@open-mercato/shared 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/dist/lib/catalog-visibility/unionScopes.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/catalog-visibility/unionScopes.ts"],
+  "sourcesContent": ["import type { AssortmentScope, EffectiveAssortmentScope } from './types'\n\n/**\n * Combines N independent sources' own scopes into one OR-list.\n * THE CRITICAL CORRECTNESS REQUIREMENT (a first draft got this wrong \u2014 R2 defect):\n * do NOT merge every source's categoryIds/tagIds into one flat AssortmentScope object.\n * That computes AND across sources' dimensions instead of OR. Each source becomes its\n * own OR-branch in the returned list, UNMODIFIED \u2014 nothing about one source's scope\n * changes because another source exists. The returned list is a fresh array, never the\n * caller's own.\n */\nexport function unionScopes(scopes: Array<AssortmentScope | null>): EffectiveAssortmentScope {\n  if (scopes.length === 0) return null\n  if (scopes.some((s) => s === null)) return null\n  return scopes.filter((scope): scope is AssortmentScope => scope !== null)\n}\n"],
+  "mappings": "AAWO,SAAS,YAAY,QAAiE;AAC3F,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI,OAAO,KAAK,CAAC,MAAM,MAAM,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,OAAO,CAAC,UAAoC,UAAU,IAAI;AAC1E;",
+  "names": []
+}

package/dist/lib/commands/command-bus.js

@@ -18,7 +18,32 @@ import {
 import { CommandInterceptorError } from "./errors.js";
 import { isReadProjectionAlwaysConsistent } from "@open-mercato/shared/lib/data/consistency";
 import { createLogger } from "../logger/index.js";
+import { withAtomicFlush } from "./flush.js";
+import {
+  getTransactionLifetime,
+  onTransactionLifetimeComplete,
+  ownsTransactionLifetime
+} from "./transaction-lifetime.js";
 const logger = createLogger("shared").child({ component: "commands" });
+function isInTransaction(em) {
+  const probe = em.isInTransaction;
+  return typeof probe === "function" && probe.call(em);
+}
+function resolveAtomicReplayTransaction(ctx) {
+  const em = ctx.transactionalEm ?? ctx.container.resolve("em");
+  const joinsAmbient = isInTransaction(em);
+  if (joinsAmbient && !ownsTransactionLifetime(em, ctx.transactionLifetime)) {
+    throw new Error("[internal] Ambient atomic replay requires its outer transaction lifetime owner");
+  }
+  return { em, joinsAmbient };
+}
+function bindReplayTransactionContext(ctx, em, expectedLifetime) {
+  const transactionLifetime = getTransactionLifetime(em);
+  if (!transactionLifetime || expectedLifetime && transactionLifetime !== expectedLifetime) {
+    throw new Error("[internal] Atomic replay transaction lifetime owner changed before replay");
+  }
+  return { ...ctx, transactionalEm: em, transactionLifetime };
+}
 const SKIPPED_ACTION_LOG_RESOURCE_KINDS = /* @__PURE__ */ new Set([
   "audit_logs.access",
   "audit_logs.action",
@@ -176,117 +201,227 @@ function extractAliasList(source) {
 class CommandBus {
   async execute(commandId, options) {
     const handler = await this.resolveHandler(commandId);
+    const replayLogEntry = options.redoLogEntry ?? null;
+    const isAtomicReplay = replayLogEntry !== null && handler.atomicReplay === true;
     const allInterceptors = getAllCommandInterceptorInstances();
     let interceptorMetadata = /* @__PURE__ */ new Map();
     let effectiveOptions = options;
-    const userFeatures = allInterceptors.length ? await this.resolveUserFeaturesForInterceptors(options.ctx) : [];
-    if (allInterceptors.length) {
+    let userFeatures = [];
+    const runBeforeExecuteInterceptors = async (baseOptions) => {
+      const resolvedUserFeatures = allInterceptors.length ? await this.resolveUserFeaturesForInterceptors(baseOptions.ctx) : [];
+      if (!allInterceptors.length) {
+        return {
+          effectiveOptions: baseOptions,
+          metadata: /* @__PURE__ */ new Map(),
+          userFeatures: resolvedUserFeatures
+        };
+      }
       const interceptorCtx = {
         commandId,
-        auth: options.ctx.auth ?? null,
