@open-mercato/core 0.6.4-develop.4326.1.9a8cfb5ccb → 0.6.4-develop.4339.1.fad812f76f

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 2742 entry points
+[build:core] found 2743 entry points
 [build:core] built successfully
 [build:core:generated] found 176 entry points
 [build:core:generated] built successfully

package/dist/modules/audit_logs/api/audit-logs/actions/undo/route.js

@@ -51,12 +51,13 @@ async function POST(req) {
     return NextResponse.json({ error: "Undo token not available" }, { status: 400 });
   }
   const lookupActorId = canUndoTenant ? target.actorUserId ?? auth.sub : auth.sub;
+  const lookupOrgId = target.organizationId ?? null;
   let latest = null;
   if (target.resourceKind || target.resourceId) {
     latest = await logs.latestUndoableForResource({
       actorUserId: lookupActorId,
       tenantId: auth.tenantId ?? null,
-      organizationId: scopedOrgId,
+      organizationId: lookupOrgId,
       resourceKind: target.resourceKind ?? void 0,
       resourceId: target.resourceId ?? void 0
     });
@@ -64,7 +65,7 @@ async function POST(req) {
   if (!latest) {
     latest = await logs.latestUndoableForActor(lookupActorId, {
       tenantId: auth.tenantId ?? null,
-      organizationId: scopedOrgId
+      organizationId: lookupOrgId
     });
   }
   if (!latest || latest.id !== target.id) {

package/dist/modules/audit_logs/api/audit-logs/actions/undo/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/audit_logs/api/audit-logs/actions/undo/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { AwilixContainer } from 'awilix'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.undo_self'] },\n}\n\ntype UndoRequestBody = {\n  undoToken?: string\n}\n\nconst undoRequestSchema = z.object({\n  undoToken: z.string().min(1).describe('Undo token issued by the action log entry'),\n})\n\nconst undoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().describe('Identifier of the action log that was undone'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as UndoRequestBody | null\n  const undoToken = body?.undoToken?.trim()\n  if (!undoToken) return NextResponse.json({ error: 'Invalid undo token' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canUndoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.undo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const target = await logs.findByUndoToken(undoToken)\n  if (!target || target.executionState !== 'done') {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  if (target.actorUserId && target.actorUserId !== auth.sub && !canUndoTenant) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  if (target.tenantId && auth.tenantId && target.tenantId !== auth.tenantId) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  const scopedOrgId = canUndoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  if (target.organizationId && scopedOrgId && target.organizationId !== scopedOrgId) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canUndoTenant ? (target.actorUserId ?? auth.sub) : auth.sub\n  let latest = null\n  if (target.resourceKind || target.resourceId) {\n    latest = await logs.latestUndoableForResource({\n      actorUserId: lookupActorId,\n      tenantId: auth.tenantId ?? null,\n      organizationId: scopedOrgId,\n      resourceKind: target.resourceKind ?? undefined,\n      resourceId: target.resourceId ?? undefined,\n    })\n  }\n  if (!latest) {\n    latest = await logs.latestUndoableForActor(lookupActorId, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: scopedOrgId,\n    })\n  }\n  if (!latest || latest.id !== target.id) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    await commandBus.undo(undoToken, ctx)\n    return NextResponse.json({ ok: true, logId: target.id })\n  } catch (err) {\n    console.error('Undo failed', err)\n    return NextResponse.json({ error: 'Undo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Undo a recent action',\n  description: 'Executes the undo operation for the most recent undoable action belonging to the caller.',\n  methods: {\n    POST: {\n      summary: 'Undo action by token',\n      description:\n        'Replays the undo handler registered for a command. The provided undo token must match the latest undoable log entry accessible to the caller.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: undoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Undo applied successfully', schema: undoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid or unavailable undo token', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Undo blocked by organization or tenant scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAM/E,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,2CAA2C;AACnF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAC3E,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,YAAY,MAAM,WAAW,KAAK;AACxC,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,SAAS,MAAM,KAAK,gBAAgB,SAAS;AACnD,MAAI,CAAC,UAAU,OAAO,mBAAmB,QAAQ;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,OAAO,eAAe,OAAO,gBAAgB,KAAK,OAAO,CAAC,eAAe;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,OAAO,YAAY,KAAK,YAAY,OAAO,aAAa,KAAK,UAAU;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAC7F,MAAI,OAAO,kBAAkB,eAAe,OAAO,mBAAmB,aAAa;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,QAAM,gBAAgB,gBAAiB,OAAO,eAAe,KAAK,MAAO,KAAK;AAC9E,MAAI,SAAS;AACb,MAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,aAAS,MAAM,KAAK,0BAA0B;AAAA,MAC5C,aAAa;AAAA,MACb,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,MAChB,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY,OAAO,cAAc;AAAA,IACnC,CAAC;AAAA,EACH;AACA,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,KAAK,uBAAuB,eAAe;AAAA,MACxD,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,OAAO,IAAI;AACtC,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,WAAW,KAAK,WAAW,GAAG;AACpC,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,GAAG,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,YAAQ,MAAM,eAAe,GAAG;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,mBAAmB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { AwilixContainer } from 'awilix'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.undo_self'] },\n}\n\ntype UndoRequestBody = {\n  undoToken?: string\n}\n\nconst undoRequestSchema = z.object({\n  undoToken: z.string().min(1).describe('Undo token issued by the action log entry'),\n})\n\nconst undoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().describe('Identifier of the action log that was undone'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as UndoRequestBody | null\n  const undoToken = body?.undoToken?.trim()\n  if (!undoToken) return NextResponse.json({ error: 'Invalid undo token' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canUndoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.undo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const target = await logs.findByUndoToken(undoToken)\n  if (!target || target.executionState !== 'done') {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  if (target.actorUserId && target.actorUserId !== auth.sub && !canUndoTenant) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  if (target.tenantId && auth.tenantId && target.tenantId !== auth.tenantId) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  const scopedOrgId = canUndoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  if (target.organizationId && scopedOrgId && target.organizationId !== scopedOrgId) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canUndoTenant ? (target.actorUserId ?? auth.sub) : auth.sub\n  // Scope the latest-undoable re-lookup to the target row's own organization, not\n  // the caller's currently-resolved org. The actor/tenant/org guards above already\n  // authorized the caller for this row; reusing the caller's scope here breaks undo\n  // for tenant-level rows (organization create/update/delete/reparent log with a\n  // null organization_id) whenever the caller resolves to a concrete home org, so\n  // the lookup never matches and returns \"Undo token not available\" (issue #2398).\n  const lookupOrgId = target.organizationId ?? null\n  let latest = null\n  if (target.resourceKind || target.resourceId) {\n    latest = await logs.latestUndoableForResource({\n      actorUserId: lookupActorId,\n      tenantId: auth.tenantId ?? null,\n      organizationId: lookupOrgId,\n      resourceKind: target.resourceKind ?? undefined,\n      resourceId: target.resourceId ?? undefined,\n    })\n  }\n  if (!latest) {\n    latest = await logs.latestUndoableForActor(lookupActorId, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: lookupOrgId,\n    })\n  }\n  if (!latest || latest.id !== target.id) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    await commandBus.undo(undoToken, ctx)\n    return NextResponse.json({ ok: true, logId: target.id })\n  } catch (err) {\n    console.error('Undo failed', err)\n    return NextResponse.json({ error: 'Undo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Undo a recent action',\n  description: 'Executes the undo operation for the most recent undoable action belonging to the caller.',\n  methods: {\n    POST: {\n      summary: 'Undo action by token',\n      description:\n        'Replays the undo handler registered for a command. The provided undo token must match the latest undoable log entry accessible to the caller.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: undoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Undo applied successfully', schema: undoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid or unavailable undo token', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Undo blocked by organization or tenant scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAM/E,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,2CAA2C;AACnF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAC3E,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,YAAY,MAAM,WAAW,KAAK;AACxC,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,SAAS,MAAM,KAAK,gBAAgB,SAAS;AACnD,MAAI,CAAC,UAAU,OAAO,mBAAmB,QAAQ;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,OAAO,eAAe,OAAO,gBAAgB,KAAK,OAAO,CAAC,eAAe;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,OAAO,YAAY,KAAK,YAAY,OAAO,aAAa,KAAK,UAAU;AACzE,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAC7F,MAAI,OAAO,kBAAkB,eAAe,OAAO,mBAAmB,aAAa;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,QAAM,gBAAgB,gBAAiB,OAAO,eAAe,KAAK,MAAO,KAAK;AAO9E,QAAM,cAAc,OAAO,kBAAkB;AAC7C,MAAI,SAAS;AACb,MAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,aAAS,MAAM,KAAK,0BAA0B;AAAA,MAC5C,aAAa;AAAA,MACb,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,MAChB,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY,OAAO,cAAc;AAAA,IACnC,CAAC;AAAA,EACH;AACA,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,KAAK,uBAAuB,eAAe;AAAA,MACxD,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,OAAO,IAAI;AACtC,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,WAAW,KAAK,WAAW,GAAG;AACpC,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,GAAG,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,YAAQ,MAAM,eAAe,GAAG;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,mBAAmB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/api/records.js

@@ -239,7 +239,7 @@ async function POST(req) {
     const norm = normalizeValues(values);
     try {
       const { validateCustomFieldValuesServer } = await import("../lib/validation.js");
