@open-mercato/core 0.10.1-develop.7709.1.046124599c → 0.10.1-develop.7714.1.9dbb8200d8

package/dist/modules/wms/api/putaway-tasks/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/wms/api/putaway-tasks/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput, resolveCrudRecordId } from '@open-mercato/shared/lib/api/scoped'\nimport { E } from '#generated/entities.ids.generated'\nimport { PutawayTask } from '../../data/entities'\nimport { putawayTaskCreateSchema, putawayTaskUpdateSchema } from '../../data/validators'\nimport {\n  assertPutawayLifecycleFieldsForbidden,\n  buildPutawayTaskStatusFilter,\n} from '../../lib/putaway'\nimport { createPagedListResponseSchema, createWmsCrudOpenApi, defaultOkResponseSchema } from '../openapi'\n\nconst F = {\n  id: 'id',\n  organization_id: 'organization_id',\n  tenant_id: 'tenant_id',\n  warehouse_id: 'warehouse_id',\n  source_location_id: 'source_location_id',\n  target_location_id: 'target_location_id',\n  catalog_variant_id: 'catalog_variant_id',\n  lot_id: 'lot_id',\n  serial_number: 'serial_number',\n  quantity: 'quantity',\n  status: 'status',\n  assigned_to: 'assigned_to',\n  priority: 'priority',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n  POST: { requireAuth: true, requireFeatures: ['wms.manage_putaway'] },\n  PUT: { requireAuth: true, requireFeatures: ['wms.manage_putaway'] },\n  DELETE: { requireAuth: true, requireFeatures: ['wms.manage_putaway'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(25),\n    ids: z.string().optional(),\n    warehouseId: z.string().uuid().optional(),\n    // Single status or comma-separated (e.g. open,in_progress for the active queue).\n    status: z.string().optional(),\n    assignedTo: z.string().uuid().optional(),\n    catalogVariantId: z.string().uuid().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: PutawayTask,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.wms.putaway_task },\n  list: {\n    schema: listSchema,\n    disableListCache: true,\n    entityId: E.wms.putaway_task,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.warehouse_id,\n      F.source_location_id,\n      F.target_location_id,\n      F.catalog_variant_id,\n      F.lot_id,\n      F.serial_number,\n      F.quantity,\n      F.status,\n      F.assigned_to,\n      F.priority,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      status: F.status,\n      priority: F.priority,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      quantity: F.quantity,\n    },\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        filters[F.id] = {\n          $in: query.ids\n            .split(',')\n            .map((value) => value.trim())\n            .filter((value) => value.length > 0),\n        }\n      }\n      if (typeof query.warehouseId === 'string' && query.warehouseId.length > 0) {\n        filters[F.warehouse_id] = { $eq: query.warehouseId }\n      }\n      if (typeof query.status === 'string' && query.status.length > 0) {\n        const statusFilter = buildPutawayTaskStatusFilter(query.status)\n        if (statusFilter) filters[F.status] = statusFilter\n      }\n      if (typeof query.assignedTo === 'string' && query.assignedTo.length > 0) {\n        filters[F.assigned_to] = { $eq: query.assignedTo }\n      }\n      if (typeof query.catalogVariantId === 'string' && query.catalogVariantId.length > 0) {\n        filters[F.catalog_variant_id] = { $eq: query.catalogVariantId }\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'wms.putaway-tasks.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(putawayTaskCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.taskId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'wms.putaway-tasks.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        assertPutawayLifecycleFieldsForbidden(raw)\n        return parseScopedCommandInput(putawayTaskUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'wms.putaway-tasks.