-        selectedOrganizationId: options.ctx.selectedOrganizationId ?? options.ctx.auth?.orgId ?? null,
-        container: options.ctx.container
+        auth: baseOptions.ctx.auth ?? null,
+        selectedOrganizationId: baseOptions.ctx.selectedOrganizationId ?? baseOptions.ctx.auth?.orgId ?? null,
+        container: baseOptions.ctx.container
       };
       const beforeResult = await runCommandInterceptorsBefore(
         allInterceptors,
         commandId,
-        options.input,
+        baseOptions.input,
         interceptorCtx,
-        userFeatures
+        resolvedUserFeatures
       );
       if (!beforeResult.ok) {
         const blocked = beforeResult.error;
         throw new CommandInterceptorError(blocked.message, { status: blocked.status, body: blocked.body });
       }
-      interceptorMetadata = beforeResult.metadataByInterceptor;
-      if (beforeResult.modifiedInput) {
-        effectiveOptions = {
-          ...options,
-          input: { ...options.input, ...beforeResult.modifiedInput }
-        };
-      }
-    }
-    const snapshots = await this.prepareSnapshots(handler, effectiveOptions);
-    const redoLogEntry = effectiveOptions.redoLogEntry ?? null;
-    const result = redoLogEntry && typeof handler.redo === "function" ? await handler.redo({ input: effectiveOptions.input, ctx: effectiveOptions.ctx, logEntry: redoLogEntry }) : await handler.execute(effectiveOptions.input, effectiveOptions.ctx);
-    const afterSnapshot = await this.captureAfter(handler, effectiveOptions, result);
-    const snapshotsWithAfter = { ...snapshots, after: afterSnapshot };
-    const logMeta = await this.buildLog(handler, effectiveOptions, result, snapshotsWithAfter);
-    let mergedMeta = this.mergeMetadata(effectiveOptions.metadata, logMeta);
-    let interceptorContextMerged = {};
-    for (const meta of interceptorMetadata.values()) {
-      const logContextRecord = asRecord(asRecord(meta)?.logContext);
-      if (!logContextRecord) continue;
-      interceptorContextMerged = {
-        ...interceptorContextMerged,
-        ...logContextRecord
-      };
-    }
-    const baseContext = asRecord(effectiveOptions.metadata?.context) ?? {};
-    const logMetaContext = asRecord(logMeta?.context) ?? {};
-    if (Object.keys(interceptorContextMerged).length > 0 || Object.keys(baseContext).length > 0 || Object.keys(logMetaContext).length > 0) {
-      mergedMeta = mergedMeta ?? {};
-      mergedMeta.context = {
-        ...baseContext,
-        ...interceptorContextMerged,
-        ...logMetaContext
+      const preparedOptions = beforeResult.modifiedInput ? {
+        ...baseOptions,
+        input: { ...baseOptions.input, ...beforeResult.modifiedInput }
+      } : baseOptions;
+      return {
+        effectiveOptions: preparedOptions,
+        metadata: beforeResult.metadataByInterceptor,
+        userFeatures: resolvedUserFeatures
       };
+    };
+    if (replayLogEntry && !isAtomicReplay) {
+      await this.runReplayTransactionGuard(options.ctx, "redo", replayLogEntry);
+      if (handler.authorizeReplay) {
+        await handler.authorizeReplay({
+          operation: "redo",
+          input: options.input,
+          ctx: options.ctx,
+          logEntry: replayLogEntry
+        });
+      }
     }
-    const undoable = this.isUndoable(handler);
-    if (undoable) {
-      mergedMeta = mergedMeta ?? {};
-      if (!mergedMeta.undoToken) mergedMeta.undoToken = defaultUndoToken();
-      if (mergedMeta.actorUserId === void 0) mergedMeta.actorUserId = effectiveOptions.ctx.auth?.sub ?? null;
+    if (!isAtomicReplay) {
+      const prepared = await runBeforeExecuteInterceptors(options);
+      effectiveOptions = prepared.effectiveOptions;
+      interceptorMetadata = prepared.metadata;
+      userFeatures = prepared.userFeatures;
     }
-    if (afterSnapshot !== void 0 && afterSnapshot !== null) {
-      if (!mergedMeta) {
-        mergedMeta = { snapshotAfter: afterSnapshot };
-      } else if (!mergedMeta.snapshotAfter) {
-        mergedMeta.snapshotAfter = afterSnapshot;
