@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/dist/modules/customers/api/labels/assign/route.js

@@ -0,0 +1,189 @@
+import { NextResponse } from "next/server";
+import { CustomerEntity } from "../../../data/entities.js";
+import { labelAssignCommandSchema, labelAssignmentSchema } from "../../../data/validators.js";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { z } from "zod";
+import { resolveLabelActorUserId } from "../auth.js";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+import {
+  createMissingCustomerLabelTablesError,
+  isMissingCustomerLabelTable
+} from "../table-errors.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+const metadata = {
+  POST: { requireAuth: true }
+};
+const labelAssignmentRequestSchema = labelAssignmentSchema.extend({
+  organizationId: z.string().uuid().optional()
+});
+function resolveResourceKind(kind) {
+  if (kind === "company") return "customers.company";
+  return "customers.person";
+}
+function resolveRequiredFeature(kind) {
+  return kind === "company" ? "customers.companies.manage" : "customers.people.manage";
+}
+async function POST(req) {
+  try {
+    const { translate } = await resolveTranslations();
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const actorUserId = resolveLabelActorUserId(auth);
+    if (!auth || !auth.tenantId || !actorUserId) {
+      return NextResponse.json({ error: translate("customers.errors.unauthorized", "Unauthorized") }, { status: 401 });
+    }
+    const body = labelAssignmentRequestSchema.parse(await readJsonSafe(req, {}));
+    const scope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request: req,
+      selectedId: body.organizationId ?? void 0
+    });
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: translate("customers.errors.organization_required", "Organization context is required") });
+    }
+    const em = container.resolve("em").fork();
+    const targetEntity = await findOneWithDecryption(
+      em,
+      CustomerEntity,
+      {
+        id: body.entityId,
+        tenantId: auth.tenantId,
+        organizationId,
+        deletedAt: null
+      },
+      void 0,
+      { tenantId: auth.tenantId, organizationId }
+    );
+    if (!targetEntity) {
+      throw new CrudHttpError(404, { error: translate("customers.errors.entity_not_found", "Entity not found") });
+    }
+    const entityKind = targetEntity.kind === "person" || targetEntity.kind === "company" ? targetEntity.kind : null;
+    const resourceKind = resolveResourceKind(entityKind);
+    const rbac = container.resolve("rbacService");
+    if (!rbac) {
+      throw new CrudHttpError(500, { error: translate("customers.errors.internal", "Internal error") });
+    }
+    const requiredFeature = resolveRequiredFeature(entityKind);
+    const hasFeature = await rbac.userHasAllFeatures(actorUserId, [requiredFeature], {
+      tenantId: auth.tenantId,
+      organizationId
+    });
+    if (!hasFeature) {
+      throw new CrudHttpError(403, { error: translate("customers.errors.access_denied", "Access denied") });
+    }
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: auth.tenantId,
+      organizationId,
+      userId: actorUserId,
+      resourceKind,
+      resourceId: body.entityId,
+      operation: "custom",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: body
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
+    const commandInput = labelAssignCommandSchema.parse({
+      labelId: body.labelId,
+      entityId: body.entityId,
+      tenantId: auth.tenantId,
+      organizationId
+    });
+    const commandBus = container.resolve("commandBus");
+    const { result, logEntry } = await commandBus.execute(
+      "customers.labels.assign",
+      {
+        input: commandInput,
+        ctx: {
+          container,
+          auth,
+          organizationScope: scope,
+          selectedOrganizationId: organizationId,
+          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+          request: req
+        }
+      }
+    );
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId,
+        userId: actorUserId,
+        resourceKind,
+        resourceId: body.entityId,
+        operation: "custom",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
+    const response = NextResponse.json({ id: result.assignmentId }, { status: result.created ? 201 : 200 });
+    if (result.created && logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+      response.headers.set(
+        "x-om-operation",
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? "customers.labelAssignment",
+          resourceId: logEntry.resourceId ?? result.assignmentId,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+    return response;
