@freighttech/ui 0.13.18

package/dist/backend/utils/api.js

@@ -0,0 +1,178 @@
+"use client";
+import { flash } from "../FlashMessages.js";
+import { deserializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { pushOperation } from "../operations/store.js";
+import { pushPartialIndexWarning } from "../indexes/store.js";
+import { createScopedHeaderStack } from "./scopedHeaderStack.js";
+const scopedHeaders = createScopedHeaderStack();
+function mergeHeaders(base, scoped) {
+  const headers = new Headers(base ?? {});
+  for (const [key, value] of Object.entries(scoped)) {
+    if (headers.has(key)) continue;
+    headers.set(key, value);
+  }
+  return headers;
+}
+function readRedirectOverride(headers, headerName) {
+  return headers.get(headerName) === "0";
+}
+async function withScopedApiHeaders(headers, run) {
+  return scopedHeaders.withScopedHeaders(headers, run);
+}
+class UnauthorizedError extends Error {
+  constructor(message = "Unauthorized") {
+    super(message);
+    this.status = 401;
+    this.name = "UnauthorizedError";
+  }
+}
+function redirectToSessionRefresh() {
+  if (typeof window === "undefined") return;
+  const current = window.location.pathname + window.location.search;
+  if (window.location.pathname.startsWith("/api/auth")) return;
+  if (/\/[^/]+\/portal(\/|$)/.test(window.location.pathname)) return;
+  try {
+    flash("Session expired. Redirecting to sign in\u2026", "warning");
+    setTimeout(() => {
+      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`;
+    }, 20);
+  } catch {
+  }
+}
+class ForbiddenError extends Error {
+  constructor(message = "Forbidden") {
+    super(message);
+    this.status = 403;
+    this.name = "ForbiddenError";
+  }
+}
+let DEFAULT_FORBIDDEN_ROLES = ["admin"];
+function setAuthRedirectConfig(cfg) {
+  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {
+    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String);
+  }
+}
+function redirectToForbiddenLogin(options) {
+  if (typeof window === "undefined") return;
+  if (window.location.pathname.startsWith("/login")) return;
+  if (/\/[^/]+\/portal(\/|$)/.test(window.location.pathname)) return;
+  try {
+    const current = window.location.pathname + window.location.search;
+    const features = options?.requiredFeatures?.filter(Boolean) ?? [];
+    const roles = options?.requiredRoles?.filter(Boolean) ?? [];
+    const fallbackRoles = DEFAULT_FORBIDDEN_ROLES.filter(Boolean);
+    const effectiveRoles = roles.length ? roles : fallbackRoles;
+    const query = features.length ? `requireFeature=${encodeURIComponent(features.join(","))}` : effectiveRoles.length ? `requireRole=${encodeURIComponent(effectiveRoles.map(String).join(","))}` : "";
+    const url = query ? `/login?${query}&redirect=${encodeURIComponent(current)}` : `/login?redirect=${encodeURIComponent(current)}`;
+    flash("Insufficient permissions. Redirecting to login\u2026", "warning");
+    setTimeout(() => {
+      window.location.href = url;
+    }, 60);
+  } catch {
+  }
+}
+async function apiFetch(input, init) {
+  const originalFetch = typeof window !== "undefined" ? window.__omOriginalFetch : void 0;
+  const fallbackFetch = globalThis.fetch;
+  const baseFetch = originalFetch ?? fallbackFetch;
+  if (!baseFetch) {
+    return new Response(
+      JSON.stringify({ error: "Fetch API is not available in this runtime" }),
+      { status: 503, headers: { "content-type": "application/json" } }
+    );
+  }
+  const scoped = scopedHeaders.resolveScopedHeaders();
+  const mergedInit = Object.keys(scoped).length ? { ...init ?? {}, headers: mergeHeaders(init?.headers, scoped) } : init;
+  const requestHeaders = new Headers(mergedInit?.headers);
+  const disableUnauthorizedRedirect = readRedirectOverride(requestHeaders, "x-om-unauthorized-redirect");
+  const disableForbiddenRedirect = readRedirectOverride(requestHeaders, "x-om-forbidden-redirect");
+  const res = await baseFetch(input, mergedInit);
+  const pathname = typeof window !== "undefined" ? window.location.pathname : "";
+  const onLoginPage = pathname.startsWith("/login");
+  const onPortalRoute = /\/[^/]+\/portal(\/|$)/.test(pathname);
+  if (res.status === 401) {
+    if (!onLoginPage && !onPortalRoute && !disableUnauthorizedRedirect) {
+      redirectToSessionRefresh();
+      throw new UnauthorizedError(await res.text().catch(() => "Unauthorized"));
+    }
+    return res;
+  }
+  if (res.status === 403) {
+    let roles = null;
+    let features = null;
+    let payload = null;
+    const aclData = await readJsonSafe(res.clone(), null);
+    if (aclData && typeof aclData === "object") {
+      if (Array.isArray(aclData.requiredRoles)) {
+        roles = aclData.requiredRoles.map((r) => String(r));
+      }
+      if (Array.isArray(aclData.requiredFeatures)) {
+        features = aclData.requiredFeatures.map((f) => String(f));
+      }
+      payload = aclData;
+    }
+    if (!onLoginPage && !onPortalRoute && !disableForbiddenRedirect) {
+      const target = typeof input === "string" ? input : input instanceof URL ? input.toString() : typeof Request !== "undefined" && input instanceof Request ? input.url : "unknown";
+      try {
+        console.warn("[apiFetch] Forbidden response", {
+          url: target,
+          status: res.status,
+          requiredRoles: roles,
+          requiredFeatures: features,
+          details: payload
+        });
+      } catch {
+      }
+      const hasAclHints = Boolean(roles && roles.length || features && features.length);
+      if (hasAclHints) {
+        redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features });
+      }
+      let msg = "Forbidden";
+      if (aclData && typeof aclData === "object") {
+        if (typeof aclData.error === "string") {
+          msg = aclData.error;
+        } else if (typeof aclData.message === "string") {
+          msg = aclData.message;
+        }
+      } else {
+        msg = await res.clone().text().catch(() => "Forbidden");
+      }
+      throw new ForbiddenError(msg);
+    }
+  }
+  try {
+    const header = res.headers.get("x-om-operation");
+    const metadata = deserializeOperationMetadata(header);
+    if (metadata) pushOperation(metadata);
+  } catch {
+  }
+  try {
+    const warningRaw = res.headers.get("x-om-partial-index");
+    if (warningRaw) {
+      const parsed = JSON.parse(warningRaw);
+      if (parsed && typeof parsed === "object" && parsed.type === "partial_index") {
+        const entity = typeof parsed.entity === "string" ? parsed.entity : String(parsed.entity ?? "");
+        if (entity) {
+          const baseCount = typeof parsed.baseCount === "number" ? parsed.baseCount : null;