+    const executeCore = async (coreOptions) => {
+      const sourceLog = coreOptions.redoLogEntry ?? null;
+      const snapshots = await this.prepareSnapshots(handler, coreOptions);
+      const result2 = sourceLog && typeof handler.redo === "function" ? await handler.redo({ input: coreOptions.input, ctx: coreOptions.ctx, logEntry: sourceLog }) : await handler.execute(coreOptions.input, coreOptions.ctx);
+      const afterSnapshot = await this.captureAfter(handler, coreOptions, result2);
+      const snapshotsWithAfter = { ...snapshots, after: afterSnapshot };
+      const logMeta = await this.buildLog(handler, coreOptions, result2, snapshotsWithAfter);
+      let mergedMeta2 = this.mergeMetadata(coreOptions.metadata, logMeta);
+      let interceptorContextMerged = {};
+      for (const meta of interceptorMetadata.values()) {
+        const logContextRecord = asRecord(asRecord(meta)?.logContext);
+        if (!logContextRecord) continue;
+        interceptorContextMerged = {
+          ...interceptorContextMerged,
+          ...logContextRecord
+        };
       }
-    }
-    if (snapshots.before) {
-      if (!mergedMeta) {
-        mergedMeta = { snapshotBefore: snapshots.before };
-      } else if (!mergedMeta.snapshotBefore) {
-        mergedMeta.snapshotBefore = snapshots.before;
+      const baseContext = asRecord(coreOptions.metadata?.context) ?? {};
+      const logMetaContext = asRecord(logMeta?.context) ?? {};
+      if (Object.keys(interceptorContextMerged).length > 0 || Object.keys(baseContext).length > 0 || Object.keys(logMetaContext).length > 0) {
+        mergedMeta2 = mergedMeta2 ?? {};
+        mergedMeta2.context = {
+          ...baseContext,
+          ...interceptorContextMerged,
+          ...logMetaContext
+        };
       }
-    }
-    if (mergedMeta?.snapshotBefore !== void 0 && mergedMeta?.snapshotAfter !== void 0) {
-      const currentChanges = mergedMeta.changes;
-      const shouldInfer = currentChanges === void 0 || currentChanges === null || typeof currentChanges === "object" && !Array.isArray(currentChanges) && Object.keys(currentChanges).length === 0;
-      if (shouldInfer) {
-        const inferred = deriveChangesFromSnapshots(mergedMeta.snapshotBefore, mergedMeta.snapshotAfter);
-        if (inferred) mergedMeta.changes = inferred;
+      const undoable = this.isUndoable(handler);
+      if (undoable && mergedMeta2?.replayable !== false) {
+        mergedMeta2 = mergedMeta2 ?? {};
+        if (!mergedMeta2.undoToken) mergedMeta2.undoToken = defaultUndoToken();
+        if (mergedMeta2.actorUserId === void 0) mergedMeta2.actorUserId = coreOptions.ctx.auth?.sub ?? null;
+      } else if (mergedMeta2?.replayable === false) {
+        mergedMeta2.undoToken = null;
       }
-    }
-    const logEntry = await this.persistLog(commandId, effectiveOptions, mergedMeta);
-    let finalResult = result;
-    if (allInterceptors.length) {
-      const interceptorCtx = {
-        commandId,
-        auth: effectiveOptions.ctx.auth ?? null,
-        selectedOrganizationId: effectiveOptions.ctx.selectedOrganizationId ?? effectiveOptions.ctx.auth?.orgId ?? null,
-        container: effectiveOptions.ctx.container
-      };
-      const afterResult = await runCommandInterceptorsAfter(
-        allInterceptors,
-        commandId,
-        effectiveOptions.input,
-        result,
-        interceptorCtx,
-        userFeatures,
-        interceptorMetadata
-      );
-      if (afterResult.modifiedResult && typeof result === "object" && result) {
-        finalResult = { ...result, ...afterResult.modifiedResult };
+      if (afterSnapshot !== void 0 && afterSnapshot !== null) {
+        if (!mergedMeta2) {
+          mergedMeta2 = { snapshotAfter: afterSnapshot };
+        } else if (!mergedMeta2.snapshotAfter) {
+          mergedMeta2.snapshotAfter = afterSnapshot;
+        }
+      }
+      if (snapshots.before) {
+        if (!mergedMeta2) {
+          mergedMeta2 = { snapshotBefore: snapshots.before };
+        } else if (!mergedMeta2.snapshotBefore) {
+          mergedMeta2.snapshotBefore = snapshots.before;