-      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId, values: norm });
+      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId, values: norm, rejectUndeclaredKeys: true });
       if (!check.ok) return NextResponse.json({ error: "Validation failed", fields: check.fieldErrors }, { status: 400 });
     } catch {
     }
@@ -298,7 +298,7 @@ async function PUT(req) {
     const norm = normalizeValues(values);
     try {
       const { validateCustomFieldValuesServer } = await import("../lib/validation.js");
-      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId, values: norm });
+      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId, values: norm, rejectUndeclaredKeys: true });
       if (!check.ok) return NextResponse.json({ error: "Validation failed", fields: check.fieldErrors }, { status: 400 });
     } catch {
     }

package/dist/modules/entities/api/records.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/records.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { QueryEngine, QueryOptions, Where, Sort } from '@open-mercato/shared/lib/query/types'\nimport { normalizeExportFormat, serializeExport, defaultExportFilename, ensureColumns } from '@open-mercato/shared/lib/crud/exporters'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { setRecordCustomFields } from '../lib/helpers'\nimport { CustomFieldValue } from '../data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n}\n\nconst DEFAULT_EXPORT_PAGE_SIZE = 1000\n\nconst listRecordsQuerySchema = z\n  .object({\n    entityId: z.string().min(1),\n    page: z.coerce.number().int().min(1).optional(),\n    pageSize: z.coerce.number().int().min(1).max(100).optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n    withDeleted: z.coerce.boolean().optional(),\n    format: z.enum(['csv', 'json', 'xml', 'markdown']).optional(),\n    exportScope: z.enum(['full']).optional(),\n    export_scope: z.enum(['full']).optional(),\n    all: z.coerce.boolean().optional(),\n    full: z.coerce.boolean().optional(),\n  })\n  .passthrough()\n\nconst recordItemSchema = z.record(z.string(), z.any())\n\nconst listRecordsResponseSchema = z.object({\n  items: z.array(recordItemSchema),\n  total: z.number(),\n  page: z.number(),\n  pageSize: z.number(),\n  totalPages: z.number(),\n})\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const requestedExport = normalizeExportFormat(url.searchParams.get('format'))\n  const exportScopeRaw = (url.searchParams.get('exportScope') || url.searchParams.get('export_scope') || '').toLowerCase()\n  const exportFullRequested = requestedExport != null && (exportScopeRaw === 'full' || parseBooleanWithDefault(url.searchParams.get('full'), false))\n  const exportAll = parseBooleanWithDefault(url.searchParams.get('all'), false)\n  const noPagination = exportAll || requestedExport != null\n  const page = noPagination ? 1 : Math.max(parseInt(url.searchParams.get('page') || '1', 10) || 1, 1)\n  const basePageSize = Math.min(Math.max(parseInt(url.searchParams.get('pageSize') || '50', 10) || 50, 1), 100)\n  const pageSize = noPagination ? Math.max(basePageSize, DEFAULT_EXPORT_PAGE_SIZE) : basePageSize\n  const sortField = url.searchParams.get('sortField') || 'id'\n  const sortDir = (url.searchParams.get('sortDir') || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc'\n  const withDeleted = parseBooleanWithDefault(url.searchParams.get('withDeleted'), false)\n\n  const qpEntries: Array<[string, string]> = []\n  for (const [key, val] of url.searchParams.entries()) {\n    if (['entityId','page','pageSize','sortField','sortDir','withDeleted','format','exportScope','export_scope','all','full'].includes(key)) continue\n    qpEntries.push([key, val])\n  }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const qe = resolve('queryEngine') as QueryEngine\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    let organizationIds: string[] | null = scope.filterIds\n    let isCustomEntity = false\n    try {\n      const { CustomEntity } = await import('../data/entities')\n      const found = await em.findOne(CustomEntity as any, { entityId, isActive: true })\n      isCustomEntity = !!found\n    } catch {}\n    if (organizationIds && organizationIds.length === 0) {\n      return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n    }\n    const normalizeCustomEntityValue = (value: unknown) => {\n      if (Array.isArray(value)) {\n        return value.map((entry) => {\n          if (typeof entry !== 'string') return entry\n          const parsed = parseBooleanToken(entry)\n          return parsed === null ? entry : parsed\n        })\n      }\n      if (typeof value !== 'string') return value\n      const parsed = parseBooleanToken(value)\n      return parsed === null ? value : parsed\n    }\n    const mapRow = (row: any) => {\n      if (!isCustomEntity || !row || typeof row !== 'object') return row\n      const out: Record<string, unknown> = {}\n      for (const [k, v] of Object.entries(row)) {\n        if (k.startsWith('cf_')) out[k.replace(/^cf_/, '')] = normalizeCustomEntityValue(v)\n        else out[k] = v\n      }\n      return out\n    }\n    const mapFullRow = (row: any) => {\n      if (!row || typeof row !== 'object') return row\n      return { ...(row as Record<string, unknown>) }\n    }\n    // Build filters with awareness of custom-entity mode\n    const filtersObj: Where<any> = {}\n    const buildFilter = (key: string, val: string, allowAnyKey: boolean) => {\n      if (key.startsWith('cf_')) {\n        if (key.endsWith('In')) {\n          const base = key.slice(0, -2)\n          const values = val.split(',').map((s) => s.trim()).filter(Boolean)\n          ;(filtersObj as any)[base] = { $in: values }\n        } else {\n          if (val.includes(',')) {\n            const values = val.split(',').map((s) => s.trim()).filter(Boolean)\n            ;(filtersObj as any)[key] = { $in: values }\n          } else {\n            const parsed = parseBooleanToken(val)\n            ;(filtersObj as any)[key] = parsed === null ? val : parsed\n          }\n        }\n      } else if (allowAnyKey) {\n        if (val.includes(',')) {\n          const values = val.split(',').map((s) => s.trim()).filter(Boolean)\n          ;(filtersObj as any)[key] = { $in: values }\n        } else {\n          const parsed = parseBooleanToken(val)\n          ;(filtersObj as any)[key] = parsed === null ? val : parsed\n        }\n      } else {\n        if (['id', 'created_at', 'updated_at', 'deleted_at', 'name', 'title', 'email'].includes(key)) {\n          ;(filtersObj as any)[key] = val\n        }\n      }\n    }\n\n    if (organizationIds && organizationIds.length) {\n      (filtersObj as any).organization_id = { $in: organizationIds }\n    }\n    const qopts: QueryOptions = {\n      tenantId: auth.tenantId!,\n      includeCustomFields: true,\n      page: { page, pageSize },\n      sort: [{ field: sortField as any, dir: sortDir as any }] as Sort[],\n      filters: filtersObj as any,\n      withDeleted,\n    }\n    if (organizationIds && organizationIds.length) {\n      qopts.organizationIds = organizationIds\n    }\n    for (const [k, v] of qpEntries) buildFilter(k, v, isCustomEntity)\n    const res = await qe.query(entityId as any, qopts)\n    const rawItems = res.items || []\n    const viewPageItems = rawItems.map(mapRow)\n    const fullPageItems = rawItems.map(mapFullRow)\n    const total = typeof res.total === 'number' ? res.total : rawItems.length\n    const effectivePageSize = res.pageSize || pageSize\n    const payload = {\n      items: viewPageItems,\n      total,\n      page: res.page || page,\n      pageSize: effectivePageSize,\n      totalPages: Math.ceil(total / (effectivePageSize || 1)),\n    }\n\n    if (requestedExport) {\n      let exportItems: any[] = exportFullRequested ? [...fullPageItems] : [...viewPageItems]\n      if (total > exportItems.length) {\n        let nextPage = 2\n        while (exportItems.length < total) {\n          const nextRes = await qe.query(entityId as any, {\n            ...qopts,\n            page: { page: nextPage, pageSize },\n          })\n          const nextRawItems = nextRes.items || []\n          if (!nextRawItems.length) break\n          const nextViewItems = nextRawItems.map(mapRow)\n          const nextFullItems = nextRawItems.map(mapFullRow)\n          const nextBatch = exportFullRequested ? nextFullItems : nextViewItems\n          exportItems.push(...nextBatch)\n          if (nextBatch.length < pageSize) break\n          nextPage += 1\n        }\n      }\n      const prepared = {\n        columns: ensureColumns(exportItems),\n        rows: exportItems,\n      }\n      const filenameBase = exportFullRequested ? `${entityId || 'records'}_full` : entityId || 'records'\n      const serialized = serializeExport(prepared, requestedExport)\n      const filename = defaultExportFilename(filenameBase, requestedExport)\n      return new Response(serialized.body, {\n        headers: {\n          'content-type': serialized.contentType,\n          'content-disposition': `attachment; filename=\"${filename}\"`,\n        },\n      })\n    }\n\n    return NextResponse.json(payload)\n  } catch (e) {\n    try { console.error('[entities.records.GET] Error', e) } catch {}\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst postBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1).optional(),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst putBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst mutationResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z\n    .object({\n      entityId: z.string(),\n      recordId: z.string(),\n    })\n    .optional(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: unknown\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = postBodySchema.safeParse(json)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId } = parsed.data\n  let { recordId, values } = parsed.data as { recordId?: string; values: Record<string, any> }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    const normalizedRecordId = (() => {\n      const raw = String(recordId || '').trim()\n      if (!raw) return undefined\n      const low = raw.toLowerCase()\n      if (low === 'create' || low === 'new' || low === 'null' || low === 'undefined') return undefined\n      // Enforce UUID only; any non-uuid is ignored so we generate one in the DE\n      const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n      return uuid.test(raw) ? raw : undefined\n    })()\n    const { id } = await de.createCustomEntityRecord({\n      entityId,\n      recordId: normalizedRecordId,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n\n    return NextResponse.json({ ok: true, item: { entityId, recordId: id } })\n  } catch (e) {\n    try { console.error('[entities.records.POST] Error', e) } catch {}\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\n// Avoid zod here to prevent runtime import issues in some environments\nfunction parsePutBody(json: any): { ok: true; data: { entityId: string; recordId: string; values: Record<string, any> } } | { ok: false; error: string } {\n  if (!json || typeof json !