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return { id: resolveCrudRecordId(parsed, ctx, translate) }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst putawayTaskListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  warehouse_id: z.string().uuid().nullable().optional(),\n  source_location_id: z.string().uuid().nullable().optional(),\n  target_location_id: z.string().uuid().nullable().optional(),\n  catalog_variant_id: z.string().uuid().nullable().optional(),\n  lot_id: z.string().uuid().nullable().optional(),\n  serial_number: z.string().nullable().optional(),\n  quantity: z.union([z.string(), z.number()]).nullable().optional(),\n  status: z.string().nullable().optional(),\n  assigned_to: z.string().uuid().nullable().optional(),\n  priority: z.union([z.string(), z.number()]).nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createWmsCrudOpenApi({\n  resourceName: 'PutawayTask',\n  pluralName: 'Putaway tasks',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(putawayTaskListItemSchema),\n  create: {\n    schema: putawayTaskCreateSchema,\n    description:\n      'Creates an open putaway task after verifying available staging balance (on-hand minus reserved/allocated minus open/in-progress putaway commitments). Target location may be null until completion. Assignee changes use POST .../assign.',\n  },\n  update: {\n    schema: putawayTaskUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates putaway task fields (locations, quantity, priority, metadata). Status and assignedTo are lifecycle-only \u2014 use POST .../{assign,start,complete,cancel}.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a putaway task by id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB,2BAA2B;AAC7D,SAAS,SAAS;AAClB,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB,+BAA+B;AACjE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B,sBAAsB,+BAA+B;AAE7F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAAA,EACxD,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EAClE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAExC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,IAAI,aAAa;AAAA,EAC1C,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,kBAAkB;AAAA,IAClB,UAAU,EAAE,IAAI;AAAA,IAChB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,QAAQ,EAAE;AAAA,MACV,UAAU,EAAE;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,UAAU,EAAE;AAAA,IACd;AAAA,IACA,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,gBAAQ,EAAE,EAAE,IAAI;AAAA,UACd,KAAK,MAAM,IACR,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,QACvC;AAAA,MACF;AACA,UAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,YAAY,SAAS,GAAG;AACzE,gBAAQ,EAAE,YAAY,IAAI,EAAE,KAAK,MAAM,YAAY;AAAA,MACrD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,SAAS,GAAG;AAC/D,cAAM,eAAe,6BAA6B,MAAM,MAAM;AAC9D,YAAI,aAAc,SAAQ,EAAE,MAAM,IAAI;AAAA,MACxC;AACA,UAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,SAAS,GAAG;AACvE,gBAAQ,EAAE,WAAW,IAAI,EAAE,KAAK,MAAM,WAAW;AAAA,MACnD;AACA,UAAI,OAAO,MAAM,qBAAqB,YAAY,MAAM,iBAAiB,SAAS,GAAG;AACnF,gBAAQ,EAAE,kBAAkB,IAAI,EAAE,KAAK,MAAM,iBAAiB;AAAA,MAChE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,yBAAyB,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACnF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,UAAU,KAAK;AAAA,MACxD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,8CAAsC,GAAG;AACzC,eAAO,wBAAwB,yBAAyB,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACnF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,EAAE,IAAI,oBAAoB,QAAQ,KAAK,SAAS,EAAE;AAAA,MAC3D;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAChE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAChE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,qBAAqB;AAAA,EAC1C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/wms/api/receiving-lines/route.js

@@ -0,0 +1,180 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { parseScopedCommandInput, resolveCrudRecordId } from "@open-mercato/shared/lib/api/scoped";
+import { E } from "../../../../generated/entities.ids.generated.js";
+import { ReceivingLine } from "../../data/entities.js";
+import { receivingLineCreateSchema, receivingLineUpdateSchema } from "../../data/validators.js";
+import { assertReceivingLineLifecycleFieldsForbidden } from "../../lib/asnReceiving.js";
+import { createPagedListResponseSchema, createWmsCrudOpenApi, defaultOkResponseSchema } from "../openapi.js";
+const F = {
+  id: "id",
+  organization_id: "organization_id",
+  tenant_id: "tenant_id",
+  asn_id: "asn_id",
+  catalog_variant_id: "catalog_variant_id",
+  expected_qty: "expected_qty",
+  received_qty: "received_qty",
+  lot_number: "lot_number",
+  serial_numbers: "serial_numbers",
+  qc_status: "qc_status",
+  target_staging_location_id: "target_staging_location_id",
+  rejection_reason: "rejection_reason",
+  created_at: "created_at",
+  updated_at: "updated_at"
+};
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["wms.view"] },