+        }
       }
+      if (mergedMeta2?.snapshotBefore !== void 0 && mergedMeta2?.snapshotAfter !== void 0) {
+        const currentChanges = mergedMeta2.changes;
+        const shouldInfer = currentChanges === void 0 || currentChanges === null || typeof currentChanges === "object" && !Array.isArray(currentChanges) && Object.keys(currentChanges).length === 0;
+        if (shouldInfer) {
+          const inferred = deriveChangesFromSnapshots(mergedMeta2.snapshotBefore, mergedMeta2.snapshotAfter);
+          if (inferred) mergedMeta2.changes = inferred;
+        }
+      }
+      const logEntry2 = await this.persistLog(commandId, coreOptions, mergedMeta2);
+      return { result: result2, mergedMeta: mergedMeta2, logEntry: logEntry2 };
+    };
+    let replaySourceFinalized = false;
+    let coreResult;
+    const atomicSourceLog = options.redoLogEntry ?? null;
+    let ambientReplay = null;
+    let replayTransactionLifetime = null;
+    if (atomicSourceLog && isAtomicReplay) {
+      ambientReplay = resolveAtomicReplayTransaction(options.ctx);
+      const replayEm = ambientReplay.em;
+      await withAtomicFlush(replayEm, [async () => {
+        const replayCtx = bindReplayTransactionContext(
+          options.ctx,
+          replayEm,
+          ambientReplay?.joinsAmbient ? options.ctx.transactionLifetime : void 0
+        );
+        replayTransactionLifetime = replayCtx.transactionLifetime ?? null;
+        const transactionalBaseOptions = {
+          ...options,
+          ctx: replayCtx
+        };
+        if (!atomicSourceLog.id) throw new Error("[internal] Atomic redo source log id is required");
+        if (handler.stabilizeReplay) {
+          await handler.stabilizeReplay({
+            operation: "redo",
+            input: transactionalBaseOptions.input,
+            ctx: transactionalBaseOptions.ctx,
+            logEntry: atomicSourceLog
+          });
+        }
+        await this.runReplayTransactionGuard(
+          transactionalBaseOptions.ctx,
+          "redo",
+          atomicSourceLog,
+          replayEm
+        );
+        const prepared = await runBeforeExecuteInterceptors(transactionalBaseOptions);
+        effectiveOptions = prepared.effectiveOptions;
+        interceptorMetadata = prepared.metadata;
+        userFeatures = prepared.userFeatures;
+        const service = effectiveOptions.ctx.container.resolve("actionLogService");
+        if (handler.authorizeReplay) {
+          await handler.authorizeReplay({
+            operation: "redo",
+            input: effectiveOptions.input,
+            ctx: effectiveOptions.ctx,
+            logEntry: atomicSourceLog
+          });
+        }
+        const claimed = await service.claimForRedo(atomicSourceLog.id, replayEm);
+        if (!claimed) throw new Error("[internal] Redo source already consumed");
+        coreResult = await executeCore(effectiveOptions);
+      }], { transaction: true, label: `${commandId}.redo` });
+      replaySourceFinalized = !ambientReplay.joinsAmbient;
+    } else {
+      coreResult = await executeCore(effectiveOptions);
     }
-    if (!effectiveOptions.skipCacheInvalidation) {
-      await this.invalidateCacheAfterExecute(commandId, effectiveOptions, finalResult, mergedMeta);
+    const { result, mergedMeta, logEntry } = coreResult;
+    const runPostCommit = async () => {
+      let finalResult = result;
+      if (allInterceptors.length) {
+        const interceptorCtx = {
+          commandId,
+          auth: effectiveOptions.ctx.auth ?? null,
+          selectedOrganizationId: effectiveOptions.ctx.selectedOrganizationId ?? effectiveOptions.ctx.auth?.orgId ?? null,
+          container: effectiveOptions.ctx.container
+        };
+        const afterResult = await runCommandInterceptorsAfter(
+          allInterceptors,
+          commandId,
+          effectiveOptions.input,
+          result,
+          interceptorCtx,
+          userFeatures,
+          interceptorMetadata
+        );
+        if (afterResult.modifiedResult && typeof result === "object" && result) {