== 'object') return { ok: false, error: 'Invalid JSON' }\n  const entityId = typeof json.entityId === 'string' && json.entityId.length ? json.entityId : ''\n  const recordId = typeof json.recordId === 'string' && json.recordId.length ? json.recordId : ''\n  const values = (json.values && typeof json.values === 'object') ? json.values as Record<string, any> : {}\n  if (!entityId || !recordId) return { ok: false, error: 'entityId and recordId are required' }\n  return { ok: true, data: { entityId, recordId, values } }\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: any\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = parsePutBody(json)\n  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })\n  const { entityId, recordId, values } = parsed.data\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    // Normalize recordId: if blank/sentinel/non-uuid => create instead of update\n    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n    const rid = String(recordId || '').trim()\n    const low = rid.toLowerCase()\n    const isSentinel = !rid || low === 'create' || low === 'new' || low === 'null' || low === 'undefined'\n    const isUuid = uuidRe.test(rid)\n    if (isSentinel || !isUuid) {\n      const created = await de.createCustomEntityRecord({\n        entityId,\n        recordId: undefined,\n        organizationId: targetOrgId,\n        tenantId: auth.tenantId!,\n        values: norm,\n      })\n      return NextResponse.json({ ok: true, item: { entityId, recordId: created.id } })\n    }\n\n    await de.updateCustomEntityRecord({\n      entityId,\n      recordId: rid,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n    return NextResponse.json({ ok: true, item: { entityId, recordId: rid } })\n  } catch (e) {\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst deleteBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n})\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const qpEntityId = url.searchParams.get('entityId')\n  const qpRecordId = url.searchParams.get('recordId')\n  let payload: any = qpEntityId && qpRecordId ? { entityId: qpEntityId, recordId: qpRecordId } : null\n  if (!payload) {\n    try { payload = await req.json() } catch { payload = null }\n  }\n  const parsed = deleteBodySchema.safeParse(payload)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId, recordId } = parsed.data\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    await de.deleteCustomEntityRecord({ entityId, recordId, organizationId: targetOrgId, tenantId: auth.tenantId!, soft: true })\n    return NextResponse.json({ ok: true })\n  } catch (e) {\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nfunction normalizeValues(input: Record<string, any>): Record<string, any> {\n  const out: Record<string, any> = {}\n  for (const [k, v] of Object.entries(input || {})) {\n    const key = k.startsWith('cf_') ? k.replace(/^cf_/, '') : k\n    out[key] = v\n  }\n  return out\n}\n\nconst deleteResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n}).passthrough()\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'CRUD operations on entity records',\n  methods: {\n    GET: {\n      summary: 'List records',\n      description:\n        'Returns paginated records for the supplied entity. Supports custom field filters, exports, and soft-delete toggles.',\n      query: listRecordsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated records',\n          schema: listRecordsResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create record',\n      description:\n        'Creates a record for the given entity. When `recordId` is omitted or not a UUID the data engine will generate one automatically.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: postBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record created',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    PUT: {\n      summary: 'Update record',\n      description:\n        'Updates an existing record. If the provided recordId is not a UUID the record will be created instead to support optimistic flows.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record updated',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete record',\n      description: 'Soft deletes the specified record within the current tenant/org scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record deleted',\n          schema: deleteResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id or record id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 404,\n          description: 'Record not found',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,uBAAuB,iBAAiB,uBAAuB,qBAAqB;AAE7F,SAAS,0BAA0B,0CAA0C;AAC7E,SAAS,mBAAmB,+BAA+B;AAKpD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACxE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACvE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC5E;AAEA,MAAM,2BAA2B;AAEjC,MAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA,EAC5D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACxC,KAAK,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACjC,MAAM,EAAE,OAAO,QAAQ,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAEf,MAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAErD,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,kBAAkB,sBAAsB,IAAI,aAAa,IAAI,QAAQ,CAAC;AAC5E,QAAM,kBAAkB,IAAI,aAAa,IAAI,aAAa,KAAK,IAAI,aAAa,IAAI,cAAc,KAAK,IAAI,YAAY;AACvH,QAAM,sBAAsB,mBAAmB,SAAS,mBAAmB,UAAU,wBAAwB,IAAI,aAAa,IAAI,MAAM,GAAG,KAAK;AAChJ,QAAM,YAAY,wBAAwB,IAAI,aAAa,IAAI,KAAK,GAAG,KAAK;AAC5E,QAAM,eAAe,aAAa,mBAAmB;AACrD,QAAM,OAAO,eAAe,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,KAAK,GAAG,CAAC;AAClG,QAAM,eAAe,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AAC5G,QAAM,WAAW,eAAe,KAAK,IAAI,cAAc,wBAAwB,IAAI;AACnF,QAAM,YAAY,IAAI,aAAa,IAAI,WAAW,KAAK;AACvD,QAAM,WAAW,IAAI,aAAa,IAAI,SAAS,KAAK,OAAO,YAAY,MAAM,SAAS,SAAS;AAC/F,QAAM,cAAc,wBAAwB,IAAI,aAAa,IAAI,aAAa,GAAG,KAAK;AAEtF,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,GAAG,KAAK,IAAI,aAAa,QAAQ,GAAG;AACnD,QAAI,CAAC,YAAW,QAAO,YAAW,aAAY,WAAU,eAAc,UAAS,eAAc,gBAAe,OAAM,MAAM,EAAE,SAAS,GAAG,EAAG;AACzI,cAAU,KAAK,CAAC,KAAK,GAAG,CAAC;AAAA,EAC3B;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,aAAa;AAChC,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,QAAI,kBAAmC,MAAM;AAC7C,QAAI,iBAAiB;AACrB,QAAI;AACF,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,kBAAkB;AACxD,YAAM,QAAQ,MAAM,GAAG,QAAQ,cAAqB,EAAE,UAAU,UAAU,KAAK,CAAC;AAChF,uBAAiB,CAAC,CAAC;AAAA,IACrB,QAAQ;AAAA,IAAC;AACT,QAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,6BAA6B,CAAC,UAAmB;AACrD,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,MAAM,IAAI,CAAC,UAAU;AAC1B,cAAI,OAAO,UAAU,SAAU,QAAO;AACtC,gBAAMA,UAAS,kBAAkB,KAAK;AACtC,iBAAOA,YAAW,OAAO,QAAQA;AAAA,QACnC,CAAC;AAAA,MACH;AACA,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,SAAS,kBAAkB,KAAK;AACtC,aAAO,WAAW,OAAO,QAAQ;AAAA,IACnC;AACA,UAAM,SAAS,CAAC,QAAa;AAC3B,UAAI,CAAC,kBAAkB,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC/D,YAAM,MAA+B,CAAC;AACtC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,YAAI,EAAE,WAAW,KAAK,EAAG,KAAI,EAAE,QAAQ,QAAQ,EAAE,CAAC,IAAI,2BAA2B,CAAC;AAAA,YAC7E,KAAI,CAAC,IAAI;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAa;AAC/B,UAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,aAAO,EAAE,GAAI,IAAgC;AAAA,IAC/C;AAEA,UAAM,aAAyB,CAAC;AAChC,UAAM,cAAc,CAAC,KAAa,KAAa,gBAAyB;AACtE,UAAI,IAAI,WAAW,KAAK,GAAG;AACzB,YAAI,IAAI,SAAS,IAAI,GAAG;AACtB,gBAAM,OAAO,IAAI,MAAM,GAAG,EAAE;AAC5B,gBAAM,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChE,UAAC,WAAmB,IAAI,IAAI,EAAE,KAAK,OAAO;AAAA,QAC7C,OAAO;AACL,cAAI,IAAI,SAAS,GAAG,GAAG;AACrB,kBAAM,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChE,YAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,UAC5C,OAAO;AACL,kBAAM,SAAS,kBAAkB,GAAG;AACnC,YAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,UACtD;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,YAAI,IAAI,SAAS,GAAG,GAAG;AACrB,gBAAM,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChE,UAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,QAC5C,OAAO;AACL,gBAAM,SAAS,kBAAkB,GAAG;AACnC,UAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,QACtD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,cAAc,cAAc,cAAc,QAAQ,SAAS,OAAO,EAAE,SAAS,GAAG,GAAG;AAC5F;AAAC,UAAC,WAAmB,GAAG,IAAI;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,MAAC,WAAmB,kBAAkB,EAAE,KAAK,gBAAgB;AAAA,IAC/D;AACA,UAAM,QAAsB;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,qBAAqB;AAAA,MACrB,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,MAAM,CAAC,EAAE,OAAO,WAAkB,KAAK,QAAe,CAAC;AAAA,MACvD,SAAS;AAAA,MACT;AAAA,IACF;AACA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,YAAM,kBAAkB;AAAA,IAC1B;AACA,eAAW,CAAC,GAAG,CAAC,KAAK,UAAW,aAAY,GAAG,GAAG,cAAc;AAChE,UAAM,MAAM,MAAM,GAAG,MAAM,UAAiB,KAAK;AACjD,UAAM,WAAW,IAAI,SAAS,CAAC;AAC/B,UAAM,gBAAgB,SAAS,IAAI,MAAM;AACzC,UAAM,gBAAgB,SAAS,IAAI,UAAU;AAC7C,UAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,SAAS;AACnE,UAAM,oBAAoB,IAAI,YAAY;AAC1C,UAAM,UAAU;AAAA,MACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,IAAI,QAAQ;AAAA,MAClB,UAAU;AAAA,MACV,YAAY,KAAK,KAAK,SAAS,qBAAqB,EAAE;AAAA,IACxD;AAEA,QAAI,iBAAiB;AACnB,UAAI,cAAqB,sBAAsB,CAAC,GAAG,aAAa,IAAI,CAAC,GAAG,aAAa;AACrF,UAAI,QAAQ,YAAY,QAAQ;AAC9B,YAAI,WAAW;AACf,eAAO,YAAY,SAAS,OAAO;AACjC,gBAAM,UAAU,MAAM,GAAG,MAAM,UAAiB;AAAA,YAC9C,GAAG;AAAA,YACH,MAAM,EAAE,MAAM,UAAU,SAAS;AAAA,UACnC,CAAC;AACD,gBAAM,eAAe,QAAQ,SAAS,CAAC;AACvC,cAAI,CAAC,aAAa,OAAQ;AAC1B,gBAAM,gBAAgB,aAAa,IAAI,MAAM;AAC7C,gBAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,gBAAM,YAAY,sBAAsB,gBAAgB;AACxD,sBAAY,KAAK,GAAG,SAAS;AAC7B,cAAI,UAAU,SAAS,SAAU;AACjC,sBAAY;AAAA,QACd;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,SAAS,cAAc,WAAW;AAAA,QAClC,MAAM;AAAA,MACR;AACA,YAAM,eAAe,sBAAsB,GAAG,YAAY,SAAS,UAAU,YAAY;AACzF,YAAM,aAAa,gBAAgB,UAAU,eAAe;AAC5D,YAAM,WAAW,sBAAsB,cAAc,eAAe;AACpE,aAAO,IAAI,SAAS,WAAW,MAAM;AAAA,QACnC,SAAS;AAAA,UACP,gBAAgB,WAAW;AAAA,UAC3B,uBAAuB,yBAAyB,QAAQ;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,GAAG;AACV,QAAI;AAAE,cAAQ,MAAM,gCAAgC,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAC;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EACH,OAAO;AAAA,IACN,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO;AAAA,EACrB,CAAC,EACA,SAAS;AACd,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,EAAE,UAAU,OAAO,IAAI,OAAO;AAElC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,KAAK,CAAC;AACzI,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAEzC,UAAM,sBAAsB,MAAM;AAChC,YAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,MAAM,IAAI,YAAY;AAC5B,UAAI,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ,YAAa,QAAO;AAEvF,YAAM,OAAO;AACb,aAAO,KAAK,KAAK,GAAG,IAAI,MAAM;AAAA,IAChC,GAAG;AACH,UAAM,EAAE,GAAG,IAAI,MAAM,GAAG,yBAAyB;AAAA,MAC/C;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,GAAG,EAAE,CAAC;AAAA,EACzE,SAAS,GAAG;AACV,QAAI;AAAE,cAAQ,MAAM,iCAAiC,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAC;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAGA,SAAS,aAAa,MAAmI;AACvJ,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,eAAe;AACjF,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,SAAU,KAAK,UAAU,OAAO,KAAK,WAAW,WAAY,KAAK,SAAgC,CAAC;AACxG,MAAI,CAAC,YAAY,CAAC,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,qCAAqC;AAC5F,SAAO,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,OAAO,EAAE;AAC1D;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,aAAa,IAAI;AAChC,MAAI,CAAC,OAAO,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjF,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI,OAAO;AAE9C,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,KAAK,CAAC;AACzI,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAGzC,UAAM,SAAS;AACf,UAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,aAAa,CAAC,OAAO,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ;AAC1F,UAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,QAAI,cAAc,CAAC,QAAQ;AACzB,YAAM,UAAU,MAAM,GAAG,yBAAyB;AAAA,QAChD;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,QAAQ,GAAG,EAAE,CAAC;AAAA,IACjF;AAEA,UAAM,GAAG,yBAAyB;AAAA,MAChC;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,IAAI,EAAE,CAAC;AAAA,EAC1E,SAAS,GAAG;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAED,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,MAAI,UAAe,cAAc,aAAa,EAAE,UAAU,YAAY,UAAU,WAAW,IAAI;AAC/F,MAAI,CAAC,SAAS;AACZ,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAE,QAAQ;AAAE,gBAAU;AAAA,IAAK;AAAA,EAC5D;AACA,QAAM,SAAS,iBAAiB,UAAU,OAAO;AACjD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,UAAU,SAAS,IAAI,OAAO;AAEtC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,GAAG,yBAAyB,EAAE,UAAU,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,MAAM,KAAK,CAAC;AAC3H,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,GAAG;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,SAAS,gBAAgB,OAAiD;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AAChD,UAAM,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,QAAQ,QAAQ,EAAE,IAAI;AAC1D,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC,EAAE,YAAY;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { QueryEngine, QueryOptions, Where, Sort } from '@open-mercato/shared/lib/query/types'\nimport { normalizeExportFormat, serializeExport, defaultExportFilename, ensureColumns } from '@open-mercato/shared/lib/crud/exporters'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { setRecordCustomFields } from '../lib/helpers'\nimport { CustomFieldValue } from '../data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n}\n\nconst DEFAULT_EXPORT_PAGE_SIZE = 1000\n\nconst listRecordsQuerySchema = z\n  .object({\n    entityId: z.string().min(1),\n    page: z.coerce.number().int().min(1).optional(),\n    pageSize: z.coerce.number().int().min(1).max(100).optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n    withDeleted: z.coerce.boolean().optional(),\n    format: z.enum(['csv', 'json', 'xml', 'markdown']).optional(),\n    exportScope: z.enum(['full']).optional(),\n    export_scope: z.enum(['full']).optional(),\n    all: z.coerce.boolean().optional(),\n    full: z.coerce.boolean().optional(),\n  })\n  .passthrough()\n\nconst recordItemSchema = z.record(z.string(), z.any())\n\nconst listRecordsResponseSchema = z.object({\n  items: z.array(recordItemSchema),\n  total: z.number(),\n  page: z.number(),\n  pageSize: z.number(),\n  totalPages: z.number(),\n})\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const requestedExport = normalizeExportFormat(url.searchParams.get('format'))\n  const exportScopeRaw = (url.searchParams.get('exportScope') || url.searchParams.get('export_scope') || '').toLowerCase()\n  const exportFullRequested = requestedExport != null && (exportScopeRaw === 'full' || parseBooleanWithDefault(url.searchParams.get('full'), false))\n  const exportAll = parseBooleanWithDefault(url.searchParams.get('all'), false)\n  const noPagination = exportAll || requestedExport != null\n  const page = noPagination ? 1 : Math.max(parseInt(url.searchParams.get('page') || '1', 10) || 1, 1)\n  const basePageSize = Math.min(Math.max(parseInt(url.searchParams.get('pageSize') || '50', 10) || 50, 1), 100)\n  const pageSize = noPagination ? Math.max(basePageSize, DEFAULT_EXPORT_PAGE_SIZE) : basePageSize\n  const sortField = url.searchParams.get('sortField') || 'id'\n  const sortDir = (url.searchParams.get('sortDir') || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc'\n  const withDeleted = parseBooleanWithDefault(url.searchParams.get('withDeleted'), false)\n\n  const qpEntries: Array<[string, string]> = []\n  for (const [key, val] of url.searchParams.entries()) {\n    if (['entityId','page','pageSize','sortField','sortDir','withDeleted','format','exportScope','export_scope','all','full'].includes(key)) continue\n    qpEntries.push([key, val])\n  }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const qe = resolve('queryEngine') as QueryEngine\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    let organizationIds: string[] | null = scope.filterIds\n    let isCustomEntity = false\n    try {\n      const { CustomEntity } = await import('../data/entities')\n      const found = await em.findOne(CustomEntity as any, { entityId, isActive: true })\n      isCustomEntity = !!found\n    } catch {}\n    if (organizationIds && organizationIds.length === 0) {\n      return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n    }\n    const normalizeCustomEntityValue = (value: unknown) => {\n      if (Array.isArray(value)) {\n        return value.map((entry) => {\n          if (typeof entry !== 'string') return entry\n          const parsed = parseBooleanToken(entry)\n          return parsed === null ? entry : parsed\n        })\n      }\n      if (typeof value !== 'string') return value\n      const parsed = parseBooleanToken(value)\n      return parsed === null ? value : parsed\n    }\n    const mapRow = (row: any) => {\n      if (!isCustomEntity || !row || typeof row !== 'object') return row\n      const out: Record<string, unknown> = {}\n      for (const [k, v] of Object.entries(row)) {\n        if (k.startsWith('cf_')) out[k.replace(/^cf_/, '')] = normalizeCustomEntityValue(v)\n        else out[k] = v\n      }\n      return out\n    }\n    const mapFullRow = (row: any) => {\n      if (!row || typeof row !== 'object') return row\n      return { ...(row as Record<string, unknown>) }\n    }\n    // Build filters with awareness of custom-entity mode\n    const filtersObj: Where<any> = {}\n    const buildFilter = (key: string, val: string, allowAnyKey: boolean) => {\n      if (key.startsWith('cf_')) {\n        if (key.endsWith('In')) {\n          const base = key.slice(0, -2)\n          const values = val.split(',').map((s) => s.trim()).filter(Boolean)\n          ;(filtersObj as any)[base] = { $in: values }\n        } else {\n          if (val.includes(',')) {\n            const values = val.split(',').map((s) => s.trim()).filter(Boolean)\n            ;(filtersObj as any)[key] = { $in: values }\n          } else {\n            const parsed = parseBooleanToken(val)\n            ;(filtersObj as any)[key] = parsed === null ? val : parsed\n          }\n        }\n      } else if (allowAnyKey) {\n        if (val.includes(',')) {\n          const values = val.split(',').map((s) => s.trim()).filter(Boolean)\n          ;(filtersObj as any)[key] = { $in: values }\n        } else {\n          const parsed = parseBooleanToken(val)\n          ;(filtersObj as any)[key] = parsed === null ? val : parsed\n        }\n      } else {\n        if (['id', 'created_at', 'updated_at', 'deleted_at', 'name', 'title', 'email'].includes(key)) {\n          ;(filtersObj as any)[key] = val\n        }\n      }\n    }\n\n    if (organizationIds && organizationIds.length) {\n      (filtersObj as any).organization_id = { $in: organizationIds }\n    }\n    const qopts: QueryOptions = {\n      tenantId: auth.tenantId!,\n      includeCustomFields: true,\n      page: { page, pageSize },\n      sort: [{ field: sortField as any, dir: sortDir as any }] as Sort[],\n      filters: filtersObj as any,\n      withDeleted,\n    }\n    if (organizationIds && organizationIds.length) {\n      qopts.organizationIds = organizationIds\n    }\n    for (const [k, v] of qpEntries) buildFilter(k, v, isCustomEntity)\n    const res = await qe.query(entityId as any, qopts)\n    const rawItems = res.items || []\n    const viewPageItems = rawItems.map(mapRow)\n    const fullPageItems = rawItems.map(mapFullRow)\n    const total = typeof res.total === 'number' ? res.total : rawItems.length\n    const effectivePageSize = res.pageSize || pageSize\n    const payload = {\n      items: viewPageItems,\n      total,\n      page: res.page || page,\n      pageSize: effectivePageSize,\n      totalPages: Math.ceil(total / (effectivePageSize || 1)),\n    }\n\n    if (requestedExport) {\n      let exportItems: any[] = exportFullRequested ? [...fullPageItems] : [...viewPageItems]\n      if (total > exportItems.length) {\n        let nextPage = 2\n        while (exportItems.length < total) {\n          const nextRes = await qe.query(entityId as any, {\n            ...qopts,\n            page: { page: nextPage, pageSize },\n          })\n          const nextRawItems = nextRes.items || []\n          if (!nextRawItems.length) break\n          const nextViewItems = nextRawItems.map(mapRow)\n          const nextFullItems = nextRawItems.map(mapFullRow)\n          const nextBatch = exportFullRequested ? nextFullItems : nextViewItems\n          exportItems.push(...nextBatch)\n          if (nextBatch.length < pageSize) break\n          nextPage += 1\n        }\n      }\n      const prepared = {\n        columns: ensureColumns(exportItems),\n        rows: exportItems,\n      }\n      const filenameBase = exportFullRequested ? `${entityId || 'records'}_full` : entityId || 'records'\n      const serialized = serializeExport(prepared, requestedExport)\n      const filename = defaultExportFilename(filenameBase, requestedExport)\n      return new Response(serialized.body, {\n        headers: {\n          'content-type': serialized.contentType,\n          'content-disposition': `attachment; filename=\"${filename}\"`,\n        },\n      })\n    }\n\n    return NextResponse.json(payload)\n  } catch (e) {\n    try { console.error('[entities.records.GET] Error', e) } catch {}\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst postBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1).optional(),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst putBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst mutationResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z\n    .object({\n      entityId: z.string(),\n      recordId: z.string(),\n    })\n    .optional(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: unknown\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = postBodySchema.safeParse(json)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId } = parsed.data\n  let { recordId, values } = parsed.data as { recordId?: string; values: Record<string, any> }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm, rejectUndeclaredKeys: true })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    const normalizedRecordId = (() => {\n      const raw = String(recordId || '').trim()\n      if (!raw) return undefined\n      const low = raw.toLowerCase()\n      if (low === 'create' || low === 'new' || low === 'null' || low === 'undefined') return undefined\n      // Enforce UUID only; any non-uuid is ignored so we generate one in the DE\n      const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n      return uuid.test(raw) ? raw : undefined\n    })()\n    const { id } = await de.createCustomEntityRecord({\n      entityId,\n      recordId: normalizedRecordId,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n\n    return NextResponse.json({ ok: true, item: { entityId, recordId: id } })\n  } catch (e) {\n    try { console.error('[entities.records.POST] Error', e) } catch {}\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\n// Avoid zod here to prevent runtime import issues in some environments\nfunction parsePutBody(json: any): { ok: true; data: { entityId: string; recordId: string; values: Record<string, any> } } | { ok: false; error: string } {\n  if (!json || typeof json !