+          const indexedCount = typeof parsed.indexedCount === "number" ? parsed.indexedCount : null;
+          const scope = parsed.scope === "global" ? "global" : "scoped";
+          const entityLabel = typeof parsed.entityLabel === "string" && parsed.entityLabel.trim() ? parsed.entityLabel.trim() : entity;
+          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope });
+        }
+      }
+    }
+  } catch {
+  }
+  return res;
+}
+export {
+  ForbiddenError,
+  UnauthorizedError,
+  apiFetch,
+  redirectToForbiddenLogin,
+  redirectToSessionRefresh,
+  setAuthRedirectConfig,
+  withScopedApiHeaders
+};
+//# sourceMappingURL=api.js.map

package/dist/backend/utils/api.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/backend/utils/api.ts"],
+  "sourcesContent": ["\"use client\"\n// Simple fetch wrapper that redirects to session refresh on 401 (Unauthorized)\n// Used across UI data utilities to avoid duplication.\nimport { flash } from '../FlashMessages'\nimport { deserializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { pushOperation } from '../operations/store'\nimport { pushPartialIndexWarning } from '../indexes/store'\nimport { createScopedHeaderStack } from './scopedHeaderStack'\n\nconst scopedHeaders = createScopedHeaderStack()\n\nfunction mergeHeaders(base: HeadersInit | undefined, scoped: Record<string, string>): Headers {\n  const headers = new Headers(base ?? {})\n  for (const [key, value] of Object.entries(scoped)) {\n    if (headers.has(key)) continue\n    headers.set(key, value)\n  }\n  return headers\n}\n\nfunction readRedirectOverride(headers: Headers, headerName: string): boolean {\n  return headers.get(headerName) === '0'\n}\n\nexport async function withScopedApiHeaders<T>(headers: Record<string, string>, run: () => Promise<T>): Promise<T> {\n  return scopedHeaders.withScopedHeaders(headers, run)\n}\n\nexport class UnauthorizedError extends Error {\n  readonly status = 401\n  constructor(message = 'Unauthorized') {\n    super(message)\n    this.name = 'UnauthorizedError'\n  }\n}\n\nexport function redirectToSessionRefresh() {\n  if (typeof window === 'undefined') return\n  const current = window.location.pathname + window.location.search\n  // Avoid redirect loops if already on an auth/session route\n  if (window.location.pathname.startsWith('/api/auth')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    flash('Session expired. Redirecting to sign in\u2026', 'warning')\n    setTimeout(() => {\n      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`\n    }, 20)\n  } catch {\n    // no-op\n  }\n}\n\nexport class ForbiddenError extends Error {\n  readonly status = 403\n  constructor(message = 'Forbidden') {\n    super(message)\n    this.name = 'ForbiddenError'\n  }\n}\n\nlet DEFAULT_FORBIDDEN_ROLES: string[] = ['admin']\n\nexport function setAuthRedirectConfig(cfg: { defaultForbiddenRoles?: readonly string[] }) {\n  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {\n    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String)\n  }\n}\n\nexport function redirectToForbiddenLogin(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }) {\n  if (typeof window === 'undefined') return\n  if (window.location.pathname.startsWith('/login')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    const current = window.location.pathname + window.location.search\n    const features = options?.requiredFeatures?.filter(Boolean) ?? []\n    const roles = options?.requiredRoles?.filter(Boolean) ?? []\n    const fallbackRoles = DEFAULT_FORBIDDEN_ROLES.filter(Boolean)\n    const effectiveRoles = roles.length ? roles : fallbackRoles\n    const query = features.length\n      ? `requireFeature=${encodeURIComponent(features.join(','))}`\n      : effectiveRoles.length\n        ? `requireRole=${encodeURIComponent(effectiveRoles.map(String).join(','))}`\n        : ''\n    const url = query\n      ? `/login?${query}&redirect=${encodeURIComponent(current)}`\n      : `/login?redirect=${encodeURIComponent(current)}`\n    flash('Insufficient permissions. Redirecting to login\u2026', 'warning')\n    setTimeout(() => { window.location.href = url }, 60)\n  } catch {\n    // no-op\n  }\n}\n\nexport async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n  type FetchType = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>\n  const originalFetch =\n    typeof window !== 'undefined'\n      ? (window as Window & { __omOriginalFetch?: FetchType }).__omOriginalFetch\n      : undefined\n  const fallbackFetch = (globalThis as typeof globalThis & { fetch?: FetchType }).fetch\n  const baseFetch = originalFetch ?? fallbackFetch\n  if (!baseFetch) {\n    return new Response(\n      JSON.stringify({ error: 'Fetch API is not available in this runtime' }),\n      { status: 503, headers: { 'content-type': 'application/json' } },\n    )\n  }\n  const scoped = scopedHeaders.resolveScopedHeaders()\n  const mergedInit = Object.keys(scoped).length\n    ? { ...(init ?? {}), headers: mergeHeaders(init?.headers, scoped) }\n    : init\n  const requestHeaders = new Headers(mergedInit?.headers)\n  const disableUnauthorizedRedirect = readRedirectOverride(requestHeaders, 'x-om-unauthorized-redirect')\n  const disableForbiddenRedirect = readRedirectOverride(requestHeaders, 'x-om-forbidden-redirect')\n  const res = await baseFetch(input, mergedInit)\n  const pathname = typeof window !== 'undefined' ? window.location.pathname : ''\n  const onLoginPage = pathname.startsWith('/login')\n  const onPortalRoute = /\\/[^/]+\\/portal(\\/|$)/.test(pathname)\n  if (res.status === 401) {\n    // Trigger same redirect flow as protected pages\n    // Skip for staff login page and all portal routes (portal has its own auth)\n    if (!onLoginPage && !onPortalRoute && !disableUnauthorizedRedirect) {\n      redirectToSessionRefresh()\n      // Throw a typed error for callers that might still handle it\n      throw new UnauthorizedError(await res.text().catch(() => 'Unauthorized'))\n    }\n    return res\n  }\n  if (res.status === 403) {\n    // Try to read requiredRoles from JSON body; ignore if not JSON\n    let roles: string[] | null = null\n    let features: string[] | null = null\n    let payload: unknown = null\n    const aclData = await readJsonSafe<Record<string, unknown>>(res.clone(), null)\n    if (aclData && typeof aclData === 'object') {\n      if (Array.isArray(aclData.requiredRoles)) {\n        roles = aclData.requiredRoles.map((r) => String(r))\n      }\n      if (Array.isArray(aclData.requiredFeatures)) {\n        features = aclData.requiredFeatures.map((f) => String(f))\n      }\n      payload = aclData\n    }\n    // Only redirect if not already on login page or a portal route\n    if (!onLoginPage && !onPortalRoute && !disableForbiddenRedirect) {\n      const target =\n        typeof input === 'string'\n          ? input\n          : input instanceof URL\n            ? input.toString()\n            : (typeof Request !