npm - @open-mercato/core - Versions diffs - 0.6.1-develop.3115.bc23703ef8 → 0.6.1-develop.3144.b39fb4dfa6 - Mend

@open-mercato/core 0.6.1-develop.3115.bc23703ef8 → 0.6.1-develop.3144.b39fb4dfa6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (190) hide show

package/dist/modules/sales/api/document-history/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/api/document-history/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport { loadAuditLogDisplayMaps } from '@open-mercato/core/modules/audit_logs/api/audit-logs/display'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildHistoryEntries } from '../../lib/historyHelpers'\nimport { SalesNote } from '../../data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// Spec: SPEC-006-2026-01-23-order-status-history\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst querySchema = z.object({\n  kind: z.enum(['order', 'quote']),\n  id: z.string().uuid(),\n  limit: z.coerce.number().min(1).max(100).default(50),\n  before: z.string().optional(),\n  after: z.string().optional(),\n  types: z.string().optional(), // comma-separated: status,action,comment\n})\n\nexport type DocumentHistoryEntryKind = 'status' | 'action' | 'comment'\n\nconst HISTORY_TYPES: ReadonlySet<DocumentHistoryEntryKind> = new Set(['status', 'action', 'comment'])\n\nexport function parseDocumentHistoryTypes(input: string | null | undefined): Set<DocumentHistoryEntryKind> {\n  const raw = typeof input === 'string' ? input.trim() : ''\n  if (!raw) return new Set()\n  const values = raw\n    .split(',')\n    .map((part) => part.trim().toLowerCase())\n    .filter((value) => value.length > 0)\n  const result = new Set<DocumentHistoryEntryKind>()\n  values.forEach((value) => {\n    if (HISTORY_TYPES.has(value as DocumentHistoryEntryKind)) {\n      result.add(value as DocumentHistoryEntryKind)\n    }\n  })\n  return result\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n      })\n    }\n\n    const resourceKind = query.kind === 'order' ? 'sales.order' : 'sales.quote'\n\n    const actionLogService = container.resolve('actionLogService') as ActionLogService\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const [actionLogList, notes] = await Promise.all([\n      actionLogService.list({\n        tenantId: auth.tenantId,\n        organizationId,\n        resourceKind,\n        resourceId: query.id,\n        includeRelated: true,\n        limit: query.limit,\n        before: query.before ? new Date(query.before) : undefined,\n        after: query.after ? new Date(query.after) : undefined,\n      }),\n      findWithDecryption(\n        em,\n        SalesNote,\n        {\n          contextType: query.kind,\n          contextId: query.id,\n          tenantId: auth.tenantId,\n          organizationId,\n          deletedAt: null,\n        },\n        { orderBy: { createdAt: 'DESC' } },\n        { tenantId: auth.tenantId, organizationId },\n      ),\n    ])\n    const logs = actionLogList.items as ActionLog[]\n\n    const allUserIds = [\n      ...logs.map((l) => l.actorUserId).filter((v): v is string => !!v),\n      ...notes.map((n) => n.authorUserId).filter((v): v is string => !!v),\n    ]\n\n    const displayMaps = await loadAuditLogDisplayMaps(em, {\n      userIds: allUserIds,\n      tenantIds: [],\n      organizationIds: [],\n    })\n\n    let items = buildHistoryEntries({ actionLogs: logs, notes, kind: query.kind, displayUsers: displayMaps.users })\n    const typesFilter = parseDocumentHistoryTypes(query.types)\n    if (typesFilter.size > 0) {\n      items = items.filter((entry) => typesFilter.has(entry.kind as DocumentHistoryEntryKind))\n    }\n\n    let nextCursor: string | undefined = undefined\n    if (logs.length === query.limit && items.length > 0) {\n      const last = items[items.length - 1]\n      nextCursor = Buffer.from(`${last.occurredAt}|${last.id}`).toString('base64')\n    }\n\n    return NextResponse.json({ items, nextCursor })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('sales.document-history.get failed', err)\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('sales.documents.history.error', 'Failed to load history.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst historyActorSchema = z.object({\n  id: z.string().uuid().nullable(),\n  label: z.string(),\n})\n\nconst historyEntrySchema = z.object({\n  id: z.string(),\n  occurredAt: z.string().datetime(),\n  kind: z.enum(['status', 'action', 'comment']),\n  action: z.string(),\n  actor: historyActorSchema,\n  source: z.enum(['action_log', 'note']),\n  metadata: z.object({\n    statusFrom: z.string().nullable().optional(),\n    statusTo: z.string().nullable().optional(),\n    documentKind: z.enum(['order', 'quote']).optional(),\n    commandId: z.string().optional(),\n  }).optional(),\n})\n\nconst documentHistoryResponseSchema = z.object({\n  items: z.array(historyEntrySchema),\n  nextCursor: z.string().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Get document change history',\n  methods: {\n    GET: {\n      summary: 'List history entries for an order or quote',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'History entries', schema: documentHistoryResponseSchema },\n        { status: 400, description: 'Invalid query', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Document not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAI7B,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,0BAA0B;AAI5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAID,MAAM,gBAAuD,oBAAI,IAAI,CAAC,UAAU,UAAU,SAAS,CAAC;AAE7F,SAAS,0BAA0B,OAAiE;AACzG,QAAM,MAAM,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,oBAAI,IAAI;AACzB,QAAM,SAAS,IACZ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY,CAAC,EACvC,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAM,SAAS,oBAAI,IAA8B;AACjD,SAAO,QAAQ,CAAC,UAAU;AACxB,QAAI,cAAc,IAAI,KAAiC,GAAG;AACxD,aAAO,IAAI,KAAiC;AAAA,IAC9C;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AAEpE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,MACrG,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,SAAS,UAAU,gBAAgB;AAE9D,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/C,iBAAiB,KAAK;AAAA,QACpB,UAAU,KAAK;AAAA,QACf;AAAA,QACA;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,gBAAgB;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAAA,QAChD,OAAO,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,UAAU,KAAK;AAAA,UACf;AAAA,UACA,WAAW;AAAA,QACb;AAAA,QACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,QACjC,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,MAC5C;AAAA,IACF,CAAC;AACD,UAAM,OAAO,cAAc;AAE3B,UAAM,aAAa;AAAA,MACjB,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,MAChE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,IACpE;AAEA,UAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,MACpD,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,MACZ,iBAAiB,CAAC;AAAA,IACpB,CAAC;AAED,QAAI,QAAQ,oBAAoB,EAAE,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,cAAc,YAAY,MAAM,CAAC;AAC9G,UAAM,cAAc,0BAA0B,MAAM,KAAK;AACzD,QAAI,YAAY,OAAO,GAAG;AACxB,cAAQ,MAAM,OAAO,CAAC,UAAU,YAAY,IAAI,MAAM,IAAgC,CAAC;AAAA,IACzF;AAEA,QAAI,aAAiC;AACrC,QAAI,KAAK,WAAW,MAAM,SAAS,MAAM,SAAS,GAAG;AACnD,YAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,mBAAa,OAAO,KAAK,GAAG,KAAK,UAAU,IAAI,KAAK,EAAE,EAAE,EAAE,SAAS,QAAQ;AAAA,IAC7E;AAEA,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,EAChD,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,qCAAqC,GAAG;AACtD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE;AAAA,MAC/E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAAA,EAC5C,QAAQ,EAAE,OAAO;AAAA,EACjB,OAAO;AAAA,EACP,QAAQ,EAAE,KAAK,CAAC,cAAc,MAAM,CAAC;AAAA,EACrC,UAAU,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACzC,cAAc,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,IAClD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EAAE,SAAS;AACd,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,8BAA8B;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport { loadAuditLogDisplayMaps } from '@open-mercato/core/modules/audit_logs/api/audit-logs/display'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildHistoryEntries } from '../../lib/historyHelpers'\nimport { SalesNote } from '../../data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// Spec: SPEC-006-2026-01-23-order-status-history\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst querySchema = z.object({\n  kind: z.enum(['order', 'quote']),\n  id: z.string().uuid(),\n  limit: z.coerce.number().min(1).max(100).default(50),\n  before: z.string().optional(),\n  after: z.string().optional(),\n  types: z.string().optional(), // comma-separated: status,action,comment\n})\n\nexport type DocumentHistoryEntryKind = 'status' | 'action' | 'comment'\n\nconst HISTORY_TYPES: ReadonlySet<DocumentHistoryEntryKind> = new Set(['status', 'action', 'comment'])\n\nexport function parseDocumentHistoryTypes(input: string | null | undefined): Set<DocumentHistoryEntryKind> {\n  const raw = typeof input === 'string' ? input.trim() : ''\n  if (!raw) return new Set()\n  const values = raw\n    .split(',')\n    .map((part) => part.trim().toLowerCase())\n    .filter((value) => value.length > 0)\n  const result = new Set<DocumentHistoryEntryKind>()\n  values.forEach((value) => {\n    if (HISTORY_TYPES.has(value as DocumentHistoryEntryKind)) {\n      result.add(value as DocumentHistoryEntryKind)\n    }\n  })\n  return result\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n      })\n    }\n\n    const resourceKind = query.kind === 'order' ? 'sales.order' : 'sales.quote'\n\n    const actionLogService = container.resolve('actionLogService') as ActionLogService\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const [actionLogList, notes] = await Promise.all([\n      actionLogService.list({\n        tenantId: auth.tenantId,\n        organizationId,\n        resourceKind,\n        resourceId: query.id,\n        includeRelated: true,\n        limit: query.limit,\n        before: query.before ? new Date(query.before) : undefined,\n        after: query.after ? new Date(query.after) : undefined,\n      }),\n      findWithDecryption(\n        em,\n        SalesNote,\n        {\n          contextType: query.kind,\n          contextId: query.id,\n          tenantId: auth.tenantId,\n          organizationId,\n          deletedAt: null,\n        },\n        { orderBy: { createdAt: 'DESC' } },\n        { tenantId: auth.tenantId, organizationId },\n      ),\n    ])\n    const logs = actionLogList.items as ActionLog[]\n\n    const allUserIds = [\n      ...logs.map((l) => l.actorUserId).filter((v): v is string => !!v),\n      ...notes.map((n) => n.authorUserId).filter((v): v is string => !!v),\n    ]\n\n    const displayMaps = await loadAuditLogDisplayMaps(em, {\n      userIds: allUserIds,\n      tenantIds: [],\n      organizationIds: [],\n    })\n\n    let items = buildHistoryEntries({ actionLogs: logs, notes, kind: query.kind, displayUsers: displayMaps.users })\n    const typesFilter = parseDocumentHistoryTypes(query.types)\n    if (typesFilter.size > 0) {\n      items = items.filter((entry) => typesFilter.has(entry.kind as DocumentHistoryEntryKind))\n    }\n\n    let nextCursor: string | undefined = undefined\n    if (logs.length === query.limit && items.length > 0) {\n      const last = items[items.length - 1]\n      nextCursor = Buffer.from(`${last.occurredAt}|${last.id}`).toString('base64')\n    }\n\n    return NextResponse.json({ items, nextCursor })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('sales.document-history.get failed', err)\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('sales.documents.history.error', 'Failed to load history.