+  POST: { requireAuth: true, requireFeatures: ["wms.manage_asn"] },
+  PUT: { requireAuth: true, requireFeatures: ["wms.manage_asn"] },
+  DELETE: { requireAuth: true, requireFeatures: ["wms.manage_asn"] }
+};
+const metadata = routeMetadata;
+const rawBodySchema = z.object({}).passthrough();
+const listSchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(25),
+  ids: z.string().optional(),
+  asnId: z.string().uuid().optional(),
+  catalogVariantId: z.string().uuid().optional(),
+  qcStatus: z.enum(["pending", "passed", "failed"]).optional(),
+  sortField: z.string().optional(),
+  sortDir: z.enum(["asc", "desc"]).optional()
+}).passthrough();
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: ReceivingLine,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  indexer: { entityType: E.wms.receiving_line },
+  list: {
+    schema: listSchema,
+    disableListCache: true,
+    entityId: E.wms.receiving_line,
+    fields: [
+      F.id,
+      F.organization_id,
+      F.tenant_id,
+      F.asn_id,
+      F.catalog_variant_id,
+      F.expected_qty,
+      F.received_qty,
+      F.lot_number,
+      F.serial_numbers,
+      F.qc_status,
+      F.target_staging_location_id,
+      F.rejection_reason,
+      F.created_at,
+      F.updated_at
+    ],
+    sortFieldMap: {
+      expectedQty: F.expected_qty,
+      receivedQty: F.received_qty,
+      qcStatus: F.qc_status,
+      createdAt: F.created_at,
+      updatedAt: F.updated_at
+    },
+    buildFilters: async (query) => {
+      const filters = {};
+      if (typeof query.ids === "string" && query.ids.trim().length > 0) {
+        filters[F.id] = {
+          $in: query.ids.split(",").map((value) => value.trim()).filter((value) => value.length > 0)
+        };
+      }
+      if (typeof query.asnId === "string" && query.asnId.length > 0) {
+        filters[F.asn_id] = { $eq: query.asnId };
+      }
+      if (typeof query.catalogVariantId === "string" && query.catalogVariantId.length > 0) {
+        filters[F.catalog_variant_id] = { $eq: query.catalogVariantId };
+      }
+      if (typeof query.qcStatus === "string" && query.qcStatus.length > 0) {
+        filters[F.qc_status] = { $eq: query.qcStatus };
+      }
+      return filters;
+    }
+  },
+  actions: {
+    create: {
+      commandId: "wms.receiving-lines.create",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(receivingLineCreateSchema, raw ?? {}, ctx, translate);
+      },
+      response: ({ result }) => ({ id: result?.lineId ?? null }),
+      status: 201
+    },
+    update: {
+      commandId: "wms.receiving-lines.update",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        assertReceivingLineLifecycleFieldsForbidden(raw);
+        return parseScopedCommandInput(receivingLineUpdateSchema, raw ?? {}, ctx, translate);
+      },
+      response: () => ({ ok: true })
+    },
+    delete: {
+      commandId: "wms.receiving-lines.delete",
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return { id: resolveCrudRecordId(parsed, ctx, translate) };
+      },
+      response: () => ({ ok: true })
+    }
+  }
+});
+const GET = crud.GET;
+const POST = crud.POST;
+const PUT = crud.PUT;
+const DELETE = crud.DELETE;
+const receivingLineListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  asn_id: z.string().uuid().nullable().optional(),
+  catalog_variant_id: z.string().uuid().nullable().optional(),
+  expected_qty: z.union([z.string(), z.number()]).nullable().optional(),
+  received_qty: z.union([z.string(), z.number()]).nullable().optional(),
+  lot_number: z.string().nullable().optional(),
+  serial_numbers: z.array(z.string()).nullable().optional(),
+  qc_status: z.string().nullable().optional(),
+  target_staging_location_id: z.string().uuid().nullable().optional(),
+  rejection_reason: z.string().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+const openApi = createWmsCrudOpenApi({
+  resourceName: "ReceivingLine",
+  pluralName: "Receiving lines",
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(receivingLineListItemSchema),
+  create: {
+    schema: receivingLineCreateSchema,
+    description: "Creates a receiving line against an ASN."
+  },
+  update: {
+    schema: receivingLineUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: "Updates a receiving line by id."
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: "Soft-deletes a receiving line by id."