== 'undefined' && input instanceof Request)\n              ? input.url\n              : 'unknown'\n      try {\n        // eslint-disable-next-line no-console\n        console.warn('[apiFetch] Forbidden response', {\n          url: target,\n          status: res.status,\n          requiredRoles: roles,\n          requiredFeatures: features,\n          details: payload,\n        })\n      } catch {}\n      const hasAclHints = Boolean((roles && roles.length) || (features && features.length))\n      if (hasAclHints) {\n        redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features })\n      }\n      let msg = 'Forbidden'\n      if (aclData && typeof aclData === 'object') {\n        if (typeof aclData.error === 'string') {\n          msg = aclData.error\n        } else if (typeof aclData.message === 'string') {\n          msg = aclData.message\n        }\n      } else {\n        msg = await res.clone().text().catch(() => 'Forbidden')\n      }\n      throw new ForbiddenError(msg)\n    }\n    // If already on login, just return the response for the caller to handle\n  }\n  try {\n    const header = res.headers.get('x-om-operation')\n    const metadata = deserializeOperationMetadata(header)\n    if (metadata) pushOperation(metadata)\n  } catch {\n    // ignore malformed headers\n  }\n  try {\n    const warningRaw = res.headers.get('x-om-partial-index')\n    if (warningRaw) {\n      const parsed = JSON.parse(warningRaw) as Record<string, unknown>\n      if (parsed && typeof parsed === 'object' && parsed.type === 'partial_index') {\n        const entity = typeof parsed.entity === 'string' ? parsed.entity : String(parsed.entity ?? '')\n        if (entity) {\n          const baseCount = typeof parsed.baseCount === 'number' ? parsed.baseCount : null\n          const indexedCount = typeof parsed.indexedCount === 'number' ? parsed.indexedCount : null\n          const scope = parsed.scope === 'global' ? 'global' : 'scoped'\n          const entityLabel =\n            typeof parsed.entityLabel === 'string' && parsed.entityLabel.trim()\n              ? parsed.entityLabel.trim()\n              : entity\n          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope })\n        }\n      }\n    }\n  } catch {\n    // ignore malformed headers\n  }\n  return res\n}\n"],
+  "mappings": ";AAGA,SAAS,aAAa;AACtB,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AAExC,MAAM,gBAAgB,wBAAwB;AAE9C,SAAS,aAAa,MAA+B,QAAyC;AAC5F,QAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAkB,YAA6B;AAC3E,SAAO,QAAQ,IAAI,UAAU,MAAM;AACrC;AAEA,eAAsB,qBAAwB,SAAiC,KAAmC;AAChH,SAAO,cAAc,kBAAkB,SAAS,GAAG;AACrD;AAEO,MAAM,0BAA0B,MAAM;AAAA,EAE3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,2BAA2B;AACzC,MAAI,OAAO,WAAW,YAAa;AACnC,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAE3D,MAAI,OAAO,SAAS,SAAS,WAAW,WAAW,EAAG;AAEtD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,iDAA4C,SAAS;AAC3D,eAAW,MAAM;AACf,aAAO,SAAS,OAAO,sCAAsC,mBAAmB,OAAO,CAAC;AAAA,IAC1F,GAAG,EAAE;AAAA,EACP,QAAQ;AAAA,EAER;AACF;AAEO,MAAM,uBAAuB,MAAM;AAAA,EAExC,YAAY,UAAU,aAAa;AACjC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAI,0BAAoC,CAAC,OAAO;AAEzC,SAAS,sBAAsB,KAAoD;AACxF,MAAI,KAAK,yBAAyB,IAAI,sBAAsB,QAAQ;AAClE,8BAA0B,CAAC,GAAG,IAAI,qBAAqB,EAAE,IAAI,MAAM;AAAA,EACrE;AACF;AAEO,SAAS,yBAAyB,SAAmF;AAC1H,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,OAAO,SAAS,SAAS,WAAW,QAAQ,EAAG;AAEnD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAC3D,UAAM,WAAW,SAAS,kBAAkB,OAAO,OAAO,KAAK,CAAC;AAChE,UAAM,QAAQ,SAAS,eAAe,OAAO,OAAO,KAAK,CAAC;AAC1D,UAAM,gBAAgB,wBAAwB,OAAO,OAAO;AAC5D,UAAM,iBAAiB,MAAM,SAAS,QAAQ;AAC9C,UAAM,QAAQ,SAAS,SACnB,kBAAkB,mBAAmB,SAAS,KAAK,GAAG,CAAC,CAAC,KACxD,eAAe,SACb,eAAe,mBAAmB,eAAe,IAAI,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,KACvE;AACN,UAAM,MAAM,QACR,UAAU,KAAK,aAAa,mBAAmB,OAAO,CAAC,KACvD,mBAAmB,mBAAmB,OAAO,CAAC;AAClD,UAAM,wDAAmD,SAAS;AAClE,eAAW,MAAM;AAAE,aAAO,SAAS,OAAO;AAAA,IAAI,GAAG,EAAE;AAAA,EACrD,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,SAAS,OAA0B,MAAuC;AAE9F,QAAM,gBACJ,OAAO,WAAW,cACb,OAAsD,oBACvD;AACN,QAAM,gBAAiB,WAAyD;AAChF,QAAM,YAAY,iBAAiB;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6CAA6C,CAAC;AAAA,MACtE,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AACA,QAAM,SAAS,cAAc,qBAAqB;AAClD,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,SACnC,EAAE,GAAI,QAAQ,CAAC,GAAI,SAAS,aAAa,MAAM,SAAS,MAAM,EAAE,IAChE;AACJ,QAAM,iBAAiB,IAAI,QAAQ,YAAY,OAAO;AACtD,QAAM,8BAA8B,qBAAqB,gBAAgB,4BAA4B;AACrG,QAAM,2BAA2B,qBAAqB,gBAAgB,yBAAyB;AAC/F,QAAM,MAAM,MAAM,UAAU,OAAO,UAAU;AAC7C,QAAM,WAAW,OAAO,WAAW,cAAc,OAAO,SAAS,WAAW;AAC5E,QAAM,cAAc,SAAS,WAAW,QAAQ;AAChD,QAAM,gBAAgB,wBAAwB,KAAK,QAAQ;AAC3D,MAAI,IAAI,WAAW,KAAK;AAGtB,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,6BAA6B;AAClE,+BAAyB;AAEzB,YAAM,IAAI,kBAAkB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,cAAc,CAAC;AAAA,IAC1E;AACA,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,KAAK;AAEtB,QAAI,QAAyB;AAC7B,QAAI,WAA4B;AAChC,QAAI,UAAmB;AACvB,UAAM,UAAU,MAAM,aAAsC,IAAI,MAAM,GAAG,IAAI;AAC7E,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,UAAI,MAAM,QAAQ,QAAQ,aAAa,GAAG;AACxC,gBAAQ,QAAQ,cAAc,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MACpD;AACA,UAAI,MAAM,QAAQ,QAAQ,gBAAgB,GAAG;AAC3C,mBAAW,QAAQ,iBAAiB,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MAC1D;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,0BAA0B;AAC/D,YAAM,SACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,OAAO,YAAY,eAAe,iBAAiB,UAClD,MAAM,MACN;AACV,UAAI;AAEF,gBAAQ,KAAK,iCAAiC;AAAA,UAC5C,KAAK;AAAA,UACL,QAAQ,IAAI;AAAA,UACZ,eAAe;AAAA,UACf,kBAAkB;AAAA,UAClB,SAAS;AAAA,QACX,CAAC;AAAA,MACH,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,QAAS,SAAS,MAAM,UAAY,YAAY,SAAS,MAAO;AACpF,UAAI,aAAa;AACf,iCAAyB,EAAE,eAAe,OAAO,kBAAkB,SAAS,CAAC;AAAA,MAC/E;AACA,UAAI,MAAM;AACV,UAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAI,OAAO,QAAQ,UAAU,UAAU;AACrC,gBAAM,QAAQ;AAAA,QAChB,WAAW,OAAO,QAAQ,YAAY,UAAU;AAC9C,gBAAM,QAAQ;AAAA,QAChB;AAAA,MACF,OAAO;AACL,cAAM,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW;AAAA,MACxD;AACA,YAAM,IAAI,eAAe,GAAG;AAAA,IAC9B;AAAA,EAEF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB;AAC/C,UAAM,WAAW,6BAA6B,MAAM;AACpD,QAAI,SAAU,eAAc,QAAQ;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,aAAa,IAAI,QAAQ,IAAI,oBAAoB;AACvD,QAAI,YAAY;AACd,YAAM,SAAS,KAAK,MAAM,UAAU;AACpC,UAAI,UAAU,OAAO,WAAW,YAAY,OAAO,SAAS,iBAAiB;AAC3E,cAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,EAAE;AAC7F,YAAI,QAAQ;AACV,gBAAM,YAAY,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAC5E,gBAAM,eAAe,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACrF,gBAAM,QAAQ,OAAO,UAAU,WAAW,WAAW;AACrD,gBAAM,cACJ,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,IAC9D,OAAO,YAAY,KAAK,IACxB;AACN,kCAAwB,EAAE,QAAQ,aAAa,WAAW,cAAc,MAAM,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/backend/utils/apiCall.js