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst historyActorSchema = z.object({\n  id: z.string().uuid().nullable(),\n  label: z.string(),\n})\n\nconst historyEntrySchema = z.object({\n  id: z.string(),\n  occurredAt: z.string().datetime(),\n  kind: z.enum(['status', 'action', 'comment']),\n  action: z.string(),\n  actor: historyActorSchema,\n  source: z.enum(['action_log', 'note']),\n  metadata: z.object({\n    statusFrom: z.string().nullable().optional(),\n    statusTo: z.string().nullable().optional(),\n    documentKind: z.enum(['order', 'quote']).optional(),\n    commandId: z.string().optional(),\n  }).optional(),\n})\n\nconst documentHistoryResponseSchema = z.object({\n  items: z.array(historyEntrySchema),\n  nextCursor: z.string().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Get document change history',\n  methods: {\n    GET: {\n      summary: 'List history entries for an order or quote',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'History entries', schema: documentHistoryResponseSchema },\n        { status: 400, description: 'Invalid query', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Document not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oBAAoB;AAI7B,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,0BAA0B;AAI5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAID,MAAM,gBAAuD,oBAAI,IAAI,CAAC,UAAU,UAAU,SAAS,CAAC;AAE7F,SAAS,0BAA0B,OAAiE;AACzG,QAAM,MAAM,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,oBAAI,IAAI;AACzB,QAAM,SAAS,IACZ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY,CAAC,EACvC,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAM,SAAS,oBAAI,IAA8B;AACjD,SAAO,QAAQ,CAAC,UAAU;AACxB,QAAI,cAAc,IAAI,KAAiC,GAAG;AACxD,aAAO,IAAI,KAAiC;AAAA,IAC9C;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AAEpE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,MACrG,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,SAAS,UAAU,gBAAgB;AAE9D,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/C,iBAAiB,KAAK;AAAA,QACpB,UAAU,KAAK;AAAA,QACf;AAAA,QACA;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,gBAAgB;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAAA,QAChD,OAAO,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,UAAU,KAAK;AAAA,UACf;AAAA,UACA,WAAW;AAAA,QACb;AAAA,QACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,QACjC,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,MAC5C;AAAA,IACF,CAAC;AACD,UAAM,OAAO,cAAc;AAE3B,UAAM,aAAa;AAAA,MACjB,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,MAChE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,IACpE;AAEA,UAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,MACpD,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,MACZ,iBAAiB,CAAC;AAAA,IACpB,CAAC;AAED,QAAI,QAAQ,oBAAoB,EAAE,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,cAAc,YAAY,MAAM,CAAC;AAC9G,UAAM,cAAc,0BAA0B,MAAM,KAAK;AACzD,QAAI,YAAY,OAAO,GAAG;AACxB,cAAQ,MAAM,OAAO,CAAC,UAAU,YAAY,IAAI,MAAM,IAAgC,CAAC;AAAA,IACzF;AAEA,QAAI,aAAiC;AACrC,QAAI,KAAK,WAAW,MAAM,SAAS,MAAM,SAAS,GAAG;AACnD,YAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,mBAAa,OAAO,KAAK,GAAG,KAAK,UAAU,IAAI,KAAK,EAAE,EAAE,EAAE,SAAS,QAAQ;AAAA,IAC7E;AAEA,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,EAChD,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,qCAAqC,GAAG;AACtD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE;AAAA,MAC/E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAAA,EAC5C,QAAQ,EAAE,OAAO;AAAA,EACjB,OAAO;AAAA,EACP,QAAQ,EAAE,KAAK,CAAC,cAAc,MAAM,CAAC;AAAA,EACrC,UAAU,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACzC,cAAc,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,IAClD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EAAE,SAAS;AACd,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,8BAA8B;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/document-numbers/route.js CHANGED Viewed

@@ -4,7 +4,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { documentNumberRequestSchema } from "../../data/validators.js";
 import { withScopedPayload } from "../utils.js";
 const metadata = {
@@ -78,7 +78,7 @@ async function POST(req) {
       sequence: result.sequence
     });
   } catch (err) {
-    if (err instanceof CrudHttpError) {
+    if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
     const { translate } = await resolveTranslations();

package/dist/modules/sales/api/document-numbers/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/api/document-numbers/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { documentNumberRequestSchema } from '../../data/validators'\nimport { withScopedPayload } from '../utils'\nimport { SalesDocumentNumberGenerator } from '../../services/salesDocumentNumberGenerator'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n  translate: (key: string, fallback?: string) => string\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx, translate }\n}\n\nasync function ensureKindPermission(\n  ctx: CommandRuntimeContext,\n  kind: 'order' | 'quote' | 'invoice' | 'credit_memo',\n  translate: (key: string, fallback?: string) => string\n) {\n  const rbac = ctx.container.resolve('rbacService') as RbacService | null\n  const auth = ctx.auth\n  if (!rbac || !auth?.sub) return\n  const kindFeatureMap: Record<string, string> = {\n    order: 'sales.orders.manage',\n    quote: 'sales.quotes.manage',\n    invoice: 'sales.invoices.manage',\n    credit_memo: 'sales.credit_memos.manage',\n  }\n  const requiredFeatures = [\n    kindFeatureMap[kind] ?? 'sales.orders.manage',\n    'sales.documents.number.edit',\n  ]\n  const ok = await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,\n  })\n  if (!ok) {\n    throw new CrudHttpError(403, {\n      error: translate('sales.documents.errors.number_forbidden', 'You cannot generate document numbers.'),\n    })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await resolveRequestContext(req)\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload, ctx, translate)\n    const input = documentNumberRequestSchema.parse(scoped)\n    await ensureKindPermission(ctx, input.kind, translate)\n\n    const generator = ctx.container.resolve('salesDocumentNumberGenerator') as SalesDocumentNumberGenerator\n    const result = await generator.generate({\n      kind: input.kind,\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      format: input.format,\n    })\n\n    return NextResponse.json({\n      number: result.number,\n      format: result.format,\n      sequence: result.sequence,\n    })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.document-numbers.generate failed', err)\n    return NextResponse.json(\n      { error: translate('sales.documents.errors.number_generate_failed', 'Failed to generate document number.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Generate sales document number',\n  methods: {\n    POST: {\n      summary: 'Generate next number',\n      description: 'Generates the next sales order or quote number using configured formatting rules.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: documentNumberRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Generated number',\n          schema: z.object({\n            number: z.string(),\n            format: z.string(),\n            sequence: z.number(),\n          }),\n        },\n        { status: 400, description: 'Invalid input or scope missing', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAG9B,SAAS,mCAAmC;AAC5C,SAAS,yBAAyB;AAG3B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAOA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAe,qBACb,KACA,MACA,WACA;AACA,QAAM,OAAO,IAAI,UAAU,QAAQ,aAAa;AAChD,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,MAAM,IAAK;AACzB,QAAM,iBAAyC;AAAA,IAC7C,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACA,QAAM,mBAAmB;AAAA,IACvB,eAAe,IAAI,KAAK;AAAA,IACxB;AAAA,EACF;AACA,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,IACnE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,IAAI,0BAA0B,KAAK,SAAS;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,2CAA2C,uCAAuC;AAAA,IACrG,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,sBAAsB,GAAG;AAC1D,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,SAAS,KAAK,SAAS;AACxD,UAAM,QAAQ,4BAA4B,MAAM,MAAM;AACtD,UAAM,qBAAqB,KAAK,MAAM,MAAM,SAAS;AAErD,UAAM,YAAY,IAAI,UAAU,QAAQ,8BAA8B;AACtE,UAAM,SAAS,MAAM,UAAU,SAAS;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,IAChB,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,0CAA0C,GAAG;AAC3D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iDAAiD,qCAAqC,EAAE;AAAA,MAC3G,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,QAAQ,EAAE,OAAO;AAAA,YACjB,QAAQ,EAAE,OAAO;AAAA,YACjB,UAAU,EAAE,OAAO;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { documentNumberRequestSchema } from '../../data/validators'\nimport { withScopedPayload } from '../utils'\nimport { SalesDocumentNumberGenerator } from '../../services/salesDocumentNumberGenerator'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n  translate: (key: string, fallback?: string) => string\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx, translate }\n}\n\nasync function ensureKindPermission(\n  ctx: CommandRuntimeContext,\n  kind: 'order' | 'quote' | 'invoice' | 'credit_memo',\n  translate: (key: string, fallback?: string) => string\n) {\n  const rbac = ctx.container.resolve('rbacService') as RbacService | null\n  const auth = ctx.auth\n  if (!rbac || !auth?.sub) return\n  const kindFeatureMap: Record<string, string> = {\n    order: 'sales.orders.manage',\n    quote: 'sales.quotes.manage',\n    invoice: 'sales.invoices.manage',\n    credit_memo: 'sales.credit_memos.manage',\n  }\n  const requiredFeatures = [\n    kindFeatureMap[kind] ?? 'sales.orders.manage',\n    'sales.documents.number.edit',\n  ]\n  const ok = await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,\n  })\n  if (!ok) {\n    throw new CrudHttpError(403, {\n      error: translate('sales.documents.errors.number_forbidden', 'You cannot generate document numbers.'),\n    })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await resolveRequestContext(req)\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload, ctx, translate)\n    const input = documentNumberRequestSchema.parse(scoped)\n    await ensureKindPermission(ctx, input.kind, translate)\n\n    const generator = ctx.container.resolve('salesDocumentNumberGenerator') as SalesDocumentNumberGenerator\n    const result = await generator.generate({\n      kind: input.kind,\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      format: input.format,\n    })\n\n    return NextResponse.json({\n      number: result.number,\n      format: result.format,\n      sequence: result.sequence,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.document-numbers.generate failed', err)\n    return NextResponse.json(\n      { error: translate('sales.documents.errors.number_generate_failed', 'Failed to generate document number.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Generate sales document number',\n  methods: {\n    POST: {\n      summary: 'Generate next number',\n      description: 'Generates the next sales order or quote number using configured formatting rules.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: documentNumberRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Generated number',\n          schema: z.object({\n            number: z.string(),\n            format: z.string(),\n            sequence: z.number(),\n          }),\n        },\n        { status: 400, description: 'Invalid input or scope missing', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAG/C,SAAS,mCAAmC;AAC5C,SAAS,yBAAyB;AAG3B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAOA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAe,qBACb,KACA,MACA,WACA;AACA,QAAM,OAAO,IAAI,UAAU,QAAQ,aAAa;AAChD,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,MAAM,IAAK;AACzB,QAAM,iBAAyC;AAAA,IAC7C,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACA,QAAM,mBAAmB;AAAA,IACvB,eAAe,IAAI,KAAK;AAAA,IACxB;AAAA,EACF;AACA,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,IACnE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,IAAI,0BAA0B,KAAK,SAAS;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,2CAA2C,uCAAuC;AAAA,IACrG,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,sBAAsB,GAAG;AAC1D,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,SAAS,KAAK,SAAS;AACxD,UAAM,QAAQ,4BAA4B,MAAM,MAAM;AACtD,UAAM,qBAAqB,KAAK,MAAM,MAAM,SAAS;AAErD,UAAM,YAAY,IAAI,UAAU,QAAQ,8BAA8B;AACtE,UAAM,SAAS,MAAM,UAAU,SAAS;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,IAChB,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,0CAA0C,GAAG;AAC3D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iDAAiD,qCAAqC,EAAE;AAAA,MAC3G,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,QAAQ,EAAE,OAAO;AAAA,YACjB,QAAQ,EAAE,OAAO;AAAA,YACjB,UAAU,EAAE,OAAO;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/quotes/accept/route.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { LockMode } from "@mikro-orm/core";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -154,7 +154,7 @@ async function POST(req) {
