\n    }\n    logger.warn('Vault not healthy or misconfigured (missing VAULT_ADDR/VAULT_TOKEN) and no fallback secret provided; falling back to noop KMS')\n    return new NoopKmsService()\n  }\n\n  if (fallback) {\n    return new FallbackKmsService(primary, fallback, notifyFallback)\n  }\n\n  return primary\n}\n\nexport { hashForLookup }\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,aAAa,qBAAqB;AAC3C,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB,wBAAwB;AAEnD,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAEhE,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAE3C,SAAS,+BAAuC;AAC9C,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAChD,SAAO,iBAAiB,QAAQ,gCAAgC;AAClE;AAEA,SAAS,iCAAyC;AAChD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAChD,SAAO,iBAAiB,QAAQ,kCAAkC;AACpE;AAeA,MAAM,mBAAyC;AAAA,EAE7C,YACmB,SACA,UACA,YACjB;AAHiB;AACA;AACA;AAJnB,SAAQ,WAAW;AAAA,EAKhB;AAAA,EAEH,YAAqB;AACnB,WAAO,KAAK,QAAQ,UAAU,KAAK,QAAQ,KAAK,UAAU,YAAY,CAAC;AAAA,EACzE;AAAA,EAEQ,iBAAiB;AACvB,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,MAAc,YAAe,IAAgD;AAC3E,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,KAAK,yCAAyC,EAAE,IAAI,CAAC;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,aAAa,QAAQ,CAAC;AAC5E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,aAAa,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,gBAAgB,QAAQ,CAAC;AAC/E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,gBAAgB,QAAQ;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,UAAwB;AACpC,SAAK,QAAQ,gBAAgB,QAAQ;AACrC,SAAK,UAAU,gBAAgB,QAAQ;AAAA,EACzC;AACF;AAmBA,SAAS,aAAa,OAAmC;AACvD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAIA,SAAS,0BAAgD;AACvD,QAAM,aAA+D;AAAA,IACnE,EAAE,OAAO,QAAQ,IAAI,uCAAuC,MAAM,SAAS,sCAAsC;AAAA,IACjH,EAAE,OAAO,QAAQ,IAAI,8BAA8B,MAAM,SAAS,6BAA6B;AAAA,EACjG;AACA,aAAW,OAAO,YAAY;AAC5B,UAAM,aAAa,aAAa,IAAI,SAAS,MAAS;AACtD,QAAI,WAAY,QAAO,EAAE,QAAQ,YAAY,QAAQ,YAAY,SAAS,IAAI,QAAQ;AAAA,EACxF;AACA,MACE,QAAQ,IAAI,aAAa,gBACtB,kBAAkB,QAAQ,IAAI,0BAA0B,MAAM,MACjE;AACA,WAAO,EAAE,QAAQ,4BAA4B,QAAQ,eAAe,SAAS,cAAc;AAAA,EAC7F;AACA,SAAO;AACT;AAEO,MAAM,eAAqC;AAAA,EAChD,YAAqB;AAAE,WAAO,CAAC,8BAA8B;AAAA,EAAE;AAAA,EAC/D,MAAM,eAA0C;AAAE,WAAO;AAAA,EAAK;AAAA,EAC9D,MAAM,kBAA6C;AAAE,WAAO;AAAA,EAAK;AACnE;AAEA,MAAM,kBAAwC;AAAA,EAE5C,YAAY,QAAgB;AAE1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO;AAAA,EAChE;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEO,MAAM,yBAA+C;AAAA,EAoB1D,YAAY,OAAwB,CAAC,GAAG;AAnBxC,SAAQ,QAAQ,oBAAI,IAAuB;AAO3C,SAAQ,UAAU;AAIlB;AAAA;AAAA;AAAA,SAAQ,gBAAgB;AAIxB;AAAA;AAAA;AAAA,SAAQ,yBAAwC;AAK9C,SAAK,YAAY,aAAa,KAAK,aAAa,QAAQ,IAAI,cAAc,EAAE;AAC5E,SAAK,aAAa,aAAa,KAAK,cAAc,QAAQ,IAAI,eAAe,EAAE;AAC/E,SAAK,aAAa,KAAK,aAAa,QAAQ,IAAI,iBAAiB,eAAe,QAAQ,QAAQ,EAAE;AAClG,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,6BAA6B,CAAC;AAC9F,SAAK,qBAAqB,iBAAiB,KAAK,oBAAoB,+BAA+B,CAAC;AACpG,SAAK,eAAe,yBAAyB;AAC7C,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,WAAK,gBAAgB;AACrB,UAAI,KAAK,cAAc;AACrB,eAAO,KAAK,yDAAyD;AAAA,MACvE;AAAA,IACF;AACA,QAAI,KAAK,WAAW,CAAC,yBAAyB,cAAc,KAAK,cAAc;AAC7E,+BAAyB,aAAa;AACtC,UAAI,KAAK,cAAc;AACrB,eAAO,KAAK,6BAA6B;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AAAA,EAvBA;AAAA,SAAe,aAAa;AAAA;AAAA,EAyB5B,YAAqB;AAEnB,QAAI,KAAK,cAAe,QAAO;AAC/B,QAAI,KAAK,QAAS,QAAO;AAKzB,QAAI,KAAK,2BAA2B,KAAM,QAAO;AACjD,WAAO,KAAK,IAAI,IAAI,KAAK,0BAA0B,KAAK;AAAA,EAC1D;AAAA,EAEQ,MAAc;AACpB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA;AAAA,EAGQ,cAAoB;AAC1B,SAAK,UAAU;AACf,SAAK,yBAAyB;AAAA,EAChC;AAAA;AAAA;AAAA,EAIQ,uBAA6B;AACnC,SAAK,UAAU;AACf,SAAK,yBAAyB,KAAK,IAAI;AAAA,EACzC;AAAA,EAEQ,SAAS,UAAoC;AACnD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,OAAO;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,MAAiD;AACvE,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,WAAK,gBAAgB;AACrB,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,iBAAiB,KAAK,WAAW;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AAIX,YAAI,IAAI,UAAU,IAAK,MAAK,qBAAqB;AAAA,YAC5C,MAAK,YAAY;AACtB,eAAO,KAAK,qBAAqB,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAC7D,eAAO;AAAA,MACT;AACA,WAAK,YAAY;AACjB,UAAI,KAAK,cAAc;AACrB,eAAO,KAAK,iBAAiB,EAAE,KAAK,CAAC;AAAA,MACvC;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB,SAAS,KAAK;AACZ,WAAK,qBAAqB;AAC1B,aAAO,KAAK,oBAAoB,EAAE,MAAM,KAAK,WAAW,KAAK,iBAAiB,CAAC;AAC/E,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,MAAc,KAAa,MAAqD;AACvG,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,WAAK,gBAAgB;AACrB,aAAO;AAAA,IACT;AACA,UAAM,OAA6D,EAAE,MAAM,EAAE,IAAI,EAAE;AACnF,QAAI,OAAO,MAAM,QAAQ,SAAU,MAAK,UAAU,EAAE,KAAK,KAAK,IAAI;AAClE,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,UAAI,IAAI,IAAI;AACV,aAAK,YAAY;AACjB,eAAO;AAAA,MACT;AAIA,UAAI,OAAO,MAAM,QAAQ,YAAY,IAAI,WAAW,KAAK;AACvD,aAAK,YAAY;AACjB,eAAO,KAAK,oDAAoD,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAC5F,eAAO;AAAA,MACT;AACA,WAAK,qBAAqB;AAC1B,aAAO,KAAK,sBAAsB,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAC9D,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,WAAK,qBAAqB;AAC1B,aAAO,KAAK,qBAAqB,EAAE,MAAM,KAAK,WAAW,KAAK,iBAAiB,CAAC;AAChF,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,aAAa,UAA0B;AAC7C,UAAM,SAAS,cAAc,QAAQ;AACrC,UAAM,kBAAkB,KAAK,UAAU,QAAQ,QAAQ,EAAE;AACzD,WAAO,GAAG,eAAe,IAAI,MAAM;AAAA,EACrC;AAAA,EAEQ,SAAS,OAA6B;AAC5C,SAAK,MAAM,IAAI,MAAM,UAAU,KAAK;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,UAAM,SAAS,KAAK,SAAS,QAAQ;AACrC,QAAI,OAAQ,QAAO;AACnB,UAAM,OAAO,KAAK,aAAa,QAAQ;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,IAAI;AACrC,UAAM,MAAM,KAAK,MAAM,MAAM;AAC7B,QAAI,CAAC,KAAK;AACR,aAAO,KAAK,gCAAgC,EAAE,UAAU,KAAK,CAAC;AAC9D,aAAO;AAAA,IACT;AACA,UAAM,MAAiB,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE;AAC9D,WAAO,KAAK,SAAS,GAAG;AAAA,EAC1B;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,UAAM,OAAO,KAAK,aAAa,QAAQ;AAIvC,UAAM,WAAW,MAAM,KAAK,UAAU,IAAI;AAC1C,UAAM,cAAc,UAAU,MAAM,MAAM;AAC1C,QAAI,aAAa;AACf,aAAO,KAAK,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,IAC5E;AAGA,QAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,UAAM,MAAM,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,WAAW,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;AAC3D,QAAI,YAAY,MAAM;AACpB,aAAO,KAAK,8BAA8B,EAAE,UAAU,KAAK,CAAC;AAC5D,aAAO,KAAK,SAAS,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,IAC/D;AACA,QAAI,YAAY,YAAY;AAG1B,YAAM,SAAS,MAAM,KAAK,UAAU,IAAI;AACxC,YAAM,YAAY,QAAQ,MAAM,MAAM;AACtC,UAAI,WAAW;AACb,eAAO,KAAK,2CAA2C,EAAE,UAAU,KAAK,CAAC;AACzE,eAAO,KAAK,SAAS,EAAE,UAAU,KAAK,WAAW,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF;AACA,WAAO,KAAK,uCAAuC,EAAE,UAAU,KAAK,CAAC;AACrE,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,UAAwB;AACpC,SAAK,MAAM,OAAO,QAAQ;AAAA,EAC5B;AACF;AAEA,IAAI,iCAAiC;AAE9B,SAAS,mCAAmC,MAA+B;AAChF,QAAM,aACJ,KAAK,WAAW,aAAa,WAAW,KAAK,OAAO,KAAK;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,MAA2B;AAC9D,MAAI,QAAQ,IAAI,aAAa,UAAU,+BAAgC;AACvE,mCAAiC;AACjC,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAI,OAAO,KAAK,CAAC,GAAG,KAAK;AAC3D,QAAM,OAAO,mCAAmC,IAAI;AACpD,QAAM,cAAc;AAAA,IAClB;AAAA,IACA,GAAG,KAAK,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,GAAG,CAAC,IAAI,KAAK,EAAE;AAAA,IAChF;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,YAAY,KAAK,IAAI,IAAI,IAAI;AAClD,SAAO,KAAK,qEAAqE;AAAA,IAC/E,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACH;AAmBO,SAAS,sBAAsB,KAA8D;AAClG,MAAI,CAAC,8BAA8B,EAAG,QAAO;AAC7C,SAAO,IAAI,UAAU,IAAI,WAAW;AACtC;AAEO,SAAS,mBAA+B;AAC7C,MAAI,CAAC,8BAA8B,EAAG,QAAO,IAAI,eAAe;AAChE,QAAM,UAAU,IAAI,yBAAyB;AAE7C,QAAM,UAAU,wBAAwB;AACxC,QAAM,WAAW,UAAU,IAAI,kBAAkB,QAAQ,MAAM,IAAI;AACnE,QAAM,iBAAiB,UACnB,MAAM;AACJ,gCAA4B,OAAO;AAAA,EACrC,IACA;AAEJ,MAAI,CAAC,QAAQ,UAAU,GAAG;AACxB,QAAI,UAAU;AACZ,uBAAiB;AACjB,aAAO;AAAA,IACT;AACA,WAAO,KAAK,+HAA+H;AAC3I,WAAO,IAAI,eAAe;AAAA,EAC5B;AAEA,MAAI,UAAU;AACZ,WAAO,IAAI,mBAAmB,SAAS,UAAU,cAAc;AAAA,EACjE;AAEA,SAAO;AACT;",
   "names": []
 }

package/dist/lib/encryption/likeFilterWarning.js

@@ -43,7 +43,9 @@ function resolveEntityId(em, entityName) {
 }
 async function warnOnEncryptedLikeFilter(params) {
   if (!isWarningEnabled()) return;
-  const fields = collectLikeFilterFields(params.where);
+  const fields = Array.from(
+    /* @__PURE__ */ new Set([...collectLikeFilterFields(params.where), ...params.likeFields ?? []])
+  );
   if (!fields.length) return;
   try {
     const entity = resolveEntityId(params.em, params.entityName);

package/dist/lib/encryption/likeFilterWarning.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/likeFilterWarning.ts"],
-  "sourcesContent": ["import type { EntityManager, EntityName } from '@mikro-orm/postgresql'\nimport { warnOnCiphertextLikeFallback } from '../query/ciphertext-search-warning'\nimport { resolveTenantEncryptionService } from './customFieldValues'\nimport { resolveEntityIdFromMetadata } from './entityIds'\nimport type { TenantDataEncryptionService } from './tenantDataEncryptionService'\n\nconst LIKE_OPERATORS = new Set(['$like', '$ilike', '$re', '$fulltext'])\nconst LOGICAL_OPERATORS = new Set(['$and', '$or', '$not', '$every', '$some', '$none'])\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value) && !