+  } catch (err) {
+    if (isMissingCustomerLabelTable(err)) {
+      const migrationError = await createMissingCustomerLabelTablesError();
+      return NextResponse.json(migrationError.body, { status: migrationError.status });
+    }
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    console.error("[customers/labels/assign.POST]", err);
+    const { translate: fallbackTranslate } = await resolveTranslations();
+    return NextResponse.json(
+      { error: fallbackTranslate("customers.errors.failed_to_assign_label", "Failed to assign label") },
+      { status: 500 }
+    );
+  }
+}
+const responseSchema = z.object({ id: z.string().uuid() });
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "Customers",
+  summary: "Assign label to entity",
+  methods: {
+    POST: {
+      summary: "Assign label",
+      requestBody: { contentType: "application/json", schema: labelAssignmentRequestSchema },
+      responses: [
+        { status: 201, description: "Assigned", schema: responseSchema },
+        { status: 200, description: "Already assigned", schema: responseSchema }
+      ],
+      errors: [
+        { status: 404, description: "Label or entity not found", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/customers/api/labels/assign/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/customers/api/labels/assign/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { CustomerEntity } from '../../../data/entities'\nimport { labelAssignCommandSchema, labelAssignmentSchema, type LabelAssignCommandInput } from '../../../data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { z } from 'zod'\nimport { resolveLabelActorUserId } from '../auth'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  createMissingCustomerLabelTablesError,\n  isMissingCustomerLabelTable,\n} from '../table-errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst labelAssignmentRequestSchema = labelAssignmentSchema.extend({\n  organizationId: z.string().uuid().optional(),\n})\n\nfunction resolveResourceKind(kind: 'person' | 'company' | null | undefined): string {\n  if (kind === 'company') return 'customers.company'\n  return 'customers.person'\n}\n\nfunction resolveRequiredFeature(kind: 'person' | 'company' | null | undefined): string {\n  return kind === 'company' ? 'customers.companies.manage' : 'customers.people.manage'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = labelAssignmentRequestSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: body.organizationId ?? undefined,\n    })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const targetEntity = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      {\n        id: body.entityId,\n        tenantId: auth.tenantId,\n        organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId },\n    )\n    if (!targetEntity) {\n      throw new CrudHttpError(404, { error: translate('customers.errors.entity_not_found', 'Entity not found') })\n    }\n    const entityKind = targetEntity.kind === 'person' || targetEntity.kind === 'company' ? targetEntity.kind : null\n    const resourceKind = resolveResourceKind(entityKind)\n\n    const rbac = container.resolve('rbacService') as RbacService | undefined\n    if (!rbac) {\n      throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n    }\n    const requiredFeature = resolveRequiredFeature(entityKind)\n    const hasFeature = await rbac.userHasAllFeatures(actorUserId, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasFeature) {\n      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      resourceKind,\n      resourceId: body.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandInput = labelAssignCommandSchema.parse({\n      labelId: body.labelId,\n      entityId: body.entityId,\n      tenantId: auth.tenantId,\n      organizationId,\n    } satisfies LabelAssignCommandInput)\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<LabelAssignCommandInput, { assignmentId: string; created: boolean; entityKind: 'person' | 'company' | null }>(\n      'customers.labels.assign',\n      {\n        input: commandInput,\n        ctx: {\n          container,\n          auth,\n          organizationScope: scope,\n          selectedOrganizationId: organizationId,\n          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n          request: req,\n        },\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        resourceKind,\n        resourceId: body.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result.assignmentId }, { status: result.created ? 