+  }
+});
+export {
+  DELETE,
+  GET,
+  POST,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/receiving-lines/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/wms/api/receiving-lines/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput, resolveCrudRecordId } from '@open-mercato/shared/lib/api/scoped'\nimport { E } from '#generated/entities.ids.generated'\nimport { ReceivingLine } from '../../data/entities'\nimport { receivingLineCreateSchema, receivingLineUpdateSchema } from '../../data/validators'\nimport { assertReceivingLineLifecycleFieldsForbidden } from '../../lib/asnReceiving'\nimport { createPagedListResponseSchema, createWmsCrudOpenApi, defaultOkResponseSchema } from '../openapi'\n\nconst F = {\n  id: 'id',\n  organization_id: 'organization_id',\n  tenant_id: 'tenant_id',\n  asn_id: 'asn_id',\n  catalog_variant_id: 'catalog_variant_id',\n  expected_qty: 'expected_qty',\n  received_qty: 'received_qty',\n  lot_number: 'lot_number',\n  serial_numbers: 'serial_numbers',\n  qc_status: 'qc_status',\n  target_staging_location_id: 'target_staging_location_id',\n  rejection_reason: 'rejection_reason',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n  POST: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n  PUT: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n  DELETE: { requireAuth: true, requireFeatures: ['wms.manage_asn'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(25),\n  ids: z.string().optional(),\n  asnId: z.string().uuid().optional(),\n  catalogVariantId: z.string().uuid().optional(),\n  qcStatus: z.enum(['pending', 'passed', 'failed']).optional(),\n  sortField: z.string().optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: ReceivingLine,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.wms.receiving_line },\n  list: {\n    schema: listSchema,\n    disableListCache: true,\n    entityId: E.wms.receiving_line,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.asn_id,\n      F.catalog_variant_id,\n      F.expected_qty,\n      F.received_qty,\n      F.lot_number,\n      F.serial_numbers,\n      F.qc_status,\n      F.target_staging_location_id,\n      F.rejection_reason,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      expectedQty: F.expected_qty,\n      receivedQty: F.received_qty,\n      qcStatus: F.qc_status,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n    },\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        filters[F.id] = {\n          $in: query.ids.split(',').map((value) => value.trim()).filter((value) => value.length > 0),\n        }\n      }\n      if (typeof query.asnId === 'string' && query.asnId.length > 0) {\n        filters[F.asn_id] = { $eq: query.asnId }\n      }\n      if (typeof query.catalogVariantId === 'string' && query.catalogVariantId.length > 0) {\n        filters[F.catalog_variant_id] = { $eq: query.catalogVariantId }\n      }\n      if (typeof query.qcStatus === 'string' && query.qcStatus.length > 0) {\n        filters[F.qc_status] = { $eq: query.qcStatus }\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'wms.receiving-lines.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(receivingLineCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.lineId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'wms.receiving-lines.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        assertReceivingLineLifecycleFieldsForbidden(raw)\n        return parseScopedCommandInput(receivingLineUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'wms.receiving-lines.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return { id: resolveCrudRecordId(parsed, ctx, translate) }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst receivingLineListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  asn_id: z.string().uuid().nullable().optional(),\n  catalog_variant_id: z.string().uuid().nullable().optional(),\n  expected_qty: z.union([z.string(), z.number()]).nullable().optional(),\n  received_qty: z.union([z.string(), z.number()]).nullable().optional(),\n  lot_number: z.string().nullable().optional(),\n  serial_numbers: z.array(z.string()).nullable().optional(),\n  qc_status: z.string().nullable().optional(),\n  target_staging_location_id: z.string().uuid().nullable().optional(),\n  rejection_reason: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createWmsCrudOpenApi({\n  resourceName: 'ReceivingLine',\n  pluralName: 'Receiving lines',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(receivingLineListItemSchema),\n  create: {\n    schema: receivingLineCreateSchema,\n    description: 'Creates a receiving line against an ASN.',\n  },\n  update: {\n    schema: receivingLineUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a receiving line by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a receiving line by id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB,2BAA2B;AAC7D,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B,iCAAiC;AACrE,SAAS,mDAAmD;AAC5D,SAAS,+BAA+B,sBAAsB,+BAA+B;AAE7F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,4BAA4B;AAAA,EAC5B,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAAA,EACxD,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACnE;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,WAAW,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EAAE,YAAY;AAEf,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,IAAI,eAAe;AAAA,EAC5C,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,kBAAkB;AAAA,IAClB,UAAU,EAAE,IAAI;AAAA,IAChB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,aAAa,EAAE;AAAA,MACf,aAAa,EAAE;AAAA,MACf,UAAU,EAAE;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,gBAAQ,EAAE,EAAE,IAAI;AAAA,UACd,KAAK,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,QAC3F;AAAA,MACF;AACA,UAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,GAAG;AAC7D,gBAAQ,EAAE,MAAM,IAAI,EAAE,KAAK,MAAM,MAAM;AAAA,MACzC;AACA,UAAI,OAAO,MAAM,qBAAqB,YAAY,MAAM,iBAAiB,SAAS,GAAG;AACnF,gBAAQ,EAAE,kBAAkB,IAAI,EAAE,KAAK,MAAM,iBAAiB;AAAA,MAChE;AACA,UAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,GAAG;AACnE,gBAAQ,EAAE,SAAS,IAAI,EAAE,KAAK,MAAM,SAAS;AAAA,MAC/C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,UAAU,KAAK;AAAA,MACxD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,oDAA4C,GAAG;AAC/C,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,EAAE,IAAI,oBAAoB,QAAQ,KAAK,SAAS,EAAE;AAAA,MAC3D;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAClE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,qBAAqB;AAAA,EAC1C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,2BAA2B;AAAA,EAC7E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/wms/api/scan/putaway/route.js

@@ -0,0 +1,104 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { putawayTaskCompleteSchema, scanPutawaySchema } from "../../../data/validators.js";
+import { resolveScanPutawayCommandInput } from "../../../lib/scanResolve.js";
+import { executeWmsCustomPostRoute } from "../../inventory/helpers.js";
+const logger = createLogger("wms");
+const metadata = {
+  // Same floor ACL as putaway-tasks/:id/complete (command enforces manage vs assignee).