(value instanceof Date)\n\n// An operator object holds only `$`-prefixed keys. Anything else is a nested\n// relation filter, whose property names belong to another entity's encryption\n// map \u2014 attributing them to the root entity would produce false warnings.\nconst isOperatorObject = (value: unknown): value is Record<string, unknown> => {\n  if (!isPlainObject(value)) return false\n  const keys = Object.keys(value)\n  return keys.length > 0 && keys.every((key) => key.startsWith('$'))\n}\n\nfunction walkFilter(node: unknown, field: string | null, out: Set<string>): void {\n  if (Array.isArray(node)) {\n    for (const item of node) walkFilter(item, field, out)\n    return\n  }\n  if (!isPlainObject(node)) return\n  for (const [key, value] of Object.entries(node)) {\n    if (LIKE_OPERATORS.has(key)) {\n      if (field) out.add(field)\n      continue\n    }\n    if (LOGICAL_OPERATORS.has(key)) {\n      walkFilter(value, field, out)\n      continue\n    }\n    if (key.startsWith('$')) continue\n    if (isOperatorObject(value)) walkFilter(value, key, out)\n  }\n}\n\n/**\n * Lists the root-entity properties a filter targets with a string-matching\n * operator (`$like`, `$ilike`, `$re`, `$fulltext`), including inside\n * `$and`/`$or`/`$not` branches.\n */\nexport function collectLikeFilterFields(where: unknown): string[] {\n  const found = new Set<string>()\n  walkFilter(where, null, found)\n  return Array.from(found)\n}\n\n// The map lookup behind the warning issues an uncached read against\n// `encryption_maps`, and this path runs on every matching query rather than in a\n// rare fallback branch \u2014 so the check stays out of production entirely.\nconst isWarningEnabled = (): boolean => process.env.NODE_ENV !== 'production'\n\nfunction resolveEntityId(em: EntityManager, entityName: EntityName<any>): string | null {\n  const metadata = (em as any)?.getMetadata?.()\n  if (!metadata || typeof metadata.find !== 'function') return null\n  const name = typeof entityName === 'string' ? entityName : (entityName as any)?.name\n  if (!name) return null\n  return resolveEntityIdFromMetadata(metadata.find(name) ?? undefined)\n}\n\n/**\n * Warn, outside production, when a `where` clause matches an encrypted-at-rest\n * column with a string operator.\n *\n * Decryption happens on load, not on filter, so the predicate compares a\n * plaintext pattern against ciphertext: it matches nothing and does not raise,\n * which is indistinguishable from a genuine empty result. The query engines\n * already warn about their own `ILIKE` fallback; this covers the raw-ORM path\n * that never reaches them. Issue #5051, related to #2990.\n *\n * Never throws and never blocks the query.\n */\nexport async function warnOnEncryptedLikeFilter(params: {\n  em: EntityManager\n  entityName: EntityName<any>\n  where: unknown\n  tenantId?: string | null\n  encryptionService?: TenantDataEncryptionService | null\n}): Promise<void> {\n  if (!isWarningEnabled()) return\n  const fields = collectLikeFilterFields(params.where)\n  if (!fields.length) return\n  try {\n    const entity = resolveEntityId(params.em, params.entityName)\n    if (!entity) return\n    const service = params.encryptionService ?? resolveTenantEncryptionService(params.em)\n    await warnOnCiphertextLikeFallback({\n      entity,\n      fields,\n      tenantId: params.tenantId ?? null,\n      reason: 'raw-orm-filter',\n      service,\n    })\n  } catch {\n    // A diagnostic must never break the query it is diagnosing.\n  }\n}\n"],
-  "mappings": "AACA,SAAS,oCAAoC;AAC7C,SAAS,sCAAsC;AAC/C,SAAS,mCAAmC;AAG5C,MAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,WAAW,CAAC;AACtE,MAAM,oBAAoB,oBAAI,IAAI,CAAC,QAAQ,OAAO,QAAQ,UAAU,SAAS,OAAO,CAAC;AAErF,MAAM,gBAAgB,CAAC,UACrB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB;AAK7F,MAAM,mBAAmB,CAAC,UAAqD;AAC7E,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,QAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,SAAO,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,QAAQ,IAAI,WAAW,GAAG,CAAC;AACnE;AAEA,SAAS,WAAW,MAAe,OAAsB,KAAwB;AAC/E,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,eAAW,QAAQ,KAAM,YAAW,MAAM,OAAO,GAAG;AACpD;AAAA,EACF;AACA,MAAI,CAAC,cAAc,IAAI,EAAG;AAC1B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,eAAe,IAAI,GAAG,GAAG;AAC3B,UAAI,MAAO,KAAI,IAAI,KAAK;AACxB;AAAA,IACF;AACA,QAAI,kBAAkB,IAAI,GAAG,GAAG;AAC9B,iBAAW,OAAO,OAAO,GAAG;AAC5B;AAAA,IACF;AACA,QAAI,IAAI,WAAW,GAAG,EAAG;AACzB,QAAI,iBAAiB,KAAK,EAAG,YAAW,OAAO,KAAK,GAAG;AAAA,EACzD;AACF;AAOO,SAAS,wBAAwB,OAA0B;AAChE,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,OAAO,MAAM,KAAK;AAC7B,SAAO,MAAM,KAAK,KAAK;AACzB;AAKA,MAAM,mBAAmB,MAAe,QAAQ,IAAI,aAAa;AAEjE,SAAS,gBAAgB,IAAmB,YAA4C;AACtF,QAAM,WAAY,IAAY,cAAc;AAC5C,MAAI,CAAC,YAAY,OAAO,SAAS,SAAS,WAAY,QAAO;AAC7D,QAAM,OAAO,OAAO,eAAe,WAAW,aAAc,YAAoB;AAChF,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,4BAA4B,SAAS,KAAK,IAAI,KAAK,MAAS;AACrE;AAcA,eAAsB,0BAA0B,QAM9B;AAChB,MAAI,CAAC,iBAAiB,EAAG;AACzB,QAAM,SAAS,wBAAwB,OAAO,KAAK;AACnD,MAAI,CAAC,OAAO,OAAQ;AACpB,MAAI;AACF,UAAM,SAAS,gBAAgB,OAAO,IAAI,OAAO,UAAU;AAC3D,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU,OAAO,qBAAqB,+BAA+B,OAAO,EAAE;AACpF,UAAM,6BAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,UAAU,OAAO,YAAY;AAAA,MAC7B,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;",
+  "sourcesContent": ["import type { EntityManager, EntityName } from '@mikro-orm/postgresql'\nimport { warnOnCiphertextLikeFallback } from '../query/ciphertext-search-warning'\nimport { resolveTenantEncryptionService } from './customFieldValues'\nimport { resolveEntityIdFromMetadata } from './entityIds'\nimport type { TenantDataEncryptionService } from './tenantDataEncryptionService'\n\nconst LIKE_OPERATORS = new Set(['$like', '$ilike', '$re', '$fulltext'])\nconst LOGICAL_OPERATORS = new Set(['$and', '$or', '$not', '$every', '$some', '$none'])\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value) && !