+          finalResult = { ...result, ...afterResult.modifiedResult };
+        }
+      }
+      if (!effectiveOptions.skipCacheInvalidation) {
+        await this.invalidateCacheAfterExecute(commandId, effectiveOptions, finalResult, mergedMeta);
+      }
+      await this.flushCrudSideEffects(effectiveOptions.ctx.container, effectiveOptions.ctx?.bulkImport);
+      return finalResult;
+    };
+    const executionResult = {
+      result,
+      logEntry,
+      replaySourceFinalized
+    };
+    if (ambientReplay?.joinsAmbient) {
+      if (!replayTransactionLifetime || !ownsTransactionLifetime(ambientReplay.em, replayTransactionLifetime)) {
+        throw new Error("[internal] Ambient atomic replay lost its outer transaction lifetime owner");
+      }
+      onTransactionLifetimeComplete(ambientReplay.em, async (outcome) => {
+        if (outcome !== "committed") return;
+        executionResult.result = await runPostCommit();
+        executionResult.replaySourceFinalized = true;
+      });
+      return executionResult;
     }
-    await this.flushCrudSideEffects(effectiveOptions.ctx.container, effectiveOptions.ctx?.bulkImport);
-    return { result: finalResult, logEntry };
+    executionResult.result = await runPostCommit();
+    return executionResult;
   }
   async undo(undoToken, ctx) {
     const service = ctx.container.resolve("actionLogService");
@@ -296,39 +431,121 @@ class CommandBus {
     if (!handler.undo || this.isUndoable(handler) === false) {
       throw new Error(`Command ${log.commandId} is not undoable`);
     }
-    const claimed = await service.claimForUndo(log.id);
-    if (!claimed) throw new Error("Undo token already consumed");
-    try {
-      const allInterceptors = getAllCommandInterceptorInstances();
-      let undoInterceptorMetadata = /* @__PURE__ */ new Map();
-      const userFeatures = allInterceptors.length ? await this.resolveUserFeaturesForInterceptors(ctx) : [];
-      if (allInterceptors.length) {
-        const undoCtx = { input: log.commandPayload, logEntry: log, undoToken };
-        const interceptorCtx = {
-          commandId: log.commandId,
-          auth: ctx.auth ?? null,
-          selectedOrganizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
-          container: ctx.container
+    const isAtomicReplay = handler.atomicReplay === true;
+    const allInterceptors = getAllCommandInterceptorInstances();
+    let undoInterceptorMetadata = /* @__PURE__ */ new Map();
+    let userFeatures = [];
+    const runBeforeUndoInterceptors = async (replayCtx) => {
+      const resolvedUserFeatures = allInterceptors.length ? await this.resolveUserFeaturesForInterceptors(replayCtx) : [];
+      if (!allInterceptors.length) {
+        return {
+          metadata: /* @__PURE__ */ new Map(),
+          userFeatures: resolvedUserFeatures
         };
-        const beforeResult = await runCommandInterceptorsBeforeUndo(
-          allInterceptors,
-          log.commandId,
-          undoCtx,
-          interceptorCtx,
-          userFeatures
-        );
-        if (!beforeResult.ok) {
-          const blocked = beforeResult.error;
-          throw new CommandInterceptorError(blocked.message, { status: blocked.status, body: blocked.body });
-        }
-        undoInterceptorMetadata = beforeResult.metadataByInterceptor;
       }
+      const undoCtx = { input: log.commandPayload, logEntry: log, undoToken };
+      const interceptorCtx = {
+        commandId: log.commandId,
+        auth: replayCtx.auth ?? null,
+        selectedOrganizationId: replayCtx.selectedOrganizationId ?? replayCtx.auth?.orgId ?? null,
+        container: replayCtx.container
+      };
+      const beforeResult = await runCommandInterceptorsBeforeUndo(
+        allInterceptors,
+        log.commandId,
+        undoCtx,
+        interceptorCtx,
+        resolvedUserFeatures
+      );
+      if (!beforeResult.ok) {
+        const blocked = beforeResult.error;
+        throw new CommandInterceptorError(blocked.message, { status: blocked.status, body: blocked.body });