== 'object') return { ok: false, error: 'Invalid JSON' }\n  const entityId = typeof json.entityId === 'string' && json.entityId.length ? json.entityId : ''\n  const recordId = typeof json.recordId === 'string' && json.recordId.length ? json.recordId : ''\n  const values = (json.values && typeof json.values === 'object') ? json.values as Record<string, any> : {}\n  if (!entityId || !recordId) return { ok: false, error: 'entityId and recordId are required' }\n  return { ok: true, data: { entityId, recordId, values } }\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: any\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = parsePutBody(json)\n  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })\n  const { entityId, recordId, values } = parsed.data\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm, rejectUndeclaredKeys: true })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    // Normalize recordId: if blank/sentinel/non-uuid => create instead of update\n    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n    const rid = String(recordId || '').trim()\n    const low = rid.toLowerCase()\n    const isSentinel = !rid || low === 'create' || low === 'new' || low === 'null' || low === 'undefined'\n    const isUuid = uuidRe.test(rid)\n    if (isSentinel || !isUuid) {\n      const created = await de.createCustomEntityRecord({\n        entityId,\n        recordId: undefined,\n        organizationId: targetOrgId,\n        tenantId: auth.tenantId!,\n        values: norm,\n      })\n      return NextResponse.json({ ok: true, item: { entityId, recordId: created.id } })\n    }\n\n    await de.updateCustomEntityRecord({\n      entityId,\n      recordId: rid,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n    return NextResponse.json({ ok: true, item: { entityId, recordId: rid } })\n  } catch (e) {\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst deleteBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n})\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const qpEntityId = url.searchParams.get('entityId')\n  const qpRecordId = url.searchParams.get('recordId')\n  let payload: any = qpEntityId && qpRecordId ? { entityId: qpEntityId, recordId: qpRecordId } : null\n  if (!payload) {\n    try { payload = await req.json() } catch { payload = null }\n  }\n  const parsed = deleteBodySchema.safeParse(payload)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId, recordId } = parsed.data\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    await de.deleteCustomEntityRecord({ entityId, recordId, organizationId: targetOrgId, tenantId: auth.tenantId!, soft: true })\n    return NextResponse.json({ ok: true })\n  } catch (e) {\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nfunction normalizeValues(input: Record<string, any>): Record<string, any> {\n  const out: Record<string, any> = {}\n  for (const [k, v] of Object.entries(input || {})) {\n    const key = k.startsWith('cf_') ? k.replace(/^cf_/, '') : k\n    out[key] = v\n  }\n  return out\n}\n\nconst deleteResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n}).passthrough()\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'CRUD operations on entity records',\n  methods: {\n    GET: {\n      summary: 'List records',\n      description:\n        'Returns paginated records for the supplied entity. Supports custom field filters, exports, and soft-delete toggles.',\n      query: listRecordsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated records',\n          schema: listRecordsResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create record',\n      description:\n        'Creates a record for the given entity. When `recordId` is omitted or not a UUID the data engine will generate one automatically.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: postBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record created',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    PUT: {\n      summary: 'Update record',\n      description:\n        'Updates an existing record. If the provided recordId is not a UUID the record will be created instead to support optimistic flows.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record updated',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete record',\n      description: 'Soft deletes the specified record within the current tenant/org scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record deleted',\n          schema: deleteResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id or record id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 404,\n          description: 'Record not found',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,uBAAuB,iBAAiB,uBAAuB,qBAAqB;AAE7F,SAAS,0BAA0B,0CAA0C;AAC7E,SAAS,mBAAmB,+BAA+B;AAKpD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACxE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACvE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC5E;AAEA,MAAM,2BAA2B;AAEjC,MAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA,EAC5D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACxC,KAAK,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACjC,MAAM,EAAE,OAAO,QAAQ,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAEf,MAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAErD,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,kBAAkB,sBAAsB,IAAI,aAAa,IAAI,QAAQ,CAAC;AAC5E,QAAM,kBAAkB,IAAI,aAAa,IAAI,aAAa,KAAK,IAAI,aAAa,IAAI,cAAc,KAAK,IAAI,YAAY;AACvH,QAAM,sBAAsB,mBAAmB,SAAS,mBAAmB,UAAU,wBAAwB,IAAI,aAAa,IAAI,MAAM,GAAG,KAAK;AAChJ,QAAM,YAAY,wBAAwB,IAAI,aAAa,IAAI,KAAK,GAAG,KAAK;AAC5E,QAAM,eAAe,aAAa,mBAAmB;AACrD,QAAM,OAAO,eAAe,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,KAAK,GAAG,CAAC;AAClG,QAAM,eAAe,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AAC5G,QAAM,WAAW,eAAe,KAAK,IAAI,cAAc,wBAAwB,IAAI;AACnF,QAAM,YAAY,IAAI,aAAa,IAAI,WAAW,KAAK;AACvD,QAAM,WAAW,IAAI,aAAa,IAAI,SAAS,KAAK,OAAO,YAAY,MAAM,SAAS,SAAS;AAC/F,QAAM,cAAc,wBAAwB,IAAI,aAAa,IAAI,aAAa,GAAG,KAAK;AAEtF,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,GAAG,KAAK,IAAI,aAAa,QAAQ,GAAG;AACnD,QAAI,CAAC,YAAW,QAAO,YAAW,aAAY,WAAU,eAAc,UAAS,eAAc,gBAAe,OAAM,MAAM,EAAE,SAAS,GAAG,EAAG;AACzI,cAAU,KAAK,CAAC,KAAK,GAAG,CAAC;AAAA,EAC3B;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,aAAa;AAChC,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,QAAI,kBAAmC,MAAM;AAC7C,QAAI,iBAAiB;AACrB,QAAI;AACF,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,kBAAkB;AACxD,YAAM,QAAQ,MAAM,GAAG,QAAQ,cAAqB,EAAE,UAAU,UAAU,KAAK,CAAC;AAChF,uBAAiB,CAAC,CAAC;AAAA,IACrB,QAAQ;AAAA,IAAC;AACT,QAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,6BAA6B,CAAC,UAAmB;AACrD,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,MAAM,IAAI,CAAC,UAAU;AAC1B,cAAI,OAAO,UAAU,SAAU,QAAO;AACtC,gBAAMA,UAAS,kBAAkB,KAAK;AACtC,iBAAOA,YAAW,OAAO,QAAQA;AAAA,QACnC,CAAC;AAAA,MACH;AACA,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,SAAS,kBAAkB,KAAK;AACtC,aAAO,WAAW,OAAO,QAAQ;AAAA,IACnC;AACA,UAAM,SAAS,CAAC,QAAa;AAC3B,UAAI,CAAC,kBAAkB,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC/D,YAAM,MAA+B,CAAC;AACtC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,YAAI,EAAE,WAAW,KAAK,EAAG,KAAI,EAAE,QAAQ,QAAQ,EAAE,CAAC,IAAI,2BAA2B,CAAC;AAAA,YAC7E,KAAI,CAAC,IAAI;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAa;AAC/B,UAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,aAAO,EAAE,GAAI,IAAgC;AAAA,IAC/C;AAEA,UAAM,aAAyB,CAAC;AAChC,UAAM,cAAc,CAAC,KAAa,KAAa,gBAAyB;AACtE,UAAI,IAAI,WAAW,KAAK,GAAG;AACzB,YAAI,IAAI,SAAS,IAAI,GAAG;AACtB,gBAAM,OAAO,IAAI,MAAM,GAAG,EAAE;AAC5B,gBAAM,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChE,UAAC,WAAmB,IAAI,IAAI,EAAE,KAAK,OAAO;AAAA,QAC7C,OAAO;AACL,cAAI,IAAI,SAAS,GAAG,GAAG;AACrB,kBAAM,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChE,YAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,UAC5C,OAAO;AACL,kBAAM,SAAS,kBAAkB,GAAG;AACnC,YAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,UACtD;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,YAAI,IAAI,SAAS,GAAG,GAAG;AACrB,gBAAM,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChE,UAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,QAC5C,OAAO;AACL,gBAAM,SAAS,kBAAkB,GAAG;AACnC,UAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,QACtD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,cAAc,cAAc,cAAc,QAAQ,SAAS,OAAO,EAAE,SAAS,GAAG,GAAG;AAC5F;AAAC,UAAC,WAAmB,GAAG,IAAI;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,MAAC,WAAmB,kBAAkB,EAAE,KAAK,gBAAgB;AAAA,IAC/D;AACA,UAAM,QAAsB;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,qBAAqB;AAAA,MACrB,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,MAAM,CAAC,EAAE,OAAO,WAAkB,KAAK,QAAe,CAAC;AAAA,MACvD,SAAS;AAAA,MACT;AAAA,IACF;AACA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,YAAM,kBAAkB;AAAA,IAC1B;AACA,eAAW,CAAC,GAAG,CAAC,KAAK,UAAW,aAAY,GAAG,GAAG,cAAc;AAChE,UAAM,MAAM,MAAM,GAAG,MAAM,UAAiB,KAAK;AACjD,UAAM,WAAW,IAAI,SAAS,CAAC;AAC/B,UAAM,gBAAgB,SAAS,IAAI,MAAM;AACzC,UAAM,gBAAgB,SAAS,IAAI,UAAU;AAC7C,UAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,SAAS;AACnE,UAAM,oBAAoB,IAAI,YAAY;AAC1C,UAAM,UAAU;AAAA,MACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,IAAI,QAAQ;AAAA,MAClB,UAAU;AAAA,MACV,YAAY,KAAK,KAAK,SAAS,qBAAqB,EAAE;AAAA,IACxD;AAEA,QAAI,iBAAiB;AACnB,UAAI,cAAqB,sBAAsB,CAAC,GAAG,aAAa,IAAI,CAAC,GAAG,aAAa;AACrF,UAAI,QAAQ,YAAY,QAAQ;AAC9B,YAAI,WAAW;AACf,eAAO,YAAY,SAAS,OAAO;AACjC,gBAAM,UAAU,MAAM,GAAG,MAAM,UAAiB;AAAA,YAC9C,GAAG;AAAA,YACH,MAAM,EAAE,MAAM,UAAU,SAAS;AAAA,UACnC,CAAC;AACD,gBAAM,eAAe,QAAQ,SAAS,CAAC;AACvC,cAAI,CAAC,aAAa,OAAQ;AAC1B,gBAAM,gBAAgB,aAAa,IAAI,MAAM;AAC7C,gBAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,gBAAM,YAAY,sBAAsB,gBAAgB;AACxD,sBAAY,KAAK,GAAG,SAAS;AAC7B,cAAI,UAAU,SAAS,SAAU;AACjC,sBAAY;AAAA,QACd;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,SAAS,cAAc,WAAW;AAAA,QAClC,MAAM;AAAA,MACR;AACA,YAAM,eAAe,sBAAsB,GAAG,YAAY,SAAS,UAAU,YAAY;AACzF,YAAM,aAAa,gBAAgB,UAAU,eAAe;AAC5D,YAAM,WAAW,sBAAsB,cAAc,eAAe;AACpE,aAAO,IAAI,SAAS,WAAW,MAAM;AAAA,QACnC,SAAS;AAAA,UACP,gBAAgB,WAAW;AAAA,UAC3B,uBAAuB,yBAAyB,QAAQ;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,GAAG;AACV,QAAI;AAAE,cAAQ,MAAM,gCAAgC,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAC;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EACH,OAAO;AAAA,IACN,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO;AAAA,EACrB,CAAC,EACA,SAAS;AACd,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,EAAE,UAAU,OAAO,IAAI,OAAO;AAElC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,MAAM,sBAAsB,KAAK,CAAC;AACrK,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAEzC,UAAM,sBAAsB,MAAM;AAChC,YAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,MAAM,IAAI,YAAY;AAC5B,UAAI,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ,YAAa,QAAO;AAEvF,YAAM,OAAO;AACb,aAAO,KAAK,KAAK,GAAG,IAAI,MAAM;AAAA,IAChC,GAAG;AACH,UAAM,EAAE,GAAG,IAAI,MAAM,GAAG,yBAAyB;AAAA,MAC/C;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,GAAG,EAAE,CAAC;AAAA,EACzE,SAAS,GAAG;AACV,QAAI;AAAE,cAAQ,MAAM,iCAAiC,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAC;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAGA,SAAS,aAAa,MAAmI;AACvJ,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,eAAe;AACjF,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,SAAU,KAAK,UAAU,OAAO,KAAK,WAAW,WAAY,KAAK,SAAgC,CAAC;AACxG,MAAI,CAAC,YAAY,CAAC,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,qCAAqC;AAC5F,SAAO,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,OAAO,EAAE;AAC1D;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,aAAa,IAAI;AAChC,MAAI,CAAC,OAAO,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjF,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI,OAAO;AAE9C,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,MAAM,sBAAsB,KAAK,CAAC;AACrK,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAGzC,UAAM,SAAS;AACf,UAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,aAAa,CAAC,OAAO,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ;AAC1F,UAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,QAAI,cAAc,CAAC,QAAQ;AACzB,YAAM,UAAU,MAAM,GAAG,yBAAyB;AAAA,QAChD;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,QAAQ,GAAG,EAAE,CAAC;AAAA,IACjF;AAEA,UAAM,GAAG,yBAAyB;AAAA,MAChC;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,IAAI,EAAE,CAAC;AAAA,EAC1E,SAAS,GAAG;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAED,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,MAAI,UAAe,cAAc,aAAa,EAAE,UAAU,YAAY,UAAU,WAAW,IAAI;AAC/F,MAAI,CAAC,SAAS;AACZ,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAE,QAAQ;AAAE,gBAAU;AAAA,IAAK;AAAA,EAC5D;AACA,QAAM,SAAS,iBAAiB,UAAU,OAAO;AACjD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,UAAU,SAAS,IAAI,OAAO;AAEtC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,GAAG,yBAAyB,EAAE,UAAU,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,MAAM,KAAK,CAAC;AAC3H,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,GAAG;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,SAAS,gBAAgB,OAAiD;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AAChD,UAAM,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,QAAQ,QAAQ,EAAE,IAAI;AAC1D,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC,EAAE,YAAY;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["parsed"]