201 : 200 })\n    if (result.created && logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.labelAssignment',\n          resourceId: logEntry.resourceId ?? result.assignmentId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      const migrationError = await createMissingCustomerLabelTablesError()\n      return NextResponse.json(migrationError.body, { status: migrationError.status })\n    }\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[customers/labels/assign.POST]', err)\n    const { translate: fallbackTranslate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: fallbackTranslate('customers.errors.failed_to_assign_label', 'Failed to assign label') },\n      { status: 500 },\n    )\n  }\n}\n\nconst responseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Assign label to entity',\n  methods: {\n    POST: {\n      summary: 'Assign label',\n      requestBody: { contentType: 'application/json', schema: labelAssignmentRequestSchema },\n      responses: [\n        { status: 201, description: 'Assigned', schema: responseSchema },\n        { status: 200, description: 'Already assigned', schema: responseSchema },\n      ],\n      errors: [\n        { status: 404, description: 'Label or entity not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B,6BAA2D;AAC9F,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAK9B,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAE7B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,+BAA+B,sBAAsB,OAAO;AAAA,EAChE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,SAAS,oBAAoB,MAAuD;AAClF,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAuD;AACrF,SAAO,SAAS,YAAY,+BAA+B;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,OAAO,6BAA6B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC3E,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,kBAAkB;AAAA,IACrC,CAAC;AACD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,KAAK;AAAA,QACT,UAAU,KAAK;AAAA,QACf;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IAC5C;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,qCAAqC,kBAAkB,EAAE,CAAC;AAAA,IAC5G;AACA,UAAM,aAAa,aAAa,SAAS,YAAY,aAAa,SAAS,YAAY,aAAa,OAAO;AAC3G,UAAM,eAAe,oBAAoB,UAAU;AAEnD,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,IAClG;AACA,UAAM,kBAAkB,uBAAuB,UAAU;AACzD,UAAM,aAAa,MAAM,KAAK,mBAAmB,aAAa,CAAC,eAAe,GAAG;AAAA,MAC/E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,IACtG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,eAAe,yBAAyB,MAAM;AAAA,MAClD,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAmC;AAEnC,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,aAAa,GAAG,EAAE,QAAQ,OAAO,UAAU,MAAM,IAAI,CAAC;AACtG,QAAI,OAAO,WAAW,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AAC9E,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC7G,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,YAAM,iBAAiB,MAAM,sCAAsC;AACnE,aAAO,aAAa,KAAK,eAAe,MAAM,EAAE,QAAQ,eAAe,OAAO,CAAC;AAAA,IACjF;AACA,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,kCAAkC,GAAG;AACnD,UAAM,EAAE,WAAW,kBAAkB,IAAI,MAAM,oBAAoB;AACnE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kBAAkB,2CAA2C,wBAAwB,EAAE;AAAA,MAChG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MACrF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,eAAe;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,eAAe;AAAA,MACzE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customers/api/labels/auth.js

@@ -0,0 +1,17 @@
+const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function resolveLabelActorUserId(auth) {
+  if (!auth) return null;
+  const apiUserId = typeof auth.userId === "string" ? auth.userId.trim() : "";
+  if (apiUserId && uuidRegex.test(apiUserId)) {
+    return apiUserId;
+  }
+  if (auth.isApiKey) {
+    return null;
+  }
+  const subjectId = typeof auth.sub === "string" ? auth.sub.trim() : "";
+  return subjectId && uuidRegex.test(subjectId) ? subjectId : null;
+}
+export {
+  resolveLabelActorUserId
+};
+//# sourceMappingURL=auth.js.map

package/dist/modules/customers/api/labels/auth.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customers/api/labels/auth.ts"],
+  "sourcesContent": ["import type { AuthContext } from '@open-mercato/shared/lib/auth/server'\n\nconst uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nexport function resolveLabelActorUserId(auth: AuthContext): string | null {\n  if (!auth) return null\n\n  const apiUserId = typeof auth.userId === 'string' ? auth.userId.trim() : ''\n  if (apiUserId && uuidRegex.test(apiUserId)) {\n    return apiUserId\n  }\n\n  if (auth.isApiKey) {\n    return null\n  }\n\n  const subjectId = typeof auth.sub === 'string' ? auth.sub.trim() : ''\n  return subjectId && uuidRegex.test(subjectId) ? subjectId : null\n}\n"],