+      }
+      return {
+        metadata: beforeResult.metadataByInterceptor,
+        userFeatures: resolvedUserFeatures
+      };
+    };
+    if (!isAtomicReplay) {
+      await this.runReplayTransactionGuard(ctx, "undo", log);
+      if (handler.authorizeReplay) {
+        await handler.authorizeReplay({
+          operation: "undo",
+          input: log.commandPayload,
+          ctx,
+          logEntry: log
+        });
+      }
+    }
+    const claimUndo = async (replayEm) => {
+      const claimed = replayEm ? await service.claimForUndo(log.id, replayEm) : await service.claimForUndo(log.id);
+      if (!claimed) throw new Error("[internal] Undo token already consumed");
+    };
+    const finishUndo = async (replayCtx, replayEm) => {
       await handler.undo({
         input: log.commandPayload,
-        ctx,
+        ctx: replayCtx,
         logEntry: log
       });
-      await service.markUndone(log.id, this.buildUndoTraceLog(log, ctx));
+      const traceLog = this.buildUndoTraceLog(log, replayCtx);
+      if (replayEm) {
+        await service.markUndone(log.id, traceLog, replayEm);
+      } else {
+        await service.markUndone(log.id, traceLog);
+      }
+    };
+    let ambientReplay = null;
+    let replayTransactionLifetime = null;
+    if (isAtomicReplay) {
+      ambientReplay = resolveAtomicReplayTransaction(ctx);
+      const replayEm = ambientReplay.em;
+      await withAtomicFlush(replayEm, [async () => {
+        const replayCtx = bindReplayTransactionContext(
+          ctx,
+          replayEm,
+          ambientReplay?.joinsAmbient ? ctx.transactionLifetime : void 0
+        );
+        replayTransactionLifetime = replayCtx.transactionLifetime ?? null;
+        if (handler.stabilizeReplay) {
+          await handler.stabilizeReplay({
+            operation: "undo",
+            input: log.commandPayload,
+            ctx: replayCtx,
+            logEntry: log
+          });
+        }
+        await this.runReplayTransactionGuard(replayCtx, "undo", log, replayEm);
+        const prepared = await runBeforeUndoInterceptors(replayCtx);
+        undoInterceptorMetadata = prepared.metadata;
+        userFeatures = prepared.userFeatures;
+        if (handler.authorizeReplay) {
+          await handler.authorizeReplay({
+            operation: "undo",
+            input: log.commandPayload,
+            ctx: replayCtx,
+            logEntry: log
+          });
+        }
+        await claimUndo(replayEm);
+        await finishUndo(replayCtx, replayEm);
+      }], {
+        transaction: true,
+        label: `${log.commandId}.undo`
+      });
+    } else {
+      try {
+        await claimUndo();
+        const prepared = await runBeforeUndoInterceptors(ctx);
+        undoInterceptorMetadata = prepared.metadata;
+        userFeatures = prepared.userFeatures;
+        await finishUndo(ctx);
+      } catch (err) {
+        await service.releaseUndoClaim(log.id).catch(() => {
+        });
+        throw err;
+      }
+    }
+    const runPostCommit = async () => {
       if (allInterceptors.length) {
         const undoCtx = { input: log.commandPayload, logEntry: log, undoToken };
         const interceptorCtx = {
@@ -348,11 +565,17 @@ class CommandBus {
       }
       await this.invalidateCacheAfterUndo(log, ctx);
       await this.flushCrudSideEffects(ctx.container);
-    } catch (err) {
-      await service.releaseUndoClaim(log.id).catch(() => {
+    };
+    if (ambientReplay?.joinsAmbient) {
+      if (!replayTransactionLifetime || !ownsTransactionLifetime(ambientReplay.em, replayTransactionLifetime)) {
+        throw new Error("[internal] Ambient atomic replay lost its outer transaction lifetime owner");
+      }
+      onTransactionLifetimeComplete(ambientReplay.em, async (outcome) => {
+        if (outcome === "committed") await runPostCommit();
       });
-      throw err;
+      return;
     }
+    await runPostCommit();
   }
   buildUndoTraceLog(log, ctx) {
     const snapshotBefore = log.snapshotAfter ?? null;
@@ -385,18 +608,44 @@ class CommandBus {
   }