 }

package/dist/modules/entities/lib/helpers.js

@@ -1,4 +1,8 @@
 import { encryptCustomFieldValue, resolveTenantEncryptionService } from "@open-mercato/shared/lib/encryption/customFieldValues";
+import {
+  MAX_CUSTOM_FIELD_KEYS_PER_RECORD,
+  TOO_MANY_CUSTOM_FIELDS_ERROR
+} from "@open-mercato/shared/modules/entities/validation";
 import { CustomFieldDef, CustomFieldValue } from "../data/entities.js";
 function columnFromKind(kind) {
   switch (kind) {
@@ -41,13 +45,29 @@ async function setRecordCustomFields(em, opts) {
   if (preferDefs) {
     const defs = await em.find(CustomFieldDef, {
       entityId,
+      isActive: true,
+      deletedAt: null,
       organizationId: { $in: [organizationId, null] },
       tenantId: { $in: [tenantId, null] }
     });
+    const scopeScore = (def) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0);
     defsByKey = {};
     for (const d of defs) {
       const existing = defsByKey[d.key];
-      if (!existing || existing.organizationId == null && d.organizationId != null || existing.tenantId == null && d.tenantId != null) {
+      if (!existing) {
+        defsByKey[d.key] = d;
+        continue;
+      }
+      const nextScore = scopeScore(d);
+      const existingScore = scopeScore(existing);
+      if (nextScore > existingScore) {
+        defsByKey[d.key] = d;
+        continue;
+      }
+      if (nextScore < existingScore) continue;
+      const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime();
+      const existingUpdatedAt = existing.updatedAt instanceof Date ? existing.updatedAt.getTime() : new Date(existing.updatedAt).getTime();
+      if (nextUpdatedAt >= existingUpdatedAt) {
         defsByKey[d.key] = d;
       }
     }
@@ -61,6 +81,10 @@ async function setRecordCustomFields(em, opts) {
     return encryptionService;
   };
   const keys = Object.keys(values);
+  const presentKeyCount = keys.filter((key) => values[key] !== void 0).length;
+  if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {
+    throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR);
+  }
   for (const fieldKey of keys) {
     const raw = values[fieldKey];
     if (raw === void 0) continue;

package/dist/modules/entities/lib/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/lib/helpers.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { CustomFieldDef, CustomFieldValue } from '../data/entities'\n\ntype Primitive = string | number | boolean | null | undefined\ntype PrimitiveOrArray = Primitive | Primitive[]\n\nexport type SetRecordCustomFieldsOptions = {\n  entityId: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  values: Record<string, PrimitiveOrArray>\n  // When true (default), try to use field definitions to decide storage column\n  preferDefs?: boolean\n  // Optional: notify external systems (e.g., indexing) when values changed\n  onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void\n  // Optional: re-use an existing tenant encryption service instance\n  encryptionService?: TenantDataEncryptionService | null\n}\n\nfunction columnFromKind(kind: string): keyof CustomFieldValue {\n  switch (kind) {\n    case 'text':\n    case 'select':\n    case 'currency':\n    case 'dictionary':\n      return 'valueText'\n    case 'multiline':\n      return 'valueMultiline'\n    case 'integer':\n      return 'valueInt'\n    case 'float':\n      return 'valueFloat'\n    case 'boolean':\n      return 'valueBool'\n    default:\n      return 'valueText'\n  }\n}\n\nfunction columnFromJsValue(v: Primitive): keyof CustomFieldValue {\n  if (v === null || v === undefined) return 'valueText'\n  if (typeof v === 'boolean') return 'valueBool'\n  if (typeof v === 'number') return Number.isInteger(v) ? 'valueInt' : 'valueFloat'\n  return 'valueText'\n}\n\n// Clears all value columns to avoid leftovers on update\nfunction clearValueColumns(cf: CustomFieldValue) {\n  cf.valueText = null\n  cf.valueMultiline = null\n  cf.valueInt = null\n  cf.valueFloat = null\n  cf.valueBool = null\n}\n\nexport async function setRecordCustomFields(\n  em: EntityManager,\n  opts: SetRecordCustomFieldsOptions,\n): Promise<void> {\n  const { entityId, recordId, values } = opts\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const preferDefs = opts.preferDefs !== false\n\n  let defsByKey: Record<string, CustomFieldDef> | undefined\n  if (preferDefs) {\n    const defs = await em.find(CustomFieldDef, {\n      entityId,\n      organizationId: { $in: [organizationId, null] as any },\n      tenantId: { $in: [tenantId, null] as any },\n    })\n    // Prefer org+tenant-specific over global if duplicates\n    defsByKey = {}\n    for (const d of defs) {\n      const existing = defsByKey[d.key]\n      if (!existing || \n          (existing.organizationId == null && d.organizationId != null) ||\n          (existing.tenantId == null && d.tenantId != null)) {\n        defsByKey[d.key] = d\n      }\n    }\n  }\n\n  const toPersist: CustomFieldValue[] = []\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)\n    return encryptionService\n  }\n  const keys = Object.keys(values)\n  for (const fieldKey of keys) {\n    const raw = values[fieldKey]\n    if (raw === undefined) continue\n\n    const def = defsByKey?.[fieldKey]\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const isArray = Array.isArray(raw)\n    // When array: remove existing values for key and create multiple rows\n    if (isArray) {\n      const arr = raw as Primitive[]\n      // Clear existing for this key\n      const existing = await em.find(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n      if (existing.length) existing.forEach((e) => em.remove(e))\n      for (const val of arr) {\n        const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)\n        const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n        clearValueColumns(cf)\n        const stored = encrypted\n          ? await encryptCustomFieldValue(val, tenantId, getEncryptionService(), encryptionCache)\n          : val\n        switch (col) {\n          case 'valueText': cf.valueText = stored == null ? null : String(stored); break\n          case 'valueMultiline': cf.valueMultiline = stored == null ? null : String(stored); break\n          case 'valueInt': cf.valueInt = stored == null ? null : Number(stored); break\n          case 'valueFloat': cf.valueFloat = stored == null ? null : Number(stored); break\n          case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break\n          default: cf.valueText = stored == null ? null : String(stored); break\n        }\n        toPersist.push(cf)\n      }\n      continue\n    }\n\n    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)\n    const storedValue = encrypted\n      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache)\n      : raw\n\n    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n    if (!cf) {\n      cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n      toPersist.push(cf)\n    }\n    clearValueColumns(cf)\n    switch (column) {\n      case 'valueText':\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueMultiline':\n        cf.valueMultiline = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueInt':\n        cf.valueInt = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueFloat':\n        cf.valueFloat = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueBool':\n        cf.valueBool = (storedValue as Primitive) == null ? null : Boolean(storedValue as Primitive)\n        break\n      default:\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n    }\n  }\n\n  if (toPersist.length) em.persist(toPersist)\n  await em.flush()\n  // Emit hook for indexing if requested (outside CRUD flows)\n  try {\n    if (typeof opts.onChanged === 'function') {\n      await opts.onChanged({ entityId, recordId, organizationId, tenantId })\n    }\n  } catch {\n    // Non-blocking\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,yBAAyB,sCAAsC;AACxE,SAAS,gBAAgB,wBAAwB;AAmBjD,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,kBAAkB,GAAsC;AAC/D,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,UAAW,QAAO;AACnC,MAAI,OAAO,MAAM,SAAU,QAAO,OAAO,UAAU,CAAC,IAAI,aAAa;AACrE,SAAO;AACT;AAGA,SAAS,kBAAkB,IAAsB;AAC/C,KAAG,YAAY;AACf,KAAG,iBAAiB;AACpB,KAAG,WAAW;AACd,KAAG,aAAa;AAChB,KAAG,YAAY;AACjB;AAEA,eAAsB,sBACpB,IACA,MACe;AACf,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI;AACvC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAS;AAAA,MACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAS;AAAA,IAC3C,CAAC;AAED,gBAAY,CAAC;AACb,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,UAAU,EAAE,GAAG;AAChC,UAAI,CAAC,YACA,SAAS,kBAAkB,QAAQ,EAAE,kBAAkB,QACvD,SAAS,YAAY,QAAQ,EAAE,YAAY,MAAO;AACrD,kBAAU,EAAE,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAgC,CAAC;AACvC,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAW,KAAK,iBAAiB;AACpF,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,aAAW,YAAY,MAAM;AAC3B,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAI,QAAQ,OAAW;AAEvB,UAAM,MAAM,YAAY,QAAQ;AAChC,UAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,UAAM,UAAU,MAAM,QAAQ,GAAG;AAEjC,QAAI,SAAS;AACX,YAAM,MAAM;AAEZ,YAAM,WAAW,MAAM,GAAG,KAAK,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AAC3G,UAAI,SAAS,OAAQ,UAAS,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;AACzD,iBAAW,OAAO,KAAK;AACrB,cAAM,MAA8B,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAG;AACpH,cAAMA,MAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AACxH,0BAAkBA,GAAE;AACpB,cAAM,SAAS,YACX,MAAM,wBAAwB,KAAK,UAAU,qBAAqB,GAAG,eAAe,IACpF;AACJ,gBAAQ,KAAK;AAAA,UACX,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACzE,KAAK;AAAkB,YAAAA,IAAG,iBAAiB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACnF,KAAK;AAAY,YAAAA,IAAG,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACvE,KAAK;AAAc,YAAAA,IAAG,aAAa,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UAC3E,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,QAAQ,MAAM;AAAG;AAAA,UAC1E;AAAS,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,QAClE;AACA,kBAAU,KAAKA,GAAE;AAAA,MACnB;AACA;AAAA,IACF;AAEA,UAAM,SAAiC,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAgB;AACpI,UAAM,cAAc,YAChB,MAAM,wBAAwB,KAAkB,UAAU,qBAAqB,GAAG,eAAe,IACjG;AAEJ,QAAI,KAAK,MAAM,GAAG,QAAQ,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AACtG,QAAI,CAAC,IAAI;AACP,WAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AAClH,gBAAU,KAAK,EAAE;AAAA,IACnB;AACA,sBAAkB,EAAE;AACpB,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,MACF,KAAK;AACH,WAAG,iBAAkB,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC/F;AAAA,MACF,KAAK;AACH,WAAG,WAAY,eAA6B,OAAO,OAAO,OAAO,WAAwB;AACzF;AAAA,MACF,KAAK;AACH,WAAG,aAAc,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC3F;AAAA,MACF,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,QAAQ,WAAwB;AAC3F;AAAA,MACF;AACE,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,IACJ;AAAA,EACF;AAEA,MAAI,UAAU,OAAQ,IAAG,QAAQ,SAAS;AAC1C,QAAM,GAAG,MAAM;AAEf,MAAI;AACF,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,KAAK,UAAU,EAAE,UAAU,UAAU,gBAAgB,SAAS,CAAC;AAAA,IACvE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport {\n  MAX_CUSTOM_FIELD_KEYS_PER_RECORD,\n  TOO_MANY_CUSTOM_FIELDS_ERROR,\n} from '@open-mercato/shared/modules/entities/validation'\nimport { CustomFieldDef, CustomFieldValue } from '../data/entities'\n\ntype Primitive = string | number | boolean | null | undefined\ntype PrimitiveOrArray = Primitive | Primitive[]\n\nexport type SetRecordCustomFieldsOptions = {\n  entityId: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  values: Record<string, PrimitiveOrArray>\n  // When true (default), try to use field definitions to decide storage column\n  preferDefs?: boolean\n  // Optional: notify external systems (e.g., indexing) when values changed\n  onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void\n  // Optional: re-use an existing tenant encryption service instance\n  encryptionService?: TenantDataEncryptionService | null\n}\n\nfunction columnFromKind(kind: string): keyof CustomFieldValue {\n  switch (kind) {\n    case 'text':\n    case 'select':\n    case 'currency':\n    case 'dictionary':\n      return 'valueText'\n    case 'multiline':\n      return 'valueMultiline'\n    case 'integer':\n      return 'valueInt'\n    case 'float':\n      return 'valueFloat'\n    case 'boolean':\n      return 'valueBool'\n    default:\n      return 'valueText'\n  }\n}\n\nfunction columnFromJsValue(v: Primitive): keyof CustomFieldValue {\n  if (v === null || v === undefined) return 'valueText'\n  if (typeof v === 'boolean') return 'valueBool'\n  if (typeof v === 'number') return Number.isInteger(v) ? 'valueInt' : 'valueFloat'\n  return 'valueText'\n}\n\n// Clears all value columns to avoid leftovers on update\nfunction clearValueColumns(cf: CustomFieldValue) {\n  cf.valueText = null\n  cf.valueMultiline = null\n  cf.valueInt = null\n  cf.valueFloat = null\n  cf.valueBool = null\n}\n\nexport async function setRecordCustomFields(\n  em: EntityManager,\n  opts: SetRecordCustomFieldsOptions,\n): Promise<void> {\n  const { entityId, recordId, values } = opts\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const preferDefs = opts.preferDefs !== false\n\n  let defsByKey: Record<string, CustomFieldDef> | undefined\n  if (preferDefs) {\n    const defs = await em.find(CustomFieldDef, {\n      entityId,\n      isActive: true,\n      deletedAt: null,\n      organizationId: { $in: [organizationId, null] as any },\n      tenantId: { $in: [tenantId, null] as any },\n    })\n    const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n    defsByKey = {}\n    for (const d of defs) {\n      const existing = defsByKey[d.key]\n      if (!existing) {\n        defsByKey[d.key] = d\n        continue\n      }\n      const nextScore = scopeScore(d)\n      const existingScore = scopeScore(existing)\n      if (nextScore > existingScore) {\n        defsByKey[d.key] = d\n        continue\n      }\n      if (nextScore < existingScore) continue\n\n      const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const existingUpdatedAt = existing.updatedAt instanceof Date\n        ? existing.updatedAt.getTime()\n        : new Date(existing.updatedAt).getTime()\n      if (nextUpdatedAt >= existingUpdatedAt) {\n        defsByKey[d.key] = d\n      }\n    }\n  }\n\n  const toPersist: CustomFieldValue[] = []\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)\n    return encryptionService\n  }\n  const keys = Object.keys(values)\n  const presentKeyCount = keys.filter((key) => values[key] !== undefined).length\n  if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {\n    throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR)\n  }\n\n  for (const fieldKey of keys) {\n    const raw = values[fieldKey]\n    if (raw === undefined) continue\n\n    const def = defsByKey?.[fieldKey]\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const isArray = Array.isArray(raw)\n    // When array: remove existing values for key and create multiple rows\n    if (isArray) {\n      const arr = raw as Primitive[]\n      // Clear existing for this key\n      const existing = await em.find(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n      if (existing.length) existing.forEach((e) => em.remove(e))\n      for (const val of arr) {\n        const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)\n        const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n        clearValueColumns(cf)\n        const stored = encrypted\n          ? await encryptCustomFieldValue(val, tenantId, getEncryptionService(), encryptionCache)\n          : val\n        switch (col) {\n          case 'valueText': cf.valueText = stored == null ? null : String(stored); break\n          case 'valueMultiline': cf.valueMultiline = stored == null ? null : String(stored); break\n          case 'valueInt': cf.valueInt = stored == null ? null : Number(stored); break\n          case 'valueFloat': cf.valueFloat = stored == null ? null : Number(stored); break\n          case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break\n          default: cf.valueText = stored == null ? null : String(stored); break\n        }\n        toPersist.push(cf)\n      }\n      continue\n    }\n\n    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)\n    const storedValue = encrypted\n      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache)\n      : raw\n\n    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n    if (!cf) {\n      cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n      toPersist.push(cf)\n    }\n    clearValueColumns(cf)\n    switch (column) {\n      case 'valueText':\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueMultiline':\n        cf.valueMultiline = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueInt':\n        cf.valueInt = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueFloat':\n        cf.valueFloat = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueBool':\n        cf.valueBool = (storedValue as Primitive) == null ? null : Boolean(storedValue as Primitive)\n        break\n      default:\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n    }\n  }\n\n  if (toPersist.length) em.persist(toPersist)\n  await em.flush()\n  // Emit hook for indexing if requested (outside CRUD flows)\n  try {\n    if (typeof opts.onChanged === 'function') {\n      await opts.onChanged({ entityId, recordId, organizationId, tenantId })\n    }\n  } catch {\n    // Non-blocking\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,yBAAyB,sCAAsC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,wBAAwB;AAmBjD,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,kBAAkB,GAAsC;AAC/D,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,UAAW,QAAO;AACnC,MAAI,OAAO,MAAM,SAAU,QAAO,OAAO,UAAU,CAAC,IAAI,aAAa;AACrE,SAAO;AACT;AAGA,SAAS,kBAAkB,IAAsB;AAC/C,KAAG,YAAY;AACf,KAAG,iBAAiB;AACpB,KAAG,WAAW;AACd,KAAG,aAAa;AAChB,KAAG,YAAY;AACjB;AAEA,eAAsB,sBACpB,IACA,MACe;AACf,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI;AACvC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAS;AAAA,MACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAS;AAAA,IAC3C,CAAC;AACD,UAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,gBAAY,CAAC;AACb,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,UAAU,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,YAAM,YAAY,WAAW,CAAC;AAC9B,YAAM,gBAAgB,WAAW,QAAQ;AACzC,UAAI,YAAY,eAAe;AAC7B,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,UAAI,YAAY,cAAe;AAE/B,YAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,YAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,UAAI,iBAAiB,mBAAmB;AACtC,kBAAU,EAAE,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAgC,CAAC;AACvC,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAW,KAAK,iBAAiB;AACpF,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,QAAM,kBAAkB,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS,EAAE;AACxE,MAAI,cAAc,kBAAkB,kCAAkC;AACpE,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAEA,aAAW,YAAY,MAAM;AAC3B,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAI,QAAQ,OAAW;AAEvB,UAAM,MAAM,YAAY,QAAQ;AAChC,UAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,UAAM,UAAU,MAAM,QAAQ,GAAG;AAEjC,QAAI,SAAS;AACX,YAAM,MAAM;AAEZ,YAAM,WAAW,MAAM,GAAG,KAAK,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AAC3G,UAAI,SAAS,OAAQ,UAAS,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;AACzD,iBAAW,OAAO,KAAK;AACrB,cAAM,MAA8B,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAG;AACpH,cAAMA,MAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AACxH,0BAAkBA,GAAE;AACpB,cAAM,SAAS,YACX,MAAM,wBAAwB,KAAK,UAAU,qBAAqB,GAAG,eAAe,IACpF;AACJ,gBAAQ,KAAK;AAAA,UACX,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACzE,KAAK;AAAkB,YAAAA,IAAG,iBAAiB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACnF,KAAK;AAAY,YAAAA,IAAG,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACvE,KAAK;AAAc,YAAAA,IAAG,aAAa,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UAC3E,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,QAAQ,MAAM;AAAG;AAAA,UAC1E;AAAS,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,QAClE;AACA,kBAAU,KAAKA,GAAE;AAAA,MACnB;AACA;AAAA,IACF;AAEA,UAAM,SAAiC,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAgB;AACpI,UAAM,cAAc,YAChB,MAAM,wBAAwB,KAAkB,UAAU,qBAAqB,GAAG,eAAe,IACjG;AAEJ,QAAI,KAAK,MAAM,GAAG,QAAQ,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AACtG,QAAI,CAAC,IAAI;AACP,WAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AAClH,gBAAU,KAAK,EAAE;AAAA,IACnB;AACA,sBAAkB,EAAE;AACpB,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,MACF,KAAK;AACH,WAAG,iBAAkB,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC/F;AAAA,MACF,KAAK;AACH,WAAG,WAAY,eAA6B,OAAO,OAAO,OAAO,WAAwB;AACzF;AAAA,MACF,KAAK;AACH,WAAG,aAAc,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC3F;AAAA,MACF,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,QAAQ,WAAwB;AAC3F;AAAA,MACF;AACE,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,IACJ;AAAA,EACF;AAEA,MAAI,UAAU,OAAQ,IAAG,QAAQ,SAAS;AAC1C,QAAM,GAAG,MAAM;AAEf,MAAI;AACF,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,KAAK,UAAU,EAAE,UAAU,UAAU,gBAAgB,SAAS,CAAC;AAAA,IACvE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;",
   "names": ["cf"]
 }

package/dist/modules/entities/lib/validation.js

@@ -37,7 +37,9 @@ async function validateCustomFieldValuesServer(em, opts) {