+  "mappings": "AAEA,MAAM,YAAY;AAEX,SAAS,wBAAwB,MAAkC;AACxE,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,YAAY,OAAO,KAAK,WAAW,WAAW,KAAK,OAAO,KAAK,IAAI;AACzE,MAAI,aAAa,UAAU,KAAK,SAAS,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,OAAO,KAAK,QAAQ,WAAW,KAAK,IAAI,KAAK,IAAI;AACnE,SAAO,aAAa,UAAU,KAAK,SAAS,IAAI,YAAY;AAC9D;",
+  "names": []
+}

package/dist/modules/customers/api/labels/route.js

@@ -0,0 +1,281 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CustomerLabel, CustomerLabelAssignment } from "../../data/entities.js";
+import { labelCreateCommandSchema, labelCreateSchema } from "../../data/validators.js";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveLabelActorUserId } from "./auth.js";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+import {
+  createMissingCustomerLabelTablesError,
+  isMissingCustomerLabelTable
+} from "./table-errors.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["customers.people.view"] },
+  POST: { requireAuth: true, requireFeatures: ["customers.people.manage"] }
+};
+const querySchema = z.object({
+  entityId: z.string().uuid().optional(),
+  organizationId: z.string().uuid().optional(),
+  ids: z.string().optional(),
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
+  search: z.string().optional()
+});
+const createLabelRequestSchema = labelCreateSchema.extend({
+  organizationId: z.string().uuid().optional()
+});
+async function GET(req) {
+  const { translate } = await resolveTranslations();
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const actorUserId = resolveLabelActorUserId(auth);
+    if (!auth || !auth.tenantId || !actorUserId) {
+      return NextResponse.json({ error: translate("customers.errors.unauthorized", "Unauthorized") }, { status: 401 });
+    }
+    const em = container.resolve("em");
+    const url = new URL(req.url);
+    const query = querySchema.parse({
+      entityId: url.searchParams.get("entityId") ?? void 0,
+      organizationId: url.searchParams.get("organizationId") ?? void 0,
+      ids: url.searchParams.get("ids") ?? void 0,
+      page: url.searchParams.get("page") ?? void 0,
+      pageSize: url.searchParams.get("pageSize") ?? void 0,
+      search: url.searchParams.get("search") ?? void 0
+    });
+    const scope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request: req,
+      selectedId: query.organizationId ?? void 0
+    });
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: translate("customers.errors.organization_required", "Organization context is required") });
+    }
+    const labels = await findWithDecryption(em, CustomerLabel, {
+      tenantId: auth.tenantId,
+      organizationId,
+      userId: actorUserId
+    }, { orderBy: { label: "asc" } }, { tenantId: auth.tenantId, organizationId });
+    let assignedLabelIds = [];
+    if (query.entityId) {
+      const assignments = await findWithDecryption(em, CustomerLabelAssignment, {
+        tenantId: auth.tenantId,
+        organizationId,
+        userId: actorUserId,
+        entity: query.entityId
+      }, {}, { tenantId: auth.tenantId, organizationId });
+      assignedLabelIds = assignments.map((a) => {
+        try {
+          return a.label.id;
+        } catch {
+          return "";
+        }
+      });
+      if (assignedLabelIds.some((id) => !id)) {
+        const loaded = await findWithDecryption(em, CustomerLabelAssignment, {
+          tenantId: auth.tenantId,
+          organizationId,
+          userId: actorUserId,
+          entity: query.entityId
+        }, { populate: ["label"] }, { tenantId: auth.tenantId, organizationId });
+        assignedLabelIds = loaded.map((a) => a.label.id);
+      }
+    }
+    const requestedIds = query.ids ? new Set(
+      query.ids.split(",").map((value) => value.trim()).filter(Boolean)
+    ) : null;
+    const scopedLabels = requestedIds ? labels.filter((label) => requestedIds.has(label.id)) : labels;
+    const filteredLabels = query.search?.trim().length ? scopedLabels.filter((label) => label.label.toLowerCase().includes(query.search.trim().toLowerCase())) : scopedLabels;
+    const total = filteredLabels.length;
+    const totalPages = Math.max(1, Math.ceil(total / query.pageSize));
+    const page = Math.min(query.page, totalPages);
+    const start = (page - 1) * query.pageSize;
+    const items = filteredLabels.slice(start, start + query.pageSize);
+    return NextResponse.json({
+      items: items.map((l) => ({
+        id: l.id,
+        slug: l.slug,
+        label: l.label
+      })),
+      assignedIds: assignedLabelIds.filter(Boolean),
+      total,
+      page,
+      pageSize: query.pageSize,
+      totalPages
+    });
+  } catch (err) {
+    if (isMissingCustomerLabelTable(err)) {
+      return NextResponse.json({ items: [], assignedIds: [] });
+    }
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    console.error("[customers/labels.GET]", err);
+    return NextResponse.json({ error: translate("customers.errors.labels_load_failed", "Failed to load labels") }, { status: 500 });
+  }
+}
+function slugifyLabel(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+async function POST(req) {
+  try {
+    const { translate } = await resolveTranslations();
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const actorUserId = resolveLabelActorUserId(auth);
+    if (!auth || !auth.tenantId || !actorUserId) {
+      return NextResponse.json({ error: translate("customers.errors.unauthorized", "Unauthorized") }, { status: 401 });
+    }
+    const body = createLabelRequestSchema.parse(await readJsonSafe(req, {}));
+    const scope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request: req,
+      selectedId: body.organizationId ?? void 0
+    });
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: translate("customers.errors.organization_required", "Organization context is required") });
+    }
+    const slug = body.slug || slugifyLabel(body.label);
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: auth.tenantId,
+      organizationId,
+      userId: actorUserId,
+      resourceKind: "customers.label",
+      resourceId: organizationId,
+      operation: "custom",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: body
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
+    const commandInput = labelCreateCommandSchema.parse({
+      tenantId: auth.tenantId,
+      organizationId,
+      userId: actorUserId,
+      slug,
+      label: body.label
+    });
+    const commandBus = container.resolve("commandBus");
+    const { result, logEntry } = await commandBus.execute(
+      "customers.labels.create",
+      {
+        input: commandInput,
+        ctx: {
+          container,
+          auth,
+          organizationScope: scope,
+          selectedOrganizationId: organizationId,
+          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+          request: req
+        }
+      }
+    );
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId,
+        userId: actorUserId,
+        resourceKind: "customers.label",
+        resourceId: organizationId,
+        operation: "custom",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
+    const response = NextResponse.json({
+      id: result.labelId,
+      slug: result.slug,
+      label: result.label
+    }, { status: 201 });
+    if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+      response.headers.set(
+        "x-om-operation",
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? "customers.label",
+          resourceId: logEntry.resourceId ?? result.labelId,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+    return response;
+  } catch (err) {
+    if (isMissingCustomerLabelTable(err)) {
+      const migrationError = await createMissingCustomerLabelTablesError();
+      return NextResponse.json(migrationError.body, { status: migrationError.status });
+    }
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    console.error("[customers/labels.POST]", err);
+    return NextResponse.json({ error: "Failed to create label" }, { status: 500 });
+  }
+}
+const labelSchema = z.object({
+  id: z.string().uuid(),
+  slug: z.string(),
+  label: z.string()
+});
+const labelsListSchema = z.object({
+  items: z.array(labelSchema),
+  assignedIds: z.array(z.string().uuid()),
+  total: z.number().int().nonnegative(),
+  page: z.number().int().min(1),
+  pageSize: z.number().int().min(1),
+  totalPages: z.number().int().min(1)
+});
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "Customers",
+  summary: "Customer labels (user- and organization-scoped)",
+  methods: {
+    GET: {
+      summary: "List labels",
+      description: "Returns labels for the current user within the selected organization. Optionally includes assignment status for a specific entity.",
+      responses: [
+        { status: 200, description: "Labels list", schema: labelsListSchema }
+      ],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: errorSchema }
+      ]
+    },
+    POST: {
+      summary: "Create label",
+      description: "Creates a new label scoped to the current user and selected organization.",
+      requestBody: { contentType: "application/json", schema: createLabelRequestSchema },
+      responses: [
+        { status: 201, description: "Label created", schema: labelSchema }
+      ],
+      errors: [
+        { status: 409, description: "Duplicate slug", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/customers/api/labels/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customers/api/labels/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { CustomerLabel, CustomerLabelAssignment } from '../../data/entities'\nimport { labelCreateCommandSchema, labelCreateSchema, type LabelCreateCommandInput } from '../../data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveLabelActorUserId } from './auth'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  createMissingCustomerLabelTablesError,\n  isMissingCustomerLabelTable,\n} from './table-errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.people.view'] },\n  POST: { requireAuth: true, requireFeatures: ['customers.people.manage'] },\n}\n\nconst querySchema = z.object({\n  entityId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n  ids: z.string().optional(),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n})\n\nconst createLabelRequestSchema = labelCreateSchema.extend({\n  organizationId: z.string().uuid().optional(),\n})\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const url = new URL(req.url)\n    const query = querySchema.parse({\n      entityId: url.searchParams.get('entityId') ?? undefined,\n      organizationId: url.searchParams.get('organizationId') ?? undefined,\n      ids: url.searchParams.get('ids') ?? undefined,\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n    })\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: query.organizationId ?? undefined,\n    })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n\n    // Load all labels for this user\n    const labels = await findWithDecryption(em, CustomerLabel, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n    }, { orderBy: { label: 'asc' } }, { tenantId: auth.tenantId, organizationId })\n\n    // If entityId provided, also load assignments for that entity\n    let assignedLabelIds: string[] = []\n    if (query.entityId) {\n      const assignments = await findWithDecryption(em, CustomerLabelAssignment, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        entity: query.entityId,\n      } as FilterQuery<CustomerLabelAssignment>, {}, { tenantId: auth.tenantId, organizationId })\n      assignedLabelIds = assignments.map((a) => {\n        try { return a.label.id } catch { return '' }\n      })\n      // Handle unloaded references\n      if (assignedLabelIds.some((id) => !id)) {\n        const loaded = await findWithDecryption(em, CustomerLabelAssignment, {\n          tenantId: auth.tenantId,\n          organizationId,\n          userId: actorUserId,\n          entity: query.entityId,\n        } as FilterQuery<CustomerLabelAssignment>, { populate: ['label'] }, { tenantId: auth.tenantId, organizationId })\n        assignedLabelIds = loaded.map((a) => a.label.id)\n      }\n    }\n\n    const requestedIds = query.ids\n      ? new Set(\n          query.ids\n            .split(',')\n            .map((value) => value.trim())\n            .filter(Boolean),\n        )\n      : null\n    const scopedLabels = requestedIds\n      ? labels.filter((label) => requestedIds.has(label.id))\n      : labels\n    const filteredLabels = query.search?.trim().length\n      ? scopedLabels.filter((label) => label.label.toLowerCase().includes(query.search!.trim().toLowerCase()))\n      : scopedLabels\n    const total = filteredLabels.length\n    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))\n    const page = Math.min(query.page, totalPages)\n    const start = (page - 1) * query.pageSize\n    const items = filteredLabels.slice(start, start + query.pageSize)\n\n    return NextResponse.json({\n      items: items.map((l) => ({\n        id: l.id,\n        slug: l.slug,\n        label: l.label,\n      })),\n      assignedIds: assignedLabelIds.filter(Boolean),\n      total,\n      page,\n      pageSize: query.pageSize,\n      totalPages,\n    })\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      return NextResponse.json({ items: [], assignedIds: [] })\n    }\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[customers/labels.GET]', err)\n    return NextResponse.json({ error: translate('customers.errors.labels_load_failed', 'Failed to load labels') }, { status: 500 })\n  }\n}\n\nfunction slugifyLabel(value: string): string {\n  return value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = createLabelRequestSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: body.organizationId ?? undefined,\n    })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n    const slug = body.slug || slugifyLabel(body.label)\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      resourceKind: 'customers.label',\n      resourceId: organizationId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandInput = labelCreateCommandSchema.parse({\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      slug,\n      label: body.label,\n    } satisfies LabelCreateCommandInput)\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<LabelCreateCommandInput, { labelId: string; slug: string; label: string }>(\n      'customers.labels.create',\n      {\n        input: commandInput,\n        ctx: {\n          container,\n          auth,\n          organizationScope: scope,\n          selectedOrganizationId: organizationId,\n          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n          request: req,\n        },\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        resourceKind: 'customers.label',\n        resourceId: organizationId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({\n      id: result.labelId,\n      slug: result.slug,\n      label: result.label,\n    }, { status: 201 })\n    if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.label',\n          resourceId: logEntry.resourceId ?? result.labelId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      const migrationError = await createMissingCustomerLabelTablesError()\n      return NextResponse.json(migrationError.body, { status: migrationError.status })\n    }\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[customers/labels.POST]', err)\n    return NextResponse.json({ error: 'Failed to create label' }, { status: 500 })\n  }\n}\n\nconst labelSchema = z.object({\n  id: z.string().uuid(),\n  slug: z.string(),\n  label: z.string(),\n})\n\nconst labelsListSchema = z.object({\n  items: z.array(labelSchema),\n  assignedIds: z.array(z.string().uuid()),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().min(1),\n  pageSize: z.number().int().min(1),\n  totalPages: z.number().int().min(1),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Customer labels (user- and organization-scoped)',\n  methods: {\n    GET: {\n      summary: 'List labels',\n      description: 'Returns labels for the current user within the selected organization. Optionally includes assignment status for a specific entity.',\n      responses: [\n        { status: 200, description: 'Labels list', schema: labelsListSchema },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create label',\n      description: 'Creates a new label scoped to the current user and selected organization.',\n      requestBody: { contentType: 'application/json', schema: createLabelRequestSchema },\n      responses: [\n        { status: 201, description: 'Label created', schema: labelSchema },\n      ],\n      errors: [\n        { status: 409, description: 'Duplicate slug', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,eAAe,+BAA+B;AACvD,SAAS,0BAA0B,yBAAuD;AAC1F,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAI9B,SAAS,kCAAkC;AAC3C,SAAS,0BAAiD;AAC1D,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAE7B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,2BAA2B,kBAAkB,OAAO;AAAA,EACxD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM;AAAA,MAC9B,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,gBAAgB,IAAI,aAAa,IAAI,gBAAgB,KAAK;AAAA,MAC1D,KAAK,IAAI,aAAa,IAAI,KAAK,KAAK;AAAA,MACpC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC5C,CAAC;AACD,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,MAAM,kBAAkB;AAAA,IACtC,CAAC;AACD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AAGA,UAAM,SAAS,MAAM,mBAAmB,IAAI,eAAe;AAAA,MACzD,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV,GAAG,EAAE,SAAS,EAAE,OAAO,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,UAAU,eAAe,CAAC;AAG7E,QAAI,mBAA6B,CAAC;AAClC,QAAI,MAAM,UAAU;AAClB,YAAM,cAAc,MAAM,mBAAmB,IAAI,yBAAyB;AAAA,QACxE,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,MAAM;AAAA,MAChB,GAA2C,CAAC,GAAG,EAAE,UAAU,KAAK,UAAU,eAAe,CAAC;AAC1F,yBAAmB,YAAY,IAAI,CAAC,MAAM;AACxC,YAAI;AAAE,iBAAO,EAAE,MAAM;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAG;AAAA,MAC9C,CAAC;AAED,UAAI,iBAAiB,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG;AACtC,cAAM,SAAS,MAAM,mBAAmB,IAAI,yBAAyB;AAAA,UACnE,UAAU,KAAK;AAAA,UACf;AAAA,UACA,QAAQ;AAAA,UACR,QAAQ,MAAM;AAAA,QAChB,GAA2C,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,UAAU,eAAe,CAAC;AAC/G,2BAAmB,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,MACvB,IAAI;AAAA,MACF,MAAM,IACH,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AAAA,IACnB,IACA;AACJ,UAAM,eAAe,eACjB,OAAO,OAAO,CAAC,UAAU,aAAa,IAAI,MAAM,EAAE,CAAC,IACnD;AACJ,UAAM,iBAAiB,MAAM,QAAQ,KAAK,EAAE,SACxC,aAAa,OAAO,CAAC,UAAU,MAAM,MAAM,YAAY,EAAE,SAAS,MAAM,OAAQ,KAAK,EAAE,YAAY,CAAC,CAAC,IACrG;AACJ,UAAM,QAAQ,eAAe;AAC7B,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,MAAM,QAAQ,CAAC;AAChE,UAAM,OAAO,KAAK,IAAI,MAAM,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,KAAK,MAAM;AACjC,UAAM,QAAQ,eAAe,