@open-mercato/core 0.10.1-develop.7709.1.046124599c → 0.10.1-develop.7714.1.9dbb8200d8

package/dist/modules/wms/api/asns/[id]/complete/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/wms/api/asns/%5Bid%5D/complete/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { asnCloseSchema } from '../../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../../../inventory/helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n}\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nexport async function POST(request: Request, routeContext: { params: { id: string } }) {\n  const parsedParams = paramsSchema.parse(routeContext.params)\n  const body = await readJsonSafe<Record<string, unknown>>(request, {})\n  const scopedRequest = new Request(request.url, {\n    method: 'POST',\n    headers: request.headers,\n    body: JSON.stringify({ ...body, id: parsedParams.id }),\n  })\n  return executeWmsCustomPostRoute({\n    request: scopedRequest,\n    routePath: `wms/asns/${parsedParams.id}/complete`,\n    inputSchema: asnCloseSchema,\n    commandId: 'wms.asns.close',\n    describeResource: (input) => ({\n      resourceKind: 'wms.asn',\n      resourceId: input.id,\n    }),\n    mapSuccess: (result: { status: string }) => ({\n      ok: true,\n      status: result.status,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  status: z.enum(['draft', 'in_transit', 'received', 'closed']),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Complete ASN',\n  methods: {\n    POST: {\n      summary: 'Complete ASN',\n      description:\n        'Marks an ASN as received when it has receipt activity (at least one line with receivedQty > 0) and lines are complete (QC-passed accepted qty meets expected), or when closeWhenShort is true for short/QC-fail receipts after some receipt activity. Header-only ASNs and zero-receipt lines are rejected even with closeWhenShort.',\n      requestBody: { contentType: 'application/json', schema: asnCloseSchema },\n      responses: [{ status: 200, description: 'ASN completed', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Invalid receipt state', schema: errorSchema },\n      ],\n    },\n  },\n}"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,eAAsB,KAAK,SAAkB,cAA0C;AACrF,QAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,QAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,QAAM,gBAAgB,IAAI,QAAQ,QAAQ,KAAK;AAAA,IAC7C,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB,MAAM,KAAK,UAAU,EAAE,GAAG,MAAM,IAAI,aAAa,GAAG,CAAC;AAAA,EACvD,CAAC;AACD,SAAO,0BAA0B;AAAA,IAC/B,SAAS;AAAA,IACT,WAAW,YAAY,aAAa,EAAE;AAAA,IACtC,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,IACpB;AAAA,IACA,YAAY,CAAC,YAAgC;AAAA,MAC3C,IAAI;AAAA,MACJ,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,KAAK,CAAC,SAAS,cAAc,YAAY,QAAQ,CAAC;AAC9D,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,eAAe;AAAA,MACvE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,cAAc,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/asns/[id]/receive/route.js

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { asnReceiveLineSchema } from "../../../../data/validators.js";
+import { executeWmsCustomPostRoute } from "../../../inventory/helpers.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["wms.receive_inventory"] }
+};
+const paramsSchema = z.object({
+  id: z.string().uuid()
+});
+async function POST(request, routeContext) {
+  const parsedParams = paramsSchema.parse(routeContext.params);
+  const body = await readJsonSafe(request, {});
+  const scopedRequest = new Request(request.url, {
+    method: "POST",
+    headers: request.headers,
+    body: JSON.stringify({ ...body, asnId: parsedParams.id })
+  });
+  return executeWmsCustomPostRoute({
+    request: scopedRequest,
+    routePath: `wms/asns/${parsedParams.id}/receive`,
+    inputSchema: asnReceiveLineSchema,
+    commandId: "wms.asns.receive-line",
+    describeResource: (input) => ({
+      resourceKind: "wms.asn",
+      resourceId: input.asnId
+    }),
+    mapSuccess: (result) => ({
+      ok: true,
+      movementIds: result.movementIds,
+      putawayTaskIds: result.putawayTaskIds,
+      receivedQty: result.receivedQty,
+      asnUpdatedAt: result.asnUpdatedAt
+    })
+  });
+}
+const successSchema = z.object({
+  ok: z.literal(true),
+  movementIds: z.array(z.string().uuid()),
+  putawayTaskIds: z.array(z.string().uuid()),
+  receivedQty: z.number().optional(),
+  asnUpdatedAt: z.string().datetime().optional()
+});
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "WMS",
+  summary: "Receive ASN line",
+  methods: {
+    POST: {
+      summary: "Receive ASN line",
+      description: "Receives a line against an ASN with QC outcome. QC pass writes receipt stock at staging/dock; QC fail records audit without balance increase. Both require absolute targetReceivedQty for retry-safe attempts (optional idempotencyKey is an extra stabilizer).",
+      requestBody: { contentType: "application/json", schema: asnReceiveLineSchema },
+      responses: [{ status: 200, description: "ASN line received", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 409, description: "Invalid receipt state", schema: errorSchema },