(value instanceof Date)\n\n// An operator object holds only `$`-prefixed keys. Anything else is a nested\n// relation filter, whose property names belong to another entity's encryption\n// map \u2014 attributing them to the root entity would produce false warnings.\nconst isOperatorObject = (value: unknown): value is Record<string, unknown> => {\n  if (!isPlainObject(value)) return false\n  const keys = Object.keys(value)\n  return keys.length > 0 && keys.every((key) => key.startsWith('$'))\n}\n\nfunction walkFilter(node: unknown, field: string | null, out: Set<string>): void {\n  if (Array.isArray(node)) {\n    for (const item of node) walkFilter(item, field, out)\n    return\n  }\n  if (!isPlainObject(node)) return\n  for (const [key, value] of Object.entries(node)) {\n    if (LIKE_OPERATORS.has(key)) {\n      if (field) out.add(field)\n      continue\n    }\n    if (LOGICAL_OPERATORS.has(key)) {\n      walkFilter(value, field, out)\n      continue\n    }\n    if (key.startsWith('$')) continue\n    if (isOperatorObject(value)) walkFilter(value, key, out)\n  }\n}\n\n/**\n * Lists the root-entity properties a filter targets with a string-matching\n * operator (`$like`, `$ilike`, `$re`, `$fulltext`), including inside\n * `$and`/`$or`/`$not` branches.\n */\nexport function collectLikeFilterFields(where: unknown): string[] {\n  const found = new Set<string>()\n  walkFilter(where, null, found)\n  return Array.from(found)\n}\n\n// The map lookup behind the warning issues an uncached read against\n// `encryption_maps`, and this path runs on every matching query rather than in a\n// rare fallback branch \u2014 so the check stays out of production entirely.\nconst isWarningEnabled = (): boolean => process.env.NODE_ENV !== 'production'\n\nfunction resolveEntityId(em: EntityManager, entityName: EntityName<any>): string | null {\n  const metadata = (em as any)?.getMetadata?.()\n  if (!metadata || typeof metadata.find !== 'function') return null\n  const name = typeof entityName === 'string' ? entityName : (entityName as any)?.name\n  if (!name) return null\n  return resolveEntityIdFromMetadata(metadata.find(name) ?? undefined)\n}\n\n/**\n * Warn, outside production, when a `where` clause matches an encrypted-at-rest\n * column with a string operator.\n *\n * Decryption happens on load, not on filter, so the predicate compares a\n * plaintext pattern against ciphertext: it matches nothing and does not raise,\n * which is indistinguishable from a genuine empty result. The query engines\n * already warn about their own `ILIKE` fallback; this covers the raw-ORM path\n * that never reaches them. Issue #5051, related to #2990.\n *\n * A caller whose predicate the walker cannot read \u2014 a `raw()` fragment keyed by\n * a symbol, say, which `Object.entries` never yields \u2014 passes the matched\n * properties as `likeFields` instead, so wrapping a filter in raw SQL does not\n * silently opt it out of the diagnostic.