     }
     return NextResponse.json({ orderId, orderNumber });
   } catch (err) {
-    if (err instanceof CrudHttpError) {
+    if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
     const { translate } = await resolveTranslations();

package/dist/modules/sales/api/quotes/accept/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/sales/api/quotes/accept/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkRateLimit, getClientIp, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { validateSameOriginMutationRequest } from './originGuard'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { SalesOrder, SalesQuote } from '../../../data/entities'\nimport { quoteAcceptSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteAcceptedAdminEmail } from '../../../emails/QuoteAcceptedAdminEmail'\n\ntype ConvertToOrderResult = {\n  result?: { orderId?: string } | null\n  orderId?: string\n}\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nconst quoteAcceptRateLimitConfig = readEndpointRateLimitConfig('SALES_QUOTES_ACCEPT', {\n  points: 10,\n  duration: 60,\n  blockDuration: 300,\n  keyPrefix: 'sales_quote_accept',\n})\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const sameOriginViolation = validateSameOriginMutationRequest(req)\n    if (sameOriginViolation) {\n      return NextResponse.json(\n        { error: translate('sales.quotes.accept.forbidden', 'Cross-site quote acceptance is not allowed.') },\n        { status: 403 },\n      )\n    }\n\n    const rateLimiterService = getCachedRateLimiterService()\n    const clientIp = rateLimiterService ? getClientIp(req, rateLimiterService.trustProxyDepth) : null\n    if (rateLimiterService && clientIp) {\n      const rateLimitResponse = await checkRateLimit(\n        rateLimiterService,\n        quoteAcceptRateLimitConfig,\n        clientIp,\n        translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),\n      )\n      if (rateLimitResponse) return rateLimitResponse\n    }\n\n    const { token } = quoteAcceptSchema.parse(await req.json().catch(() => ({})))\n    const auth = await getAuthFromRequest(req)\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const hashedToken = hashAuthToken(token)\n    const tenantScope = auth?.tenantId ? { tenantId: auth.tenantId } : undefined\n\n    const quote = await em.transactional(async (trx) => {\n      const findQuoteByToken = (acceptanceToken: string) =>\n        findOneWithDecryption(\n          trx,\n          SalesQuote,\n          {\n            acceptanceToken,\n            ...(auth?.tenantId ? { tenantId: auth.tenantId } : {}),\n            deletedAt: null,\n          },\n          { lockMode: LockMode.PESSIMISTIC_WRITE },\n          tenantScope,\n        )\n      const quote = (await findQuoteByToken(hashedToken)) ?? (await findQuoteByToken(token))\n      if (!quote) {\n        throw new CrudHttpError(404, { error: translate('sales.quotes.accept.notFound', 'Quote not found.') })\n      }\n\n      const now = new Date()\n      if (quote.validUntil && quote.validUntil.getTime() < now.getTime()) {\n        throw new CrudHttpError(400, { error: translate('sales.quotes.accept.expired', 'This quote has expired.') })\n      }\n\n      if ((quote.status ?? null) !== 'sent') {\n        throw new CrudHttpError(400, {\n          error: translate('sales.quotes.accept.invalidStatus', 'This quote cannot be accepted in its current status.'),\n        })\n      }\n\n      quote.status = 'confirmed'\n      quote.statusEntryId = await resolveStatusEntryIdByValue(trx, {\n        tenantId: quote.tenantId,\n        organizationId: quote.organizationId,\n        value: 'confirmed',\n      })\n      quote.updatedAt = now\n      trx.persist(quote)\n      await trx.flush()\n\n      return quote\n    })\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth: null,\n      organizationScope: null,\n      selectedOrganizationId: quote.organizationId,\n      organizationIds: [quote.organizationId],\n      request: req,\n    }\n\n    let result: ConvertToOrderResult | null\n    try {\n      result = (await commandBus.execute('sales.quotes.convert_to_order', { input: { quoteId: quote.id }, ctx })) as ConvertToOrderResult | null\n    } catch (conversionError) {\n      const freshEm = (container.resolve('em') as EntityManager).fork()\n      const staleQuote = await findOneWithDecryption(\n        freshEm,\n        SalesQuote,\n        { id: quote.id, deletedAt: null },\n        {},\n        tenantScope,\n      )\n      if (staleQuote) {\n        staleQuote.status = 'sent'\n        staleQuote.statusEntryId = await resolveStatusEntryIdByValue(freshEm, {\n          tenantId: staleQuote.tenantId,\n          organizationId: staleQuote.organizationId,\n          value: 'sent',\n        })\n        staleQuote.updatedAt = new Date()\n        freshEm.persist(staleQuote)\n        await freshEm.flush()\n      }\n      throw conversionError\n    }\n    const orderId = result?.result?.orderId ?? result?.orderId ?? quote.id\n\n    const order = await findOneWithDecryption(em, SalesOrder, { id: orderId, deletedAt: null }, {}, tenantScope)\n    const orderNumber = order?.orderNumber ?? orderId\n\n    // Admin notification should not block acceptance.\n    const adminEmail = process.env.ADMIN_EMAIL || ''\n    if (adminEmail) {\n      try {\n        const appUrl = process.env.APP_URL || ''\n        const orderUrl = appUrl ? `${appUrl.replace(/\\/$/, '')}/backend/sales/orders/${orderId}` : `/backend/sales/orders/${orderId}`\n\n        const copy = {\n          preview: translate('sales.quotes.accept.adminEmail.preview', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          heading: translate('sales.quotes.accept.adminEmail.heading', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          body: translate('sales.quotes.accept.adminEmail.body', 'The customer accepted quote {quoteNumber}. An order has been created: {orderNumber}.', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          cta: translate('sales.quotes.accept.adminEmail.cta', 'View order'),\n          footer: translate('sales.quotes.accept.adminEmail.footer', 'Open Mercato'),\n        }\n\n        await sendEmail({\n          to: adminEmail,\n          subject: translate('sales.quotes.accept.adminSubject', 'Quote {quoteNumber} accepted \u2192 Order {orderNumber}', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          react: QuoteAcceptedAdminEmail({ orderUrl, copy }),\n        })\n      } catch (err) {\n        console.error('sales.quotes.accept.adminEmail failed', err)\n      }\n    }\n\n    return NextResponse.json({ orderId, orderNumber })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.quotes.accept failed', err)\n    return NextResponse.json({ error: translate('sales.quotes.accept.failed', 'Failed to accept quote.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Accept a quote (public)',\n  methods: {\n    POST: {\n      summary: 'Accept quote and convert to order',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteAcceptSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Quote accepted and order created',\n          schema: z.object({ orderId: z.string().uuid(), orderNumber: z.string() }),\n        },\n        { status: 400, description: 'Invalid or expired quote', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Cross-site request rejected', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Quote not found', schema: z.object({ error: z.string() }) },\n        { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAG9B,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,mCAAmC;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,gBAAgB,aAAa,4BAA4B;AAClE,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,YAAY,kBAAkB;AACvC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,+BAA+B;AAOjC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,6BAA6B,4BAA4B,uBAAuB;AAAA,EACpF,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AACb,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,sBAAsB,kCAAkC,GAAG;AACjE,QAAI,qBAAqB;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,iCAAiC,6CAA6C,EAAE;AAAA,QACnG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,qBAAqB,4BAA4B;AACvD,UAAM,WAAW,qBAAqB,YAAY,KAAK,mBAAmB,eAAe,IAAI;AAC7F,QAAI,sBAAsB,UAAU;AAClC,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU,wBAAwB,4CAA4C;AAAA,MAChF;AACA,UAAI,kBAAmB,QAAO;AAAA,IAChC;AAEA,UAAM,EAAE,MAAM,IAAI,kBAAkB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC5E,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,cAAc,MAAM,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI;AAEnE,UAAM,QAAQ,MAAM,GAAG,cAAc,OAAO,QAAQ;AAClD,YAAM,mBAAmB,CAAC,oBACxB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,GAAI,MAAM,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,UACpD,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACF,YAAMA,SAAS,MAAM,iBAAiB,WAAW,KAAO,MAAM,iBAAiB,KAAK;AACpF,UAAI,CAACA,QAAO;AACV,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gCAAgC,kBAAkB,EAAE,CAAC;AAAA,MACvG;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,UAAIA,OAAM,cAAcA,OAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ,GAAG;AAClE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,+BAA+B,yBAAyB,EAAE,CAAC;AAAA,MAC7G;AAEA,WAAKA,OAAM,UAAU,UAAU,QAAQ;AACrC,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,qCAAqC,sDAAsD;AAAA,QAC9G,CAAC;AAAA,MACH;AAEA,MAAAA,OAAM,SAAS;AACf,MAAAA,OAAM,gBAAgB,MAAM,4BAA4B,KAAK;AAAA,QAC3D,UAAUA,OAAM;AAAA,QAChB,gBAAgBA,OAAM;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,MAAAA,OAAM,YAAY;AAClB,UAAI,QAAQA,MAAK;AACjB,YAAM,IAAI,MAAM;AAEhB,aAAOA;AAAA,IACT,CAAC;AAED,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,CAAC,MAAM,cAAc;AAAA,MACtC,SAAS;AAAA,IACX;AAEA,QAAI;AACJ,QAAI;AACF,eAAU,MAAM,WAAW,QAAQ,iCAAiC,EAAE,OAAO,EAAE,SAAS,MAAM,GAAG,GAAG,IAAI,CAAC;AAAA,IAC3G,SAAS,iBAAiB;AACxB,YAAM,UAAW,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAChE,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,MAAM,IAAI,WAAW,KAAK;AAAA,QAChC,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,YAAY;AACd,mBAAW,SAAS;AACpB,mBAAW,gBAAgB,MAAM,4BAA4B,SAAS;AAAA,UACpE,UAAU,WAAW;AAAA,UACrB,gBAAgB,WAAW;AAAA,UAC3B,OAAO;AAAA,QACT,CAAC;AACD,mBAAW,YAAY,oBAAI,KAAK;AAChC,gBAAQ,QAAQ,UAAU;AAC1B,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,YAAM;AAAA,IACR;AACA,UAAM,UAAU,QAAQ,QAAQ,WAAW,QAAQ,WAAW,MAAM;AAEpE,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AAC3G,UAAM,cAAc,OAAO,eAAe;AAG1C,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,QAAI,YAAY;AACd,UAAI;AACF,cAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,cAAM,WAAW,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,yBAAyB,OAAO,KAAK,yBAAyB,OAAO;AAE3H,cAAM,OAAO;AAAA,UACX,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,MAAM,UAAU,uCAAuC,wFAAwF;AAAA,YAC7I,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,KAAK,UAAU,sCAAsC,YAAY;AAAA,UACjE,QAAQ,UAAU,yCAAyC,cAAc;AAAA,QAC3E;AAEA,cAAM,UAAU;AAAA,UACd,IAAI;AAAA,UACJ,SAAS,UAAU,oCAAoC,2DAAsD;AAAA,YAC3G,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,OAAO,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAAA,QACnD,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ,MAAM,yCAAyC,GAAG;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,YAAY,CAAC;AAAA,EACnD,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,8BAA8B,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC;AAAA,QAC1E;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkRateLimit, getClientIp, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { validateSameOriginMutationRequest } from './originGuard'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { SalesOrder, SalesQuote } from '../../../data/entities'\nimport { quoteAcceptSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteAcceptedAdminEmail } from '../../../emails/QuoteAcceptedAdminEmail'\n\ntype ConvertToOrderResult = {\n  result?: { orderId?: string } | null\n  orderId?: string\n}\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nconst quoteAcceptRateLimitConfig = readEndpointRateLimitConfig('SALES_QUOTES_ACCEPT', {\n  points: 10,\n  duration: 60,\n  blockDuration: 300,\n  keyPrefix: 'sales_quote_accept',\n})\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const sameOriginViolation = validateSameOriginMutationRequest(req)\n    if (sameOriginViolation) {\n      return NextResponse.json(\n        { error: translate('sales.quotes.accept.forbidden', 'Cross-site quote acceptance is not allowed.') },\n        { status: 403 },\n      )\n    }\n\n    const rateLimiterService = getCachedRateLimiterService()\n    const clientIp = rateLimiterService ? getClientIp(req, rateLimiterService.trustProxyDepth) : null\n    if (rateLimiterService && clientIp) {\n      const rateLimitResponse = await checkRateLimit(\n        rateLimiterService,\n        quoteAcceptRateLimitConfig,\n        clientIp,\n        translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),\n      )\n      if (rateLimitResponse) return rateLimitResponse\n    }\n\n    const { token } = quoteAcceptSchema.parse(await req.json().catch(() => ({})))\n    const auth = await getAuthFromRequest(req)\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const hashedToken = hashAuthToken(token)\n    const tenantScope = auth?.tenantId ? { tenantId: auth.tenantId } : undefined\n\n    const quote = await em.transactional(async (trx) => {\n      const findQuoteByToken = (acceptanceToken: string) =>\n        findOneWithDecryption(\n          trx,\n          SalesQuote,\n          {\n            acceptanceToken,\n            ...(auth?.tenantId ? { tenantId: auth.tenantId } : {}),\n            deletedAt: null,\n          },\n          { lockMode: LockMode.PESSIMISTIC_WRITE },\n          tenantScope,\n        )\n      const quote = (await findQuoteByToken(hashedToken)) ?? (await findQuoteByToken(token))\n      if (!quote) {\n        throw new CrudHttpError(404, { error: translate('sales.quotes.accept.notFound', 'Quote not found.') })\n      }\n\n      const now = new Date()\n      if (quote.validUntil && quote.validUntil.getTime() < now.getTime()) {\n        throw new CrudHttpError(400, { error: translate('sales.quotes.accept.expired', 'This quote has expired.') })\n      }\n\n      if ((quote.status ?? null) !== 'sent') {\n        throw new CrudHttpError(400, {\n          error: translate('sales.quotes.accept.invalidStatus', 'This quote cannot be accepted in its current status.'),\n        })\n      }\n\n      quote.status = 'confirmed'\n      quote.statusEntryId = await resolveStatusEntryIdByValue(trx, {\n        tenantId: quote.tenantId,\n        organizationId: quote.organizationId,\n        value: 'confirmed',\n      })\n      quote.updatedAt = now\n      trx.persist(quote)\n      await trx.flush()\n\n      return quote\n    })\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth: null,\n      organizationScope: null,\n      selectedOrganizationId: quote.organizationId,\n      organizationIds: [quote.organizationId],\n      request: req,\n    }\n\n    let result: ConvertToOrderResult | null\n    try {\n      result = (await commandBus.execute('sales.quotes.convert_to_order', { input: { quoteId: quote.id }, ctx })) as ConvertToOrderResult | null\n    } catch (conversionError) {\n      const freshEm = (container.resolve('em') as EntityManager).fork()\n      const staleQuote = await findOneWithDecryption(\n        freshEm,\n        SalesQuote,\n        { id: quote.id, deletedAt: null },\n        {},\n        tenantScope,\n      )\n      if (staleQuote) {\n        staleQuote.status = 'sent'\n        staleQuote.statusEntryId = await resolveStatusEntryIdByValue(freshEm, {\n          tenantId: staleQuote.tenantId,\n          organizationId: staleQuote.organizationId,\n          value: 'sent',\n        })\n        staleQuote.updatedAt = new Date()\n        freshEm.persist(staleQuote)\n        await freshEm.flush()\n      }\n      throw conversionError\n    }\n    const orderId = result?.result?.orderId ?? result?.orderId ?? quote.id\n\n    const order = await findOneWithDecryption(em, SalesOrder, { id: orderId, deletedAt: null }, {}, tenantScope)\n    const orderNumber = order?.orderNumber ?? orderId\n\n    // Admin notification should not block acceptance.\n    const adminEmail = process.env.ADMIN_EMAIL || ''\n    if (adminEmail) {\n      try {\n        const appUrl = process.env.APP_URL || ''\n        const orderUrl = appUrl ? `${appUrl.replace(/\\/$/, '')}/backend/sales/orders/${orderId}` : `/backend/sales/orders/${orderId}`\n\n        const copy = {\n          preview: translate('sales.quotes.accept.adminEmail.preview', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          heading: translate('sales.quotes.accept.adminEmail.heading', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          body: translate('sales.quotes.accept.adminEmail.body', 'The customer accepted quote {quoteNumber}. An order has been created: {orderNumber}.', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          cta: translate('sales.quotes.accept.adminEmail.cta', 'View order'),\n          footer: translate('sales.quotes.accept.adminEmail.footer', 'Open Mercato'),\n        }\n\n        await sendEmail({\n          to: adminEmail,\n          subject: translate('sales.quotes.accept.adminSubject', 'Quote {quoteNumber} accepted \u2192 Order {orderNumber}', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          react: QuoteAcceptedAdminEmail({ orderUrl, copy }),\n        })\n      } catch (err) {\n        console.error('sales.quotes.accept.adminEmail failed', err)\n      }\n    }\n\n    return NextResponse.json({ orderId, orderNumber })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.quotes.accept failed', err)\n    return NextResponse.json({ error: translate('sales.quotes.accept.failed', 'Failed to accept quote.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Accept a quote (public)',\n  methods: {\n    POST: {\n      summary: 'Accept quote and convert to order',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteAcceptSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Quote accepted and order created',\n          schema: z.object({ orderId: z.string().uuid(), orderNumber: z.string() }),\n        },\n        { status: 400, description: 'Invalid or expired quote', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Cross-site request rejected', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Quote not found', schema: z.object({ error: z.string() }) },\n        { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAG/C,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,mCAAmC;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,gBAAgB,aAAa,4BAA4B;AAClE,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,YAAY,kBAAkB;AACvC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,+BAA+B;AAOjC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,6BAA6B,4BAA4B,uBAAuB;AAAA,EACpF,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AACb,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,sBAAsB,kCAAkC,GAAG;AACjE,QAAI,qBAAqB;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,iCAAiC,6CAA6C,EAAE;AAAA,QACnG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,qBAAqB,4BAA4B;AACvD,UAAM,WAAW,qBAAqB,YAAY,KAAK,mBAAmB,eAAe,IAAI;AAC7F,QAAI,sBAAsB,UAAU;AAClC,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU,wBAAwB,4CAA4C;AAAA,MAChF;AACA,UAAI,kBAAmB,QAAO;AAAA,IAChC;AAEA,UAAM,EAAE,MAAM,IAAI,kBAAkB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC5E,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,cAAc,MAAM,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI;AAEnE,UAAM,QAAQ,MAAM,GAAG,cAAc,OAAO,QAAQ;AAClD,YAAM,mBAAmB,CAAC,oBACxB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,GAAI,MAAM,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,UACpD,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACF,YAAMA,SAAS,MAAM,iBAAiB,WAAW,KAAO,MAAM,iBAAiB,KAAK;AACpF,UAAI,CAACA,QAAO;AACV,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gCAAgC,kBAAkB,EAAE,CAAC;AAAA,MACvG;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,UAAIA,OAAM,cAAcA,OAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ,GAAG;AAClE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,+BAA+B,yBAAyB,EAAE,CAAC;AAAA,MAC7G;AAEA,WAAKA,OAAM,UAAU,UAAU,QAAQ;AACrC,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,qCAAqC,sDAAsD;AAAA,QAC9G,CAAC;AAAA,MACH;AAEA,MAAAA,OAAM,SAAS;AACf,MAAAA,OAAM,gBAAgB,MAAM,4BAA4B,KAAK;AAAA,QAC3D,UAAUA,OAAM;AAAA,QAChB,gBAAgBA,OAAM;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,MAAAA,OAAM,YAAY;AAClB,UAAI,QAAQA,MAAK;AACjB,YAAM,IAAI,MAAM;AAEhB,aAAOA;AAAA,IACT,CAAC;AAED,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,CAAC,MAAM,cAAc;AAAA,MACtC,SAAS;AAAA,IACX;AAEA,QAAI;AACJ,QAAI;AACF,eAAU,MAAM,WAAW,QAAQ,iCAAiC,EAAE,OAAO,EAAE,SAAS,MAAM,GAAG,GAAG,IAAI,CAAC;AAAA,IAC3G,SAAS,iBAAiB;AACxB,YAAM,UAAW,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAChE,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,MAAM,IAAI,WAAW,KAAK;AAAA,QAChC,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,YAAY;AACd,mBAAW,SAAS;AACpB,mBAAW,gBAAgB,MAAM,4BAA4B,SAAS;AAAA,UACpE,UAAU,WAAW;AAAA,UACrB,gBAAgB,WAAW;AAAA,UAC3B,OAAO;AAAA,QACT,CAAC;AACD,mBAAW,YAAY,oBAAI,KAAK;AAChC,gBAAQ,QAAQ,UAAU;AAC1B,cAAM,QAAQ,MAAM;AAAA,MACtB;AACA,YAAM;AAAA,IACR;AACA,UAAM,UAAU,QAAQ,QAAQ,WAAW,QAAQ,WAAW,MAAM;AAEpE,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AAC3G,UAAM,cAAc,OAAO,eAAe;AAG1C,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,QAAI,YAAY;AACd,UAAI;AACF,cAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,cAAM,WAAW,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,yBAAyB,OAAO,KAAK,yBAAyB,OAAO;AAE3H,cAAM,OAAO;AAAA,UACX,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,MAAM,UAAU,uCAAuC,wFAAwF;AAAA,YAC7I,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,KAAK,UAAU,sCAAsC,YAAY;AAAA,UACjE,QAAQ,UAAU,yCAAyC,cAAc;AAAA,QAC3E;AAEA,cAAM,UAAU;AAAA,UACd,IAAI;AAAA,UACJ,SAAS,UAAU,oCAAoC,2DAAsD;AAAA,YAC3G,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,OAAO,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAAA,QACnD,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ,MAAM,yCAAyC,GAAG;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,YAAY,CAAC;AAAA,EACnD,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,8BAA8B,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC;AAAA,QAC1E;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["quote"]
 }

package/dist/modules/sales/api/quotes/convert/route.js CHANGED Viewed

@@ -5,7 +5,7 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import {
   bridgeLegacyGuard,
   runMutationGuards
@@ -118,7 +118,7 @@ async function POST(req) {
     }
     return jsonResponse;
   } catch (err) {
-    if (err instanceof CrudHttpError) {
+    if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
     const { translate } = await resolveTranslations();

package/dist/modules/sales/api/quotes/convert/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/sales/api/quotes/convert/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { withScopedPayload } from '../../utils'\n\nconst convertSchema = z.object({\n  quoteId: z.string().uuid(),\n  orderId: z.string().uuid().optional(),\n  orderNumber: z.string().trim().max(191).optional(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage', 'sales.orders.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = convertSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { quoteId: string; orderId?: string; orderNumber?: string },\n      { orderId: string }\n    >('sales.quotes.convert_to_order', { input, ctx })\n\n    const orderId = result?.orderId ?? input.orderId ?? input.quoteId\n    const jsonResponse = NextResponse.json({ orderId })\n\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      jsonResponse.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'sales.order',\n          resourceId: logEntry.resourceId ?? orderId,\n          executedAt: logEntry.createdAt instanceof Date\n            ? logEntry.createdAt.toISOString()\n            : typeof logEntry.createdAt === 'string'\n              ? logEntry.createdAt\n              : new Date().toISOString(),\n        })\n      )\n    }\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return jsonResponse\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.quotes.convert failed', err)\n    return NextResponse.json(\n      { error: translate('sales.documents.detail.convertError', 'Failed to convert quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst convertResponseSchema = z.object({\n  orderId: z.string().uuid(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Convert quote to order',\n  methods: {\n    POST: {\n      summary: 'Convert quote',\n      description: 'Creates a sales order from a quote and removes the original quote record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: convertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Conversion succeeded', schema: convertResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAE9B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yBAAyB;AAElC,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,qBAAqB,EAAE;AAC7F;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,cAAc,MAAM,MAAM;AACxC,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AACA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,iCAAiC,EAAE,OAAO,IAAI,CAAC;AAEjD,UAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,MAAM;AAC1D,UAAM,eAAe,aAAa,KAAK,EAAE,QAAQ,CAAC;AAElD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,mBAAa,QAAQ;AAAA,QACnB;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OACtC,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,uCAAuC,0BAA0B,EAAE;AAAA,MACtF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { withScopedPayload } from '../../utils'\n\nconst convertSchema = z.object({\n  quoteId: z.string().uuid(),\n  orderId: z.string().uuid().optional(),\n  orderNumber: z.string().trim().max(191).optional(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage', 'sales.orders.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = convertSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { quoteId: string; orderId?: string; orderNumber?: string },\n      { orderId: string }\n    >('sales.quotes.convert_to_order', { input, ctx })\n\n    const orderId = result?.orderId ?? input.orderId ?? input.quoteId\n    const jsonResponse = NextResponse.json({ orderId })\n\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      jsonResponse.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'sales.order',\n          resourceId: logEntry.resourceId ?? orderId,\n          executedAt: logEntry.createdAt instanceof Date\n            ? logEntry.createdAt.toISOString()\n            : typeof logEntry.createdAt === 'string'\n              ? logEntry.createdAt\n              : new Date().toISOString(),\n        })\n      )\n    }\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return jsonResponse\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.quotes.convert failed', err)\n    return NextResponse.json(\n      { error: translate('sales.documents.detail.convertError', 'Failed to convert quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst convertResponseSchema = z.object({\n  orderId: z.string().uuid(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Convert quote to order',\n  methods: {\n    POST: {\n      summary: 'Convert quote',\n      description: 'Creates a sales order from a quote and removes the original quote record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: convertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Conversion succeeded', schema: convertResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yBAAyB;AAElC,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,qBAAqB,EAAE;AAC7F;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,cAAc,MAAM,MAAM;AACxC,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AACA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,iCAAiC,EAAE,OAAO,IAAI,CAAC;AAEjD,UAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,MAAM;AAC1D,UAAM,eAAe,aAAa,KAAK,EAAE,QAAQ,CAAC;AAElD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,mBAAa,QAAQ;AAAA,QACnB;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OACtC,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,uCAAuC,0BAA0B,EAAE;AAAA,MACtF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/quotes/public/[token]/route.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { hashAuthToken } from "../../../../../auth/lib/tokenHash.js";
 import {
@@ -122,7 +122,7 @@ async function GET(req, ctx) {
       isExpired
     });
   } catch (err) {
-    if (err instanceof CrudHttpError) {
+    if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
     const { translate } = await resolveTranslations();

package/dist/modules/sales/api/quotes/public/[token]/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/sales/api/quotes/public/%5Btoken%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from \"next/server\";\nimport { z } from \"zod\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport { resolveTranslations } from \"@open-mercato/shared/lib/i18n/server\";\nimport { CrudHttpError } from \"@open-mercato/shared/lib/crud/errors\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { findOneWithDecryption, findWithDecryption } from \"@open-mercato/shared/lib/encryption/find\";\nimport { hashAuthToken } from \"../../../../../auth/lib/tokenHash\";\nimport {\n  SalesQuote,\n  SalesQuoteLine,\n  SalesQuoteAdjustment,\n} from \"../../../../data/entities\";\nimport { canonicalizeUnitCode } from \"@open-mercato/shared/lib/units/unitCodes\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\n\nconst paramsSchema = z.object({\n  token: z.string().uuid(),\n});\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(req: Request, ctx: { params: { token: string } }) {\n  try {\n    const { token } = paramsSchema.parse(ctx.params ?? {});\n    const container = await createRequestContainer();\n    const em = container.resolve(\"em\") as EntityManager;\n    const hashedToken = hashAuthToken(token);\n    const quote =\n      (await findOneWithDecryption(em, SalesQuote, {\n        acceptanceToken: hashedToken,\n        deletedAt: null,\n      })) ??\n      (await findOneWithDecryption(em, SalesQuote, {\n        acceptanceToken: token,\n        deletedAt: null,\n      }));\n    const { translate } = await resolveTranslations();\n    if (!quote) {\n      throw new CrudHttpError(404, {\n        error: translate(\"sales.quotes.public.notFound\", \"Quote not found.\"),\n      });\n    }\n\n    const auth = await getAuthFromRequest(req);\n    if (auth?.tenantId && quote.tenantId !== auth.tenantId) {\n      throw new CrudHttpError(404, {\n        error: translate(\"sales.quotes.public.notFound\", \"Quote not found.\"),\n      });\n    }\n\n    const now = new Date();\n    const isExpired =\n      !!quote.validUntil && quote.validUntil.getTime() < now.getTime();\n\n    const [lines, adjustments] = await Promise.all([\n      findWithDecryption(\n        em,\n        SalesQuoteLine,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId, deletedAt: null },\n        { orderBy: { lineNumber: \"asc\" } },\n      ),\n      findWithDecryption(\n        em,\n        SalesQuoteAdjustment,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId },\n        { orderBy: { position: \"asc\" } },\n      ),\n    ]);\n\n    return NextResponse.json({\n      quote: {\n        quoteNumber: quote.quoteNumber,\n        currencyCode: quote.currencyCode,\n        validFrom: quote.validFrom?.toISOString() ?? null,\n        validUntil: quote.validUntil?.toISOString() ?? null,\n        status: quote.status ?? null,\n        subtotalNetAmount: quote.subtotalNetAmount,\n        subtotalGrossAmount: quote.subtotalGrossAmount,\n        discountTotalAmount: quote.discountTotalAmount,\n        taxTotalAmount: quote.taxTotalAmount,\n        grandTotalNetAmount: quote.grandTotalNetAmount,\n        grandTotalGrossAmount: quote.grandTotalGrossAmount,\n      },\n      lines: lines.map((line) => ({\n        lineNumber: line.lineNumber ?? null,\n        kind: line.kind,\n        name: line.name ?? null,\n        description: line.description ?? null,\n        quantity: line.quantity,\n        quantityUnit: canonicalizeUnitCode(line.quantityUnit) ?? null,\n        normalizedQuantity: line.normalizedQuantity ?? line.quantity,\n        normalizedUnit:\n          canonicalizeUnitCode(line.normalizedUnit ?? line.quantityUnit) ??\n          null,\n        uomSnapshot: line.uomSnapshot\n          ? {\n              baseUnitCode: line.uomSnapshot.baseUnitCode ?? null,\n              enteredUnitCode: line.uomSnapshot.enteredUnitCode ?? null,\n            }\n          : null,\n        currencyCode: line.currencyCode,\n        unitPriceNet: line.unitPriceNet,\n        unitPriceGross: line.unitPriceGross,\n        discountAmount: line.discountAmount,\n        discountPercent: line.discountPercent,\n        taxRate: line.taxRate,\n        taxAmount: line.taxAmount,\n        totalNetAmount: line.totalNetAmount,\n        totalGrossAmount: line.totalGrossAmount,\n        unitPriceReference: (() => {\n          if (!line.uomSnapshot) return null;\n          const ref = line.uomSnapshot.unitPriceReference;\n          if (!ref) return null;\n          return {\n            enabled: ref.enabled ?? null,\n            referenceUnitCode: ref.referenceUnitCode ?? null,\n            baseQuantity: ref.baseQuantity ?? null,\n            grossPerReference: ref.grossPerReference ?? null,\n            netPerReference: ref.netPerReference ?? null,\n          };\n        })(),\n      })),\n      adjustments: adjustments.map((adj) => ({\n        scope: adj.scope,\n        kind: adj.kind,\n        label: adj.label ?? adj.code ?? null,\n        rate: adj.rate,\n        amountNet: adj.amountNet,\n        amountGross: adj.amountGross,\n        currencyCode: adj.currencyCode ?? null,\n        position: adj.position ?? null,\n        quoteLineId: adj.quoteLine?.id ?? null,\n      })),\n      isExpired,\n    });\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status });\n    }\n    const { translate } = await resolveTranslations();\n    console.error(\"sales.quotes.public failed\", err);\n    return NextResponse.json(\n      {\n        error: translate(\"sales.quotes.public.failed\", \"Failed to load quote.\"),\n      },\n      { status: 400 },\n    );\n  }\n}\n\nconst publicQuoteResponseSchema = z.object({\n  quote: z.object({\n    quoteNumber: z.string(),\n    currencyCode: z.string(),\n    validFrom: z.string().nullable(),\n    validUntil: z.string().nullable(),\n    status: z.string().nullable(),\n    subtotalNetAmount: z.string(),\n    subtotalGrossAmount: z.string(),\n    discountTotalAmount: z.string(),\n    taxTotalAmount: z.string(),\n    grandTotalNetAmount: z.string(),\n    grandTotalGrossAmount: z.string(),\n  }),\n  lines: z.array(\n    z.object({\n      lineNumber: z.number().nullable(),\n      kind: z.string(),\n      name: z.string().nullable(),\n      description: z.string().nullable(),\n      quantity: z.string(),\n      quantityUnit: z.string().nullable(),\n      normalizedQuantity: z.string(),\n      normalizedUnit: z.string().nullable(),\n      uomSnapshot: z\n        .object({\n          baseUnitCode: z.string().nullable(),\n          enteredUnitCode: z.string().nullable(),\n        })\n        .nullable()\n        .optional(),\n      currencyCode: z.string(),\n      unitPriceNet: z.string(),\n      unitPriceGross: z.string(),\n      discountAmount: z.string(),\n      discountPercent: z.string(),\n      taxRate: z.string(),\n      taxAmount: z.string(),\n      totalNetAmount: z.string(),\n      totalGrossAmount: z.string(),\n      unitPriceReference: z\n        .object({\n          enabled: z.boolean().nullable().optional(),\n          referenceUnitCode: z.string().nullable().optional(),\n          baseQuantity: z.string().nullable().optional(),\n          grossPerReference: z.string().nullable().optional(),\n          netPerReference: z.string().nullable().optional(),\n        })\n        .nullable()\n        .optional(),\n    }),\n  ),\n  adjustments: z.array(\n    z.object({\n      scope: z.string().nullable(),\n      kind: z.string().nullable(),\n      label: z.string().nullable(),\n      rate: z.string().nullable(),\n      amountNet: z.string().nullable(),\n      amountGross: z.string().nullable(),\n      currencyCode: z.string().nullable(),\n      position: z.number().nullable(),\n      quoteLineId: z.string().uuid().nullable(),\n    }),\n  ),\n  isExpired: z.boolean(),\n});\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: \"Sales\",\n  summary: \"View a quote (public)\",\n  pathParams: z.object({ token: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: \"Get quote details by acceptance token\",\n      responses: [\n        {\n          status: 200,\n          description: \"Quote details\",\n          schema: publicQuoteResponseSchema,\n        },\n        {\n          status: 404,\n          description: \"Quote not found\",\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n};\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAG9B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,0BAA0B;AAEnC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,KAAK;AACzB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IAAI,KAAc,KAAoC;AAC1E,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,aAAa,MAAM,IAAI,UAAU,CAAC,CAAC;AACrD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,QACH,MAAM,sBAAsB,IAAI,YAAY;AAAA,MAC3C,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC,KACA,MAAM,sBAAsB,IAAI,YAAY;AAAA,MAC3C,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC;AACH,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gCAAgC,kBAAkB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,MAAM,YAAY,MAAM,aAAa,KAAK,UAAU;AACtD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gCAAgC,kBAAkB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YACJ,CAAC,CAAC,MAAM,cAAc,MAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ;AAEjE,UAAM,CAAC,OAAO,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7C;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,QACnG,EAAE,SAAS,EAAE,YAAY,MAAM,EAAE;AAAA,MACnC;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,QAClF,EAAE,SAAS,EAAE,UAAU,MAAM,EAAE;AAAA,MACjC;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL,aAAa,MAAM;AAAA,QACnB,cAAc,MAAM;AAAA,QACpB,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,QAC7C,YAAY,MAAM,YAAY,YAAY,KAAK;AAAA,QAC/C,QAAQ,MAAM,UAAU;AAAA,QACxB,mBAAmB,MAAM;AAAA,QACzB,qBAAqB,MAAM;AAAA,QAC3B,qBAAqB,MAAM;AAAA,QAC3B,gBAAgB,MAAM;AAAA,QACtB,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,MAAM;AAAA,MAC/B;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,QAC1B,YAAY,KAAK,cAAc;AAAA,QAC/B,MAAM,KAAK;AAAA,QACX,MAAM,KAAK,QAAQ;AAAA,QACnB,aAAa,KAAK,eAAe;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,cAAc,qBAAqB,KAAK,YAAY,KAAK;AAAA,QACzD,oBAAoB,KAAK,sBAAsB,KAAK;AAAA,QACpD,gBACE,qBAAqB,KAAK,kBAAkB,KAAK,YAAY,KAC7D;AAAA,QACF,aAAa,KAAK,cACd;AAAA,UACE,cAAc,KAAK,YAAY,gBAAgB;AAAA,UAC/C,iBAAiB,KAAK,YAAY,mBAAmB;AAAA,QACvD,IACA;AAAA,QACJ,cAAc,KAAK;AAAA,QACnB,cAAc,KAAK;AAAA,QACnB,gBAAgB,KAAK;AAAA,QACrB,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB,SAAS,KAAK;AAAA,QACd,WAAW,KAAK;AAAA,QAChB,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,KAAK;AAAA,QACvB,qBAAqB,MAAM;AACzB,cAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,gBAAM,MAAM,KAAK,YAAY;AAC7B,cAAI,CAAC,IAAK,QAAO;AACjB,iBAAO;AAAA,YACL,SAAS,IAAI,WAAW;AAAA,YACxB,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,cAAc,IAAI,gBAAgB;AAAA,YAClC,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,iBAAiB,IAAI,mBAAmB;AAAA,UAC1C;AAAA,QACF,GAAG;AAAA,MACL,EAAE;AAAA,MACF,aAAa,YAAY,IAAI,CAAC,SAAS;AAAA,QACrC,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,OAAO,IAAI,SAAS,IAAI,QAAQ;AAAA,QAChC,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI,gBAAgB;AAAA,QAClC,UAAU,IAAI,YAAY;AAAA,QAC1B,aAAa,IAAI,WAAW,MAAM;AAAA,MACpC,EAAE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,UAAU,8BAA8B,uBAAuB;AAAA,MACxE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO;AAAA,IACd,aAAa,EAAE,OAAO;AAAA,IACtB,cAAc,EAAE,OAAO;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,mBAAmB,EAAE,OAAO;AAAA,IAC5B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,gBAAgB,EAAE,OAAO;AAAA,IACzB,qBAAqB,EAAE,OAAO;AAAA,IAC9B,uBAAuB,EAAE,OAAO;AAAA,EAClC,CAAC;AAAA,EACD,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,UAAU,EAAE,OAAO;AAAA,MACnB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,oBAAoB,EAAE,OAAO;AAAA,MAC7B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,MACpC,aAAa,EACV,OAAO;AAAA,QACN,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,QAClC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,MACvC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,MACZ,cAAc,EAAE,OAAO;AAAA,MACvB,cAAc,EAAE,OAAO;AAAA,MACvB,gBAAgB,EAAE,OAAO;AAAA,MACzB,gBAAgB,EAAE,OAAO;AAAA,MACzB,iBAAiB,EAAE,OAAO;AAAA,MAC1B,SAAS,EAAE,OAAO;AAAA,MAClB,WAAW,EAAE,OAAO;AAAA,MACpB,gBAAgB,EAAE,OAAO;AAAA,MACzB,kBAAkB,EAAE,OAAO;AAAA,MAC3B,oBAAoB,EACjB,OAAO;AAAA,QACN,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,QACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAC7C,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAClD,CAAC,EACA,SAAS,EACT,SAAS;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EACA,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA,EACA,WAAW,EAAE,QAAQ;AACvB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACjD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from \"next/server\";\nimport { z } from \"zod\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport { resolveTranslations } from \"@open-mercato/shared/lib/i18n/server\";\nimport { CrudHttpError, isCrudHttpError } from \"@open-mercato/shared/lib/crud/errors\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { findOneWithDecryption, findWithDecryption } from \"@open-mercato/shared/lib/encryption/find\";\nimport { hashAuthToken } from \"../../../../../auth/lib/tokenHash\";\nimport {\n  SalesQuote,\n  SalesQuoteLine,\n  SalesQuoteAdjustment,\n} from \"../../../../data/entities\";\nimport { canonicalizeUnitCode } from \"@open-mercato/shared/lib/units/unitCodes\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\n\nconst paramsSchema = z.object({\n  token: z.string().uuid(),\n});\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(req: Request, ctx: { params: { token: string } }) {\n  try {\n    const { token } = paramsSchema.parse(ctx.params ?? {});\n    const container = await createRequestContainer();\n    const em = container.resolve(\"em\") as EntityManager;\n    const hashedToken = hashAuthToken(token);\n    const quote =\n      (await findOneWithDecryption(em, SalesQuote, {\n        acceptanceToken: hashedToken,\n        deletedAt: null,\n      })) ??\n      (await findOneWithDecryption(em, SalesQuote, {\n        acceptanceToken: token,\n        deletedAt: null,\n      }));\n    const { translate } = await resolveTranslations();\n    if (!quote) {\n      throw new CrudHttpError(404, {\n        error: translate(\"sales.quotes.public.notFound\", \"Quote not found.\"),\n      });\n    }\n\n    const auth = await getAuthFromRequest(req);\n    if (auth?.tenantId && quote.tenantId !== auth.tenantId) {\n      throw new CrudHttpError(404, {\n        error: translate(\"sales.quotes.public.notFound\", \"Quote not found.\"),\n      });\n    }\n\n    const now = new Date();\n    const isExpired =\n      !!quote.validUntil && quote.validUntil.getTime() < now.getTime();\n\n    const [lines, adjustments] = await Promise.all([\n      findWithDecryption(\n        em,\n        SalesQuoteLine,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId, deletedAt: null },\n        { orderBy: { lineNumber: \"asc\" } },\n      ),\n      findWithDecryption(\n        em,\n        SalesQuoteAdjustment,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId },\n        { orderBy: { position: \"asc\" } },\n      ),\n    ]);\n\n    return NextResponse.json({\n      quote: {\n        quoteNumber: quote.quoteNumber,\n        currencyCode: quote.currencyCode,\n        validFrom: quote.validFrom?.toISOString() ?? null,\n        validUntil: quote.validUntil?.toISOString() ?? null,\n        status: quote.status ?? null,\n        subtotalNetAmount: quote.subtotalNetAmount,\n        subtotalGrossAmount: quote.subtotalGrossAmount,\n        discountTotalAmount: quote.discountTotalAmount,\n        taxTotalAmount: quote.taxTotalAmount,\n        grandTotalNetAmount: quote.grandTotalNetAmount,\n        grandTotalGrossAmount: quote.grandTotalGrossAmount,\n      },\n      lines: lines.map((line) => ({\n        lineNumber: line.lineNumber ?? null,\n        kind: line.kind,\n        name: line.name ?? null,\n        description: line.description ?? null,\n        quantity: line.quantity,\n        quantityUnit: canonicalizeUnitCode(line.quantityUnit) ?? null,\n        normalizedQuantity: line.normalizedQuantity ?? line.quantity,\n        normalizedUnit:\n          canonicalizeUnitCode(line.normalizedUnit ?? line.quantityUnit) ??\n          null,\n        uomSnapshot: line.uomSnapshot\n          ? {\n              baseUnitCode: line.uomSnapshot.baseUnitCode ?? null,\n              enteredUnitCode: line.uomSnapshot.enteredUnitCode ?? null,\n            }\n          : null,\n        currencyCode: line.currencyCode,\n        unitPriceNet: line.unitPriceNet,\n        unitPriceGross: line.unitPriceGross,\n        discountAmount: line.discountAmount,\n        discountPercent: line.discountPercent,\n        taxRate: line.taxRate,\n        taxAmount: line.taxAmount,\n        totalNetAmount: line.totalNetAmount,\n        totalGrossAmount: line.totalGrossAmount,\n        unitPriceReference: (() => {\n          if (!line.uomSnapshot) return null;\n          const ref = line.uomSnapshot.unitPriceReference;\n          if (!ref) return null;\n          return {\n            enabled: ref.enabled ?? null,\n            referenceUnitCode: ref.referenceUnitCode ?? null,\n            baseQuantity: ref.baseQuantity ?? null,\n            grossPerReference: ref.grossPerReference ?? null,\n            netPerReference: ref.netPerReference ?? null,\n          };\n        })(),\n      })),\n      adjustments: adjustments.map((adj) => ({\n        scope: adj.scope,\n        kind: adj.kind,\n        label: adj.label ?? adj.code ?? null,\n        rate: adj.rate,\n        amountNet: adj.amountNet,\n        amountGross: adj.amountGross,\n        currencyCode: adj.currencyCode ?? null,\n        position: adj.position ?? null,\n        quoteLineId: adj.quoteLine?.id ?? null,\n      })),\n      isExpired,\n    });\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status });\n    }\n    const { translate } = await resolveTranslations();\n    console.error(\"sales.quotes.public failed\", err);\n    return NextResponse.json(\n      {\n        error: translate(\"sales.quotes.public.failed\", \"Failed to load quote.\"),\n      },\n      { status: 400 },\n    );\n  }\n}\n\nconst publicQuoteResponseSchema = z.object({\n  quote: z.object({\n    quoteNumber: z.string(),\n    currencyCode: z.string(),\n    validFrom: z.string().nullable(),\n    validUntil: z.string().nullable(),\n    status: z.string().nullable(),\n    subtotalNetAmount: z.string(),\n    subtotalGrossAmount: z.string(),\n    discountTotalAmount: z.string(),\n    taxTotalAmount: z.string(),\n    grandTotalNetAmount: z.string(),\n    grandTotalGrossAmount: z.string(),\n  }),\n  lines: z.array(\n    z.object({\n      lineNumber: z.number().nullable(),\n      kind: z.string(),\n      name: z.string().nullable(),\n      description: z.string().nullable(),\n      quantity: z.string(),\n      quantityUnit: z.string().nullable(),\n      normalizedQuantity: z.string(),\n      normalizedUnit: z.string().nullable(),\n      uomSnapshot: z\n        .object({\n          baseUnitCode: z.string().nullable(),\n          enteredUnitCode: z.string().nullable(),\n        })\n        .nullable()\n        .optional(),\n      currencyCode: z.string(),\n      unitPriceNet: z.string(),\n      unitPriceGross: z.string(),\n      discountAmount: z.string(),\n      discountPercent: z.string(),\n      taxRate: z.string(),\n      taxAmount: z.string(),\n      totalNetAmount: z.string(),\n      totalGrossAmount: z.string(),\n      unitPriceReference: z\n        .object({\n          enabled: z.boolean().nullable().optional(),\n          referenceUnitCode: z.string().nullable().optional(),\n          baseQuantity: z.string().nullable().optional(),\n          grossPerReference: z.string().nullable().optional(),\n          netPerReference: z.string().nullable().optional(),\n        })\n        .nullable()\n        .optional(),\n    }),\n  ),\n  adjustments: z.array(\n    z.object({\n      scope: z.string().nullable(),\n      kind: z.string().nullable(),\n      label: z.string().nullable(),\n      rate: z.string().nullable(),\n      amountNet: z.string().nullable(),\n      amountGross: z.string().nullable(),\n      currencyCode: z.string().nullable(),\n      position: z.number().nullable(),\n      quoteLineId: z.string().uuid().nullable(),\n    }),\n  ),\n  isExpired: z.boolean(),\n});\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: \"Sales\",\n  summary: \"View a quote (public)\",\n  pathParams: z.object({ token: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: \"Get quote details by acceptance token\",\n      responses: [\n        {\n          status: 200,\n          description: \"Quote details\",\n          schema: publicQuoteResponseSchema,\n        },\n        {\n          status: 404,\n          description: \"Quote not found\",\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAG/C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,0BAA0B;AAEnC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,KAAK;AACzB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IAAI,KAAc,KAAoC;AAC1E,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,aAAa,MAAM,IAAI,UAAU,CAAC,CAAC;AACrD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,QACH,MAAM,sBAAsB,IAAI,YAAY;AAAA,MAC3C,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC,KACA,MAAM,sBAAsB,IAAI,YAAY;AAAA,MAC3C,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC;AACH,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gCAAgC,kBAAkB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,MAAM,YAAY,MAAM,aAAa,KAAK,UAAU;AACtD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gCAAgC,kBAAkB;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YACJ,CAAC,CAAC,MAAM,cAAc,MAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ;AAEjE,UAAM,CAAC,OAAO,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7C;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,QACnG,EAAE,SAAS,EAAE,YAAY,MAAM,EAAE;AAAA,MACnC;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,QAClF,EAAE,SAAS,EAAE,UAAU,MAAM,EAAE;AAAA,MACjC;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL,aAAa,MAAM;AAAA,QACnB,cAAc,MAAM;AAAA,QACpB,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,QAC7C,YAAY,MAAM,YAAY,YAAY,KAAK;AAAA,QAC/C,QAAQ,MAAM,UAAU;AAAA,QACxB,mBAAmB,MAAM;AAAA,QACzB,qBAAqB,MAAM;AAAA,QAC3B,qBAAqB,MAAM;AAAA,QAC3B,gBAAgB,MAAM;AAAA,QACtB,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,MAAM;AAAA,MAC/B;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,QAC1B,YAAY,KAAK,cAAc;AAAA,QAC/B,MAAM,KAAK;AAAA,QACX,MAAM,KAAK,QAAQ;AAAA,QACnB,aAAa,KAAK,eAAe;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,cAAc,qBAAqB,KAAK,YAAY,KAAK;AAAA,QACzD,oBAAoB,KAAK,sBAAsB,KAAK;AAAA,QACpD,gBACE,qBAAqB,KAAK,kBAAkB,KAAK,YAAY,KAC7D;AAAA,QACF,aAAa,KAAK,cACd;AAAA,UACE,cAAc,KAAK,YAAY,gBAAgB;AAAA,UAC/C,iBAAiB,KAAK,YAAY,mBAAmB;AAAA,QACvD,IACA;AAAA,QACJ,cAAc,KAAK;AAAA,QACnB,cAAc,KAAK;AAAA,QACnB,gBAAgB,KAAK;AAAA,QACrB,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB,SAAS,KAAK;AAAA,QACd,WAAW,KAAK;AAAA,QAChB,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,KAAK;AAAA,QACvB,qBAAqB,MAAM;AACzB,cAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,gBAAM,MAAM,KAAK,YAAY;AAC7B,cAAI,CAAC,IAAK,QAAO;AACjB,iBAAO;AAAA,YACL,SAAS,IAAI,WAAW;AAAA,YACxB,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,cAAc,IAAI,gBAAgB;AAAA,YAClC,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,iBAAiB,IAAI,mBAAmB;AAAA,UAC1C;AAAA,QACF,GAAG;AAAA,MACL,EAAE;AAAA,MACF,aAAa,YAAY,IAAI,CAAC,SAAS;AAAA,QACrC,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,OAAO,IAAI,SAAS,IAAI,QAAQ;AAAA,QAChC,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI,gBAAgB;AAAA,QAClC,UAAU,IAAI,YAAY;AAAA,QAC1B,aAAa,IAAI,WAAW,MAAM;AAAA,MACpC,EAAE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,8BAA8B,GAAG;AAC/C,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,UAAU,8BAA8B,uBAAuB;AAAA,MACxE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO;AAAA,IACd,aAAa,EAAE,OAAO;AAAA,IACtB,cAAc,EAAE,OAAO;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,mBAAmB,EAAE,OAAO;AAAA,IAC5B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,gBAAgB,EAAE,OAAO;AAAA,IACzB,qBAAqB,EAAE,OAAO;AAAA,IAC9B,uBAAuB,EAAE,OAAO;AAAA,EAClC,CAAC;AAAA,EACD,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,UAAU,EAAE,OAAO;AAAA,MACnB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,oBAAoB,EAAE,OAAO;AAAA,MAC7B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,MACpC,aAAa,EACV,OAAO;AAAA,QACN,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,QAClC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,MACvC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,MACZ,cAAc,EAAE,OAAO;AAAA,MACvB,cAAc,EAAE,OAAO;AAAA,MACvB,gBAAgB,EAAE,OAAO;AAAA,MACzB,gBAAgB,EAAE,OAAO;AAAA,MACzB,iBAAiB,EAAE,OAAO;AAAA,MAC1B,SAAS,EAAE,OAAO;AAAA,MAClB,WAAW,EAAE,OAAO;AAAA,MACpB,gBAAgB,EAAE,OAAO;AAAA,MACzB,kBAAkB,EAAE,OAAO;AAAA,MAC3B,oBAAoB,EACjB,OAAO;AAAA,QACN,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,QACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAC7C,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAClD,CAAC,EACA,SAAS,EACT,SAAS;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EACA,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA,EACA,WAAW,EAAE,QAAQ;AACvB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACjD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/quotes/send/route.js CHANGED Viewed

@@ -4,7 +4,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveTranslations, detectLocale } from "@open-mercato/shared/lib/i18n/server";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import {
   bridgeLegacyGuard,
   runMutationGuards
@@ -168,7 +168,7 @@ async function POST(req) {
     }
     return NextResponse.json({ ok: true });
   } catch (err) {
-    if (err instanceof CrudHttpError) {
+    if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
     const { translate } = await resolveTranslations();

package/dist/modules/sales/api/quotes/send/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/sales/api/quotes/send/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations, detectLocale } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport crypto from 'node:crypto'\nimport { withScopedPayload } from '../../utils'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SalesQuote } from '../../../data/entities'\nimport { quoteSendSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteSentEmail } from '../../../emails/QuoteSentEmail'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nfunction resolveQuoteEmail(quote: SalesQuote): string | null {\n  const snapshot = quote.customerSnapshot && typeof quote.customerSnapshot === 'object' ? (quote.customerSnapshot as Record<string, unknown>) : null\n  const metadata = quote.metadata && typeof quote.metadata === 'object' ? (quote.metadata as Record<string, unknown>) : null\n  const contact = snapshot?.contact as Record<string, unknown> | undefined\n  const customer = snapshot?.customer as Record<string, unknown> | undefined\n  const candidate =\n    (typeof contact?.email === 'string' && contact.email.trim()) ||\n    (typeof customer?.primaryEmail === 'string' && customer.primaryEmail.trim()) ||\n    (typeof metadata?.customerEmail === 'string' && metadata.customerEmail.trim()) ||\n    null\n  if (!candidate) return null\n  const parsed = z.string().email().safeParse(candidate)\n  return parsed.success ? parsed.data : null\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = quoteSendSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const tenantScope = ctx.auth?.tenantId ? { tenantId: ctx.auth.tenantId } : undefined\n    const quote = await findOneWithDecryption(em, SalesQuote, { id: input.quoteId, deletedAt: null }, {}, tenantScope)\n    if (!quote) {\n      throw new CrudHttpError(404, { error: translate('sales.documents.detail.error', 'Document not found or inaccessible.') })\n    }\n    if (quote.tenantId !== ctx.auth?.tenantId || quote.organizationId !== ctx.selectedOrganizationId) {\n      throw new CrudHttpError(403, { error: translate('sales.documents.errors.forbidden', 'Forbidden') })\n    }\n\n    if ((quote.status ?? null) === 'canceled') {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.canceled', 'Canceled quotes cannot be sent.') })\n    }\n\n    const email = resolveQuoteEmail(quote)\n    if (!email) {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.missingEmail', 'Customer email is required to send a quote.') })\n    }\n\n    const now = new Date()\n    const validUntil = new Date(now)\n    validUntil.setUTCDate(validUntil.getUTCDate() + input.validForDays)\n\n    const rawAcceptanceToken = crypto.randomUUID()\n    quote.validUntil = validUntil\n    quote.acceptanceToken = hashAuthToken(rawAcceptanceToken)\n    quote.sentAt = now\n    quote.status = 'sent'\n    quote.statusEntryId = await resolveStatusEntryIdByValue(em, {\n      tenantId: quote.tenantId,\n      organizationId: quote.organizationId,\n      value: 'sent',\n    })\n    quote.updatedAt = now\n    em.persist(quote)\n\n    const appUrl = process.env.APP_URL || ''\n    const url = appUrl ? `${appUrl.replace(/\\/$/, '')}/quote/${rawAcceptanceToken}` : `/quote/${rawAcceptanceToken}`\n\n    const locale = await detectLocale()\n    const validUntilFormatted = validUntil.toLocaleDateString(locale, {\n      year: 'numeric',\n      month: 'long',\n      day: 'numeric',\n    })\n\n    const copy = {\n      preview: translate('sales.quotes.email.preview', 'Quote {quoteNumber} is ready for review', { quoteNumber: quote.quoteNumber }),\n      heading: translate('sales.quotes.email.heading', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      total: translate('sales.quotes.email.total', 'Total: {amount} {currency}', {\n        amount: quote.grandTotalGrossAmount ?? quote.grandTotalNetAmount ?? '0',\n        currency: quote.currencyCode,\n      }),\n      validUntil: translate('sales.quotes.email.validUntil', 'Valid until: {date}', { date: validUntilFormatted }),\n      cta: translate('sales.quotes.email.cta', 'View quote'),\n      footer: translate('sales.quotes.email.footer', 'Open Mercato'),\n    }\n\n    await sendEmail({\n      to: email,\n      subject: translate('sales.quotes.email.subject', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      react: QuoteSentEmail({ url, copy }),\n    })\n\n    await em.flush()\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.quotes.send failed', err)\n    return NextResponse.json(\n      { error: translate('sales.quotes.send.failed', 'Failed to send quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Send quote to customer',\n  methods: {\n    POST: {\n      summary: 'Send quote',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteSendSchema,\n      },\n      responses: [\n        { status: 200, description: 'Email queued', schema: z.object({ ok: z.literal(true) }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB,oBAAoB;AAClD,SAAS,qBAAqB;AAE9B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP,OAAO,YAAY;AACnB,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,sBAAsB;AAExB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,QAAM,WAAW,MAAM,oBAAoB,OAAO,MAAM,qBAAqB,WAAY,MAAM,mBAA+C;AAC9I,QAAMA,YAAW,MAAM,YAAY,OAAO,MAAM,aAAa,WAAY,MAAM,WAAuC;AACtH,QAAM,UAAU,UAAU;AAC1B,QAAM,WAAW,UAAU;AAC3B,QAAM,YACH,OAAO,SAAS,UAAU,YAAY,QAAQ,MAAM,KAAK,KACzD,OAAO,UAAU,iBAAiB,YAAY,SAAS,aAAa,KAAK,KACzE,OAAOA,WAAU,kBAAkB,YAAYA,UAAS,cAAc,KAAK,KAC5E;AACF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAS;AACrD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,gBAAgB,MAAM,MAAM;AAC1C,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AAEA,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,cAAc,IAAI,MAAM,WAAW,EAAE,UAAU,IAAI,KAAK,SAAS,IAAI;AAC3E,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,MAAM,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AACjH,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gCAAgC,qCAAqC,EAAE,CAAC;AAAA,IAC1H;AACA,QAAI,MAAM,aAAa,IAAI,MAAM,YAAY,MAAM,mBAAmB,IAAI,wBAAwB;AAChG,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,WAAW,EAAE,CAAC;AAAA,IACpG;AAEA,SAAK,MAAM,UAAU,UAAU,YAAY;AACzC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8BAA8B,iCAAiC,EAAE,CAAC;AAAA,IACpH;AAEA,UAAM,QAAQ,kBAAkB,KAAK;AACrC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,6CAA6C,EAAE,CAAC;AAAA,IACpI;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,aAAa,IAAI,KAAK,GAAG;AAC/B,eAAW,WAAW,WAAW,WAAW,IAAI,MAAM,YAAY;AAElE,UAAM,qBAAqB,OAAO,WAAW;AAC7C,UAAM,aAAa;AACnB,UAAM,kBAAkB,cAAc,kBAAkB;AACxD,UAAM,SAAS;AACf,UAAM,SAAS;AACf,UAAM,gBAAgB,MAAM,4BAA4B,IAAI;AAAA,MAC1D,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,YAAY;AAClB,OAAG,QAAQ,KAAK;AAEhB,UAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,UAAM,MAAM,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,UAAU,kBAAkB,KAAK,UAAU,kBAAkB;AAE9G,UAAM,SAAS,MAAM,aAAa;AAClC,UAAM,sBAAsB,WAAW,mBAAmB,QAAQ;AAAA,MAChE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAED,UAAM,OAAO;AAAA,MACX,SAAS,UAAU,8BAA8B,2CAA2C,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC9H,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,UAAU,4BAA4B,8BAA8B;AAAA,QACzE,QAAQ,MAAM,yBAAyB,MAAM,uBAAuB;AAAA,QACpE,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,MACD,YAAY,UAAU,iCAAiC,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAAA,MAC3G,KAAK,UAAU,0BAA0B,YAAY;AAAA,MACrD,QAAQ,UAAU,6BAA6B,cAAc;AAAA,IAC/D;AAEA,UAAM,UAAU;AAAA,MACd,IAAI;AAAA,MACJ,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,eAAe,EAAE,KAAK,KAAK,CAAC;AAAA,IACrC,CAAC;AAED,UAAM,GAAG,MAAM;AAEf,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,4BAA4B,GAAG;AAC7C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,4BAA4B,uBAAuB,EAAE;AAAA,MACxE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations, detectLocale } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport crypto from 'node:crypto'\nimport { withScopedPayload } from '../../utils'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SalesQuote } from '../../../data/entities'\nimport { quoteSendSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteSentEmail } from '../../../emails/QuoteSentEmail'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nfunction resolveQuoteEmail(quote: SalesQuote): string | null {\n  const snapshot = quote.customerSnapshot && typeof quote.customerSnapshot === 'object' ? (quote.customerSnapshot as Record<string, unknown>) : null\n  const metadata = quote.metadata && typeof quote.metadata === 'object' ? (quote.metadata as Record<string, unknown>) : null\n  const contact = snapshot?.contact as Record<string, unknown> | undefined\n  const customer = snapshot?.customer as Record<string, unknown> | undefined\n  const candidate =\n    (typeof contact?.email === 'string' && contact.email.trim()) ||\n    (typeof customer?.primaryEmail === 'string' && customer.primaryEmail.trim()) ||\n    (typeof metadata?.customerEmail === 'string' && metadata.customerEmail.trim()) ||\n    null\n  if (!candidate) return null\n  const parsed = z.string().email().safeParse(candidate)\n  return parsed.success ? parsed.data : null\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = quoteSendSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const tenantScope = ctx.auth?.tenantId ? { tenantId: ctx.auth.tenantId } : undefined\n    const quote = await findOneWithDecryption(em, SalesQuote, { id: input.quoteId, deletedAt: null }, {}, tenantScope)\n    if (!quote) {\n      throw new CrudHttpError(404, { error: translate('sales.documents.detail.error', 'Document not found or inaccessible.') })\n    }\n    if (quote.tenantId !== ctx.auth?.tenantId || quote.organizationId !== ctx.selectedOrganizationId) {\n      throw new CrudHttpError(403, { error: translate('sales.documents.errors.forbidden', 'Forbidden') })\n    }\n\n    if ((quote.status ?? null) === 'canceled') {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.canceled', 'Canceled quotes cannot be sent.') })\n    }\n\n    const email = resolveQuoteEmail(quote)\n    if (!email) {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.missingEmail', 'Customer email is required to send a quote.') })\n    }\n\n    const now = new Date()\n    const validUntil = new Date(now)\n    validUntil.setUTCDate(validUntil.getUTCDate() + input.validForDays)\n\n    const rawAcceptanceToken = crypto.randomUUID()\n    quote.validUntil = validUntil\n    quote.acceptanceToken = hashAuthToken(rawAcceptanceToken)\n    quote.sentAt = now\n    quote.status = 'sent'\n    quote.statusEntryId = await resolveStatusEntryIdByValue(em, {\n      tenantId: quote.tenantId,\n      organizationId: quote.organizationId,\n      value: 'sent',\n    })\n    quote.updatedAt = now\n    em.persist(quote)\n\n    const appUrl = process.env.APP_URL || ''\n    const url = appUrl ? `${appUrl.replace(/\\/$/, '')}/quote/${rawAcceptanceToken}` : `/quote/${rawAcceptanceToken}`\n\n    const locale = await detectLocale()\n    const validUntilFormatted = validUntil.toLocaleDateString(locale, {\n      year: 'numeric',\n      month: 'long',\n      day: 'numeric',\n    })\n\n    const copy = {\n      preview: translate('sales.quotes.email.preview', 'Quote {quoteNumber} is ready for review', { quoteNumber: quote.quoteNumber }),\n      heading: translate('sales.quotes.email.heading', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      total: translate('sales.quotes.email.total', 'Total: {amount} {currency}', {\n        amount: quote.grandTotalGrossAmount ?? quote.grandTotalNetAmount ?? '0',\n        currency: quote.currencyCode,\n      }),\n      validUntil: translate('sales.quotes.email.validUntil', 'Valid until: {date}', { date: validUntilFormatted }),\n      cta: translate('sales.quotes.email.cta', 'View quote'),\n      footer: translate('sales.quotes.email.footer', 'Open Mercato'),\n    }\n\n    await sendEmail({\n      to: email,\n      subject: translate('sales.quotes.email.subject', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      react: QuoteSentEmail({ url, copy }),\n    })\n\n    await em.flush()\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('sales.quotes.send failed', err)\n    return NextResponse.json(\n      { error: translate('sales.quotes.send.failed', 'Failed to send quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Send quote to customer',\n  methods: {\n    POST: {\n      summary: 'Send quote',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteSendSchema,\n      },\n      responses: [\n        { status: 200, description: 'Email queued', schema: z.object({ ok: z.literal(true) }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB,oBAAoB;AAClD,SAAS,eAAe,uBAAuB;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP,OAAO,YAAY;AACnB,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,sBAAsB;AAExB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,QAAM,WAAW,MAAM,oBAAoB,OAAO,MAAM,qBAAqB,WAAY,MAAM,mBAA+C;AAC9I,QAAMA,YAAW,MAAM,YAAY,OAAO,MAAM,aAAa,WAAY,MAAM,WAAuC;AACtH,QAAM,UAAU,UAAU;AAC1B,QAAM,WAAW,UAAU;AAC3B,QAAM,YACH,OAAO,SAAS,UAAU,YAAY,QAAQ,MAAM,KAAK,KACzD,OAAO,UAAU,iBAAiB,YAAY,SAAS,aAAa,KAAK,KACzE,OAAOA,WAAU,kBAAkB,YAAYA,UAAS,cAAc,KAAK,KAC5E;AACF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAS;AACrD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,gBAAgB,MAAM,MAAM;AAC1C,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AAEA,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,cAAc,IAAI,MAAM,WAAW,EAAE,UAAU,IAAI,KAAK,SAAS,IAAI;AAC3E,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,MAAM,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AACjH,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gCAAgC,qCAAqC,EAAE,CAAC;AAAA,IAC1H;AACA,QAAI,MAAM,aAAa,IAAI,MAAM,YAAY,MAAM,mBAAmB,IAAI,wBAAwB;AAChG,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,WAAW,EAAE,CAAC;AAAA,IACpG;AAEA,SAAK,MAAM,UAAU,UAAU,YAAY;AACzC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8BAA8B,iCAAiC,EAAE,CAAC;AAAA,IACpH;AAEA,UAAM,QAAQ,kBAAkB,KAAK;AACrC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,6CAA6C,EAAE,CAAC;AAAA,IACpI;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,aAAa,IAAI,KAAK,GAAG;AAC/B,eAAW,WAAW,WAAW,WAAW,IAAI,MAAM,YAAY;AAElE,UAAM,qBAAqB,OAAO,WAAW;AAC7C,UAAM,aAAa;AACnB,UAAM,kBAAkB,cAAc,kBAAkB;AACxD,UAAM,SAAS;AACf,UAAM,SAAS;AACf,UAAM,gBAAgB,MAAM,4BAA4B,IAAI;AAAA,MAC1D,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,YAAY;AAClB,OAAG,QAAQ,KAAK;AAEhB,UAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,UAAM,MAAM,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,UAAU,kBAAkB,KAAK,UAAU,kBAAkB;AAE9G,UAAM,SAAS,MAAM,aAAa;AAClC,UAAM,sBAAsB,WAAW,mBAAmB,QAAQ;AAAA,MAChE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAED,UAAM,OAAO;AAAA,MACX,SAAS,UAAU,8BAA8B,2CAA2C,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC9H,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,UAAU,4BAA4B,8BAA8B;AAAA,QACzE,QAAQ,MAAM,yBAAyB,MAAM,uBAAuB;AAAA,QACpE,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,MACD,YAAY,UAAU,iCAAiC,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAAA,MAC3G,KAAK,UAAU,0BAA0B,YAAY;AAAA,MACrD,QAAQ,UAAU,6BAA6B,cAAc;AAAA,IAC/D;AAEA,UAAM,UAAU;AAAA,MACd,IAAI;AAAA,MACJ,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,eAAe,EAAE,KAAK,KAAK,CAAC;AAAA,IACrC,CAAC;AAED,UAAM,GAAG,MAAM;AAEf,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,4BAA4B,GAAG;AAC7C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,4BAA4B,uBAAuB,EAAE;AAAA,MACxE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/sales/api/returns/[id]/route.js CHANGED Viewed

@@ -4,7 +4,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { SalesReturn, SalesReturnLine } from "../../../data/entities.js";
 const metadata = {
@@ -87,7 +87,7 @@ async function GET(req, ctx) {
       }))
     });
   } catch (err) {
-    if (err instanceof CrudHttpError) {
+    if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
     console.error("sales.returns.get failed", err);