   async resolveUserFeaturesForInterceptors(ctx) {
     if (!ctx.auth) return [];
+    let rbac;
+    try {
+      rbac = ctx.container.resolve("rbacService");
+    } catch {
+      return [];
+    }
+    const scope = {
+      tenantId: ctx.auth.tenantId,
+      organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId
+    };
+    if (ctx.transactionalEm) {
+      if (!rbac?.getGrantedFeaturesWithEntityManager) return [];
+      return await rbac.getGrantedFeaturesWithEntityManager(
+        ctx.transactionalEm,
+        ctx.auth.sub,
+        scope
+      );
+    }
     try {
-      const rbac = ctx.container.resolve("rbacService");
       if (rbac?.getGrantedFeatures) {
-        return await rbac.getGrantedFeatures(ctx.auth.sub, {
-          tenantId: ctx.auth.tenantId,
-          organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId
-        });
+        return await rbac.getGrantedFeatures(ctx.auth.sub, scope);
       }
     } catch {
     }
     return [];
   }
+  async runReplayTransactionGuard(ctx, operation, logEntry, transactionalEm) {
+    if (!ctx.replayTransactionGuard) return;
+    if (transactionalEm) {
+      await ctx.replayTransactionGuard({ operation, logEntry, transactionalEm });
+      return;
+    }
+    const requestEm = ctx.container.resolve("em");
+    const guardEm = typeof requestEm.fork === "function" ? requestEm.fork() : requestEm;
+    await withAtomicFlush(guardEm, [async () => {
+      await ctx.replayTransactionGuard({ operation, logEntry, transactionalEm: guardEm });
+    }], { transaction: true, label: `${logEntry.commandId}.${operation}.request-guard` });
+  }
   async resolveHandler(commandId) {
     const handler = commandRegistry.get(commandId) ?? await commandRegistry.load(commandId);
     if (!handler) {
@@ -436,6 +685,7 @@ class CommandBus {
     if (!primary && !secondary) return null;
     return {
       skipLog: secondary?.skipLog ?? primary?.skipLog ?? false,
+      replayable: secondary?.replayable === false || primary?.replayable === false ? false : secondary?.replayable ?? primary?.replayable,
       tenantId: secondary?.tenantId ?? primary?.tenantId ?? null,
       organizationId: secondary?.organizationId ?? primary?.organizationId ?? null,
       actorUserId: secondary?.actorUserId ?? primary?.actorUserId ?? null,
@@ -448,6 +698,9 @@ class CommandBus {
       relatedResourceKind: secondary?.relatedResourceKind ?? primary?.relatedResourceKind ?? null,
       relatedResourceId: secondary?.relatedResourceId ?? primary?.relatedResourceId ?? null,
       undoToken: secondary?.undoToken ?? primary?.undoToken ?? null,
+      // A redacted redo input always wins: it exists precisely because the raw
+      // input carries a secret that must not reach `action_logs`.
+      redoInput: secondary?.redoInput !== void 0 ? secondary.redoInput : primary?.redoInput,
       payload: secondary?.payload ?? primary?.payload ?? null,
       snapshotBefore: secondary?.snapshotBefore ?? primary?.snapshotBefore ?? null,
       snapshotAfter: secondary?.snapshotAfter ?? primary?.snapshotAfter ?? null,
@@ -505,9 +758,14 @@ class CommandBus {
       const baseContext = asRecord(payload.context) ?? {};
       payload.context = { ...baseContext, source: runAs.source };
     }
-    const redoEnvelope = wrapRedoPayload("commandPayload" in payload ? payload.commandPayload : void 0, options.input);
-    payload.commandPayload = redoEnvelope;
-    return await service.log(payload);
+    if (metadata.replayable === false) {
+      delete payload.commandPayload;
+    } else {
+      const redoInput = metadata.redoInput !== void 0 ? metadata.redoInput : options.input;
+      const redoEnvelope = wrapRedoPayload("commandPayload" in payload ? payload.commandPayload : void 0, redoInput);
+      payload.commandPayload = redoEnvelope;
+    }
+    return options.ctx.transactionalEm ? await service.log(payload, options.ctx.transactionalEm) : await service.log(payload);
   }
   isUndoable(handler) {
     return handler.isUndoable !== false && typeof handler.undo === "function";