@@ -0,0 +1,68 @@
+"use client";
+import { apiFetch } from "./api.js";
+import { raiseCrudError, readJsonSafe } from "./serverErrors.js";
+import { createScopedHeaderStack } from "./scopedHeaderStack.js";
+const scopedRequestHeaders = createScopedHeaderStack();
+function mergeHeaders(base, extra) {
+  if (!base) return extra;
+  if (typeof Headers !== "undefined" && base instanceof Headers) {
+    const merged = new Headers(base);
+    Object.entries(extra).forEach(([key, value]) => merged.set(key, value));
+    return merged;
+  }
+  if (Array.isArray(base)) {
+    return [...base, ...Object.entries(extra)];
+  }
+  return { ...base, ...extra };
+}
+async function withScopedApiRequestHeaders(headers, run) {
+  return scopedRequestHeaders.withScopedHeaders(headers, run);
+}
+async function apiCall(input, init, options) {
+  const scopedHeaders = scopedRequestHeaders.resolveScopedHeaders();
+  const requestInit = Object.keys(scopedHeaders).length > 0 ? { ...init ?? {}, headers: mergeHeaders(init?.headers, scopedHeaders) } : init;
+  const response = await apiFetch(input, requestInit);
+  const parser = options?.parse;
+  const fallback = options?.fallback ?? null;
+  let result = null;
+  const rawCacheStatus = response.headers?.get?.("x-om-cache") ?? response.headers?.get?.("x-cache-status") ?? null;
+  const cacheStatus = rawCacheStatus === "hit" || rawCacheStatus === "miss" ? rawCacheStatus : null;
+  try {
+    const source = typeof response.clone === "function" ? response.clone() : response;
+    if (parser) result = await parser(source);
+    else result = await readJsonSafe(source, fallback);
+  } catch {
+    result = fallback;
+  }
+  return {
+    ok: response.ok,
+    status: response.status,
+    result,
+    response,
+    cacheStatus
+  };
+}
+async function apiCallOrThrow(input, init, options) {
+  const { errorMessage, ...callOptions } = options ?? {};
+  const call = await apiCall(input, init, callOptions);
+  if (!call.ok) {
+    await raiseCrudError(call.response, errorMessage);
+  }
+  return call;
+}
+async function readApiResultOrThrow(input, init, options) {
+  const { allowNullResult = false, emptyResultMessage, ...callOptions } = options ?? {};
+  const call = await apiCallOrThrow(input, init, callOptions);
+  if (call.result == null && !allowNullResult) {
+    const fallback = emptyResultMessage ?? callOptions.errorMessage ?? `Missing response payload (${call.status})`;
+    throw new Error(fallback);
+  }
+  return call.result;
+}
+export {
+  apiCall,
+  apiCallOrThrow,
+  readApiResultOrThrow,
+  withScopedApiRequestHeaders
+};
+//# sourceMappingURL=apiCall.js.map

package/dist/backend/utils/apiCall.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/backend/utils/apiCall.ts"],
+  "sourcesContent": ["\"use client\"\n\nimport { apiFetch } from './api'\nimport { raiseCrudError, readJsonSafe } from './serverErrors'\nimport { createScopedHeaderStack } from './scopedHeaderStack'\n\nexport type ApiCallOptions<TReturn> = {\n  parse?: (res: Response) => Promise<TReturn | null>\n  fallback?: TReturn | null\n}\n\nexport type ApiCallResult<TReturn> = {\n  ok: boolean\n  status: number\n  result: TReturn | null\n  response: Response\n  cacheStatus: 'hit' | 'miss' | null\n}\n\nconst scopedRequestHeaders = createScopedHeaderStack()\n\nfunction mergeHeaders(base: HeadersInit | undefined, extra: Record<string, string>): HeadersInit {\n  if (!base) return extra\n  if (typeof Headers !== 'undefined' && base instanceof Headers) {\n    const merged = new Headers(base)\n    Object.entries(extra).forEach(([key, value]) => merged.set(key, value))\n    return merged\n  }\n  if (Array.isArray(base)) {\n    return [...base, ...Object.entries(extra)]\n  }\n  return { ...(base as Record<string, string>), ...extra }\n}\n\nexport async function withScopedApiRequestHeaders<T>(\n  headers: Record<string, string>,\n  run: () => Promise<T>,\n): Promise<T> {\n  return scopedRequestHeaders.withScopedHeaders(headers, run)\n}\n\nexport async function apiCall<TReturn = Record<string, unknown>>(\n  input: RequestInfo | URL,\n  init?: RequestInit,\n  options?: ApiCallOptions<TReturn>,\n): Promise<ApiCallResult<TReturn>> {\n  const scopedHeaders = scopedRequestHeaders.resolveScopedHeaders()\n  const requestInit = Object.keys(scopedHeaders).length > 0\n    ? { ...(init ?? {}), headers: mergeHeaders(init?.headers, scopedHeaders) }\n    : init\n  const response = await apiFetch(input, requestInit)\n  const parser = options?.parse\n  const fallback = options?.fallback ?? null\n  let result: TReturn | null = null\n  const rawCacheStatus =\n    response.headers?.get?.('x-om-cache') ??\n    response.headers?.get?.('x-cache-status') ??\n    null\n  const cacheStatus = rawCacheStatus === 'hit' || rawCacheStatus === 'miss' ? rawCacheStatus : null\n  try {\n    const source = typeof (response as Response & { clone?: () => Response }).clone === 'function'\n      ? response.clone()\n      : response\n    if (parser) result = await parser(source)\n    else result = await readJsonSafe<TReturn>(source, fallback)\n  } catch {\n    result = fallback\n  }\n  return {\n    ok: response.ok,\n    status: response.status,\n    result,\n    response,\n    cacheStatus,\n  }\n}\n\nexport type ApiCallOrThrowOptions<TReturn> = ApiCallOptions<TReturn> & {\n  errorMessage?: string\n}\n\nexport async function apiCallOrThrow<TReturn = Record<string, unknown>>(\n  input: RequestInfo | URL,\n  init?: RequestInit,\n  options?: ApiCallOrThrowOptions<TReturn>,\n): Promise<ApiCallResult<TReturn>> {\n  const { errorMessage, ...callOptions } = options ?? {}\n  const call = await apiCall<TReturn>(input, init, callOptions)\n  if (!call.ok) {\n    await raiseCrudError(call.response, errorMessage)\n  }\n  return call\n}\n\nexport type ReadApiResultOrThrowOptions<TReturn> = ApiCallOrThrowOptions<TReturn> & {\n  allowNullResult?: boolean\n  emptyResultMessage?: string\n}\n\nexport async function readApiResultOrThrow<TReturn = Record<string, unknown>>(\n  input: RequestInfo | URL,\n  init?: RequestInit,\n  options?: ReadApiResultOrThrowOptions<TReturn> & { allowNullResult?: false },\n): Promise<TReturn>\nexport async function readApiResultOrThrow<TReturn = Record<string, unknown>>(\n  input: RequestInfo | URL,\n  init: RequestInit | undefined,\n  options: ReadApiResultOrThrowOptions<TReturn> & { allowNullResult: true },\n): Promise<TReturn | null>\nexport async function readApiResultOrThrow<TReturn = Record<string, unknown>>(\n  input: RequestInfo | URL,\n  init?: RequestInit,\n  options?: ReadApiResultOrThrowOptions<TReturn>,\n): Promise<TReturn | null> {\n  const { allowNullResult = false, emptyResultMessage, ...callOptions } = options ?? {}\n  const call = await apiCallOrThrow<TReturn>(input, init, callOptions)\n  if (call.result == null && !allowNullResult) {\n    const fallback =\n      emptyResultMessage ?? callOptions.errorMessage ?? `Missing response payload (${call.status})`\n    throw new Error(fallback)\n  }\n  return call.result\n}\n"],
+  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,oBAAoB;AAC7C,SAAS,+BAA+B;AAexC,MAAM,uBAAuB,wBAAwB;AAErD,SAAS,aAAa,MAA+B,OAA4C;AAC/F,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,OAAO,YAAY,eAAe,gBAAgB,SAAS;AAC7D,UAAM,SAAS,IAAI,QAAQ,IAAI;AAC/B,WAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,IAAI,KAAK,KAAK,CAAC;AACtE,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO,CAAC,GAAG,MAAM,GAAG,OAAO,QAAQ,KAAK,CAAC;AAAA,EAC3C;AACA,SAAO,EAAE,GAAI,MAAiC,GAAG,MAAM;AACzD;AAEA,eAAsB,4BACpB,SACA,KACY;AACZ,SAAO,qBAAqB,kBAAkB,SAAS,GAAG;AAC5D;AAEA,eAAsB,QACpB,OACA,MACA,SACiC;AACjC,QAAM,gBAAgB,qBAAqB,qBAAqB;AAChE,QAAM,cAAc,OAAO,KAAK,aAAa,EAAE,SAAS,IACpD,EAAE,GAAI,QAAQ,CAAC,GAAI,SAAS,aAAa,MAAM,SAAS,aAAa,EAAE,IACvE;AACJ,QAAM,WAAW,MAAM,SAAS,OAAO,WAAW;AAClD,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,SAAS,YAAY;AACtC,MAAI,SAAyB;AAC7B,QAAM,iBACJ,SAAS,SAAS,MAAM,YAAY,KACpC,SAAS,SAAS,MAAM,gBAAgB,KACxC;AACF,QAAM,cAAc,mBAAmB,SAAS,mBAAmB,SAAS,iBAAiB;AAC7F,MAAI;AACF,UAAM,SAAS,OAAQ,SAAmD,UAAU,aAChF,SAAS,MAAM,IACf;AACJ,QAAI,OAAQ,UAAS,MAAM,OAAO,MAAM;AAAA,QACnC,UAAS,MAAM,aAAsB,QAAQ,QAAQ;AAAA,EAC5D,QAAQ;AACN,aAAS;AAAA,EACX;AACA,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAMA,eAAsB,eACpB,OACA,MACA,SACiC;AACjC,QAAM,EAAE,cAAc,GAAG,YAAY,IAAI,WAAW,CAAC;AACrD,QAAM,OAAO,MAAM,QAAiB,OAAO,MAAM,WAAW;AAC5D,MAAI,CAAC,KAAK,IAAI;AACZ,UAAM,eAAe,KAAK,UAAU,YAAY;AAAA,EAClD;AACA,SAAO;AACT;AAiBA,eAAsB,qBACpB,OACA,MACA,SACyB;AACzB,QAAM,EAAE,kBAAkB,OAAO,oBAAoB,GAAG,YAAY,IAAI,WAAW,CAAC;AACpF,QAAM,OAAO,MAAM,eAAwB,OAAO,MAAM,WAAW;AACnE,MAAI,KAAK,UAAU,QAAQ,CAAC,iBAAiB;AAC3C,UAAM,WACJ,sBAAsB,YAAY,gBAAgB,6BAA6B,KAAK,MAAM;AAC5F,UAAM,IAAI,MAAM,QAAQ;AAAA,EAC1B;AACA,SAAO,KAAK;AACd;",
+  "names": []
+}

package/dist/backend/utils/crud.js

@@ -0,0 +1,126 @@
+function toQuery(params) {
+  const sp = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) {
+    if (v === void 0 || v === null) continue;
+    if (Array.isArray(v)) {
+      if (v.length === 0) continue;
+      sp.set(k, v.join(","));
+    } else {
+      sp.set(k, String(v));
+    }
+  }
+  return sp.toString();
+}
+function buildCrudQuery(params) {
+  return toQuery(params);
+}
+import { apiCall, readApiResultOrThrow } from "./apiCall.js";
+import { raiseCrudError } from "./serverErrors.js";
+function mergeHeaders(base, extra) {
+  if (!base) return extra;
+  const hasHeadersCtor = typeof Headers !== "undefined";
+  if (hasHeadersCtor && base instanceof Headers) {
+    const merged = new Headers(base);
+    Object.entries(extra).forEach(([key, value]) => merged.set(key, value));
+    return merged;
+  }
+  if (Array.isArray(base)) {
+    return [...base, ...Object.entries(extra)];
+  }
+  return { ...base, ...extra };
+}
+async function fetchCrudList(apiPath, params, init) {
+  const qs = buildCrudQuery(params);
+  return readApiResultOrThrow(`/api/${apiPath}?${qs}`, init, {
+    errorMessage: "Failed to fetch list"
+  });
+}
+function buildCrudExportUrl(apiPath, params, format) {
+  const qs = buildCrudQuery({ ...params, format });
+  return `/api/${apiPath}?${qs}`;
+}
+function buildCrudCsvUrl(apiPath, params) {
+  return buildCrudExportUrl(apiPath, params, "csv");
+}
+async function createCrud(apiPath, body, init) {
+  const { parseResult, fallbackResult, errorMessage, headers, ...rest } = init ?? {};
+  const call = await apiCall(
+    `/api/${apiPath}`,
+    {
+      ...rest,
+      method: "POST",
+      headers: mergeHeaders(headers, { "content-type": "application/json" }),
+      body: JSON.stringify(body)
+    },
+    {
+      parse: parseResult,
+      fallback: fallbackResult ?? null
+    }
+  );
+  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? "Failed to create");
+  return call;
+}
+async function updateCrud(apiPath, body, init) {
+  const { parseResult, fallbackResult, errorMessage, headers, ...rest } = init ?? {};
+  const call = await apiCall(
+    `/api/${apiPath}`,
+    {
+      ...rest,
+      method: "PUT",
+      headers: mergeHeaders(headers, { "content-type": "application/json" }),
+      body: JSON.stringify(body)
+    },
+    {
+      parse: parseResult,
+      fallback: fallbackResult ?? null
+    }
+  );
+  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? "Failed to update");
+  return call;
+}
+async function deleteCrud(apiPath, idOrOptions, maybeInit) {
+  if (typeof idOrOptions === "string") {
+    const { parseResult: parseResult2, fallbackResult: fallbackResult2, errorMessage: errorMessage2, ...rest2 } = maybeInit ?? {};
+    const call2 = await apiCall(
+      `/api/${apiPath}?id=${encodeURIComponent(idOrOptions)}`,
+      {
+        ...rest2,
+        method: "DELETE"
+      },
+      {
+        parse: parseResult2,
+        fallback: fallbackResult2 ?? null
+      }
+    );
+    if (!call2.ok) await raiseCrudError(call2.response, errorMessage2 ?? "Failed to delete");
+    return call2;
+  }
+  const { parseResult, fallbackResult, errorMessage, headers, body, id, ...rest } = idOrOptions;
+  const payload = body ?? (id ? { id } : void 0);
+  const requestHeaders = payload !== void 0 ? mergeHeaders(headers, { "content-type": "application/json" }) : headers;
+  const call = await apiCall(
+    `/api/${apiPath}`,
+    {
+      ...rest,
+      method: "DELETE",
+      headers: requestHeaders,
+      body: payload !== void 0 ? JSON.stringify(payload) : void 0
+    },
+    {
+      parse: parseResult,
+      fallback: fallbackResult ?? null
+    }
+  );
+  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? "Failed to delete");
+  return call;
+}
+export {
+  buildCrudCsvUrl,
+  buildCrudExportUrl,
+  buildCrudQuery,
+  createCrud,
+  deleteCrud,
+  fetchCrudList,
+  updateCrud
+};
+//# sourceMappingURL=crud.js.map

package/dist/backend/utils/crud.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/backend/utils/crud.ts"],
+  "sourcesContent": ["export type SortDir = 'asc' | 'desc'\n\nexport type ListResponse<T> = {\n  items: T[]\n  total: number\n  page: number\n  pageSize: number\n  totalPages: number\n}\n\nexport type CrudExportFormat = 'csv' | 'json' | 'xml' | 'markdown'\n\nfunction toQuery(params: Record<string, any>) {\n  const sp = new URLSearchParams()\n  for (const [k, v] of Object.entries(params)) {\n    if (v === undefined || v === null) continue\n    if (Array.isArray(v)) {\n      if (v.length === 0) continue\n      sp.set(k, v.join(','))\n    } else {\n      sp.set(k, String(v))\n    }\n  }\n  return sp.toString()\n}\n\nexport function buildCrudQuery(params: Record<string, any>): string {\n  return toQuery(params)\n}\n\nimport { apiCall, readApiResultOrThrow, type ApiCallResult } from './apiCall'\nimport { raiseCrudError } from './serverErrors'\n\nfunction mergeHeaders(base: HeadersInit | undefined, extra: Record<string, string>): HeadersInit {\n  if (!base) return extra\n  const hasHeadersCtor = typeof Headers !== 'undefined'\n  if (hasHeadersCtor && base instanceof Headers) {\n    const merged = new Headers(base)\n    Object.entries(extra).forEach(([key, value]) => merged.set(key, value))\n    return merged\n  }\n  if (Array.isArray(base)) {\n    return [...base, ...Object.entries(extra)]\n  }\n  return { ...(base as Record<string, string>), ...extra }\n}\n\ntype CrudRequestExtras<TReturn> = {\n  parseResult?: (res: Response) => Promise<TReturn | null>\n  fallbackResult?: TReturn | null\n  errorMessage?: string\n}\n\nexport type CrudRequestInit<TReturn> = Omit<RequestInit, 'body' | 'method'> & CrudRequestExtras<TReturn>\ntype CrudDeleteOptions<TReturn> = Omit<RequestInit, 'method' | 'body'> &\n  CrudRequestExtras<TReturn> & {\n    body?: unknown\n    id?: string\n  }\n\nexport type CrudResponse<TReturn> = ApiCallResult<TReturn>\n\nexport async function fetchCrudList<T>(apiPath: string, params: Record<string, any>, init?: RequestInit): Promise<ListResponse<T>> {\n  const qs = buildCrudQuery(params)\n  return readApiResultOrThrow<ListResponse<T>>(`/api/${apiPath}?${qs}`, init, {\n    errorMessage: 'Failed to fetch list',\n  })\n}\n\nexport function buildCrudExportUrl(apiPath: string, params: Record<string, any>, format: CrudExportFormat): string {\n  const qs = buildCrudQuery({ ...params, format })\n  return `/api/${apiPath}?${qs}`\n}\n\nexport function buildCrudCsvUrl(apiPath: string, params: Record<string, any>): string {\n  return buildCrudExportUrl(apiPath, params, 'csv')\n}\n\nexport async function createCrud<TReturn = Record<string, unknown>>(\n  apiPath: string,\n  body: any,\n  init?: CrudRequestInit<TReturn>,\n): Promise<CrudResponse<TReturn>> {\n  const { parseResult, fallbackResult, errorMessage, headers, ...rest } = init ?? {}\n  const call = await apiCall<TReturn>(\n    `/api/${apiPath}`,\n    {\n      ...rest,\n      method: 'POST',\n      headers: mergeHeaders(headers, { 'content-type': 'application/json' }),\n      body: JSON.stringify(body),\n    },\n    {\n      parse: parseResult,\n      fallback: fallbackResult ?? null,\n    },\n  )\n  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to create')\n  return call\n}\n\nexport async function updateCrud<TReturn = Record<string, unknown>>(\n  apiPath: string,\n  body: any,\n  init?: CrudRequestInit<TReturn>,\n): Promise<CrudResponse<TReturn>> {\n  const { parseResult, fallbackResult, errorMessage, headers, ...rest } = init ?? {}\n  const call = await apiCall<TReturn>(\n    `/api/${apiPath}`,\n    {\n      ...rest,\n      method: 'PUT',\n      headers: mergeHeaders(headers, { 'content-type': 'application/json' }),\n      body: JSON.stringify(body),\n    },\n    {\n      parse: parseResult,\n      fallback: fallbackResult ?? null,\n    },\n  )\n  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to update')\n  return call\n}\n\nexport async function deleteCrud<TReturn = Record<string, unknown>>(\n  apiPath: string,\n  id: string,\n  init?: CrudRequestInit<TReturn>,\n): Promise<CrudResponse<TReturn>>\nexport async function deleteCrud<TReturn = Record<string, unknown>>(\n  apiPath: string,\n  options: CrudDeleteOptions<TReturn>,\n): Promise<CrudResponse<TReturn>>\nexport async function deleteCrud<TReturn = Record<string, unknown>>(\n  apiPath: string,\n  idOrOptions: string | CrudDeleteOptions<TReturn>,\n  maybeInit?: CrudRequestInit<TReturn>,\n): Promise<CrudResponse<TReturn>> {\n  if (typeof idOrOptions === 'string') {\n    const { parseResult, fallbackResult, errorMessage, ...rest } = maybeInit ?? {}\n    const call = await apiCall<TReturn>(\n      `/api/${apiPath}?id=${encodeURIComponent(idOrOptions)}`,\n      {\n        ...rest,\n        method: 'DELETE',\n      },\n      {\n        parse: parseResult,\n        fallback: fallbackResult ?? null,\n      },\n    )\n    if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to delete')\n    return call\n  }\n  const { parseResult, fallbackResult, errorMessage, headers, body, id, ...rest } = idOrOptions\n  const payload = body ?? (id ? { id } : undefined)\n  const requestHeaders =\n    payload !== undefined ? mergeHeaders(headers, { 'content-type': 'application/json' }) : headers\n  const call = await apiCall<TReturn>(\n    `/api/${apiPath}`,\n    {\n      ...rest,\n      method: 'DELETE',\n      headers: requestHeaders,\n      body: payload !== undefined ? JSON.stringify(payload) : undefined,\n    },\n    {\n      parse: parseResult,\n      fallback: fallbackResult ?? null,\n    },\n  )\n  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to delete')\n  return call\n}\n"],
+  "mappings": "AAYA,SAAS,QAAQ,QAA6B;AAC5C,QAAM,KAAK,IAAI,gBAAgB;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,MAAM,UAAa,MAAM,KAAM;AACnC,QAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,UAAI,EAAE,WAAW,EAAG;AACpB,SAAG,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,IACvB,OAAO;AACL,SAAG,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACrB;AAAA,EACF;AACA,SAAO,GAAG,SAAS;AACrB;AAEO,SAAS,eAAe,QAAqC;AAClE,SAAO,QAAQ,MAAM;AACvB;AAEA,SAAS,SAAS,4BAAgD;AAClE,SAAS,sBAAsB;AAE/B,SAAS,aAAa,MAA+B,OAA4C;AAC/F,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,iBAAiB,OAAO,YAAY;AAC1C,MAAI,kBAAkB,gBAAgB,SAAS;AAC7C,UAAM,SAAS,IAAI,QAAQ,IAAI;AAC/B,WAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,IAAI,KAAK,KAAK,CAAC;AACtE,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO,CAAC,GAAG,MAAM,GAAG,OAAO,QAAQ,KAAK,CAAC;AAAA,EAC3C;AACA,SAAO,EAAE,GAAI,MAAiC,GAAG,MAAM;AACzD;AAiBA,eAAsB,cAAiB,SAAiB,QAA6B,MAA8C;AACjI,QAAM,KAAK,eAAe,MAAM;AAChC,SAAO,qBAAsC,QAAQ,OAAO,IAAI,EAAE,IAAI,MAAM;AAAA,IAC1E,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,mBAAmB,SAAiB,QAA6B,QAAkC;AACjH,QAAM,KAAK,eAAe,EAAE,GAAG,QAAQ,OAAO,CAAC;AAC/C,SAAO,QAAQ,OAAO,IAAI,EAAE;AAC9B;AAEO,SAAS,gBAAgB,SAAiB,QAAqC;AACpF,SAAO,mBAAmB,SAAS,QAAQ,KAAK;AAClD;AAEA,eAAsB,WACpB,SACA,MACA,MACgC;AAChC,QAAM,EAAE,aAAa,gBAAgB,cAAc,SAAS,GAAG,KAAK,IAAI,QAAQ,CAAC;AACjF,QAAM,OAAO,MAAM;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf;AAAA,MACE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,SAAS,aAAa,SAAS,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,MACrE,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,UAAU,kBAAkB;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,CAAC,KAAK,GAAI,OAAM,eAAe,KAAK,UAAU,gBAAgB,kBAAkB;AACpF,SAAO;AACT;AAEA,eAAsB,WACpB,SACA,MACA,MACgC;AAChC,QAAM,EAAE,aAAa,gBAAgB,cAAc,SAAS,GAAG,KAAK,IAAI,QAAQ,CAAC;AACjF,QAAM,OAAO,MAAM;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf;AAAA,MACE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,SAAS,aAAa,SAAS,EAAE,gBAAgB,mBAAmB,CAAC;AAAA,MACrE,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,UAAU,kBAAkB;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,CAAC,KAAK,GAAI,OAAM,eAAe,KAAK,UAAU,gBAAgB,kBAAkB;AACpF,SAAO;AACT;AAWA,eAAsB,WACpB,SACA,aACA,WACgC;AAChC,MAAI,OAAO,gBAAgB,UAAU;AACnC,UAAM,EAAE,aAAAA,cAAa,gBAAAC,iBAAgB,cAAAC,eAAc,GAAGC,MAAK,IAAI,aAAa,CAAC;AAC7E,UAAMC,QAAO,MAAM;AAAA,MACjB,QAAQ,OAAO,OAAO,mBAAmB,WAAW,CAAC;AAAA,MACrD;AAAA,QACE,GAAGD;AAAA,QACH,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,QACE,OAAOH;AAAA,QACP,UAAUC,mBAAkB;AAAA,MAC9B;AAAA,IACF;AACA,QAAI,CAACG,MAAK,GAAI,OAAM,eAAeA,MAAK,UAAUF,iBAAgB,kBAAkB;AACpF,WAAOE;AAAA,EACT;AACA,QAAM,EAAE,aAAa,gBAAgB,cAAc,SAAS,MAAM,IAAI,GAAG,KAAK,IAAI;AAClF,QAAM,UAAU,SAAS,KAAK,EAAE,GAAG,IAAI;AACvC,QAAM,iBACJ,YAAY,SAAY,aAAa,SAAS,EAAE,gBAAgB,mBAAmB,CAAC,IAAI;AAC1F,QAAM,OAAO,MAAM;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf;AAAA,MACE,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,YAAY,SAAY,KAAK,UAAU,OAAO,IAAI;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,UAAU,kBAAkB;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,CAAC,KAAK,GAAI,OAAM,eAAe,KAAK,UAAU,gBAAgB,kBAAkB;AACpF,SAAO;AACT;",
+  "names": ["parseResult", "fallbackResult", "errorMessage", "rest", "call"]
+}

package/dist/backend/utils/customFieldColumns.js

@@ -0,0 +1,100 @@
+import { isDefVisible } from "./customFieldDefs.js";
+function supportsCustomFieldColumn(def) {
+  return def.kind !== "attachment";
+}
+function mapCustomFieldKindToFilterType(kind) {
+  switch (kind) {
+    case "boolean":
+      return "boolean";
+    case "integer":
+    case "float":
+      return "number";
+    case "date":
+    case "datetime":
+      return "date";
+    case "select":
+    case "dictionary":
+    case "currency":
+    case "relation":
+      return "select";
+    default:
+      return "text";
+  }
+}
+function normalizeCustomFieldFilterOptions(options) {
+  if (!Array.isArray(options)) return [];
+  return options.map((option) => {
+    if (option && typeof option === "object" && "value" in option) {
+      const rawValue = option.value;
+      const rawLabel = option.label ?? rawValue;
+      return {
+        value: String(rawValue),
+        label: typeof rawLabel === "string" ? rawLabel : String(rawLabel)
+      };
+    }
+    const value = String(option);
+    return {
+      value,
+      label: value.charAt(0).toUpperCase() + value.slice(1)
+    };
+  });
+}
+function applyCustomFieldVisibility(columns, defs, mode = "list") {
+  const byKey = new Map(defs.map((d) => [d.key, d]));
+  const filtered = columns.filter((c) => {
+    const key = String(c.accessorKey || "");
+    if (!key.startsWith("cf_")) return true;
+    const cfKey = key.slice(3);
+    const def = byKey.get(cfKey);
+    if (!def) return false;
+    if (!supportsCustomFieldColumn(def)) return false;
+    if (!isDefVisible(def, mode)) return false;
+    const currentHeader = c.header;
+    const fallbackHeader = typeof currentHeader === "string" && currentHeader.trim().length ? currentHeader : key;
+    const label = def.label && def.label.trim().length ? def.label : fallbackHeader;
+    if (currentHeader == null || typeof currentHeader === "string") {
+      c.header = label;
+    }
+    const existingMeta = c.meta || {};
+    const nextMeta = Object.assign({}, existingMeta, { label });
+    c.meta = nextMeta;
+    return true;
+  });
+  const cfEntries = [];
+  filtered.forEach((c) => {
+    const key = String(c.accessorKey || "");
+    if (key.startsWith("cf_")) {
+      const cfKey = key.slice(3);
+      const def = byKey.get(cfKey);
+      cfEntries.push({ col: c, key: cfKey, prio: def?.priority ?? 0 });
+    }
+  });
+  cfEntries.sort((a, b) => a.prio - b.prio);
+  let cfIdx = 0;
+  const result = filtered.map((c) => {
+    const key = String(c.accessorKey || "");
+    if (!key.startsWith("cf_")) return c;
+    const next = cfEntries[cfIdx++]?.col ?? c;
+    return next;
+  });
+  const existingCfKeys = new Set(result.map((c) => String(c.accessorKey || "")).filter((k) => k.startsWith("cf_")).map((k) => k.slice(3)));
+  const visibleSorted = defs.filter((d) => supportsCustomFieldColumn(d) && isDefVisible(d, mode)).sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0));
+  const missing = visibleSorted.filter((d) => !existingCfKeys.has(d.key));
+  for (const d of missing) {
+    const col = {
+      accessorKey: `cf_${d.key}`,
+      header: d.label || `cf_${d.key}`,
+      // Respect responsive priority when provided; default leaves it visible
+      meta: { priority: d.priority, label: d.label || `cf_${d.key}` }
+    };
+    result.push(col);
+  }
+  return result;
+}
+export {
+  applyCustomFieldVisibility,
+  mapCustomFieldKindToFilterType,
+  normalizeCustomFieldFilterOptions,
+  supportsCustomFieldColumn
+};
+//# sourceMappingURL=customFieldColumns.js.map

package/dist/backend/utils/customFieldColumns.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/backend/utils/customFieldColumns.ts"],
+  "sourcesContent": ["import type { ColumnDef } from '@tanstack/react-table'\nimport type { FilterFieldType, FilterOption } from '@open-mercato/shared/lib/query/advanced-filter'\nimport type { CustomFieldDefDto, CustomFieldVisibility } from './customFieldDefs'\nimport { isDefVisible } from './customFieldDefs'\n\ntype RawCustomFieldOption = string | number | { value?: unknown; label?: unknown }\n\nexport function supportsCustomFieldColumn(def: CustomFieldDefDto): boolean {\n  return def.kind !== 'attachment'\n}\n\nexport function mapCustomFieldKindToFilterType(kind: string): FilterFieldType {\n  switch (kind) {\n    case 'boolean':\n      return 'boolean'\n    case 'integer':\n    case 'float':\n      return 'number'\n    case 'date':\n    case 'datetime':\n      return 'date'\n    case 'select':\n    case 'dictionary':\n    case 'currency':\n    case 'relation':\n      return 'select'\n    default:\n      return 'text'\n  }\n}\n\nexport function normalizeCustomFieldFilterOptions(options?: RawCustomFieldOption[]): FilterOption[] {\n  if (!Array.isArray(options)) return []\n  return options.map((option) => {\n    if (option && typeof option === 'object' && 'value' in option) {\n      const rawValue = option.value\n      const rawLabel = option.label ?? rawValue\n      return {\n        value: String(rawValue),\n        label: typeof rawLabel === 'string' ? rawLabel : String(rawLabel),\n      }\n    }\n    const value = String(option)\n    return {\n      value,\n      label: value.charAt(0).toUpperCase() + value.slice(1),\n    }\n  })\n}\n\n// Filters and annotates columns with custom-field definitions:\n// - Drops cf_* columns when no definition exists or listVisible === false\n// - Uses definition label as header when header is missing\nexport function applyCustomFieldVisibility<T>(columns: ColumnDef<T, any>[], defs: CustomFieldDefDto[], mode: CustomFieldVisibility = 'list'): ColumnDef<T, any>[] {\n  const byKey = new Map(defs.map((d) => [d.key, d]))\n  // First, filter and annotate headers\n  const filtered = columns.filter((c) => {\n    const key = String((c as any).accessorKey || '')\n    if (!key.startsWith('cf_')) return true\n    const cfKey = key.slice(3)\n    const def = byKey.get(cfKey)\n    if (!def) return false\n    if (!supportsCustomFieldColumn(def)) return false\n    if (!isDefVisible(def, mode)) return false\n    const currentHeader = (c as any).header\n    const fallbackHeader = typeof currentHeader === 'string' && currentHeader.trim().length ? currentHeader : key\n    const label = def.label && def.label.trim().length ? def.label : fallbackHeader\n    if (currentHeader == null || typeof currentHeader === 'string') {\n      (c as any).header = label\n    }\n    const existingMeta = ((c as any).meta || {}) as Record<string, unknown>\n    const nextMeta = Object.assign({}, existingMeta, { label })\n    ;(c as any).meta = nextMeta\n    return true\n  })\n\n  // Then, reorder only the cf_* columns by definition priority while preserving\n  // the positions of non-cf columns and the count of cf slots.\n  const cfEntries: Array<{ col: ColumnDef<T, any>; key: string; prio: number }> = []\n  filtered.forEach((c) => {\n    const key = String((c as any).accessorKey || '')\n    if (key.startsWith('cf_')) {\n      const cfKey = key.slice(3)\n      const def = byKey.get(cfKey)\n      cfEntries.push({ col: c, key: cfKey, prio: def?.priority ?? 0 })\n    }\n  })\n  cfEntries.sort((a, b) => a.prio - b.prio)\n  let cfIdx = 0\n  const result = filtered.map((c) => {\n    const key = String((c as any).accessorKey || '')\n    if (!key.startsWith('cf_')) return c\n    const next = cfEntries[cfIdx++]?.col ?? c\n    return next\n  })\n\n  // Append any missing cf columns (defs visible but not present in incoming columns)\n  const existingCfKeys = new Set<string>(result\n    .map((c) => String((c as any).accessorKey || ''))\n    .filter((k) => k.startsWith('cf_'))\n    .map((k) => k.slice(3)))\n\n  const visibleSorted = defs\n    .filter((d) => supportsCustomFieldColumn(d) && isDefVisible(d, mode))\n    .sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0))\n\n  const missing = visibleSorted.filter((d) => !existingCfKeys.has(d.key))\n  for (const d of missing) {\n    const col: ColumnDef<T, any> = {\n      accessorKey: `cf_${d.key}` as any,\n      header: d.label || `cf_${d.key}`,\n      // Respect responsive priority when provided; default leaves it visible\n      meta: { priority: (d as any).priority, label: d.label || `cf_${d.key}` } as any,\n    }\n    result.push(col)\n  }\n  return result\n}\n"],
+  "mappings": "AAGA,SAAS,oBAAoB;AAItB,SAAS,0BAA0B,KAAiC;AACzE,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,+BAA+B,MAA+B;AAC5E,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,kCAAkC,SAAkD;AAClG,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO,CAAC;AACrC,SAAO,QAAQ,IAAI,CAAC,WAAW;AAC7B,QAAI,UAAU,OAAO,WAAW,YAAY,WAAW,QAAQ;AAC7D,YAAM,WAAW,OAAO;AACxB,YAAM,WAAW,OAAO,SAAS;AACjC,aAAO;AAAA,QACL,OAAO,OAAO,QAAQ;AAAA,QACtB,OAAO,OAAO,aAAa,WAAW,WAAW,OAAO,QAAQ;AAAA,MAClE;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,MAAM;AAC3B,WAAO;AAAA,MACL;AAAA,MACA,OAAO,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC;AAAA,IACtD;AAAA,EACF,CAAC;AACH;AAKO,SAAS,2BAA8B,SAA8B,MAA2B,OAA8B,QAA6B;AAChK,QAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAEjD,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM;AACrC,UAAM,MAAM,OAAQ,EAAU,eAAe,EAAE;AAC/C,QAAI,CAAC,IAAI,WAAW,KAAK,EAAG,QAAO;AACnC,UAAM,QAAQ,IAAI,MAAM,CAAC;AACzB,UAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,CAAC,0BAA0B,GAAG,EAAG,QAAO;AAC5C,QAAI,CAAC,aAAa,KAAK,IAAI,EAAG,QAAO;AACrC,UAAM,gBAAiB,EAAU;AACjC,UAAM,iBAAiB,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,SAAS,gBAAgB;AAC1G,UAAM,QAAQ,IAAI,SAAS,IAAI,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACjE,QAAI,iBAAiB,QAAQ,OAAO,kBAAkB,UAAU;AAC9D,MAAC,EAAU,SAAS;AAAA,IACtB;AACA,UAAM,eAAiB,EAAU,QAAQ,CAAC;AAC1C,UAAM,WAAW,OAAO,OAAO,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC;AACzD,IAAC,EAAU,OAAO;AACnB,WAAO;AAAA,EACT,CAAC;AAID,QAAM,YAA0E,CAAC;AACjF,WAAS,QAAQ,CAAC,MAAM;AACtB,UAAM,MAAM,OAAQ,EAAU,eAAe,EAAE;AAC/C,QAAI,IAAI,WAAW,KAAK,GAAG;AACzB,YAAM,QAAQ,IAAI,MAAM,CAAC;AACzB,YAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,gBAAU,KAAK,EAAE,KAAK,GAAG,KAAK,OAAO,MAAM,KAAK,YAAY,EAAE,CAAC;AAAA,IACjE;AAAA,EACF,CAAC;AACD,YAAU,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI;AACxC,MAAI,QAAQ;AACZ,QAAM,SAAS,SAAS,IAAI,CAAC,MAAM;AACjC,UAAM,MAAM,OAAQ,EAAU,eAAe,EAAE;AAC/C,QAAI,CAAC,IAAI,WAAW,KAAK,EAAG,QAAO;AACnC,UAAM,OAAO,UAAU,OAAO,GAAG,OAAO;AACxC,WAAO;AAAA,EACT,CAAC;AAGD,QAAM,iBAAiB,IAAI,IAAY,OACpC,IAAI,CAAC,MAAM,OAAQ,EAAU,eAAe,EAAE,CAAC,EAC/C,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,EACjC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzB,QAAM,gBAAgB,KACnB,OAAO,CAAC,MAAM,0BAA0B,CAAC,KAAK,aAAa,GAAG,IAAI,CAAC,EACnE,KAAK,CAAC,GAAG,OAAO,EAAE,YAAY,MAAM,EAAE,YAAY,EAAE;AAEvD,QAAM,UAAU,cAAc,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,GAAG,CAAC;AACtE,aAAW,KAAK,SAAS;AACvB,UAAM,MAAyB;AAAA,MAC7B,aAAa,MAAM,EAAE,GAAG;AAAA,MACxB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG;AAAA;AAAA,MAE9B,MAAM,EAAE,UAAW,EAAU,UAAU,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG;AAAA,IACzE;AACA,WAAO,KAAK,GAAG;AAAA,EACjB;AACA,SAAO;AACT;",
+  "names": []
+}