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAEhE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,IAAI,EAAE;AAAA,QACN,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,MACF,aAAa,iBAAiB,OAAO,OAAO;AAAA,MAC5C;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,IACzD;AACA,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,0BAA0B,GAAG;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEA,SAAS,aAAa,OAAuB;AAC3C,SAAO,MACJ,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAC3B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,OAAO,yBAAyB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACvE,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,kBAAkB;AAAA,IACrC,CAAC;AACD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AACA,UAAM,OAAO,KAAK,QAAQ,aAAa,KAAK,KAAK;AAEjD,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,eAAe,yBAAyB,MAAM;AAAA,MAClD,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,OAAO,KAAK;AAAA,IACd,CAAmC;AAEnC,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,OAAO;AAAA,MACX,MAAM,OAAO;AAAA,MACb,OAAO,OAAO;AAAA,IAChB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClB,QAAI,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AAC5D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC7G,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,YAAM,iBAAiB,MAAM,sCAAsC;AACnE,aAAO,aAAa,KAAK,eAAe,MAAM,EAAE,QAAQ,eAAe,OAAO,CAAC;AAAA,IACjF;AACA,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,2BAA2B,GAAG;AAC5C,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,MAAM,WAAW;AAAA,EAC1B,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,EAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,iBAAiB;AAAA,MACtE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACjF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,YAAY;AAAA,MACnE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customers/api/labels/table-errors.js

@@ -0,0 +1,38 @@
+import { TableNotFoundException } from "@mikro-orm/core";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+const CUSTOMER_LABEL_TABLES = [
+  "customer_labels",
+  "customer_label_assignments"
+];
+function isMissingCustomerLabelTable(error) {
+  if (error instanceof TableNotFoundException) {
+    return true;
+  }
+  if (typeof error !== "object" || error === null) {
+    return false;
+  }
+  const candidate = error;
+  if (candidate.code === "42P01") {
+    return true;
+  }
+  const message = candidate.message;
+  if (typeof message !== "string") {
+    return false;
+  }
+  return CUSTOMER_LABEL_TABLES.some((tableName) => message.includes(tableName));
+}
+async function createMissingCustomerLabelTablesError() {
+  const { translate } = await resolveTranslations();
+  return new CrudHttpError(503, {
+    error: translate(
+      "customers.errors.customer_label_tables_missing",
+      "Customer label tables are missing. Run yarn db:migrate."
+    )
+  });
+}
+export {
+  createMissingCustomerLabelTablesError,
+  isMissingCustomerLabelTable
+};
+//# sourceMappingURL=table-errors.js.map

package/dist/modules/customers/api/labels/table-errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customers/api/labels/table-errors.ts"],
+  "sourcesContent": ["import { TableNotFoundException } from '@mikro-orm/core'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nconst CUSTOMER_LABEL_TABLES = [\n  'customer_labels',\n  'customer_label_assignments',\n] as const\n\nexport function isMissingCustomerLabelTable(error: unknown): boolean {\n  if (error instanceof TableNotFoundException) {\n    return true\n  }\n  if (typeof error !== 'object' || error === null) {\n    return false\n  }\n  const candidate = error as { code?: unknown; message?: unknown }\n  if (candidate.code === '42P01') {\n    return true\n  }\n  const message = candidate.message\n  if (typeof message !== 'string') {\n    return false\n  }\n  return CUSTOMER_LABEL_TABLES.some((tableName) => message.includes(tableName))\n}\n\nexport async function createMissingCustomerLabelTablesError(): Promise<CrudHttpError> {\n  const { translate } = await resolveTranslations()\n  return new CrudHttpError(503, {\n    error: translate(\n      'customers.errors.customer_label_tables_missing',\n      'Customer label tables are missing. Run yarn db:migrate.',\n    ),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC,MAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AACF;AAEO,SAAS,4BAA4B,OAAyB;AACnE,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,YAAY;AAClB,MAAI,UAAU,SAAS,SAAS;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,UAAU;AAC1B,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,KAAK,CAAC,cAAc,QAAQ,SAAS,SAAS,CAAC;AAC9E;AAEA,eAAsB,wCAAgE;AACpF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}