+        { status: 422, description: "Tracking or QC transition invalid", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/asns/[id]/receive/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/wms/api/asns/%5Bid%5D/receive/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { asnReceiveLineSchema } from '../../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../../../inventory/helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.receive_inventory'] },\n}\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nexport async function POST(request: Request, routeContext: { params: { id: string } }) {\n  const parsedParams = paramsSchema.parse(routeContext.params)\n  const body = await readJsonSafe<Record<string, unknown>>(request, {})\n  const scopedRequest = new Request(request.url, {\n    method: 'POST',\n    headers: request.headers,\n    body: JSON.stringify({ ...body, asnId: parsedParams.id }),\n  })\n  return executeWmsCustomPostRoute({\n    request: scopedRequest,\n    routePath: `wms/asns/${parsedParams.id}/receive`,\n    inputSchema: asnReceiveLineSchema,\n    commandId: 'wms.asns.receive-line',\n    describeResource: (input) => ({\n      resourceKind: 'wms.asn',\n      resourceId: input.asnId,\n    }),\n    mapSuccess: (result: {\n      movementIds: string[]\n      putawayTaskIds: string[]\n      receivedQty?: number\n      asnUpdatedAt?: string\n    }) => ({\n      ok: true,\n      movementIds: result.movementIds,\n      putawayTaskIds: result.putawayTaskIds,\n      receivedQty: result.receivedQty,\n      asnUpdatedAt: result.asnUpdatedAt,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  movementIds: z.array(z.string().uuid()),\n  putawayTaskIds: z.array(z.string().uuid()),\n  receivedQty: z.number().optional(),\n  asnUpdatedAt: z.string().datetime().optional(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Receive ASN line',\n  methods: {\n    POST: {\n      summary: 'Receive ASN line',\n      description:\n        'Receives a line against an ASN with QC outcome. QC pass writes receipt stock at staging/dock; QC fail records audit without balance increase. Both require absolute targetReceivedQty for retry-safe attempts (optional idempotencyKey is an extra stabilizer).',\n      requestBody: { contentType: 'application/json', schema: asnReceiveLineSchema },\n      responses: [{ status: 200, description: 'ASN line received', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Invalid receipt state', schema: errorSchema },\n        { status: 422, description: 'Tracking or QC transition invalid', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,eAAsB,KAAK,SAAkB,cAA0C;AACrF,QAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,QAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,QAAM,gBAAgB,IAAI,QAAQ,QAAQ,KAAK;AAAA,IAC7C,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB,MAAM,KAAK,UAAU,EAAE,GAAG,MAAM,OAAO,aAAa,GAAG,CAAC;AAAA,EAC1D,CAAC;AACD,SAAO,0BAA0B;AAAA,IAC/B,SAAS;AAAA,IACT,WAAW,YAAY,aAAa,EAAE;AAAA,IACtC,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,IACpB;AAAA,IACA,YAAY,CAAC,YAKN;AAAA,MACL,IAAI;AAAA,MACJ,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,MACvB,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACtC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC/C,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,qBAAqB;AAAA,MAC7E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,cAAc,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/asns/route.js

@@ -0,0 +1,197 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { parseScopedCommandInput, resolveCrudRecordId } from "@open-mercato/shared/lib/api/scoped";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { E } from "../../../../generated/entities.ids.generated.js";
+import { Asn } from "../../data/entities.js";
+import { asnCreatePublicSchema, asnUpdateSchema } from "../../data/validators.js";
+import { buildAsnStatusFilter } from "../../lib/asnReceiving.js";
+import { attachVendorLabelsToListItems, attachWarehouseLabelsToListItems } from "../listEnrichers.js";
+import { createPagedListResponseSchema, createWmsCrudOpenApi, defaultOkResponseSchema } from "../openapi.js";
+const F = {
+  id: "id",
+  organization_id: "organization_id",
+  tenant_id: "tenant_id",
+  warehouse_id: "warehouse_id",
+  vendor_id: "vendor_id",
+  status: "status",
+  expected_at: "expected_at",
+  reference_number: "reference_number",
+  notes: "notes",
+  created_at: "created_at",
+  updated_at: "updated_at"
+};
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["wms.view"] },
+  POST: { requireAuth: true, requireFeatures: ["wms.manage_asn"] },
+  PUT: { requireAuth: true, requireFeatures: ["wms.manage_asn"] },
+  DELETE: { requireAuth: true, requireFeatures: ["wms.manage_asn"] }
+};
+const metadata = routeMetadata;
+const rawBodySchema = z.object({}).passthrough();
+const listSchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(25),
+  search: z.string().optional(),
+  ids: z.string().optional(),
+  warehouseId: z.string().uuid().optional(),
+  vendorId: z.string().uuid().optional(),
+  // Single status or comma-separated (e.g. draft,in_transit for open receiving queue).
+  status: z.string().optional(),
+  sortField: z.string().optional(),
+  sortDir: z.enum(["asc", "desc"]).optional()
+}).passthrough();
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: Asn,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  indexer: { entityType: E.wms.asn },
+  list: {
+    schema: listSchema,
+    disableListCache: true,
+    entityId: E.wms.asn,
+    fields: [
+      F.id,
+      F.organization_id,
+      F.tenant_id,
+      F.warehouse_id,
+      F.vendor_id,
+      F.status,
+      F.expected_at,
+      F.reference_number,
+      F.notes,
+      F.created_at,
+      F.updated_at
+    ],
+    sortFieldMap: {
+      status: F.status,
+      expectedAt: F.expected_at,
+      createdAt: F.created_at,
+      updatedAt: F.updated_at,
+      referenceNumber: F.reference_number
+    },
+    buildFilters: async (query) => {
+      const filters = {};
+      if (typeof query.ids === "string" && query.ids.trim().length > 0) {
+        filters[F.id] = {
+          $in: query.ids.split(",").map((value) => value.trim()).filter((value) => value.length > 0)
+        };
+      }
+      if (typeof query.warehouseId === "string" && query.warehouseId.length > 0) {
+        filters[F.warehouse_id] = { $eq: query.warehouseId };
+      }
+      if (typeof query.vendorId === "string" && query.vendorId.length > 0) {
+        filters[F.vendor_id] = { $eq: query.vendorId };
+      }
+      if (typeof query.status === "string" && query.status.length > 0) {
+        const statusFilter = buildAsnStatusFilter(query.status);
+        if (statusFilter) filters[F.status] = statusFilter;
+      }
+      const term = query.search?.trim();
+      if (term) {
+        const like = `%${escapeLikePattern(term)}%`;
+        filters.$or = [
+          { [F.reference_number]: { $ilike: like } },
+          { [F.notes]: { $ilike: like } }
+        ];
+      }
+      return filters;
+    }
+  },
+  hooks: {
+    afterList: async (payload, ctx) => {
+      await Promise.all([
+        attachWarehouseLabelsToListItems(payload, ctx),
+        attachVendorLabelsToListItems(payload, ctx)
+      ]);
+    }
+  },
+  actions: {
+    create: {
+      commandId: "wms.asns.create",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(asnCreatePublicSchema, raw ?? {}, ctx, translate);
+      },
+      response: ({ result }) => ({
+        id: result?.asnId ?? null,
+        lineIds: result?.lineIds ?? []
+      }),
+      status: 201
+    },
+    update: {
+      commandId: "wms.asns.update",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(asnUpdateSchema, raw ?? {}, ctx, translate);
+      },
+      response: () => ({ ok: true })
+    },
+    delete: {
+      commandId: "wms.asns.delete",
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return { id: resolveCrudRecordId(parsed, ctx, translate) };
+      },
+      response: () => ({ ok: true })
+    }
+  }
+});
+const GET = crud.GET;
+const POST = crud.POST;
+const PUT = crud.PUT;
+const DELETE = crud.DELETE;
+const asnListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  warehouse_id: z.string().uuid().nullable().optional(),
+  warehouse_name: z.string().nullable().optional(),
+  warehouse_code: z.string().nullable().optional(),
+  vendor_id: z.string().uuid().nullable().optional(),
+  vendor_name: z.string().nullable().optional(),
+  status: z.string().nullable().optional(),
+  expected_at: z.string().nullable().optional(),
+  reference_number: z.string().nullable().optional(),
+  notes: z.string().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+const openApi = createWmsCrudOpenApi({
+  resourceName: "ASN",
+  pluralName: "ASNs",
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(asnListItemSchema),
+  create: {
+    schema: asnCreatePublicSchema,
+    description: "Creates an ASN with optional expected receiving lines. `sourceKey` is server-only (procurement/system path) and is not accepted on this public API."
+  },
+  update: {
+    schema: asnUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: "Updates an ASN by id while status is draft or in_transit and no receiving line has receipt/QC activity. Received/closed ASNs, or ASNs with line receipt/QC activity, return 409 invalid_receipt_state (status demotion and warehouse/header changes are not allowed). Status may only be set to draft or in_transit; received/closed are set via receive/complete flows."
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: "Soft-deletes an ASN by id."
+  }
+});
+export {
+  DELETE,
+  GET,
+  POST,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/asns/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/wms/api/asns/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput, resolveCrudRecordId } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { E } from '#generated/entities.ids.generated'\nimport { Asn } from '../../data/entities'\nimport { asnCreatePublicSchema, asnUpdateSchema } from '../../data/validators'\nimport { buildAsnStatusFilter } from '../../lib/asnReceiving'\nimport { attachVendorLabelsToListItems, attachWarehouseLabelsToListItems } from '../listEnrichers'\nimport { createPagedListResponseSchema, createWmsCrudOpenApi, defaultOkResponseSchema } from '../openapi'\n\nconst F = {\n  id: 'id',\n  organization_id: 'organization_id',\n  tenant_id: 'tenant_id',\n  warehouse_id: 'warehouse_id',\n  vendor_id: 'vendor_id',\n  status: 'status',\n  expected_at: 'expected_at',\n  reference_number: 'reference_number',\n  notes: 'notes',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n  POST: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n  PUT: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n  DELETE: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(25),\n  search: z.string().optional(),\n  ids: z.string().optional(),\n  warehouseId: z.string().uuid().optional(),\n  vendorId: z.string().uuid().optional(),\n  // Single status or comma-separated (e.g. draft,in_transit for open receiving queue).\n  status: z.string().optional(),\n  sortField: z.string().optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: Asn,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.wms.asn },\n  list: {\n    schema: listSchema,\n    disableListCache: true,\n    entityId: E.wms.asn,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.warehouse_id,\n      F.vendor_id,\n      F.status,\n      F.expected_at,\n      F.reference_number,\n      F.notes,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      status: F.status,\n      expectedAt: F.expected_at,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      referenceNumber: F.reference_number,\n    },\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        filters[F.id] = {\n          $in: query.ids.split(',').map((value) => value.trim()).filter((value) => value.length > 0),\n        }\n      }\n      if (typeof query.warehouseId === 'string' && query.warehouseId.length > 0) {\n        filters[F.warehouse_id] = { $eq: query.warehouseId }\n      }\n      if (typeof query.vendorId === 'string' && query.vendorId.length > 0) {\n        filters[F.vendor_id] = { $eq: query.vendorId }\n      }\n      if (typeof query.status === 'string' && query.status.length > 0) {\n        const statusFilter = buildAsnStatusFilter(query.status)\n        if (statusFilter) filters[F.status] = statusFilter\n      }\n      const term = query.search?.trim()\n      if (term) {\n        const like = `%${escapeLikePattern(term)}%`\n        filters.$or = [\n          { [F.reference_number]: { $ilike: like } },\n          { [F.notes]: { $ilike: like } },\n        ]\n      }\n      return filters\n    },\n  },\n  hooks: {\n    afterList: async (payload, ctx) => {\n      await Promise.all([\n        attachWarehouseLabelsToListItems(payload, ctx),\n        attachVendorLabelsToListItems(payload, ctx),\n      ])\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'wms.asns.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        // Public create strips sourceKey \u2014 procurement/system sets it via command with auth: null.\n        return parseScopedCommandInput(asnCreatePublicSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({\n        id: result?.asnId ?? null,\n        lineIds: result?.lineIds ?? [],\n      }),\n      status: 201,\n    },\n    update: {\n      commandId: 'wms.asns.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(asnUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'wms.asns.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return { id: resolveCrudRecordId(parsed, ctx, translate) }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst asnListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  warehouse_id: z.string().uuid().nullable().optional(),\n  warehouse_name: z.string().nullable().optional(),\n  warehouse_code: z.string().nullable().optional(),\n  vendor_id: z.string().uuid().nullable().optional(),\n  vendor_name: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  expected_at: z.string().nullable().optional(),\n  reference_number: z.string().nullable().optional(),\n  notes: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createWmsCrudOpenApi({\n  resourceName: 'ASN',\n  pluralName: 'ASNs',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(asnListItemSchema),\n  create: {\n    schema: asnCreatePublicSchema,\n    description:\n      'Creates an ASN with optional expected receiving lines. `sourceKey` is server-only (procurement/system path) and is not accepted on this public API.',\n  },\n  update: {\n    schema: asnUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates an ASN by id while status is draft or in_transit and no receiving line has receipt/QC activity. Received/closed ASNs, or ASNs with line receipt/QC activity, return 409 invalid_receipt_state (status demotion and warehouse/header changes are not allowed). Status may only be set to draft or in_transit; received/closed are set via receive/complete flows.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes an ASN by id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB,2BAA2B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,SAAS;AAClB,SAAS,WAAW;AACpB,SAAS,uBAAuB,uBAAuB;AACvD,SAAS,4BAA4B;AACrC,SAAS,+BAA+B,wCAAwC;AAChF,SAAS,+BAA+B,sBAAsB,+BAA+B;AAE7F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAAA,EACxD,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACnE;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAErC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EAAE,YAAY;AAEf,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,IAAI,IAAI;AAAA,EACjC,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,kBAAkB;AAAA,IAClB,UAAU,EAAE,IAAI;AAAA,IAChB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,QAAQ,EAAE;AAAA,MACV,YAAY,EAAE;AAAA,MACd,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,iBAAiB,EAAE;AAAA,IACrB;AAAA,IACA,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,gBAAQ,EAAE,EAAE,IAAI;AAAA,UACd,KAAK,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,QAC3F;AAAA,MACF;AACA,UAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,YAAY,SAAS,GAAG;AACzE,gBAAQ,EAAE,YAAY,IAAI,EAAE,KAAK,MAAM,YAAY;AAAA,MACrD;AACA,UAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,GAAG;AACnE,gBAAQ,EAAE,SAAS,IAAI,EAAE,KAAK,MAAM,SAAS;AAAA,MAC/C;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,SAAS,GAAG;AAC/D,cAAM,eAAe,qBAAqB,MAAM,MAAM;AACtD,YAAI,aAAc,SAAQ,EAAE,MAAM,IAAI;AAAA,MACxC;AACA,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,UAAI,MAAM;AACR,cAAM,OAAO,IAAI,kBAAkB,IAAI,CAAC;AACxC,gBAAQ,MAAM;AAAA,UACZ,EAAE,CAAC,EAAE,gBAAgB,GAAG,EAAE,QAAQ,KAAK,EAAE;AAAA,UACzC,EAAE,CAAC,EAAE,KAAK,GAAG,EAAE,QAAQ,KAAK,EAAE;AAAA,QAChC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,SAAS,QAAQ;AACjC,YAAM,QAAQ,IAAI;AAAA,QAChB,iCAAiC,SAAS,GAAG;AAAA,QAC7C,8BAA8B,SAAS,GAAG;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,eAAO,wBAAwB,uBAAuB,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACjF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,IAAI,QAAQ,SAAS;AAAA,QACrB,SAAS,QAAQ,WAAW,CAAC;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,iBAAiB,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MAC3E;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,EAAE,IAAI,oBAAoB,QAAQ,KAAK,SAAS,EAAE;AAAA,MAC3D;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,qBAAqB;AAAA,EAC1C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,iBAAiB;AAAA,EACnE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/wms/api/inventory/helpers.js

@@ -4,16 +4,20 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { ensureOrganizationScope } from "@open-mercato/shared/lib/commands/scope";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
-import {
-  runCrudMutationGuardAfterSuccess,
-  validateCrudMutationGuard
-} from "@open-mercato/shared/lib/crud/mutation-guard";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { runCustomRouteAfterInterceptors } from "@open-mercato/shared/lib/crud/custom-route-interceptor";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("wms");
+function resolveBodyOrganizationId(body) {
+  const raw = body.organizationId;
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
 async function executeWmsCustomPostRoute(options) {
   try {
     const container = await createRequestContainer();
@@ -35,41 +39,45 @@ async function executeWmsCustomPostRoute(options) {
       organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: options.request
     };
-    const body = await readJsonSafe(options.request, {});
-    const parsed = options.inputSchema.parse(body);
-    const resource = options.describeResource(parsed);
-    const guardResult = await validateCrudMutationGuard(container, {
+    const body = await readJsonSafe(options.request, {}) ?? {};
+    const sessionOrganizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null;
+    const organizationId = resolveBodyOrganizationId(body) ?? sessionOrganizationId;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: "organization_scope_required" });
+    }
+    ensureOrganizationScope(ctx, organizationId);
+    const scopedBody = {
+      ...body,
       tenantId: auth.tenantId,
-      organizationId: ctx.selectedOrganizationId,
-      userId: auth.sub,
-      resourceKind: resource.resourceKind,
-      resourceId: resource.resourceId,
-      operation: "custom",
-      requestMethod: options.request.method,
-      requestHeaders: options.request.headers,
-      mutationPayload: parsed
+      organizationId
+    };
+    const parsed = options.inputSchema.parse(scopedBody);
+    const resource = options.describeResource(parsed);
+    const guardResult = await runRouteMutationGuards({
+      container,
+      req: options.request,
+      auth: {
+        userId: auth.sub,
+        tenantId: auth.tenantId,
+        organizationId
+      },
+      input: {
+        resourceKind: resource.resourceKind,
+        resourceId: resource.resourceId,
+        operation: "custom",
+        mutationPayload: parsed
+      }
     });
-    if (guardResult && !guardResult.ok) {
-      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    if (!guardResult.ok) {
+      return NextResponse.json(guardResult.errorBody, { status: guardResult.errorStatus });
     }
+    const commandInput = guardResult.modifiedPayload ?? parsed;
     const commandBus = container.resolve("commandBus");
     const execution = await commandBus.execute(options.commandId, {
-      input: parsed,
+      input: commandInput,
       ctx
     });
-    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
-      await runCrudMutationGuardAfterSuccess(container, {
-        tenantId: auth.tenantId,
-        organizationId: ctx.selectedOrganizationId,
-        userId: auth.sub,
-        resourceKind: resource.resourceKind,
-        resourceId: resource.resourceId,
-        operation: "custom",
-        requestMethod: options.request.method,
-        requestHeaders: options.request.headers,
-        metadata: guardResult.metadata ?? null
-      });
-    }
+    await guardResult.runAfterSuccess();
     const responseBody = options.mapSuccess(execution.result);
     const intercepted = await runCustomRouteAfterInterceptors({
       routePath: options.routePath,
@@ -77,7 +85,7 @@ async function executeWmsCustomPostRoute(options) {
       request: {
         method: "POST",
         url: options.request.url,
-        body: parsed,
+        body: commandInput,
         headers: Object.fromEntries(options.request.headers.entries())
       },
       response: {
@@ -89,7 +97,7 @@ async function executeWmsCustomPostRoute(options) {
         em: container.resolve("em"),
         container,
         userId: auth.sub,
-        organizationId: ctx.selectedOrganizationId,
+        organizationId,
         tenantId: auth.tenantId
       }
     });

package/dist/modules/wms/api/inventory/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/wms/api/inventory/helpers.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('wms')\n\ntype ResourceDescriptor = {\n  resourceKind: string\n  resourceId: string\n}\n\ntype ExecuteWmsCustomPostRouteOptions<TInput, TResult> = {\n  request: Request\n  routePath: string\n  inputSchema: z.ZodType<TInput>\n  commandId: string\n  describeResource: (input: TInput) => ResourceDescriptor\n  mapSuccess: (result: TResult) => Record<string, unknown>\n}\n\nexport async function executeWmsCustomPostRoute<TInput, TResult>(\n  options: ExecuteWmsCustomPostRouteOptions<TInput, TResult>,\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(options.request)\n    const { translate } = await resolveTranslations()\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: options.request,\n    })\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: options.request,\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(options.request, {})\n    const parsed = options.inputSchema.parse(body)\n    const resource = options.describeResource(parsed)\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: resource.resourceKind,\n      resourceId: resource.resourceId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const execution = await commandBus.execute<TInput, TResult>(options.commandId, {\n      input: parsed,\n      ctx,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const responseBody = options.mapSuccess(execution.result)\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: container.resolve('em'),\n        container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('custom route failed', { routePath: options.routePath, commandId: options.commandId, err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,KAAK;AAgBjC,eAAsB,0BACpB,SACA;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,QAAQ,OAAO;AACrD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS,QAAQ;AAAA,IACnB;AACA,UAAM,OAAO,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC;AAC5E,UAAM,SAAS,QAAQ,YAAY,MAAM,IAAI;AAC7C,UAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,YAAY,MAAM,WAAW,QAAyB,QAAQ,WAAW;AAAA,MAC7E,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,eAAe,QAAQ,WAAW,UAAU,MAAM;AACxD,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC1B;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,WAAW,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { ensureOrganizationScope } from '@open-mercato/shared/lib/commands/scope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('wms')\n\ntype ResourceDescriptor = {\n  resourceKind: string\n  resourceId: string\n}\n\ntype ExecuteWmsCustomPostRouteOptions<TInput, TResult> = {\n  request: Request\n  routePath: string\n  inputSchema: z.ZodType<TInput>\n  commandId: string\n  describeResource: (input: TInput) => ResourceDescriptor\n  mapSuccess: (result: TResult) => Record<string, unknown>\n}\n\nfunction resolveBodyOrganizationId(body: Record<string, unknown>): string | null {\n  const raw = body.organizationId\n  if (typeof raw !== 'string') return null\n  const trimmed = raw.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * Shared POST helper for WMS custom write routes.\n *\n * Organization scoping:\n * - When the body includes `organizationId`, pass it through and validate with\n *   `ensureOrganizationScope` (allowed org ids / Pattern C). Do not silently\n *   overwrite with the session-selected org \u2014 that mis-routes multi-org writes.\n * - When the body omits `organizationId`, default to the session selected/auth org.\n * - `tenantId` is always taken from auth (never from the body).\n *\n * Intentional session-only exception: barcode scan resolve/receive/putaway routes\n * force session org onto the request body *before* calling this helper so resolve\n * lookups cannot probe another org. That pre-scope policy stays on those routes.\n */\nexport async function executeWmsCustomPostRoute<TInput, TResult>(\n  options: ExecuteWmsCustomPostRouteOptions<TInput, TResult>,\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(options.request)\n    const { translate } = await resolveTranslations()\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: options.request,\n    })\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: options.request,\n    }\n    const body = (await readJsonSafe<Record<string, unknown>>(options.request, {})) ?? {}\n    const sessionOrganizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n    const organizationId = resolveBodyOrganizationId(body) ?? sessionOrganizationId\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: 'organization_scope_required' })\n    }\n    ensureOrganizationScope(ctx, organizationId)\n    const scopedBody = {\n      ...body,\n      tenantId: auth.tenantId,\n      organizationId,\n    }\n    const parsed = options.inputSchema.parse(scopedBody)\n    const resource = options.describeResource(parsed)\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req: options.request,\n      auth: {\n        userId: auth.sub,\n        tenantId: auth.tenantId,\n        organizationId,\n      },\n      input: {\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        mutationPayload: parsed as Record<string, unknown>,\n      },\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody, { status: guardResult.errorStatus })\n    }\n    const commandInput = (guardResult.modifiedPayload as TInput | undefined) ?? parsed\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const execution = await commandBus.execute<TInput, TResult>(options.commandId, {\n      input: commandInput,\n      ctx,\n    })\n    await guardResult.runAfterSuccess()\n    const responseBody = options.mapSuccess(execution.result)\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: commandInput as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: container.resolve('em'),\n        container,\n        userId: auth.sub,\n        organizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('custom route failed', { routePath: options.routePath, commandId: options.commandId, err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,+BAA+B;AACxC,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,KAAK;AAgBjC,SAAS,0BAA0B,MAA8C;AAC/E,QAAM,MAAM,KAAK;AACjB,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAgBA,eAAsB,0BACpB,SACA;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,QAAQ,OAAO;AACrD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS,QAAQ;AAAA,IACnB;AACA,UAAM,OAAQ,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC,KAAM,CAAC;AACpF,UAAM,wBAAwB,IAAI,0BAA0B,KAAK,SAAS;AAC1E,UAAM,iBAAiB,0BAA0B,IAAI,KAAK;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AACA,4BAAwB,KAAK,cAAc;AAC3C,UAAM,aAAa;AAAA,MACjB,GAAG;AAAA,MACH,UAAU,KAAK;AAAA,MACf;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,YAAY,MAAM,UAAU;AACnD,UAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA,KAAK,QAAQ;AAAA,MACb,MAAM;AAAA,QACJ,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,WAAW,EAAE,QAAQ,YAAY,YAAY,CAAC;AAAA,IACrF;AACA,UAAM,eAAgB,YAAY,mBAA0C;AAC5E,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,YAAY,MAAM,WAAW,QAAyB,QAAQ,WAAW;AAAA,MAC7E,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,UAAM,YAAY,gBAAgB;AAClC,UAAM,eAAe,QAAQ,WAAW,UAAU,MAAM;AACxD,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC1B;AAAA,QACA,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,WAAW,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
   "names": []
 }

package/dist/modules/wms/api/inventory/receive/route.js

@@ -31,7 +31,7 @@ const openApi = {
   methods: {
     POST: {
       summary: "Receive inventory",
-      description: "Records inbound inventory receipt and appends a receipt movement ledger row.",
+      description: "Records inbound inventory receipt and appends a receipt movement ledger row. When `organizationId` is present it must be in the caller organization scope; otherwise the session-selected organization is used.",
       requestBody: { contentType: "application/json", schema: inventoryReceiveSchema },
       responses: [{ status: 200, description: "Inventory received", schema: successSchema }],
       errors: [

package/dist/modules/wms/api/inventory/receive/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/wms/api/inventory/receive/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryReceiveSchema } from '../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.receive_inventory'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsCustomPostRoute({\n    request,\n    routePath: 'wms/inventory/receive',\n    inputSchema: inventoryReceiveSchema,\n    commandId: 'wms.inventory.receive',\n    describeResource: (input) => ({\n      resourceKind: 'wms.inventory',\n      resourceId: `${input.warehouseId}:${input.locationId}:${input.catalogVariantId}`,\n    }),\n    mapSuccess: (result: { movementId: string }) => ({\n      ok: true,\n      movementId: result.movementId,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  movementId: z.string().uuid(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Receive inventory',\n  methods: {\n    POST: {\n      summary: 'Receive inventory',\n      description: 'Records inbound inventory receipt and appends a receipt movement ledger row.',\n      requestBody: { contentType: 'application/json', schema: inventoryReceiveSchema },\n      responses: [{ status: 200, description: 'Inventory received', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 422, description: 'Invalid location', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,0BAA0B;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,GAAG,MAAM,WAAW,IAAI,MAAM,UAAU,IAAI,MAAM,gBAAgB;AAAA,IAChF;AAAA,IACA,YAAY,CAAC,YAAoC;AAAA,MAC/C,IAAI;AAAA,MACJ,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,KAAK;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MAC/E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,cAAc,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryReceiveSchema } from '../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.receive_inventory'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsCustomPostRoute({\n    request,\n    routePath: 'wms/inventory/receive',\n    inputSchema: inventoryReceiveSchema,\n    commandId: 'wms.inventory.receive',\n    describeResource: (input) => ({\n      resourceKind: 'wms.inventory',\n      resourceId: `${input.warehouseId}:${input.locationId}:${input.catalogVariantId}`,\n    }),\n    mapSuccess: (result: { movementId: string }) => ({\n      ok: true,\n      movementId: result.movementId,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  movementId: z.string().uuid(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Receive inventory',\n  methods: {\n    POST: {\n      summary: 'Receive inventory',\n      description:\n        'Records inbound inventory receipt and appends a receipt movement ledger row. When `organizationId` is present it must be in the caller organization scope; otherwise the session-selected organization is used.',\n      requestBody: { contentType: 'application/json', schema: inventoryReceiveSchema },\n      responses: [{ status: 200, description: 'Inventory received', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 422, description: 'Invalid location', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,0BAA0B;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,GAAG,MAAM,WAAW,IAAI,MAAM,UAAU,IAAI,MAAM,gBAAgB;AAAA,IAChF;AAAA,IACA,YAAY,CAAC,YAAoC;AAAA,MAC/C,IAAI;AAAA,MACJ,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,KAAK;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MAC/E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,cAAc,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/wms/api/listEnrichers.js

@@ -144,6 +144,28 @@ async function attachInventoryProfileCatalogLabelsToListItems(payload, ctx) {
     attachVariantLabelsToListItems(payload, ctx)
   ]);
 }
+const CUSTOMER_FIELDS = ["id", "display_name"];
+async function attachVendorLabelsToListItems(payload, ctx) {
+  const items = Array.isArray(payload?.items) ? payload.items : [];
+  if (items.length === 0) return;
+  const ids = uniqueIdsFromKeys(items, ["vendor_id"]);
+  if (ids.length === 0) return;
+  const map = await batchLoadById(
+    ctx,
+    E.customers.customer_entity,
+    ids,
+    CUSTOMER_FIELDS,
+    "vendor"
+  );
+  if (map.size === 0) return;
+  for (const item of items) {
+    const id = item?.vendor_id;
+    if (typeof id !== "string" || !id) continue;
+    const row = map.get(id);
+    if (!row) continue;
+    decorateOnce(item, "vendor_name", row.display_name ?? null);
+  }
+}
 const SALES_ORDER_FIELDS = ["id", "order_number"];
 async function attachReservationSourceLabelsToListItems(payload, ctx) {
   const items = Array.isArray(payload?.items) ? payload.items : [];
@@ -176,6 +198,7 @@ export {
   attachProductLabelsToListItems,
   attachReservationSourceLabelsToListItems,
   attachVariantLabelsToListItems,
+  attachVendorLabelsToListItems,
   attachWarehouseLabelsToListItems
 };
 //# sourceMappingURL=listEnrichers.js.map