+  POST: { requireAuth: true, requireFeatures: ["wms.adjust_inventory"] }
+};
+const successSchema = z.object({
+  ok: z.literal(true),
+  movementId: z.string().uuid()
+});
+const errorSchema = z.object({ error: z.string() });
+async function POST(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: "Unauthorized" });
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request
+    });
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: "organization_scope_required" });
+    }
+    const body = await readJsonSafe(request, {});
+    const parsed = scanPutawaySchema.parse(body);
+    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const scoped = {
+      ...parsed,
+      tenantId: auth.tenantId,
+      organizationId
+    };
+    const em = container.resolve("em").fork();
+    const commandInput = await resolveScanPutawayCommandInput(em, scoped);
+    const scopedRequest = new Request(request.url, {
+      method: "POST",
+      headers: request.headers,
+      body: JSON.stringify(commandInput)
+    });
+    return executeWmsCustomPostRoute({
+      request: scopedRequest,
+      routePath: "wms/scan/putaway",
+      inputSchema: putawayTaskCompleteSchema,
+      commandId: "wms.putaway-tasks.complete",
+      describeResource: (input) => ({
+        resourceKind: "wms.putawayTask",
+        resourceId: input.id
+      }),
+      mapSuccess: (result) => ({
+        ok: true,
+        movementId: result.movementId
+      })
+    });
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: "Validation failed", details: error.issues }, { status: 400 });
+    }
+    logger.error("scan putaway failed", { err: error });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "WMS",
+  summary: "Scan-assisted putaway complete",
+  methods: {
+    POST: {
+      summary: "Complete putaway from scanned target location code",
+      description: "Resolves the scanned target location code, then executes the same command path as POST /api/wms/putaway-tasks/:id/complete. Organization is taken from the authenticated session scope, not the request body. Requires `wms.adjust_inventory`; managers with `wms.manage_putaway` may complete any task, operators only when assigned.",
+      requestBody: { contentType: "application/json", schema: scanPutawaySchema },
+      responses: [{ status: 200, description: "Putaway completed", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 404, description: "Task or location not found", schema: errorSchema },
+        { status: 409, description: "Invalid putaway state or insufficient stock", schema: errorSchema },
+        { status: 422, description: "Invalid or inactive location", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/scan/putaway/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/wms/api/scan/putaway/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { putawayTaskCompleteSchema, scanPutawaySchema } from '../../../data/validators'\nimport { resolveScanPutawayCommandInput } from '../../../lib/scanResolve'\nimport { executeWmsCustomPostRoute } from '../../inventory/helpers'\n\nconst logger = createLogger('wms')\n\nexport const metadata = {\n  // Same floor ACL as putaway-tasks/:id/complete (command enforces manage vs assignee).\n  POST: { requireAuth: true, requireFeatures: ['wms.adjust_inventory'] },\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  movementId: z.string().uuid(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport async function POST(request: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request,\n    })\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: 'organization_scope_required' })\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(request, {})\n    const parsed = scanPutawaySchema.parse(body)\n    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    // Scope organization from auth/session \u2014 never trust body organizationId for\n    // task/location resolve (same contract as scan/receive and resolve-location/lot).\n    const scoped = {\n      ...parsed,\n      tenantId: auth.tenantId,\n      organizationId,\n    }\n    const em = (container.resolve('em') as EntityManager).fork()\n    const commandInput = await resolveScanPutawayCommandInput(em, scoped)\n    const scopedRequest = new Request(request.url, {\n      method: 'POST',\n      headers: request.headers,\n      body: JSON.stringify(commandInput),\n    })\n    return executeWmsCustomPostRoute({\n      request: scopedRequest,\n      routePath: 'wms/scan/putaway',\n      inputSchema: putawayTaskCompleteSchema,\n      commandId: 'wms.putaway-tasks.complete',\n      describeResource: (input) => ({\n        resourceKind: 'wms.putawayTask',\n        resourceId: input.id,\n      }),\n      mapSuccess: (result: { movementId: string }) => ({\n        ok: true,\n        movementId: result.movementId,\n      }),\n    })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('scan putaway failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Scan-assisted putaway complete',\n  methods: {\n    POST: {\n      summary: 'Complete putaway from scanned target location code',\n      description:\n        'Resolves the scanned target location code, then executes the same command path as POST /api/wms/putaway-tasks/:id/complete. Organization is taken from the authenticated session scope, not the request body. Requires `wms.adjust_inventory`; managers with `wms.manage_putaway` may complete any task, operators only when assigned.',\n      requestBody: { contentType: 'application/json', schema: scanPutawaySchema },\n      responses: [{ status: 200, description: 'Putaway completed', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Task or location not found', schema: errorSchema },\n        { status: 409, description: 'Invalid putaway state or insufficient stock', schema: errorSchema },\n        { status: 422, description: 'Invalid or inactive location', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,yBAAyB;AAC7D,SAAS,sCAAsC;AAC/C,SAAS,iCAAiC;AAE1C,MAAM,SAAS,aAAa,KAAK;AAE1B,MAAM,WAAW;AAAA;AAAA,EAEtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,KAAK;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,eAAsB,KAAK,SAAkB;AAC3C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AACA,UAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,UAAM,SAAS,kBAAkB,MAAM,IAAI;AAC3C,QAAI,OAAO,aAAa,KAAK,YAAY,CAAC,KAAK,cAAc;AAC3D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AAGA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,UAAU,KAAK;AAAA,MACf;AAAA,IACF;AACA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM,+BAA+B,IAAI,MAAM;AACpE,UAAM,gBAAgB,IAAI,QAAQ,QAAQ,KAAK;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS,QAAQ;AAAA,MACjB,MAAM,KAAK,UAAU,YAAY;AAAA,IACnC,CAAC;AACD,WAAO,0BAA0B;AAAA,MAC/B,SAAS;AAAA,MACT,WAAW;AAAA,MACX,aAAa;AAAA,MACb,WAAW;AAAA,MACX,kBAAkB,CAAC,WAAW;AAAA,QAC5B,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,MACpB;AAAA,MACA,YAAY,CAAC,YAAoC;AAAA,QAC/C,IAAI;AAAA,QACJ,YAAY,OAAO;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,KAAK,MAAM,CAAC;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kBAAkB;AAAA,MAC1E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,cAAc,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,QAC/F,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/scan/receive/route.js

@@ -0,0 +1,109 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { asnReceiveLineSchema, scanReceiveSchema } from "../../../data/validators.js";
+import { resolveScanReceiveCommandInput } from "../../../lib/scanResolve.js";
+import { executeWmsCustomPostRoute } from "../../inventory/helpers.js";
+const logger = createLogger("wms");
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["wms.receive_inventory"] }
+};
+const successSchema = z.object({
+  ok: z.literal(true),
+  movementIds: z.array(z.string().uuid()),
+  putawayTaskIds: z.array(z.string().uuid()),
+  receivedQty: z.number().optional(),
+  asnUpdatedAt: z.string().datetime().optional()
+});
+const errorSchema = z.object({ error: z.string() });
+async function POST(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: "Unauthorized" });
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request
+    });
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: "organization_scope_required" });
+    }
+    const body = await readJsonSafe(request, {});
+    const parsed = scanReceiveSchema.parse(body);
+    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const scoped = {
+      ...parsed,
+      tenantId: auth.tenantId,
+      organizationId
+    };
+    const em = container.resolve("em").fork();
+    const commandInput = await resolveScanReceiveCommandInput(em, scoped);
+    const scopedRequest = new Request(request.url, {
+      method: "POST",
+      headers: request.headers,
+      body: JSON.stringify(commandInput)
+    });
+    return executeWmsCustomPostRoute({
+      request: scopedRequest,
+      routePath: "wms/scan/receive",
+      inputSchema: asnReceiveLineSchema,
+      commandId: "wms.asns.receive-line",
+      describeResource: (input) => ({
+        resourceKind: "wms.asn",
+        resourceId: input.asnId
+      }),
+      mapSuccess: (result) => ({
+        ok: true,
+        movementIds: result.movementIds,
+        putawayTaskIds: result.putawayTaskIds,
+        receivedQty: result.receivedQty,
+        asnUpdatedAt: result.asnUpdatedAt
+      })
+    });
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: "Validation failed", details: error.issues }, { status: 400 });
+    }
+    logger.error("scan receive failed", { err: error });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "WMS",
+  summary: "Scan-assisted ASN receive",
+  methods: {
+    POST: {
+      summary: "Receive ASN line from scanned location/lot codes",
+      description: "Resolves scanned location (and optional lot) codes, then executes the same command path as POST /api/wms/asns/:id/receive. Organization is taken from the authenticated session scope, not the request body. Both QC-pass and QC-fail require absolute targetReceivedQty for retry-safe attempts (optional idempotencyKey is an extra stabilizer only).",
+      requestBody: { contentType: "application/json", schema: scanReceiveSchema },
+      responses: [{ status: 200, description: "ASN line received", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 404, description: "ASN or location not found", schema: errorSchema },
+        { status: 409, description: "Invalid receipt state", schema: errorSchema },
+        { status: 422, description: "Tracking or QC transition invalid", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/scan/receive/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/wms/api/scan/receive/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { asnReceiveLineSchema, scanReceiveSchema } from '../../../data/validators'\nimport { resolveScanReceiveCommandInput } from '../../../lib/scanResolve'\nimport { executeWmsCustomPostRoute } from '../../inventory/helpers'\n\nconst logger = createLogger('wms')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.receive_inventory'] },\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  movementIds: z.array(z.string().uuid()),\n  putawayTaskIds: z.array(z.string().uuid()),\n  receivedQty: z.number().optional(),\n  asnUpdatedAt: z.string().datetime().optional(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport async function POST(request: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request,\n    })\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: 'organization_scope_required' })\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(request, {})\n    const parsed = scanReceiveSchema.parse(body)\n    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    // Scope organization from auth/session \u2014 never trust body organizationId for\n    // ASN/location resolve (same contract as resolve-location / resolve-lot).\n    const scoped = {\n      ...parsed,\n      tenantId: auth.tenantId,\n      organizationId,\n    }\n    const em = (container.resolve('em') as EntityManager).fork()\n    const commandInput = await resolveScanReceiveCommandInput(em, scoped)\n    const scopedRequest = new Request(request.url, {\n      method: 'POST',\n      headers: request.headers,\n      body: JSON.stringify(commandInput),\n    })\n    return executeWmsCustomPostRoute({\n      request: scopedRequest,\n      routePath: 'wms/scan/receive',\n      inputSchema: asnReceiveLineSchema,\n      commandId: 'wms.asns.receive-line',\n      describeResource: (input) => ({\n        resourceKind: 'wms.asn',\n        resourceId: input.asnId,\n      }),\n      mapSuccess: (result: {\n        movementIds: string[]\n        putawayTaskIds: string[]\n        receivedQty?: number\n        asnUpdatedAt?: string\n      }) => ({\n        ok: true,\n        movementIds: result.movementIds,\n        putawayTaskIds: result.putawayTaskIds,\n        receivedQty: result.receivedQty,\n        asnUpdatedAt: result.asnUpdatedAt,\n      }),\n    })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('scan receive failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Scan-assisted ASN receive',\n  methods: {\n    POST: {\n      summary: 'Receive ASN line from scanned location/lot codes',\n      description:\n        'Resolves scanned location (and optional lot) codes, then executes the same command path as POST /api/wms/asns/:id/receive. Organization is taken from the authenticated session scope, not the request body. Both QC-pass and QC-fail require absolute targetReceivedQty for retry-safe attempts (optional idempotencyKey is an extra stabilizer only).',\n      requestBody: { contentType: 'application/json', schema: scanReceiveSchema },\n      responses: [{ status: 200, description: 'ASN line received', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'ASN or location not found', schema: errorSchema },\n        { status: 409, description: 'Invalid receipt state', schema: errorSchema },\n        { status: 422, description: 'Tracking or QC transition invalid', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB,yBAAyB;AACxD,SAAS,sCAAsC;AAC/C,SAAS,iCAAiC;AAE1C,MAAM,SAAS,aAAa,KAAK;AAE1B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACtC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC/C,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,eAAsB,KAAK,SAAkB;AAC3C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AACA,UAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,UAAM,SAAS,kBAAkB,MAAM,IAAI;AAC3C,QAAI,OAAO,aAAa,KAAK,YAAY,CAAC,KAAK,cAAc;AAC3D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AAGA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,UAAU,KAAK;AAAA,MACf;AAAA,IACF;AACA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM,+BAA+B,IAAI,MAAM;AACpE,UAAM,gBAAgB,IAAI,QAAQ,QAAQ,KAAK;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS,QAAQ;AAAA,MACjB,MAAM,KAAK,UAAU,YAAY;AAAA,IACnC,CAAC;AACD,WAAO,0BAA0B;AAAA,MAC/B,SAAS;AAAA,MACT,WAAW;AAAA,MACX,aAAa;AAAA,MACb,WAAW;AAAA,MACX,kBAAkB,CAAC,WAAW;AAAA,QAC5B,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,MACpB;AAAA,MACA,YAAY,CAAC,YAKN;AAAA,QACL,IAAI;AAAA,QACJ,aAAa,OAAO;AAAA,QACpB,gBAAgB,OAAO;AAAA,QACvB,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MACvB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,KAAK,MAAM,CAAC;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kBAAkB;AAAA,MAC1E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,cAAc,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/scan/resolve-location/route.js

@@ -0,0 +1,89 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { scanResolveLocationSchema } from "../../../data/validators.js";
+import { resolveLocationByCode } from "../../../lib/scanResolve.js";
+const logger = createLogger("wms");
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["wms.view"] }
+};
+const successSchema = z.object({
+  ok: z.literal(true),
+  locationId: z.string().uuid(),
+  code: z.string(),
+  type: z.string()
+});
+const errorSchema = z.object({ error: z.string() });
+async function POST(request) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(request);
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: "Unauthorized" });
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request
+    });
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: "organization_scope_required" });
+    }
+    const body = await readJsonSafe(request, {});
+    const parsed = scanResolveLocationSchema.parse(body);
+    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const scoped = {
+      ...parsed,
+      tenantId: auth.tenantId,
+      organizationId
+    };
+    const em = container.resolve("em").fork();
+    const resolved = await resolveLocationByCode(em, scoped);
+    return NextResponse.json({
+      ok: true,
+      locationId: resolved.locationId,
+      code: resolved.code,
+      type: resolved.type
+    });
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: "Validation failed", details: error.issues }, { status: 400 });
+    }
+    logger.error("scan resolve-location failed", { err: error });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "WMS",
+  summary: "Resolve scanned location code",
+  methods: {
+    POST: {
+      summary: "Resolve location by warehouse + barcode/code",
+      description: "Returns the canonical location id and type for a scanned warehouse location code. Organization is taken from the authenticated session scope, not the request body.",
+      requestBody: { contentType: "application/json", schema: scanResolveLocationSchema },
+      responses: [{ status: 200, description: "Location resolved", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 404, description: "Location not found", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/scan/resolve-location/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/wms/api/scan/resolve-location/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { scanResolveLocationSchema } from '../../../data/validators'\nimport { resolveLocationByCode } from '../../../lib/scanResolve'\n\nconst logger = createLogger('wms')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.view'] },\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  locationId: z.string().uuid(),\n  code: z.string(),\n  type: z.string(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport async function POST(request: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request,\n    })\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: 'organization_scope_required' })\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(request, {})\n    const parsed = scanResolveLocationSchema.parse(body)\n    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    // Scope organization from auth/session \u2014 never trust body organizationId for cross-org reads.\n    const scoped = {\n      ...parsed,\n      tenantId: auth.tenantId,\n      organizationId,\n    }\n    const em = (container.resolve('em') as EntityManager).fork()\n    const resolved = await resolveLocationByCode(em, scoped)\n    return NextResponse.json({\n      ok: true as const,\n      locationId: resolved.locationId,\n      code: resolved.code,\n      type: resolved.type,\n    })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('scan resolve-location failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Resolve scanned location code',\n  methods: {\n    POST: {\n      summary: 'Resolve location by warehouse + barcode/code',\n      description:\n        'Returns the canonical location id and type for a scanned warehouse location code. Organization is taken from the authenticated session scope, not the request body.',\n      requestBody: { contentType: 'application/json', schema: scanResolveLocationSchema },\n      responses: [{ status: 200, description: 'Location resolved', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Location not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AAEtC,MAAM,SAAS,aAAa,KAAK;AAE1B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAC3D;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AACjB,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,eAAsB,KAAK,SAAkB;AAC3C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AACA,UAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,UAAM,SAAS,0BAA0B,MAAM,IAAI;AACnD,QAAI,OAAO,aAAa,KAAK,YAAY,CAAC,KAAK,cAAc;AAC3D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AAEA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,UAAU,KAAK;AAAA,MACf;AAAA,IACF;AACA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM;AACvD,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,YAAY,SAAS;AAAA,MACrB,MAAM,SAAS;AAAA,MACf,MAAM,SAAS;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,gCAAgC,EAAE,KAAK,MAAM,CAAC;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,cAAc,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,YAAY;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}