\n *\n * Never throws and never blocks the query.\n */\nexport async function warnOnEncryptedLikeFilter(params: {\n  em: EntityManager\n  entityName: EntityName<any>\n  where?: unknown\n  likeFields?: readonly string[]\n  tenantId?: string | null\n  encryptionService?: TenantDataEncryptionService | null\n}): Promise<void> {\n  if (!isWarningEnabled()) return\n  const fields = Array.from(\n    new Set([...collectLikeFilterFields(params.where), ...(params.likeFields ?? [])]),\n  )\n  if (!fields.length) return\n  try {\n    const entity = resolveEntityId(params.em, params.entityName)\n    if (!entity) return\n    const service = params.encryptionService ?? resolveTenantEncryptionService(params.em)\n    await warnOnCiphertextLikeFallback({\n      entity,\n      fields,\n      tenantId: params.tenantId ?? null,\n      reason: 'raw-orm-filter',\n      service,\n    })\n  } catch {\n    // A diagnostic must never break the query it is diagnosing.\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oCAAoC;AAC7C,SAAS,sCAAsC;AAC/C,SAAS,mCAAmC;AAG5C,MAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,WAAW,CAAC;AACtE,MAAM,oBAAoB,oBAAI,IAAI,CAAC,QAAQ,OAAO,QAAQ,UAAU,SAAS,OAAO,CAAC;AAErF,MAAM,gBAAgB,CAAC,UACrB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB;AAK7F,MAAM,mBAAmB,CAAC,UAAqD;AAC7E,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,QAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,SAAO,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,QAAQ,IAAI,WAAW,GAAG,CAAC;AACnE;AAEA,SAAS,WAAW,MAAe,OAAsB,KAAwB;AAC/E,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,eAAW,QAAQ,KAAM,YAAW,MAAM,OAAO,GAAG;AACpD;AAAA,EACF;AACA,MAAI,CAAC,cAAc,IAAI,EAAG;AAC1B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,eAAe,IAAI,GAAG,GAAG;AAC3B,UAAI,MAAO,KAAI,IAAI,KAAK;AACxB;AAAA,IACF;AACA,QAAI,kBAAkB,IAAI,GAAG,GAAG;AAC9B,iBAAW,OAAO,OAAO,GAAG;AAC5B;AAAA,IACF;AACA,QAAI,IAAI,WAAW,GAAG,EAAG;AACzB,QAAI,iBAAiB,KAAK,EAAG,YAAW,OAAO,KAAK,GAAG;AAAA,EACzD;AACF;AAOO,SAAS,wBAAwB,OAA0B;AAChE,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,OAAO,MAAM,KAAK;AAC7B,SAAO,MAAM,KAAK,KAAK;AACzB;AAKA,MAAM,mBAAmB,MAAe,QAAQ,IAAI,aAAa;AAEjE,SAAS,gBAAgB,IAAmB,YAA4C;AACtF,QAAM,WAAY,IAAY,cAAc;AAC5C,MAAI,CAAC,YAAY,OAAO,SAAS,SAAS,WAAY,QAAO;AAC7D,QAAM,OAAO,OAAO,eAAe,WAAW,aAAc,YAAoB;AAChF,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,4BAA4B,SAAS,KAAK,IAAI,KAAK,MAAS;AACrE;AAmBA,eAAsB,0BAA0B,QAO9B;AAChB,MAAI,CAAC,iBAAiB,EAAG;AACzB,QAAM,SAAS,MAAM;AAAA,IACnB,oBAAI,IAAI,CAAC,GAAG,wBAAwB,OAAO,KAAK,GAAG,GAAI,OAAO,cAAc,CAAC,CAAE,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,OAAO,OAAQ;AACpB,MAAI;AACF,UAAM,SAAS,gBAAgB,OAAO,IAAI,OAAO,UAAU;AAC3D,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU,OAAO,qBAAqB,+BAA+B,OAAO,EAAE;AACpF,UAAM,6BAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,UAAU,OAAO,YAAY;AAAA,MAC7B,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;",
   "names": []
 }