       byKey.set(d.key, d);
     }
   }
-  return validateValuesAgainstDefs(opts.values, Array.from(byKey.values()));
+  return validateValuesAgainstDefs(opts.values, Array.from(byKey.values()), {
+    rejectUndeclaredKeys: opts.rejectUndeclaredKeys === true
+  });
 }
 export {
   validateCustomFieldValuesServer

package/dist/modules/entities/lib/validation.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/lib/validation.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport { CustomFieldDef } from '../data/entities'\nimport { validateValuesAgainstDefs } from '@open-mercato/shared/modules/entities/validation'\n\nexport async function validateCustomFieldValuesServer(\n  em: EntityManager,\n  opts: { entityId: string; organizationId?: string | null; tenantId?: string | null; values: Record<string, any> },\n): Promise<{ ok: boolean; fieldErrors: Record<string, string> }> {\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const defs = await em.find(CustomFieldDef, {\n    entityId: opts.entityId,\n    isActive: true,\n    deletedAt: null,\n    $and: [\n      {\n        $or: organizationId === null\n          ? [{ organizationId: null }]\n          : [{ organizationId }, { organizationId: null }],\n      },\n      {\n        $or: tenantId === null\n          ? [{ tenantId: null }]\n          : [{ tenantId }, { tenantId: null }],\n      },\n    ],\n  } as any)\n\n  // Prefer the most specific scope and newest definition for duplicate keys.\n  const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n  const byKey = new Map<string, CustomFieldDef>()\n  for (const d of defs) {\n    const existing = byKey.get(d.key)\n    if (!existing) {\n      byKey.set(d.key, d)\n      continue\n    }\n    const nextScore = scopeScore(d)\n    const existingScore = scopeScore(existing)\n    if (nextScore > existingScore) {\n      byKey.set(d.key, d)\n      continue\n    }\n    if (nextScore < existingScore) continue\n\n    const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n    const existingUpdatedAt = existing.updatedAt instanceof Date\n      ? existing.updatedAt.getTime()\n      : new Date(existing.updatedAt).getTime()\n    if (nextUpdatedAt >= existingUpdatedAt) {\n      byKey.set(d.key, d)\n    }\n  }\n  return validateValuesAgainstDefs(opts.values, Array.from(byKey.values()) as any)\n}\n"],
-  "mappings": "AACA,SAAS,sBAAsB;AAC/B,SAAS,iCAAiC;AAE1C,eAAsB,gCACpB,IACA,MAC+D;AAC/D,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,IACzC,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,WAAW;AAAA,IACX,MAAM;AAAA,MACJ;AAAA,QACE,KAAK,mBAAmB,OACpB,CAAC,EAAE,gBAAgB,KAAK,CAAC,IACzB,CAAC,EAAE,eAAe,GAAG,EAAE,gBAAgB,KAAK,CAAC;AAAA,MACnD;AAAA,MACA;AAAA,QACE,KAAK,aAAa,OACd,CAAC,EAAE,UAAU,KAAK,CAAC,IACnB,CAAC,EAAE,SAAS,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,MACvC;AAAA,IACF;AAAA,EACF,CAAQ;AAGR,QAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,QAAM,QAAQ,oBAAI,IAA4B;AAC9C,aAAW,KAAK,MAAM;AACpB,UAAM,WAAW,MAAM,IAAI,EAAE,GAAG;AAChC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,EAAE,KAAK,CAAC;AAClB;AAAA,IACF;AACA,UAAM,YAAY,WAAW,CAAC;AAC9B,UAAM,gBAAgB,WAAW,QAAQ;AACzC,QAAI,YAAY,eAAe;AAC7B,YAAM,IAAI,EAAE,KAAK,CAAC;AAClB;AAAA,IACF;AACA,QAAI,YAAY,cAAe;AAE/B,UAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,UAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,QAAI,iBAAiB,mBAAmB;AACtC,YAAM,IAAI,EAAE,KAAK,CAAC;AAAA,IACpB;AAAA,EACF;AACA,SAAO,0BAA0B,KAAK,QAAQ,MAAM,KAAK,MAAM,OAAO,CAAC,CAAQ;AACjF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport { CustomFieldDef } from '../data/entities'\nimport { validateValuesAgainstDefs } from '@open-mercato/shared/modules/entities/validation'\n\nexport async function validateCustomFieldValuesServer(\n  em: EntityManager,\n  opts: {\n    entityId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    values: Record<string, any>\n    rejectUndeclaredKeys?: boolean\n  },\n): Promise<{ ok: boolean; fieldErrors: Record<string, string> }> {\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const defs = await em.find(CustomFieldDef, {\n    entityId: opts.entityId,\n    isActive: true,\n    deletedAt: null,\n    $and: [\n      {\n        $or: organizationId === null\n          ? [{ organizationId: null }]\n          : [{ organizationId }, { organizationId: null }],\n      },\n      {\n        $or: tenantId === null\n          ? [{ tenantId: null }]\n          : [{ tenantId }, { tenantId: null }],\n      },\n    ],\n  } as any)\n\n  // Prefer the most specific scope and newest definition for duplicate keys.\n  const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n  const byKey = new Map<string, CustomFieldDef>()\n  for (const d of defs) {\n    const existing = byKey.get(d.key)\n    if (!existing) {\n      byKey.set(d.key, d)\n      continue\n    }\n    const nextScore = scopeScore(d)\n    const existingScore = scopeScore(existing)\n    if (nextScore > existingScore) {\n      byKey.set(d.key, d)\n      continue\n    }\n    if (nextScore < existingScore) continue\n\n    const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n    const existingUpdatedAt = existing.updatedAt instanceof Date\n      ? existing.updatedAt.getTime()\n      : new Date(existing.updatedAt).getTime()\n    if (nextUpdatedAt >= existingUpdatedAt) {\n      byKey.set(d.key, d)\n    }\n  }\n  return validateValuesAgainstDefs(opts.values, Array.from(byKey.values()) as any, {\n    rejectUndeclaredKeys: opts.rejectUndeclaredKeys === true,\n  })\n}\n"],
+  "mappings": "AACA,SAAS,sBAAsB;AAC/B,SAAS,iCAAiC;AAE1C,eAAsB,gCACpB,IACA,MAO+D;AAC/D,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,IACzC,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,WAAW;AAAA,IACX,MAAM;AAAA,MACJ;AAAA,QACE,KAAK,mBAAmB,OACpB,CAAC,EAAE,gBAAgB,KAAK,CAAC,IACzB,CAAC,EAAE,eAAe,GAAG,EAAE,gBAAgB,KAAK,CAAC;AAAA,MACnD;AAAA,MACA;AAAA,QACE,KAAK,aAAa,OACd,CAAC,EAAE,UAAU,KAAK,CAAC,IACnB,CAAC,EAAE,SAAS,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,MACvC;AAAA,IACF;AAAA,EACF,CAAQ;AAGR,QAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,QAAM,QAAQ,oBAAI,IAA4B;AAC9C,aAAW,KAAK,MAAM;AACpB,UAAM,WAAW,MAAM,IAAI,EAAE,GAAG;AAChC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,EAAE,KAAK,CAAC;AAClB;AAAA,IACF;AACA,UAAM,YAAY,WAAW,CAAC;AAC9B,UAAM,gBAAgB,WAAW,QAAQ;AACzC,QAAI,YAAY,eAAe;AAC7B,YAAM,IAAI,EAAE,KAAK,CAAC;AAClB;AAAA,IACF;AACA,QAAI,YAAY,cAAe;AAE/B,UAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,UAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,QAAI,iBAAiB,mBAAmB;AACtC,YAAM,IAAI,EAAE,KAAK,CAAC;AAAA,IACpB;AAAA,EACF;AACA,SAAO,0BAA0B,KAAK,QAAQ,MAAM,KAAK,MAAM,OAAO,CAAC,GAAU;AAAA,IAC/E,sBAAsB,KAAK,yBAAyB;AAAA,EACtD,CAAC;AACH;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js

@@ -5,6 +5,8 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { LockMode } from "@mikro-orm/core";
 import { StaffTimeEntry, StaffTimeEntrySegment } from "../../../../../../data/entities.js";
 import { staffTimeEntrySegmentUpdateSchema } from "../../../../../../data/validators.js";
 import { getStaffMemberByUserId } from "../../../../../../lib/staffMemberResolver.js";
@@ -93,23 +95,54 @@ async function PATCH(req) {
       { status: guardResult.errorStatus ?? 422 }
     );
   }
-  if (parsed.data.startedAt !== void 0) {
-    segment.startedAt = parsed.data.startedAt;
-  }
-  if (parsed.data.endedAt !== void 0) {
-    segment.endedAt = parsed.data.endedAt ?? null;
-  }
-  if (parsed.data.segmentType !== void 0) {
-    segment.segmentType = parsed.data.segmentType;
+  let updatedSegment;
+  try {
+    updatedSegment = await em.transactional(async (trx) => {
+      const lockedEntry = await findOneWithDecryption(
+        trx,
+        StaffTimeEntry,
+        { id: ids.entryId, tenantId, organizationId, deletedAt: null },
+        { lockMode: LockMode.PESSIMISTIC_WRITE },
+        scopeCtx
+      );
+      if (!lockedEntry) {
+        throw new CrudHttpError(404, { error: "Time entry not found" });
+      }
+      const lockedSegment = await findOneWithDecryption(
+        trx,
+        StaffTimeEntrySegment,
+        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },
+        {},
+        scopeCtx
+      );
+      if (!lockedSegment) {
+        throw new CrudHttpError(404, { error: "Segment not found" });
+      }
+      if (parsed.data.startedAt !== void 0) {
+        lockedSegment.startedAt = parsed.data.startedAt;
+      }
+      if (parsed.data.endedAt !== void 0) {
+        lockedSegment.endedAt = parsed.data.endedAt ?? null;
+      }
+      if (parsed.data.segmentType !== void 0) {
+        lockedSegment.segmentType = parsed.data.segmentType;
+      }
+      await trx.flush();
+      return lockedSegment;
+    });
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    throw err;
   }
-  await em.flush();
   if (guardResult.afterSuccessCallbacks.length) {
     await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
       tenantId,
       organizationId,
       userId: auth.sub ?? "",
       resourceKind: "staff.timesheets.time_entry_segment",
-      resourceId: segment.id,
+      resourceId: updatedSegment.id,
       operation: "update",
       requestMethod: req.method,
       requestHeaders: req.headers
@@ -118,13 +151,13 @@ async function PATCH(req) {
   return NextResponse.json({
     ok: true,
     item: {
-      id: segment.id,
-      timeEntryId: segment.timeEntryId,
-      startedAt: segment.startedAt,
-      endedAt: segment.endedAt,
-      segmentType: segment.segmentType,
-      createdAt: segment.createdAt,
-      updatedAt: segment.updatedAt
+      id: updatedSegment.id,
+      timeEntryId: updatedSegment.timeEntryId,
+      startedAt: updatedSegment.startedAt,
+      endedAt: updatedSegment.endedAt,
+      segmentType: updatedSegment.segmentType,
+      createdAt: updatedSegment.createdAt,
+      updatedAt: updatedSegment.updatedAt
     }
   });
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/segments/%5BsegmentId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...rawBody, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry_segment',\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  if (parsed.data.startedAt !== undefined) {\n    segment.startedAt = parsed.data.startedAt\n  }\n  if (parsed.data.endedAt !== undefined) {\n    segment.endedAt = parsed.data.endedAt ?? null\n  }\n  if (parsed.data.segmentType !== undefined) {\n    segment.segmentType = parsed.data.segmentType\n  }\n\n  await em.flush()\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry_segment',\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      startedAt: segment.startedAt,\n      endedAt: segment.endedAt,\n      segmentType: segment.segmentType,\n      createdAt: segment.createdAt,\n      updatedAt: segment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,SAAS,IAAI,IAAI,UAAU,CAAC;AAC5F,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,cAAc,QAAW;AACvC,YAAQ,YAAY,OAAO,KAAK;AAAA,EAClC;AACA,MAAI,OAAO,KAAK,YAAY,QAAW;AACrC,YAAQ,UAAU,OAAO,KAAK,WAAW;AAAA,EAC3C;AACA,MAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,YAAQ,cAAc,OAAO,KAAK;AAAA,EACpC;AAEA,QAAM,GAAG,MAAM;AAEf,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ;AAAA,MACjB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...rawBody, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry_segment',\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry_segment',\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,SAAS,IAAI,IAAI,UAAU,CAAC;AAC5F,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }