@open-mercato/core 0.6.5-develop.4616.1.0cd64e1448 → 0.6.5-develop.4629.1.3ef70cd6a4

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3172 entry points
+[build:core] found 3184 entry points
 [build:core] built successfully
 [build:core:generated] found 185 entry points
 [build:core:generated] built successfully

package/dist/helpers/integration/undoHarness.js

@@ -0,0 +1,81 @@
+import { expect } from "@playwright/test";
+import { apiRequest } from "./api.js";
+const HEADER_PREFIX = "omop:";
+const UNDO_PATH = "/api/audit_logs/audit-logs/actions/undo";
+const REDO_PATH = "/api/audit_logs/audit-logs/actions/redo";
+const ACTIONS_PATH = "/api/audit_logs/audit-logs/actions";
+function extractOperation(response) {
+  const header = response.headers()["x-om-operation"];
+  if (!header || typeof header !== "string") return null;
+  const trimmed = header.startsWith(HEADER_PREFIX) ? header.slice(HEADER_PREFIX.length) : header;
+  try {
+    const parsed = JSON.parse(decodeURIComponent(trimmed));
+    if (typeof parsed.id !== "string" || typeof parsed.commandId !== "string") return null;
+    if (typeof parsed.undoToken !== "string" || !parsed.undoToken) return null;
+    return {
+      logId: parsed.id,
+      undoToken: parsed.undoToken,
+      commandId: parsed.commandId,
+      resourceKind: parsed.resourceKind ?? null,
+      resourceId: parsed.resourceId ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+function expectOperation(response, context) {
+  const op = extractOperation(response);
+  expect(op, `Expected an undo token (x-om-operation header) for ${context}, got none`).toBeTruthy();
+  return op;
+}
+async function undoByToken(request, token, undoToken) {
+  return apiRequest(request, "POST", UNDO_PATH, { token, data: { undoToken } });
+}
+async function redoByLogId(request, token, logId) {
+  return apiRequest(request, "POST", REDO_PATH, { token, data: { logId } });
+}
+async function undoOk(request, token, undoToken, context) {
+  const res = await undoByToken(request, token, undoToken);
+  const body = await res.json().catch(() => null);
+  expect(res.ok(), `Undo failed for ${context}: status ${res.status()} body ${JSON.stringify(body)}`).toBeTruthy();
+  expect(body?.ok, `Undo not ok for ${context}: ${JSON.stringify(body)}`).toBeTruthy();
+  return body?.logId;
+}
+async function redoOk(request, token, logId, context) {
+  const res = await redoByLogId(request, token, logId);
+  const body = await res.json().catch(() => null);
+  expect(res.ok(), `Redo failed for ${context}: status ${res.status()} body ${JSON.stringify(body)}`).toBeTruthy();
+  expect(body?.ok, `Redo not ok for ${context}: ${JSON.stringify(body)}`).toBeTruthy();
+  return { logId: body?.logId, undoToken: body?.undoToken ?? null };
+}
+async function expectTokenConsumed(request, token, undoToken, context) {
+  const res = await undoByToken(request, token, undoToken);
+  expect(res.ok(), `Expected double-undo to be rejected for ${context}, but it succeeded`).toBeFalsy();
+}
+async function listUndoable(request, token, params = {}) {
+  const qs = new URLSearchParams({ undoableOnly: "true", ...params }).toString();
+  const res = await apiRequest(request, "GET", `${ACTIONS_PATH}?${qs}`, { token });
+  return res.json().catch(() => null);
+}
+function assertFieldsEqual(actual, expected, fields, context) {
+  expect(actual, `${context}: actual entity missing`).toBeTruthy();
+  expect(expected, `${context}: expected entity missing`).toBeTruthy();
+  for (const field of fields) {
+    expect(
+      JSON.stringify(actual[field]),
+      `${context}: field "${field}" not restored (expected ${JSON.stringify(expected[field])}, got ${JSON.stringify(actual[field])})`
+    ).toBe(JSON.stringify(expected[field]));
+  }
+}
+export {
+  assertFieldsEqual,
+  expectOperation,
+  expectTokenConsumed,
+  extractOperation,
+  listUndoable,
+  redoByLogId,
+  redoOk,
+  undoByToken,
+  undoOk
+};
+//# sourceMappingURL=undoHarness.js.map

package/dist/helpers/integration/undoHarness.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/undoHarness.ts"],
+  "sourcesContent": ["import { type APIRequestContext, type APIResponse, expect } from '@playwright/test'\nimport { apiRequest } from './api'\n\n/**\n * Shared harness for verifying Undo/Redo correctness against the real command bus.\n *\n * Every mutating Open Mercato API response carries the operation metadata in the\n * `x-om-operation` header (`omop:<urlencoded JSON>`) containing the `undoToken` and the\n * audit log `id` (used as `logId` for redo). These helpers extract that envelope and drive\n * the real undo/redo endpoints so tests can assert full state restoration per TC-UNDO-001.\n */\n\nconst HEADER_PREFIX = 'omop:'\nconst UNDO_PATH = '/api/audit_logs/audit-logs/actions/undo'\nconst REDO_PATH = '/api/audit_logs/audit-logs/actions/redo'\nconst ACTIONS_PATH = '/api/audit_logs/audit-logs/actions'\n\nexport type Operation = {\n  logId: string\n  undoToken: string\n  commandId: string\n  resourceKind: string | null\n  resourceId: string | null\n}\n\n/** Parse the `x-om-operation` header into a structured operation, or null when absent/malformed. */\nexport function extractOperation(response: APIResponse): Operation | null {\n  const header = response.headers()['x-om-operation']\n  if (!header || typeof header !== 'string') return null\n  const trimmed = header.startsWith(HEADER_PREFIX) ? header.slice(HEADER_PREFIX.length) : header\n  try {\n    const parsed = JSON.parse(decodeURIComponent(trimmed)) as Record<string, unknown>\n    if (typeof parsed.id !== 'string' || typeof parsed.commandId !== 'string') return null\n    if (typeof parsed.undoToken !== 'string' || !parsed.undoToken) return null\n    return {\n      logId: parsed.id,\n      undoToken: parsed.undoToken,\n      commandId: parsed.commandId,\n      resourceKind: (parsed.resourceKind as string) ?? null,\n      resourceId: (parsed.resourceId as string) ?? null,\n    }\n  } catch {\n    return null\n  }\n}\n\n/** Like extractOperation but fails the test if no undo token was issued. */\nexport function expectOperation(response: APIResponse, context: string): Operation {\n  const op = extractOperation(response)\n  expect(op, `Expected an undo token (x-om-operation header) for ${context}, got none`).toBeTruthy()\n  return op as Operation\n}\n\nexport async function undoByToken(request: APIRequestContext, token: string, undoToken: string): Promise<APIResponse> {\n  return apiRequest(request, 'POST', UNDO_PATH, { token, data: { undoToken } })\n}\n\nexport async function redoByLogId(request: APIRequestContext, token: string, logId: string): Promise<APIResponse> {\n  return apiRequest(request, 'POST', REDO_PATH, { token, data: { logId } })\n}\n\n/** Undo and assert success; returns the resolved logId. */\nexport async function undoOk(request: APIRequestContext, token: string, undoToken: string, context: string): Promise<string> {\n  const res = await undoByToken(request, token, undoToken)\n  const body = (await res.json().catch(() => null)) as { ok?: boolean; logId?: string } | null\n  expect(res.ok(), `Undo failed for ${context}: status ${res.status()} body ${JSON.stringify(body)}`).toBeTruthy()\n  expect(body?.ok, `Undo not ok for ${context}: ${JSON.stringify(body)}`).toBeTruthy()\n  return body?.logId as string\n}\n\n/** Redo and assert success; returns the new operation (new undoToken + logId). */\nexport async function redoOk(request: APIRequestContext, token: string, logId: string, context: string): Promise<{ logId: string; undoToken: string | null }> {\n  const res = await redoByLogId(request, token, logId)\n  const body = (await res.json().catch(() => null)) as { ok?: boolean; logId?: string; undoToken?: string } | null\n  expect(res.ok(), `Redo failed for ${context}: status ${res.status()} body ${JSON.stringify(body)}`).toBeTruthy()\n  expect(body?.ok, `Redo not ok for ${context}: ${JSON.stringify(body)}`).toBeTruthy()\n  return { logId: body?.logId as string, undoToken: body?.undoToken ?? null }\n}\n\n/** Assert that undoing an already-consumed token is rejected (token consumption / no double-undo). */\nexport async function expectTokenConsumed(request: APIRequestContext, token: string, undoToken: string, context: string): Promise<void> {\n  const res = await undoByToken(request, token, undoToken)\n  expect(res.ok(), `Expected double-undo to be rejected for ${context}, but it succeeded`).toBeFalsy()\n}\n\n/** Fetch undoable actions list (for Version History assertions). */\nexport async function listUndoable(request: APIRequestContext, token: string, params: Record<string, string> = {}): Promise<unknown> {\n  const qs = new URLSearchParams({ undoableOnly: 'true', ...params }).toString()\n  const res = await apiRequest(request, 'GET', `${ACTIONS_PATH}?${qs}`, { token })\n  return res.json().catch(() => null)\n}\n\n/**\n * Deep-equality assertion for a selected set of fields between two entity snapshots.\n * Reports the first mismatching field with context for clear bug triage.\n */\nexport function assertFieldsEqual(\n  actual: Record<string, unknown> | null | undefined,\n  expected: Record<string, unknown> | null | undefined,\n  fields: string[],\n  context: string,\n): void {\n  expect(actual, `${context}: actual entity missing`).toBeTruthy()\n  expect(expected, `${context}: expected entity missing`).toBeTruthy()\n  for (const field of fields) {\n    expect(\n      JSON.stringify((actual as Record<string, unknown>)[field]),\n      `${context}: field \"${field}\" not restored (expected ${JSON.stringify((expected as Record<string, unknown>)[field])}, got ${JSON.stringify((actual as Record<string, unknown>)[field])})`,\n    ).toBe(JSON.stringify((expected as Record<string, unknown>)[field]))\n  }\n}\n"],
+  "mappings": "AAAA,SAAmD,cAAc;AACjE,SAAS,kBAAkB;AAW3B,MAAM,gBAAgB;AACtB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,eAAe;AAWd,SAAS,iBAAiB,UAAyC;AACxE,QAAM,SAAS,SAAS,QAAQ,EAAE,gBAAgB;AAClD,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,UAAU,OAAO,WAAW,aAAa,IAAI,OAAO,MAAM,cAAc,MAAM,IAAI;AACxF,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,mBAAmB,OAAO,CAAC;AACrD,QAAI,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,cAAc,SAAU,QAAO;AAClF,QAAI,OAAO,OAAO,cAAc,YAAY,CAAC,OAAO,UAAW,QAAO;AACtE,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO;AAAA,MAClB,cAAe,OAAO,gBAA2B;AAAA,MACjD,YAAa,OAAO,cAAyB;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,UAAuB,SAA4B;AACjF,QAAM,KAAK,iBAAiB,QAAQ;AACpC,SAAO,IAAI,sDAAsD,OAAO,YAAY,EAAE,WAAW;AACjG,SAAO;AACT;AAEA,eAAsB,YAAY,SAA4B,OAAe,WAAyC;AACpH,SAAO,WAAW,SAAS,QAAQ,WAAW,EAAE,OAAO,MAAM,EAAE,UAAU,EAAE,CAAC;AAC9E;AAEA,eAAsB,YAAY,SAA4B,OAAe,OAAqC;AAChH,SAAO,WAAW,SAAS,QAAQ,WAAW,EAAE,OAAO,MAAM,EAAE,MAAM,EAAE,CAAC;AAC1E;AAGA,eAAsB,OAAO,SAA4B,OAAe,WAAmB,SAAkC;AAC3H,QAAM,MAAM,MAAM,YAAY,SAAS,OAAO,SAAS;AACvD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,SAAO,IAAI,GAAG,GAAG,mBAAmB,OAAO,YAAY,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,EAAE,EAAE,WAAW;AAC/G,SAAO,MAAM,IAAI,mBAAmB,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC,EAAE,EAAE,WAAW;AACnF,SAAO,MAAM;AACf;AAGA,eAAsB,OAAO,SAA4B,OAAe,OAAe,SAAuE;AAC5J,QAAM,MAAM,MAAM,YAAY,SAAS,OAAO,KAAK;AACnD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,SAAO,IAAI,GAAG,GAAG,mBAAmB,OAAO,YAAY,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,EAAE,EAAE,WAAW;AAC/G,SAAO,MAAM,IAAI,mBAAmB,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC,EAAE,EAAE,WAAW;AACnF,SAAO,EAAE,OAAO,MAAM,OAAiB,WAAW,MAAM,aAAa,KAAK;AAC5E;AAGA,eAAsB,oBAAoB,SAA4B,OAAe,WAAmB,SAAgC;AACtI,QAAM,MAAM,MAAM,YAAY,SAAS,OAAO,SAAS;AACvD,SAAO,IAAI,GAAG,GAAG,2CAA2C,OAAO,oBAAoB,EAAE,UAAU;AACrG;AAGA,eAAsB,aAAa,SAA4B,OAAe,SAAiC,CAAC,GAAqB;AACnI,QAAM,KAAK,IAAI,gBAAgB,EAAE,cAAc,QAAQ,GAAG,OAAO,CAAC,EAAE,SAAS;AAC7E,QAAM,MAAM,MAAM,WAAW,SAAS,OAAO,GAAG,YAAY,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC;AAC/E,SAAO,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACpC;AAMO,SAAS,kBACd,QACA,UACA,QACA,SACM;AACN,SAAO,QAAQ,GAAG,OAAO,yBAAyB,EAAE,WAAW;AAC/D,SAAO,UAAU,GAAG,OAAO,2BAA2B,EAAE,WAAW;AACnE,aAAW,SAAS,QAAQ;AAC1B;AAAA,MACE,KAAK,UAAW,OAAmC,KAAK,CAAC;AAAA,MACzD,GAAG,OAAO,YAAY,KAAK,4BAA4B,KAAK,UAAW,SAAqC,KAAK,CAAC,CAAC,SAAS,KAAK,UAAW,OAAmC,KAAK,CAAC,CAAC;AAAA,IACxL,EAAE,KAAK,KAAK,UAAW,SAAqC,KAAK,CAAC,CAAC;AAAA,EACrE;AACF;",
+  "names": []
+}

package/dist/modules/entities/lib/helpers.js

@@ -93,8 +93,7 @@ async function setRecordCustomFields(em, opts) {
     const isArray = Array.isArray(raw);
     if (isArray) {
       const arr = raw;
-      const existing = await em.find(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey });
-      if (existing.length) existing.forEach((e) => em.remove(e));
+      const replacements = [];
       for (const val of arr) {
         const col = encrypted ? "valueText" : def ? columnFromKind(def.kind) : columnFromJsValue(val);
         const cf2 = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: /* @__PURE__ */ new Date() });
@@ -120,8 +119,10 @@ async function setRecordCustomFields(em, opts) {
             cf2.valueText = stored == null ? null : String(stored);
             break;
         }
-        toPersist.push(cf2);
+        replacements.push(cf2);
       }
+      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey });
+      toPersist.push(...replacements);
       continue;
     }
     const column = encrypted ? "valueText" : def ? columnFromKind(def.kind) : columnFromJsValue(raw);

package/dist/modules/entities/lib/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/lib/helpers.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport {\n  MAX_CUSTOM_FIELD_KEYS_PER_RECORD,\n  TOO_MANY_CUSTOM_FIELDS_ERROR,\n} from '@open-mercato/shared/modules/entities/validation'\nimport { CustomFieldDef, CustomFieldValue } from '../data/entities'\n\ntype Primitive = string | number | boolean | null | undefined\ntype PrimitiveOrArray = Primitive | Primitive[]\n\nexport type SetRecordCustomFieldsOptions = {\n  entityId: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  values: Record<string, PrimitiveOrArray>\n  // When true (default), try to use field definitions to decide storage column\n  preferDefs?: boolean\n  // Optional: notify external systems (e.g., indexing) when values changed\n  onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void\n  // Optional: re-use an existing tenant encryption service instance\n  encryptionService?: TenantDataEncryptionService | null\n}\n\nfunction columnFromKind(kind: string): keyof CustomFieldValue {\n  switch (kind) {\n    case 'text':\n    case 'select':\n    case 'currency':\n    case 'dictionary':\n      return 'valueText'\n    case 'multiline':\n      return 'valueMultiline'\n    case 'integer':\n      return 'valueInt'\n    case 'float':\n      return 'valueFloat'\n    case 'boolean':\n      return 'valueBool'\n    default:\n      return 'valueText'\n  }\n}\n\nfunction columnFromJsValue(v: Primitive): keyof CustomFieldValue {\n  if (v === null || v === undefined) return 'valueText'\n  if (typeof v === 'boolean') return 'valueBool'\n  if (typeof v === 'number') return Number.isInteger(v) ? 'valueInt' : 'valueFloat'\n  return 'valueText'\n}\n\n// Clears all value columns to avoid leftovers on update\nfunction clearValueColumns(cf: CustomFieldValue) {\n  cf.valueText = null\n  cf.valueMultiline = null\n  cf.valueInt = null\n  cf.valueFloat = null\n  cf.valueBool = null\n}\n\nexport async function setRecordCustomFields(\n  em: EntityManager,\n  opts: SetRecordCustomFieldsOptions,\n): Promise<void> {\n  const { entityId, recordId, values } = opts\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const preferDefs = opts.preferDefs !== false\n\n  let defsByKey: Record<string, CustomFieldDef> | undefined\n  if (preferDefs) {\n    const defs = await em.find(CustomFieldDef, {\n      entityId,\n      isActive: true,\n      deletedAt: null,\n      organizationId: { $in: [organizationId, null] as any },\n      tenantId: { $in: [tenantId, null] as any },\n    })\n    const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n    defsByKey = {}\n    for (const d of defs) {\n      const existing = defsByKey[d.key]\n      if (!existing) {\n        defsByKey[d.key] = d\n        continue\n      }\n      const nextScore = scopeScore(d)\n      const existingScore = scopeScore(existing)\n      if (nextScore > existingScore) {\n        defsByKey[d.key] = d\n        continue\n      }\n      if (nextScore < existingScore) continue\n\n      const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const existingUpdatedAt = existing.updatedAt instanceof Date\n        ? existing.updatedAt.getTime()\n        : new Date(existing.updatedAt).getTime()\n      if (nextUpdatedAt >= existingUpdatedAt) {\n        defsByKey[d.key] = d\n      }\n    }\n  }\n\n  const toPersist: CustomFieldValue[] = []\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)\n    return encryptionService\n  }\n  const keys = Object.keys(values)\n  const presentKeyCount = keys.filter((key) => values[key] !== undefined).length\n  if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {\n    throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR)\n  }\n\n  for (const fieldKey of keys) {\n    const raw = values[fieldKey]\n    if (raw === undefined) continue\n\n    const def = defsByKey?.[fieldKey]\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const isArray = Array.isArray(raw)\n    // When array: remove existing values for key and create multiple rows\n    if (isArray) {\n      const arr = raw as Primitive[]\n      // Clear existing for this key\n      const existing = await em.find(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n      if (existing.length) existing.forEach((e) => em.remove(e))\n      for (const val of arr) {\n        const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)\n        const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n        clearValueColumns(cf)\n        const stored = encrypted\n          ? await encryptCustomFieldValue(val, tenantId, getEncryptionService(), encryptionCache)\n          : val\n        switch (col) {\n          case 'valueText': cf.valueText = stored == null ? null : String(stored); break\n          case 'valueMultiline': cf.valueMultiline = stored == null ? null : String(stored); break\n          case 'valueInt': cf.valueInt = stored == null ? null : Number(stored); break\n          case 'valueFloat': cf.valueFloat = stored == null ? null : Number(stored); break\n          case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break\n          default: cf.valueText = stored == null ? null : String(stored); break\n        }\n        toPersist.push(cf)\n      }\n      continue\n    }\n\n    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)\n    const storedValue = encrypted\n      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache)\n      : raw\n\n    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n    if (!cf) {\n      cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n      toPersist.push(cf)\n    }\n    clearValueColumns(cf)\n    switch (column) {\n      case 'valueText':\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueMultiline':\n        cf.valueMultiline = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueInt':\n        cf.valueInt = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueFloat':\n        cf.valueFloat = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueBool':\n        cf.valueBool = (storedValue as Primitive) == null ? null : Boolean(storedValue as Primitive)\n        break\n      default:\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n    }\n  }\n\n  if (toPersist.length) em.persist(toPersist)\n  await em.flush()\n  if (process.env.OM_CF_DEBUG) {\n    try {\n      const conn = em.getConnection()\n      for (const fieldKey of keys) {\n        if (values[fieldKey] === undefined) continue\n        const rows = await conn.execute(\n          'select value_text, value_multiline, value_int, value_float, value_bool from custom_field_values where entity_id = ? and record_id = ? and field_key = ? and ((organization_id is null and ? is null) or organization_id = ?) and ((tenant_id is null and ? is null) or tenant_id = ?)',\n          [entityId, recordId, fieldKey, organizationId, organizationId, tenantId, tenantId],\n          'all',\n        ) as Array<Record<string, unknown>>\n        const persisted = rows.map((row) => row.value_text ?? row.value_multiline ?? row.value_int ?? row.value_float ?? row.value_bool)\n        console.warn(`[CF_DEBUG] setRecordCustomFields entityId=${entityId} recordId=${recordId} fieldKey=${fieldKey} input=${JSON.stringify(values[fieldKey])} persistedRows=${rows.length} persisted=${JSON.stringify(persisted)}`)\n      }\n    } catch (err) {\n      console.warn(`[CF_DEBUG] re-query failed: ${(err as Error)?.message ?? String(err)}`)\n    }\n  }\n  // Emit hook for indexing if requested (outside CRUD flows)\n  try {\n    if (typeof opts.onChanged === 'function') {\n      await opts.onChanged({ entityId, recordId, organizationId, tenantId })\n    }\n  } catch {\n    // Non-blocking\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,yBAAyB,sCAAsC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,wBAAwB;AAmBjD,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,kBAAkB,GAAsC;AAC/D,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,UAAW,QAAO;AACnC,MAAI,OAAO,MAAM,SAAU,QAAO,OAAO,UAAU,CAAC,IAAI,aAAa;AACrE,SAAO;AACT;AAGA,SAAS,kBAAkB,IAAsB;AAC/C,KAAG,YAAY;AACf,KAAG,iBAAiB;AACpB,KAAG,WAAW;AACd,KAAG,aAAa;AAChB,KAAG,YAAY;AACjB;AAEA,eAAsB,sBACpB,IACA,MACe;AACf,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI;AACvC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAS;AAAA,MACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAS;AAAA,IAC3C,CAAC;AACD,UAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,gBAAY,CAAC;AACb,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,UAAU,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,YAAM,YAAY,WAAW,CAAC;AAC9B,YAAM,gBAAgB,WAAW,QAAQ;AACzC,UAAI,YAAY,eAAe;AAC7B,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,UAAI,YAAY,cAAe;AAE/B,YAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,YAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,UAAI,iBAAiB,mBAAmB;AACtC,kBAAU,EAAE,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAgC,CAAC;AACvC,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAW,KAAK,iBAAiB;AACpF,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,QAAM,kBAAkB,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS,EAAE;AACxE,MAAI,cAAc,kBAAkB,kCAAkC;AACpE,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAEA,aAAW,YAAY,MAAM;AAC3B,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAI,QAAQ,OAAW;AAEvB,UAAM,MAAM,YAAY,QAAQ;AAChC,UAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,UAAM,UAAU,MAAM,QAAQ,GAAG;AAEjC,QAAI,SAAS;AACX,YAAM,MAAM;AAEZ,YAAM,WAAW,MAAM,GAAG,KAAK,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AAC3G,UAAI,SAAS,OAAQ,UAAS,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;AACzD,iBAAW,OAAO,KAAK;AACrB,cAAM,MAA8B,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAG;AACpH,cAAMA,MAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AACxH,0BAAkBA,GAAE;AACpB,cAAM,SAAS,YACX,MAAM,wBAAwB,KAAK,UAAU,qBAAqB,GAAG,eAAe,IACpF;AACJ,gBAAQ,KAAK;AAAA,UACX,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACzE,KAAK;AAAkB,YAAAA,IAAG,iBAAiB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACnF,KAAK;AAAY,YAAAA,IAAG,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACvE,KAAK;AAAc,YAAAA,IAAG,aAAa,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UAC3E,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,QAAQ,MAAM;AAAG;AAAA,UAC1E;AAAS,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,QAClE;AACA,kBAAU,KAAKA,GAAE;AAAA,MACnB;AACA;AAAA,IACF;AAEA,UAAM,SAAiC,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAgB;AACpI,UAAM,cAAc,YAChB,MAAM,wBAAwB,KAAkB,UAAU,qBAAqB,GAAG,eAAe,IACjG;AAEJ,QAAI,KAAK,MAAM,GAAG,QAAQ,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AACtG,QAAI,CAAC,IAAI;AACP,WAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AAClH,gBAAU,KAAK,EAAE;AAAA,IACnB;AACA,sBAAkB,EAAE;AACpB,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,MACF,KAAK;AACH,WAAG,iBAAkB,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC/F;AAAA,MACF,KAAK;AACH,WAAG,WAAY,eAA6B,OAAO,OAAO,OAAO,WAAwB;AACzF;AAAA,MACF,KAAK;AACH,WAAG,aAAc,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC3F;AAAA,MACF,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,QAAQ,WAAwB;AAC3F;AAAA,MACF;AACE,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,IACJ;AAAA,EACF;AAEA,MAAI,UAAU,OAAQ,IAAG,QAAQ,SAAS;AAC1C,QAAM,GAAG,MAAM;AACf,MAAI,QAAQ,IAAI,aAAa;AAC3B,QAAI;AACF,YAAM,OAAO,GAAG,cAAc;AAC9B,iBAAW,YAAY,MAAM;AAC3B,YAAI,OAAO,QAAQ,MAAM,OAAW;AACpC,cAAM,OAAO,MAAM,KAAK;AAAA,UACtB;AAAA,UACA,CAAC,UAAU,UAAU,UAAU,gBAAgB,gBAAgB,UAAU,QAAQ;AAAA,UACjF;AAAA,QACF;AACA,cAAM,YAAY,KAAK,IAAI,CAAC,QAAQ,IAAI,cAAc,IAAI,mBAAmB,IAAI,aAAa,IAAI,eAAe,IAAI,UAAU;AAC/H,gBAAQ,KAAK,6CAA6C,QAAQ,aAAa,QAAQ,aAAa,QAAQ,UAAU,KAAK,UAAU,OAAO,QAAQ,CAAC,CAAC,kBAAkB,KAAK,MAAM,cAAc,KAAK,UAAU,SAAS,CAAC,EAAE;AAAA,MAC9N;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,KAAK,+BAAgC,KAAe,WAAW,OAAO,GAAG,CAAC,EAAE;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,KAAK,UAAU,EAAE,UAAU,UAAU,gBAAgB,SAAS,CAAC;AAAA,IACvE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport {\n  MAX_CUSTOM_FIELD_KEYS_PER_RECORD,\n  TOO_MANY_CUSTOM_FIELDS_ERROR,\n} from '@open-mercato/shared/modules/entities/validation'\nimport { CustomFieldDef, CustomFieldValue } from '../data/entities'\n\ntype Primitive = string | number | boolean | null | undefined\ntype PrimitiveOrArray = Primitive | Primitive[]\n\nexport type SetRecordCustomFieldsOptions = {\n  entityId: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  values: Record<string, PrimitiveOrArray>\n  // When true (default), try to use field definitions to decide storage column\n  preferDefs?: boolean\n  // Optional: notify external systems (e.g., indexing) when values changed\n  onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void\n  // Optional: re-use an existing tenant encryption service instance\n  encryptionService?: TenantDataEncryptionService | null\n}\n\nfunction columnFromKind(kind: string): keyof CustomFieldValue {\n  switch (kind) {\n    case 'text':\n    case 'select':\n    case 'currency':\n    case 'dictionary':\n      return 'valueText'\n    case 'multiline':\n      return 'valueMultiline'\n    case 'integer':\n      return 'valueInt'\n    case 'float':\n      return 'valueFloat'\n    case 'boolean':\n      return 'valueBool'\n    default:\n      return 'valueText'\n  }\n}\n\nfunction columnFromJsValue(v: Primitive): keyof CustomFieldValue {\n  if (v === null || v === undefined) return 'valueText'\n  if (typeof v === 'boolean') return 'valueBool'\n  if (typeof v === 'number') return Number.isInteger(v) ? 'valueInt' : 'valueFloat'\n  return 'valueText'\n}\n\n// Clears all value columns to avoid leftovers on update\nfunction clearValueColumns(cf: CustomFieldValue) {\n  cf.valueText = null\n  cf.valueMultiline = null\n  cf.valueInt = null\n  cf.valueFloat = null\n  cf.valueBool = null\n}\n\nexport async function setRecordCustomFields(\n  em: EntityManager,\n  opts: SetRecordCustomFieldsOptions,\n): Promise<void> {\n  const { entityId, recordId, values } = opts\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const preferDefs = opts.preferDefs !== false\n\n  let defsByKey: Record<string, CustomFieldDef> | undefined\n  if (preferDefs) {\n    const defs = await em.find(CustomFieldDef, {\n      entityId,\n      isActive: true,\n      deletedAt: null,\n      organizationId: { $in: [organizationId, null] as any },\n      tenantId: { $in: [tenantId, null] as any },\n    })\n    const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n    defsByKey = {}\n    for (const d of defs) {\n      const existing = defsByKey[d.key]\n      if (!existing) {\n        defsByKey[d.key] = d\n        continue\n      }\n      const nextScore = scopeScore(d)\n      const existingScore = scopeScore(existing)\n      if (nextScore > existingScore) {\n        defsByKey[d.key] = d\n        continue\n      }\n      if (nextScore < existingScore) continue\n\n      const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const existingUpdatedAt = existing.updatedAt instanceof Date\n        ? existing.updatedAt.getTime()\n        : new Date(existing.updatedAt).getTime()\n      if (nextUpdatedAt >= existingUpdatedAt) {\n        defsByKey[d.key] = d\n      }\n    }\n  }\n\n  const toPersist: CustomFieldValue[] = []\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)\n    return encryptionService\n  }\n  const keys = Object.keys(values)\n  const presentKeyCount = keys.filter((key) => values[key] !== undefined).length\n  if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {\n    throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR)\n  }\n\n  for (const fieldKey of keys) {\n    const raw = values[fieldKey]\n    if (raw === undefined) continue\n\n    const def = defsByKey?.[fieldKey]\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const isArray = Array.isArray(raw)\n    // When array: remove existing values for key and create multiple rows\n    if (isArray) {\n      const arr = raw as Primitive[]\n      const replacements: CustomFieldValue[] = []\n      for (const val of arr) {\n        const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)\n        const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n        clearValueColumns(cf)\n        const stored = encrypted\n          ? await encryptCustomFieldValue(val, tenantId, getEncryptionService(), encryptionCache)\n          : val\n        switch (col) {\n          case 'valueText': cf.valueText = stored == null ? null : String(stored); break\n          case 'valueMultiline': cf.valueMultiline = stored == null ? null : String(stored); break\n          case 'valueInt': cf.valueInt = stored == null ? null : Number(stored); break\n          case 'valueFloat': cf.valueFloat = stored == null ? null : Number(stored); break\n          case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break\n          default: cf.valueText = stored == null ? null : String(stored); break\n        }\n        replacements.push(cf)\n      }\n      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n      toPersist.push(...replacements)\n      continue\n    }\n\n    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)\n    const storedValue = encrypted\n      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache)\n      : raw\n\n    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n    if (!cf) {\n      cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n      toPersist.push(cf)\n    }\n    clearValueColumns(cf)\n    switch (column) {\n      case 'valueText':\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueMultiline':\n        cf.valueMultiline = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueInt':\n        cf.valueInt = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueFloat':\n        cf.valueFloat = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueBool':\n        cf.valueBool = (storedValue as Primitive) == null ? null : Boolean(storedValue as Primitive)\n        break\n      default:\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n    }\n  }\n\n  if (toPersist.length) em.persist(toPersist)\n  await em.flush()\n  if (process.env.OM_CF_DEBUG) {\n    try {\n      const conn = em.getConnection()\n      for (const fieldKey of keys) {\n        if (values[fieldKey] === undefined) continue\n        const rows = await conn.execute(\n          'select value_text, value_multiline, value_int, value_float, value_bool from custom_field_values where entity_id = ? and record_id = ? and field_key = ? and ((organization_id is null and ? is null) or organization_id = ?) and ((tenant_id is null and ? is null) or tenant_id = ?)',\n          [entityId, recordId, fieldKey, organizationId, organizationId, tenantId, tenantId],\n          'all',\n        ) as Array<Record<string, unknown>>\n        const persisted = rows.map((row) => row.value_text ?? row.value_multiline ?? row.value_int ?? row.value_float ?? row.value_bool)\n        console.warn(`[CF_DEBUG] setRecordCustomFields entityId=${entityId} recordId=${recordId} fieldKey=${fieldKey} input=${JSON.stringify(values[fieldKey])} persistedRows=${rows.length} persisted=${JSON.stringify(persisted)}`)\n      }\n    } catch (err) {\n      console.warn(`[CF_DEBUG] re-query failed: ${(err as Error)?.message ?? String(err)}`)\n    }\n  }\n  // Emit hook for indexing if requested (outside CRUD flows)\n  try {\n    if (typeof opts.onChanged === 'function') {\n      await opts.onChanged({ entityId, recordId, organizationId, tenantId })\n    }\n  } catch {\n    // Non-blocking\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,yBAAyB,sCAAsC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,wBAAwB;AAmBjD,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,kBAAkB,GAAsC;AAC/D,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,UAAW,QAAO;AACnC,MAAI,OAAO,MAAM,SAAU,QAAO,OAAO,UAAU,CAAC,IAAI,aAAa;AACrE,SAAO;AACT;AAGA,SAAS,kBAAkB,IAAsB;AAC/C,KAAG,YAAY;AACf,KAAG,iBAAiB;AACpB,KAAG,WAAW;AACd,KAAG,aAAa;AAChB,KAAG,YAAY;AACjB;AAEA,eAAsB,sBACpB,IACA,MACe;AACf,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI;AACvC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAS;AAAA,MACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAS;AAAA,IAC3C,CAAC;AACD,UAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,gBAAY,CAAC;AACb,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,UAAU,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,YAAM,YAAY,WAAW,CAAC;AAC9B,YAAM,gBAAgB,WAAW,QAAQ;AACzC,UAAI,YAAY,eAAe;AAC7B,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,UAAI,YAAY,cAAe;AAE/B,YAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,YAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,UAAI,iBAAiB,mBAAmB;AACtC,kBAAU,EAAE,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAgC,CAAC;AACvC,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAW,KAAK,iBAAiB;AACpF,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,QAAM,kBAAkB,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS,EAAE;AACxE,MAAI,cAAc,kBAAkB,kCAAkC;AACpE,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAEA,aAAW,YAAY,MAAM;AAC3B,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAI,QAAQ,OAAW;AAEvB,UAAM,MAAM,YAAY,QAAQ;AAChC,UAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,UAAM,UAAU,MAAM,QAAQ,GAAG;AAEjC,QAAI,SAAS;AACX,YAAM,MAAM;AACZ,YAAM,eAAmC,CAAC;AAC1C,iBAAW,OAAO,KAAK;AACrB,cAAM,MAA8B,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAG;AACpH,cAAMA,MAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AACxH,0BAAkBA,GAAE;AACpB,cAAM,SAAS,YACX,MAAM,wBAAwB,KAAK,UAAU,qBAAqB,GAAG,eAAe,IACpF;AACJ,gBAAQ,KAAK;AAAA,UACX,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACzE,KAAK;AAAkB,YAAAA,IAAG,iBAAiB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACnF,KAAK;AAAY,YAAAA,IAAG,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UACvE,KAAK;AAAc,YAAAA,IAAG,aAAa,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UAC3E,KAAK;AAAa,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,QAAQ,MAAM;AAAG;AAAA,UAC1E;AAAS,YAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,QAClE;AACA,qBAAa,KAAKA,GAAE;AAAA,MACtB;AACA,YAAM,GAAG,aAAa,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AAClG,gBAAU,KAAK,GAAG,YAAY;AAC9B;AAAA,IACF;AAEA,UAAM,SAAiC,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAgB;AACpI,UAAM,cAAc,YAChB,MAAM,wBAAwB,KAAkB,UAAU,qBAAqB,GAAG,eAAe,IACjG;AAEJ,QAAI,KAAK,MAAM,GAAG,QAAQ,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AACtG,QAAI,CAAC,IAAI;AACP,WAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AAClH,gBAAU,KAAK,EAAE;AAAA,IACnB;AACA,sBAAkB,EAAE;AACpB,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,MACF,KAAK;AACH,WAAG,iBAAkB,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC/F;AAAA,MACF,KAAK;AACH,WAAG,WAAY,eAA6B,OAAO,OAAO,OAAO,WAAwB;AACzF;AAAA,MACF,KAAK;AACH,WAAG,aAAc,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC3F;AAAA,MACF,KAAK;AACH,WAAG,YAAa,eAA6B,OAAO,OAAO,QAAQ,WAAwB;AAC3F;AAAA,MACF;AACE,WAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,IACJ;AAAA,EACF;AAEA,MAAI,UAAU,OAAQ,IAAG,QAAQ,SAAS;AAC1C,QAAM,GAAG,MAAM;AACf,MAAI,QAAQ,IAAI,aAAa;AAC3B,QAAI;AACF,YAAM,OAAO,GAAG,cAAc;AAC9B,iBAAW,YAAY,MAAM;AAC3B,YAAI,OAAO,QAAQ,MAAM,OAAW;AACpC,cAAM,OAAO,MAAM,KAAK;AAAA,UACtB;AAAA,UACA,CAAC,UAAU,UAAU,UAAU,gBAAgB,gBAAgB,UAAU,QAAQ;AAAA,UACjF;AAAA,QACF;AACA,cAAM,YAAY,KAAK,IAAI,CAAC,QAAQ,IAAI,cAAc,IAAI,mBAAmB,IAAI,aAAa,IAAI,eAAe,IAAI,UAAU;AAC/H,gBAAQ,KAAK,6CAA6C,QAAQ,aAAa,QAAQ,aAAa,QAAQ,UAAU,KAAK,UAAU,OAAO,QAAQ,CAAC,CAAC,kBAAkB,KAAK,MAAM,cAAc,KAAK,UAAU,SAAS,CAAC,EAAE;AAAA,MAC9N;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,KAAK,+BAAgC,KAAe,WAAW,OAAO,GAAG,CAAC,EAAE;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,KAAK,UAAU,EAAE,UAAU,UAAU,gBAAgB,SAAS,CAAC;AAAA,IACvE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;",
   "names": ["cf"]
 }

package/dist/modules/notifications/api/[id]/action/route.js

@@ -1,6 +1,10 @@
 import { executeActionSchema } from "../../../data/validators.js";
 import { actionResultResponseSchema, errorResponseSchema } from "../../openapi.js";
-import { resolveNotificationContext } from "../../../lib/routeHelpers.js";
+import {
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
+  resolveNotificationContext
+} from "../../../lib/routeHelpers.js";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 const metadata = {
   POST: { requireAuth: true }
@@ -9,7 +13,11 @@ async function POST(req, { params }) {
   const { id } = await params;
   const { service, scope } = await resolveNotificationContext(req);
   const body = await req.json().catch(() => ({}));
-  const input = executeActionSchema.parse(body);
+  const parsed = executeActionSchema.safeParse(body);
+  if (!parsed.success) {
+    return notificationValidationErrorResponse(parsed.error);
+  }
+  const input = parsed.data;
   try {
     const { notification, result } = await service.executeAction(id, input, scope);
     const action = notification.actionData?.actions?.find((a) => a.id === input.actionId);
@@ -20,6 +28,8 @@ async function POST(req, { params }) {
       href
     });
   } catch (error) {
+    const errorResponse = notificationCrudErrorResponse(error);
+    if (errorResponse) return errorResponse;
     const { t } = await resolveTranslations();
     const fallback = t("notifications.error.action", "Failed to execute action");
     const message = error instanceof Error && error.message ? error.message : fallback;

package/dist/modules/notifications/api/[id]/action/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/notifications/api/%5Bid%5D/action/route.ts"],
-  "sourcesContent": ["import { executeActionSchema } from '../../../data/validators'\nimport { actionResultResponseSchema, errorResponseSchema } from '../../openapi'\nimport { resolveNotificationContext } from '../../../lib/routeHelpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  const { id } = await params\n  const { service, scope } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const input = executeActionSchema.parse(body)\n\n  try {\n    const { notification, result } = await service.executeAction(id, input, scope)\n\n    const action = notification.actionData?.actions?.find((a) => a.id === input.actionId)\n    const href = action?.href?.replace('{sourceEntityId}', notification.sourceEntityId ?? '')\n\n    return Response.json({\n      ok: true,\n      result,\n      href,\n    })\n  } catch (error) {\n    const { t } = await resolveTranslations()\n    const fallback = t('notifications.error.action', 'Failed to execute action')\n    const message = error instanceof Error && error.message ? error.message : fallback\n    return Response.json({ error: message }, { status: 400 })\n  }\n}\n\nexport const openApi = {\n  POST: {\n    summary: 'Execute notification action',\n    tags: ['Notifications'],\n    parameters: [\n      {\n        name: 'id',\n        in: 'path',\n        required: true,\n        schema: { type: 'string', format: 'uuid' },\n      },\n    ],\n    requestBody: {\n      required: true,\n      content: {\n        'application/json': {\n          schema: executeActionSchema,\n        },\n      },\n    },\n    responses: {\n      200: {\n        description: 'Action executed successfully',\n        content: {\n          'application/json': {\n            schema: actionResultResponseSchema,\n          },\n        },\n      },\n      400: {\n        description: 'Action not found or failed',\n        content: {\n          'application/json': {\n            schema: errorResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,2BAA2B;AACpC,SAAS,4BAA4B,2BAA2B;AAChE,SAAS,kCAAkC;AAC3C,SAAS,2BAA2B;AAE7B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAwC;AACxF,QAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,oBAAoB,MAAM,IAAI;AAE5C,MAAI;AACF,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,QAAQ,cAAc,IAAI,OAAO,KAAK;AAE7E,UAAM,SAAS,aAAa,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AACpF,UAAM,OAAO,QAAQ,MAAM,QAAQ,oBAAoB,aAAa,kBAAkB,EAAE;AAExF,WAAO,SAAS,KAAK;AAAA,MACnB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,UAAM,WAAW,EAAE,8BAA8B,0BAA0B;AAC3E,UAAM,UAAU,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU;AAC1E,WAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,YAAY;AAAA,MACV;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { executeActionSchema } from '../../../data/validators'\nimport { actionResultResponseSchema, errorResponseSchema } from '../../openapi'\nimport {\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n} from '../../../lib/routeHelpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  const { id } = await params\n  const { service, scope } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = executeActionSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n  const input = parsed.data\n\n  try {\n    const { notification, result } = await service.executeAction(id, input, scope)\n\n    const action = notification.actionData?.actions?.find((a) => a.id === input.actionId)\n    const href = action?.href?.replace('{sourceEntityId}', notification.sourceEntityId ?? '')\n\n    return Response.json({\n      ok: true,\n      result,\n      href,\n    })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n\n    const { t } = await resolveTranslations()\n    const fallback = t('notifications.error.action', 'Failed to execute action')\n    const message = error instanceof Error && error.message ? error.message : fallback\n    return Response.json({ error: message }, { status: 400 })\n  }\n}\n\nexport const openApi = {\n  POST: {\n    summary: 'Execute notification action',\n    tags: ['Notifications'],\n    parameters: [\n      {\n        name: 'id',\n        in: 'path',\n        required: true,\n        schema: { type: 'string', format: 'uuid' },\n      },\n    ],\n    requestBody: {\n      required: true,\n      content: {\n        'application/json': {\n          schema: executeActionSchema,\n        },\n      },\n    },\n    responses: {\n      200: {\n        description: 'Action executed successfully',\n        content: {\n          'application/json': {\n            schema: actionResultResponseSchema,\n          },\n        },\n      },\n      400: {\n        description: 'Action not found or failed',\n        content: {\n          'application/json': {\n            schema: errorResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,2BAA2B;AACpC,SAAS,4BAA4B,2BAA2B;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAE7B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAwC;AACxF,QAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AACA,QAAM,QAAQ,OAAO;AAErB,MAAI;AACF,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,QAAQ,cAAc,IAAI,OAAO,KAAK;AAE7E,UAAM,SAAS,aAAa,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AACpF,UAAM,OAAO,QAAQ,MAAM,QAAQ,oBAAoB,aAAa,kBAAkB,EAAE;AAExF,WAAO,SAAS,KAAK;AAAA,MACnB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAE1B,UAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,UAAM,WAAW,EAAE,8BAA8B,0BAA0B;AAC3E,UAAM,UAAU,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU;AAC1E,WAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,YAAY;AAAA,MACV;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/notifications/api/route.js

@@ -2,7 +2,11 @@ import { z } from "zod";
 import { Notification } from "../data/entities.js";
 import { listNotificationsSchema, createNotificationSchema } from "../data/validators.js";
 import { toNotificationDto } from "../lib/notificationMapper.js";
-import { resolveNotificationContext } from "../lib/routeHelpers.js";
+import {
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
+  resolveNotificationContext
+} from "../lib/routeHelpers.js";
 import {
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
@@ -62,9 +66,18 @@ async function GET(req) {
 async function POST(req) {
   const { service, scope } = await resolveNotificationContext(req);
   const body = await req.json().catch(() => ({}));
-  const input = createNotificationSchema.parse(body);
-  const notification = await service.create(input, scope);
-  return Response.json({ id: notification.id }, { status: 201 });
+  const parsed = createNotificationSchema.safeParse(body);
+  if (!parsed.success) {
+    return notificationValidationErrorResponse(parsed.error);
+  }
+  try {
+    const notification = await service.create(parsed.data, scope);
+    return Response.json({ id: notification.id }, { status: 201 });
+  } catch (error) {
+    const errorResponse = notificationCrudErrorResponse(error);
+    if (errorResponse) return errorResponse;
+    throw error;
+  }
 }
 const openApi = buildNotificationsCrudOpenApi({
   resourceName: "Notification",

package/dist/modules/notifications/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/api/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { Notification } from '../data/entities'\nimport { listNotificationsSchema, createNotificationSchema } from '../data/validators'\nimport { toNotificationDto } from '../lib/notificationMapper'\nimport { resolveNotificationContext } from '../lib/routeHelpers'\nimport {\n  buildNotificationsCrudOpenApi,\n  createPagedListResponseSchema,\n  notificationItemSchema,\n} from './openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['notifications.create'] },\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const queryParams = Object.fromEntries(url.searchParams.entries())\n  const input = listNotificationsSchema.parse(queryParams)\n\n  const filters: Record<string, unknown> = {\n    recipientUserId: scope.userId,\n    tenantId: scope.tenantId,\n  }\n\n  if (input.status) {\n    filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status\n  } else {\n    filters.status = { $ne: 'dismissed' }\n  }\n  if (input.type) {\n    filters.type = input.type\n  }\n  if (input.severity) {\n    filters.severity = input.severity\n  }\n  if (input.sourceEntityType) {\n    filters.sourceEntityType = input.sourceEntityType\n  }\n  if (input.sourceEntityId) {\n    filters.sourceEntityId = input.sourceEntityId\n  }\n  if (input.since) {\n    filters.createdAt = { $gt: new Date(input.since) }\n  }\n\n  const [notifications, total] = await Promise.all([\n    em.find(Notification, filters, {\n      orderBy: { createdAt: 'desc' },\n      limit: input.pageSize,\n      offset: (input.page - 1) * input.pageSize,\n    }),\n    em.count(Notification, filters),\n  ])\n\n  const items = notifications.map(toNotificationDto)\n\n  return Response.json({\n    items,\n    total,\n    page: input.page,\n    pageSize: input.pageSize,\n    totalPages: Math.ceil(total / input.pageSize),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { service, scope } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const input = createNotificationSchema.parse(body)\n\n  const notification = await service.create(input, scope)\n\n  return Response.json({ id: notification.id }, { status: 201 })\n}\n\nexport const openApi = buildNotificationsCrudOpenApi({\n  resourceName: 'Notification',\n  querySchema: listNotificationsSchema,\n  listResponseSchema: createPagedListResponseSchema(notificationItemSchema),\n  create: {\n    schema: createNotificationSchema,\n    responseSchema: z.object({ id: z.string().uuid() }),\n    description: 'Creates a notification for a user.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;AACjE,QAAM,QAAQ,wBAAwB,MAAM,WAAW;AAEvD,QAAM,UAAmC;AAAA,IACvC,iBAAiB,MAAM;AAAA,IACvB,UAAU,MAAM;AAAA,EAClB;AAEA,MAAI,MAAM,QAAQ;AAChB,YAAQ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM;AAAA,EAC/E,OAAO;AACL,YAAQ,SAAS,EAAE,KAAK,YAAY;AAAA,EACtC;AACA,MAAI,MAAM,MAAM;AACd,YAAQ,OAAO,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,MAAI,MAAM,kBAAkB;AAC1B,YAAQ,mBAAmB,MAAM;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB;AACxB,YAAQ,iBAAiB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,OAAO;AACf,YAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,MAAM,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,GAAG,KAAK,cAAc,SAAS;AAAA,MAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,MAAM,cAAc,OAAO;AAAA,EAChC,CAAC;AAED,QAAM,QAAQ,cAAc,IAAI,iBAAiB;AAEjD,SAAO,SAAS,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,yBAAyB,MAAM,IAAI;AAEjD,QAAM,eAAe,MAAM,QAAQ,OAAO,OAAO,KAAK;AAEtD,SAAO,SAAS,KAAK,EAAE,IAAI,aAAa,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/D;AAEO,MAAM,UAAU,8BAA8B;AAAA,EACnD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB,8BAA8B,sBAAsB;AAAA,EACxE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAClD,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { Notification } from '../data/entities'\nimport { listNotificationsSchema, createNotificationSchema } from '../data/validators'\nimport { toNotificationDto } from '../lib/notificationMapper'\nimport {\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n} from '../lib/routeHelpers'\nimport {\n  buildNotificationsCrudOpenApi,\n  createPagedListResponseSchema,\n  notificationItemSchema,\n} from './openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['notifications.create'] },\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const queryParams = Object.fromEntries(url.searchParams.entries())\n  const input = listNotificationsSchema.parse(queryParams)\n\n  const filters: Record<string, unknown> = {\n    recipientUserId: scope.userId,\n    tenantId: scope.tenantId,\n  }\n\n  if (input.status) {\n    filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status\n  } else {\n    filters.status = { $ne: 'dismissed' }\n  }\n  if (input.type) {\n    filters.type = input.type\n  }\n  if (input.severity) {\n    filters.severity = input.severity\n  }\n  if (input.sourceEntityType) {\n    filters.sourceEntityType = input.sourceEntityType\n  }\n  if (input.sourceEntityId) {\n    filters.sourceEntityId = input.sourceEntityId\n  }\n  if (input.since) {\n    filters.createdAt = { $gt: new Date(input.since) }\n  }\n\n  const [notifications, total] = await Promise.all([\n    em.find(Notification, filters, {\n      orderBy: { createdAt: 'desc' },\n      limit: input.pageSize,\n      offset: (input.page - 1) * input.pageSize,\n    }),\n    em.count(Notification, filters),\n  ])\n\n  const items = notifications.map(toNotificationDto)\n\n  return Response.json({\n    items,\n    total,\n    page: input.page,\n    pageSize: input.pageSize,\n    totalPages: Math.ceil(total / input.pageSize),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { service, scope } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = createNotificationSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n\n  try {\n    const notification = await service.create(parsed.data, scope)\n\n    return Response.json({ id: notification.id }, { status: 201 })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n    throw error\n  }\n}\n\nexport const openApi = buildNotificationsCrudOpenApi({\n  resourceName: 'Notification',\n  querySchema: listNotificationsSchema,\n  listResponseSchema: createPagedListResponseSchema(notificationItemSchema),\n  create: {\n    schema: createNotificationSchema,\n    responseSchema: z.object({ id: z.string().uuid() }),\n    description: 'Creates a notification for a user.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;AACjE,QAAM,QAAQ,wBAAwB,MAAM,WAAW;AAEvD,QAAM,UAAmC;AAAA,IACvC,iBAAiB,MAAM;AAAA,IACvB,UAAU,MAAM;AAAA,EAClB;AAEA,MAAI,MAAM,QAAQ;AAChB,YAAQ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM;AAAA,EAC/E,OAAO;AACL,YAAQ,SAAS,EAAE,KAAK,YAAY;AAAA,EACtC;AACA,MAAI,MAAM,MAAM;AACd,YAAQ,OAAO,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,MAAI,MAAM,kBAAkB;AAC1B,YAAQ,mBAAmB,MAAM;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB;AACxB,YAAQ,iBAAiB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,OAAO;AACf,YAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,MAAM,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,GAAG,KAAK,cAAc,SAAS;AAAA,MAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,MAAM,cAAc,OAAO;AAAA,EAChC,CAAC;AAED,QAAM,QAAQ,cAAc,IAAI,iBAAiB;AAEjD,SAAO,SAAS,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AAEA,MAAI;AACF,UAAM,eAAe,MAAM,QAAQ,OAAO,OAAO,MAAM,KAAK;AAE5D,WAAO,SAAS,KAAK,EAAE,IAAI,aAAa,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/D,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAC1B,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAAU,8BAA8B;AAAA,EACnD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB,8BAA8B,sBAAsB;AAAA,EACxE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAClD,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/notifications/lib/notificationService.js

@@ -1,7 +1,8 @@
 import { sql } from "kysely";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { Notification } from "../data/entities.js";
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from "./events.js";
-import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import {
   buildNotificationEntity,
   emitNotificationCreated,
@@ -56,6 +57,26 @@ function applyNotificationContent(notification, input, recipientUserId, ctx) {
   notification.actionResult = null;
   notification.createdAt = /* @__PURE__ */ new Date();
 }
+async function findScopedNotificationOrThrow(em, notificationId, ctx) {
+  const notification = await findOneWithDecryption(
+    em,
+    Notification,
+    {
+      id: notificationId,
+      recipientUserId: ctx.userId,
+      tenantId: ctx.tenantId
+    },
+    void 0,
+    {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId ?? null
+    }
+  );
+  if (!notification) {
+    throw new CrudHttpError(404, { error: "Notification not found" });
+  }
+  return notification;
+}
 async function emitNotificationSseEvents(eventBus, notifications, ctx, recipientUserIds) {
   await eventBus.emit(NOTIFICATION_SSE_EVENTS.BATCH_CREATED, {
     tenantId: ctx.tenantId,
@@ -182,11 +203,7 @@ function createNotificationService(deps) {
     },
     async markAsRead(notificationId, ctx) {
       const em = rootEm.fork();
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId
-      });
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx);
       if (notification.status === "unread") {
         notification.status = "read";
         notification.readAt = /* @__PURE__ */ new Date();
@@ -249,11 +266,7 @@ function createNotificationService(deps) {
     },
     async dismiss(notificationId, ctx) {
       const em = rootEm.fork();
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId
-      });
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx);
       notification.status = "dismissed";
       notification.dismissedAt = /* @__PURE__ */ new Date();
       await em.flush();
@@ -266,11 +279,7 @@ function createNotificationService(deps) {
     },
     async restoreDismissed(notificationId, status, ctx) {
       const em = rootEm.fork();
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId
-      });
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx);
       if (notification.status !== "dismissed") {
         return notification;
       }
@@ -293,11 +302,7 @@ function createNotificationService(deps) {
     },
     async executeAction(notificationId, input, ctx) {
       const em = rootEm.fork();
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId
-      });
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx);
       const actionData = notification.actionData;
       const action = actionData?.actions?.find((a) => a.id === input.actionId);
       if (!action) {

package/dist/modules/notifications/lib/notificationService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/lib/notificationService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { type Kysely, sql } from 'kysely'\nimport { Notification, type NotificationStatus } from '../data/entities'\nimport type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'\nimport type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'\nimport { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  buildNotificationEntity,\n  emitNotificationCreated,\n  emitNotificationCreatedBatch,\n  type NotificationContentInput,\n  type NotificationTenantContext,\n} from './notificationFactory'\nimport { toNotificationDto } from './notificationMapper'\nimport { getRecipientUserIdsForFeature, getRecipientUserIdsForRole } from './notificationRecipients'\nimport { assertSafeNotificationHref, sanitizeNotificationActions } from './safeHref'\n\nconst DEBUG = process.env.NOTIFICATIONS_DEBUG === 'true'\n\nfunction debug(...args: unknown[]): void {\n  if (DEBUG) {\n    console.log('[notifications]', ...args)\n  }\n}\n\nfunction getDb(em: EntityManager): Kysely<any> {\n  return em.getKysely<any>()\n}\n\nconst UNIQUE_NOTIFICATION_ACTIVE_STATUSES: NotificationStatus[] = ['unread', 'read', 'actioned']\n\nfunction normalizeOrgScope(organizationId: string | null | undefined): string | null {\n  return organizationId ?? null\n}\n\nfunction applyNotificationContent(\n  notification: Notification,\n  input: NotificationContentInput,\n  recipientUserId: string,\n  ctx: NotificationTenantContext,\n) {\n  const actions = sanitizeNotificationActions(input.actions)\n  const linkHref = assertSafeNotificationHref(input.linkHref)\n\n  notification.recipientUserId = recipientUserId\n  notification.type = input.type\n  notification.titleKey = input.titleKey\n  notification.bodyKey = input.bodyKey\n  notification.titleVariables = input.titleVariables\n  notification.bodyVariables = input.bodyVariables\n  notification.title = input.title || input.titleKey || ''\n  notification.body = input.body\n  notification.icon = input.icon\n  notification.severity = input.severity ?? 'info'\n  notification.actionData = actions\n    ? {\n        actions,\n        primaryActionId: input.primaryActionId,\n      }\n    : null\n  notification.sourceModule = input.sourceModule\n  notification.sourceEntityType = input.sourceEntityType\n  notification.sourceEntityId = input.sourceEntityId\n  notification.linkHref = linkHref\n  notification.groupKey = input.groupKey\n  notification.expiresAt = input.expiresAt ? new Date(input.expiresAt) : null\n  notification.tenantId = ctx.tenantId\n  notification.organizationId = normalizeOrgScope(ctx.organizationId)\n  notification.status = 'unread'\n  notification.readAt = null\n  notification.actionedAt = null\n  notification.dismissedAt = null\n  notification.actionTaken = null\n  notification.actionResult = null\n  notification.createdAt = new Date()\n}\n\nasync function emitNotificationSseEvents(\n  eventBus: { emit: (event: string, payload: unknown) => Promise<void> },\n  notifications: Notification[],\n  ctx: NotificationServiceContext,\n  recipientUserIds: string[],\n): Promise<void> {\n  await eventBus.emit(NOTIFICATION_SSE_EVENTS.BATCH_CREATED, {\n    tenantId: ctx.tenantId,\n    organizationId: normalizeOrgScope(ctx.organizationId),\n    recipientUserIds,\n    count: notifications.length,\n  })\n\n  for (const notification of notifications) {\n    await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {\n      tenantId: notification.tenantId,\n      organizationId: notification.organizationId ?? null,\n      recipientUserId: notification.recipientUserId,\n      notification: toNotificationDto(notification),\n    })\n  }\n}\n\nasync function createOrRefreshNotification(\n  em: EntityManager,\n  input: NotificationContentInput,\n  recipientUserId: string,\n  ctx: NotificationTenantContext,\n): Promise<Notification> {\n  if (input.groupKey && input.groupKey.trim().length > 0) {\n    const orgScope = normalizeOrgScope(ctx.organizationId) ?? 'global'\n    const lockKey = `notifications:${ctx.tenantId}:${orgScope}:${recipientUserId}:${input.type}:${input.groupKey}`\n    try {\n      const db = getDb(em)\n      await sql`select pg_advisory_xact_lock(hashtext(${lockKey}))`.execute(db)\n    } catch {\n      // If advisory locks are unavailable, continue with best-effort dedupe.\n    }\n\n    const existing = await em.findOne(Notification, {\n      recipientUserId,\n      tenantId: ctx.tenantId,\n      organizationId: normalizeOrgScope(ctx.organizationId),\n      type: input.type,\n      groupKey: input.groupKey,\n      status: { $in: UNIQUE_NOTIFICATION_ACTIVE_STATUSES },\n    }, {\n      orderBy: { createdAt: 'desc' },\n    })\n\n    if (existing) {\n      applyNotificationContent(existing, input, recipientUserId, ctx)\n      return existing\n    }\n  }\n\n  return buildNotificationEntity(em, input, recipientUserId, ctx)\n}\n\nexport interface NotificationServiceContext {\n  tenantId: string\n  organizationId?: string | null\n  userId?: string | null\n}\n\nexport interface NotificationService {\n  create(input: CreateNotificationInput, ctx: NotificationServiceContext): Promise<Notification>\n  createBatch(input: CreateBatchNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  createForRole(input: CreateRoleNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  createForFeature(input: CreateFeatureNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  markAsRead(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>\n  markAllAsRead(ctx: NotificationServiceContext): Promise<number>\n  dismiss(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>\n  restoreDismissed(\n    notificationId: string,\n    status: 'read' | 'unread' | undefined,\n    ctx: NotificationServiceContext\n  ): Promise<Notification>\n  executeAction(\n    notificationId: string,\n    input: ExecuteActionInput,\n    ctx: NotificationServiceContext\n  ): Promise<{ notification: Notification; result: unknown }>\n  getUnreadCount(ctx: NotificationServiceContext): Promise<number>\n  getPollData(ctx: NotificationServiceContext, since?: string): Promise<NotificationPollData>\n  cleanupExpired(): Promise<number>\n  deleteBySource(\n    sourceEntityType: string,\n    sourceEntityId: string,\n    ctx: NotificationServiceContext\n  ): Promise<number>\n}\n\nexport interface NotificationServiceDeps {\n  em: EntityManager\n  eventBus: { emit: (event: string, payload: unknown) => Promise<void> }\n  commandBus?: {\n    execute: (\n      commandId: string,\n      options: { input: unknown; ctx: unknown; metadata?: unknown }\n    ) => Promise<{ result: unknown }>\n  }\n  container?: { resolve: (name: string) => unknown }\n}\n\nexport function createNotificationService(deps: NotificationServiceDeps): NotificationService {\n  const { em: rootEm, eventBus, commandBus, container } = deps\n\n  return {\n    async create(input, ctx) {\n      const { recipientUserId, ...content } = input\n      const writeEm = rootEm.fork()\n      const notification = await writeEm.transactional(async (tx) => {\n        const entity = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n        await tx.flush()\n        return entity\n      })\n\n      await emitNotificationCreated(eventBus, notification, ctx)\n      await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {\n        tenantId: notification.tenantId,\n        organizationId: notification.organizationId ?? null,\n        recipientUserId: notification.recipientUserId,\n        notification: toNotificationDto(notification),\n      })\n\n      return notification\n    },\n\n    async createBatch(input, ctx) {\n      const recipientUserIds = Array.from(new Set(input.recipientUserIds))\n      const { recipientUserIds: _recipientUserIds, ...content } = input\n      const notifications: Notification[] = []\n      const writeEm = rootEm.fork()\n\n      await writeEm.transactional(async (tx) => {\n        for (const recipientUserId of recipientUserIds) {\n          const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n          notifications.push(notification)\n        }\n        await tx.flush()\n      })\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n      await emitNotificationSseEvents(eventBus, notifications, ctx, recipientUserIds)\n\n      return notifications\n    },\n\n    async createForRole(input, ctx) {\n      const em = rootEm.fork()\n\n      const db = getDb(em)\n      const recipientUserIds = await getRecipientUserIdsForRole(db, ctx.tenantId, input.roleId)\n      if (recipientUserIds.length === 0) {\n        return []\n      }\n\n      const { roleId: _roleId, ...content } = input\n      const notifications: Notification[] = []\n      const uniqueRecipientUserIds = Array.from(new Set(recipientUserIds))\n      const writeEm = rootEm.fork()\n\n      await writeEm.transactional(async (tx) => {\n        for (const recipientUserId of uniqueRecipientUserIds) {\n          const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n          notifications.push(notification)\n        }\n        await tx.flush()\n      })\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n      await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds)\n\n      return notifications\n    },\n\n    async createForFeature(input, ctx) {\n      const em = rootEm.fork()\n      const db = getDb(em)\n      const recipientUserIds = await getRecipientUserIdsForFeature(db, ctx.tenantId, input.requiredFeature)\n\n      if (recipientUserIds.length === 0) {\n        debug('No users found with feature:', input.requiredFeature, 'in tenant:', ctx.tenantId)\n        return []\n      }\n\n      debug('Creating notifications for', recipientUserIds.length, 'user(s) with feature:', input.requiredFeature)\n\n      const { requiredFeature: _requiredFeature, ...content } = input\n      const notifications: Notification[] = []\n      const uniqueRecipientUserIds = Array.from(new Set(recipientUserIds))\n      const writeEm = rootEm.fork()\n\n      await writeEm.transactional(async (tx) => {\n        for (const recipientUserId of uniqueRecipientUserIds) {\n          const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n          notifications.push(notification)\n        }\n        await tx.flush()\n      })\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n      await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds)\n\n      return notifications\n    },\n\n    async markAsRead(notificationId, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      if (notification.status === 'unread') {\n        notification.status = 'read'\n        notification.readAt = new Date()\n        await em.flush()\n\n        await eventBus.emit(NOTIFICATION_EVENTS.READ, {\n          notificationId: notification.id,\n          userId: ctx.userId,\n          tenantId: ctx.tenantId,\n        })\n      }\n\n      return notification\n    },\n\n    async markAllAsRead(ctx) {\n      const em = rootEm.fork()\n      const db = getDb(em)\n      const applyScope = <QB extends { where: (...args: any[]) => QB }>(q: QB): QB => {\n        let chain = q\n          .where('recipient_user_id' as any, '=', ctx.userId as any)\n          .where('tenant_id' as any, '=', ctx.tenantId)\n          .where('status' as any, '=', 'unread')\n        if (ctx.organizationId) {\n          chain = chain.where('organization_id' as any, '=', ctx.organizationId)\n        }\n        return chain\n      }\n\n      const targetRows = await applyScope(\n        db\n          .selectFrom('notifications' as any)\n          .select([\n            'id' as any,\n            'organization_id' as any,\n            'recipient_user_id' as any,\n          ]),\n      ).execute() as Array<{ id: string }>\n\n      if (!targetRows.length) {\n        return 0\n      }\n\n      const updateResult = await applyScope(\n        db.updateTable('notifications' as any).set({\n          status: 'read',\n          read_at: sql`now()`,\n        } as any) as any,\n      ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined\n      const result = Number(updateResult?.numUpdatedRows ?? targetRows.length)\n\n      const notifications = await findWithDecryption(em, Notification, {\n        id: { $in: targetRows.map((row) => row.id) },\n      }, undefined, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId ?? null,\n      })\n\n      for (const notification of notifications) {\n        await eventBus.emit(NOTIFICATION_EVENTS.READ, {\n          notificationId: notification.id,\n          userId: ctx.userId,\n          tenantId: ctx.tenantId,\n        })\n\n        await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {\n          tenantId: notification.tenantId,\n          organizationId: notification.organizationId ?? null,\n          recipientUserId: notification.recipientUserId,\n          notification: toNotificationDto(notification),\n        })\n      }\n\n      return result\n    },\n\n    async dismiss(notificationId, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      notification.status = 'dismissed'\n      notification.dismissedAt = new Date()\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {\n        notificationId: notification.id,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      return notification\n    },\n\n    async restoreDismissed(notificationId, status, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      if (notification.status !== 'dismissed') {\n        return notification\n      }\n\n      const targetStatus = status ?? 'read'\n      notification.status = targetStatus\n      notification.dismissedAt = null\n\n      if (targetStatus === 'unread') {\n        notification.readAt = null\n      } else if (!notification.readAt) {\n        notification.readAt = new Date()\n      }\n\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {\n        notificationId: notification.id,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n        status: targetStatus,\n      })\n\n      return notification\n    },\n\n    async executeAction(notificationId, input, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      const actionData = notification.actionData\n      const action = actionData?.actions?.find((a) => a.id === input.actionId)\n\n      if (!action) {\n        throw new Error('Action not found')\n      }\n\n      let result: unknown = null\n\n      if (action.commandId && commandBus && container) {\n        const commandInput = {\n          id: notification.sourceEntityId,\n          ...input.payload,\n        }\n\n        // Build a CommandRuntimeContext from the notification service context\n        const commandCtx = {\n          container,\n          auth: {\n            sub: ctx.userId,\n            tenantId: ctx.tenantId,\n            orgId: ctx.organizationId,\n          },\n          organizationScope: null,\n          selectedOrganizationId: ctx.organizationId ?? null,\n          organizationIds: ctx.organizationId ? [ctx.organizationId] : null,\n        }\n\n        const commandResult = await commandBus.execute(action.commandId, {\n          input: commandInput,\n          ctx: commandCtx,\n          metadata: {\n            tenantId: ctx.tenantId,\n            organizationId: ctx.organizationId,\n            resourceKind: 'notifications',\n          },\n        })\n\n        result = commandResult.result\n      }\n\n      notification.status = 'actioned'\n      notification.actionedAt = new Date()\n      notification.actionTaken = input.actionId\n      notification.actionResult = result as Record<string, unknown>\n\n      if (!notification.readAt) {\n        notification.readAt = new Date()\n      }\n\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {\n        notificationId: notification.id,\n        actionId: input.actionId,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      return { notification, result }\n    },\n\n    async getUnreadCount(ctx) {\n      const em = rootEm.fork()\n      return em.count(Notification, {\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n        status: 'unread',\n      })\n    },\n\n    async getPollData(ctx, since) {\n      const em = rootEm.fork()\n      const filters: Record<string, unknown> = {\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      }\n\n      if (since) {\n        filters.createdAt = { $gt: new Date(since) }\n      }\n\n      const [notifications, unreadCount] = await Promise.all([\n        em.find(Notification, filters, {\n          orderBy: { createdAt: 'desc' },\n          limit: 50,\n        }),\n        em.count(Notification, {\n          recipientUserId: ctx.userId,\n          tenantId: ctx.tenantId,\n          status: 'unread',\n        }),\n      ])\n\n      const recent = notifications.map(toNotificationDto)\n      const hasNew = since ? recent.length > 0 : false\n\n      return {\n        unreadCount,\n        recent,\n        hasNew,\n        lastId: recent[0]?.id,\n      }\n    },\n\n    async cleanupExpired() {\n      const em = rootEm.fork()\n      const db = getDb(em)\n\n      const updateResult = await db\n        .updateTable('notifications' as any)\n        .set({\n          status: 'dismissed',\n          dismissed_at: sql`now()`,\n        } as any)\n        .where('expires_at' as any, '<', sql`now()`)\n        .where('status' as any, 'not in', ['actioned', 'dismissed'])\n        .executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined\n\n      return Number(updateResult?.numUpdatedRows ?? 0)\n    },\n\n    async deleteBySource(sourceEntityType, sourceEntityId, ctx) {\n      const em = rootEm.fork()\n      const db = getDb(em)\n\n      const deleteResult = await db\n        .deleteFrom('notifications' as any)\n        .where('source_entity_type' as any, '=', sourceEntityType)\n        .where('source_entity_id' as any, '=', sourceEntityId)\n        .where('tenant_id' as any, '=', ctx.tenantId)\n        .executeTakeFirst() as { numDeletedRows?: bigint | number } | undefined\n\n      return Number(deleteResult?.numDeletedRows ?? 0)\n    },\n  }\n}\n\n/**\n * Helper to create notification service from a DI container.\n * Use this in API routes and commands to avoid DI resolution issues.\n */\nexport function resolveNotificationService(container: {\n  resolve: (name: string) => unknown\n}): NotificationService {\n  const em = container.resolve('em') as EntityManager\n  const eventBus = container.resolve('eventBus') as { emit: (event: string, payload: unknown) => Promise<void> }\n\n  // commandBus may not be registered in all contexts, so resolve it safely\n  let commandBus: NotificationServiceDeps['commandBus']\n  try {\n    commandBus = container.resolve('commandBus') as typeof commandBus\n  } catch {\n    // commandBus not available - actions with commandId won't work\n    commandBus = undefined\n  }\n\n  return createNotificationService({ em, eventBus, commandBus, container })\n}\n"],
-  "mappings": "AACA,SAAsB,WAAW;AACjC,SAAS,oBAA6C;AAGtD,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yBAAyB;AAClC,SAAS,+BAA+B,kCAAkC;AAC1E,SAAS,4BAA4B,mCAAmC;AAExE,MAAM,QAAQ,QAAQ,IAAI,wBAAwB;AAElD,SAAS,SAAS,MAAuB;AACvC,MAAI,OAAO;AACT,YAAQ,IAAI,mBAAmB,GAAG,IAAI;AAAA,EACxC;AACF;AAEA,SAAS,MAAM,IAAgC;AAC7C,SAAO,GAAG,UAAe;AAC3B;AAEA,MAAM,sCAA4D,CAAC,UAAU,QAAQ,UAAU;AAE/F,SAAS,kBAAkB,gBAA0D;AACnF,SAAO,kBAAkB;AAC3B;AAEA,SAAS,yBACP,cACA,OACA,iBACA,KACA;AACA,QAAM,UAAU,4BAA4B,MAAM,OAAO;AACzD,QAAM,WAAW,2BAA2B,MAAM,QAAQ;AAE1D,eAAa,kBAAkB;AAC/B,eAAa,OAAO,MAAM;AAC1B,eAAa,WAAW,MAAM;AAC9B,eAAa,UAAU,MAAM;AAC7B,eAAa,iBAAiB,MAAM;AACpC,eAAa,gBAAgB,MAAM;AACnC,eAAa,QAAQ,MAAM,SAAS,MAAM,YAAY;AACtD,eAAa,OAAO,MAAM;AAC1B,eAAa,OAAO,MAAM;AAC1B,eAAa,WAAW,MAAM,YAAY;AAC1C,eAAa,aAAa,UACtB;AAAA,IACE;AAAA,IACA,iBAAiB,MAAM;AAAA,EACzB,IACA;AACJ,eAAa,eAAe,MAAM;AAClC,eAAa,mBAAmB,MAAM;AACtC,eAAa,iBAAiB,MAAM;AACpC,eAAa,WAAW;AACxB,eAAa,WAAW,MAAM;AAC9B,eAAa,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,IAAI;AACvE,eAAa,WAAW,IAAI;AAC5B,eAAa,iBAAiB,kBAAkB,IAAI,cAAc;AAClE,eAAa,SAAS;AACtB,eAAa,SAAS;AACtB,eAAa,aAAa;AAC1B,eAAa,cAAc;AAC3B,eAAa,cAAc;AAC3B,eAAa,eAAe;AAC5B,eAAa,YAAY,oBAAI,KAAK;AACpC;AAEA,eAAe,0BACb,UACA,eACA,KACA,kBACe;AACf,QAAM,SAAS,KAAK,wBAAwB,eAAe;AAAA,IACzD,UAAU,IAAI;AAAA,IACd,gBAAgB,kBAAkB,IAAI,cAAc;AAAA,IACpD;AAAA,IACA,OAAO,cAAc;AAAA,EACvB,CAAC;AAED,aAAW,gBAAgB,eAAe;AACxC,UAAM,SAAS,KAAK,wBAAwB,SAAS;AAAA,MACnD,UAAU,aAAa;AAAA,MACvB,gBAAgB,aAAa,kBAAkB;AAAA,MAC/C,iBAAiB,aAAa;AAAA,MAC9B,cAAc,kBAAkB,YAAY;AAAA,IAC9C,CAAC;AAAA,EACH;AACF;AAEA,eAAe,4BACb,IACA,OACA,iBACA,KACuB;AACvB,MAAI,MAAM,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AACtD,UAAM,WAAW,kBAAkB,IAAI,cAAc,KAAK;AAC1D,UAAM,UAAU,iBAAiB,IAAI,QAAQ,IAAI,QAAQ,IAAI,eAAe,IAAI,MAAM,IAAI,IAAI,MAAM,QAAQ;AAC5G,QAAI;AACF,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,4CAA4C,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC1E,QAAQ;AAAA,IAER;AAEA,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C;AAAA,MACA,UAAU,IAAI;AAAA,MACd,gBAAgB,kBAAkB,IAAI,cAAc;AAAA,MACpD,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,EAAE,KAAK,oCAAoC;AAAA,IACrD,GAAG;AAAA,MACD,SAAS,EAAE,WAAW,OAAO;AAAA,IAC/B,CAAC;AAED,QAAI,UAAU;AACZ,+BAAyB,UAAU,OAAO,iBAAiB,GAAG;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,wBAAwB,IAAI,OAAO,iBAAiB,GAAG;AAChE;AAgDO,SAAS,0BAA0B,MAAoD;AAC5F,QAAM,EAAE,IAAI,QAAQ,UAAU,YAAY,UAAU,IAAI;AAExD,SAAO;AAAA,IACL,MAAM,OAAO,OAAO,KAAK;AACvB,YAAM,EAAE,iBAAiB,GAAG,QAAQ,IAAI;AACxC,YAAM,UAAU,OAAO,KAAK;AAC5B,YAAM,eAAe,MAAM,QAAQ,cAAc,OAAO,OAAO;AAC7D,cAAM,SAAS,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AAClF,cAAM,GAAG,MAAM;AACf,eAAO;AAAA,MACT,CAAC;AAED,YAAM,wBAAwB,UAAU,cAAc,GAAG;AACzD,YAAM,SAAS,KAAK,wBAAwB,SAAS;AAAA,QACnD,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa,kBAAkB;AAAA,QAC/C,iBAAiB,aAAa;AAAA,QAC9B,cAAc,kBAAkB,YAAY;AAAA,MAC9C,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO,KAAK;AAC5B,YAAM,mBAAmB,MAAM,KAAK,IAAI,IAAI,MAAM,gBAAgB,CAAC;AACnE,YAAM,EAAE,kBAAkB,mBAAmB,GAAG,QAAQ,IAAI;AAC5D,YAAM,gBAAgC,CAAC;AACvC,YAAM,UAAU,OAAO,KAAK;AAE5B,YAAM,QAAQ,cAAc,OAAO,OAAO;AACxC,mBAAW,mBAAmB,kBAAkB;AAC9C,gBAAM,eAAe,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AACxF,wBAAc,KAAK,YAAY;AAAA,QACjC;AACA,cAAM,GAAG,MAAM;AAAA,MACjB,CAAC;AAED,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAC/D,YAAM,0BAA0B,UAAU,eAAe,KAAK,gBAAgB;AAE9E,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,OAAO,KAAK;AAC9B,YAAM,KAAK,OAAO,KAAK;AAEvB,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,mBAAmB,MAAM,2BAA2B,IAAI,IAAI,UAAU,MAAM,MAAM;AACxF,UAAI,iBAAiB,WAAW,GAAG;AACjC,eAAO,CAAC;AAAA,MACV;AAEA,YAAM,EAAE,QAAQ,SAAS,GAAG,QAAQ,IAAI;AACxC,YAAM,gBAAgC,CAAC;AACvC,YAAM,yBAAyB,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC;AACnE,YAAM,UAAU,OAAO,KAAK;AAE5B,YAAM,QAAQ,cAAc,OAAO,OAAO;AACxC,mBAAW,mBAAmB,wBAAwB;AACpD,gBAAM,eAAe,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AACxF,wBAAc,KAAK,YAAY;AAAA,QACjC;AACA,cAAM,GAAG,MAAM;AAAA,MACjB,CAAC;AAED,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAC/D,YAAM,0BAA0B,UAAU,eAAe,KAAK,sBAAsB;AAEpF,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,OAAO,KAAK;AACjC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,mBAAmB,MAAM,8BAA8B,IAAI,IAAI,UAAU,MAAM,eAAe;AAEpG,UAAI,iBAAiB,WAAW,GAAG;AACjC,cAAM,gCAAgC,MAAM,iBAAiB,cAAc,IAAI,QAAQ;AACvF,eAAO,CAAC;AAAA,MACV;AAEA,YAAM,8BAA8B,iBAAiB,QAAQ,yBAAyB,MAAM,eAAe;AAE3G,YAAM,EAAE,iBAAiB,kBAAkB,GAAG,QAAQ,IAAI;AAC1D,YAAM,gBAAgC,CAAC;AACvC,YAAM,yBAAyB,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC;AACnE,YAAM,UAAU,OAAO,KAAK;AAE5B,YAAM,QAAQ,cAAc,OAAO,OAAO;AACxC,mBAAW,mBAAmB,wBAAwB;AACpD,gBAAM,eAAe,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AACxF,wBAAc,KAAK,YAAY;AAAA,QACjC;AACA,cAAM,GAAG,MAAM;AAAA,MACjB,CAAC;AAED,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAC/D,YAAM,0BAA0B,UAAU,eAAe,KAAK,sBAAsB;AAEpF,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,WAAW,gBAAgB,KAAK;AACpC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,UAAI,aAAa,WAAW,UAAU;AACpC,qBAAa,SAAS;AACtB,qBAAa,SAAS,oBAAI,KAAK;AAC/B,cAAM,GAAG,MAAM;AAEf,cAAM,SAAS,KAAK,oBAAoB,MAAM;AAAA,UAC5C,gBAAgB,aAAa;AAAA,UAC7B,QAAQ,IAAI;AAAA,UACZ,UAAU,IAAI;AAAA,QAChB,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,aAAa,CAA+C,MAAc;AAC9E,YAAI,QAAQ,EACT,MAAM,qBAA4B,KAAK,IAAI,MAAa,EACxD,MAAM,aAAoB,KAAK,IAAI,QAAQ,EAC3C,MAAM,UAAiB,KAAK,QAAQ;AACvC,YAAI,IAAI,gBAAgB;AACtB,kBAAQ,MAAM,MAAM,mBAA0B,KAAK,IAAI,cAAc;AAAA,QACvE;AACA,eAAO;AAAA,MACT;AAEA,YAAM,aAAa,MAAM;AAAA,QACvB,GACG,WAAW,eAAsB,EACjC,OAAO;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACL,EAAE,QAAQ;AAEV,UAAI,CAAC,WAAW,QAAQ;AACtB,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,MAAM;AAAA,QACzB,GAAG,YAAY,eAAsB,EAAE,IAAI;AAAA,UACzC,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAQ;AAAA,MACV,EAAE,iBAAiB;AACnB,YAAM,SAAS,OAAO,cAAc,kBAAkB,WAAW,MAAM;AAEvE,YAAM,gBAAgB,MAAM,mBAAmB,IAAI,cAAc;AAAA,QAC/D,IAAI,EAAE,KAAK,WAAW,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE;AAAA,MAC7C,GAAG,QAAW;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI,kBAAkB;AAAA,MACxC,CAAC;AAED,iBAAW,gBAAgB,eAAe;AACxC,cAAM,SAAS,KAAK,oBAAoB,MAAM;AAAA,UAC5C,gBAAgB,aAAa;AAAA,UAC7B,QAAQ,IAAI;AAAA,UACZ,UAAU,IAAI;AAAA,QAChB,CAAC;AAED,cAAM,SAAS,KAAK,wBAAwB,SAAS;AAAA,UACnD,UAAU,aAAa;AAAA,UACvB,gBAAgB,aAAa,kBAAkB;AAAA,UAC/C,iBAAiB,aAAa;AAAA,UAC9B,cAAc,kBAAkB,YAAY;AAAA,QAC9C,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,gBAAgB,KAAK;AACjC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,mBAAa,SAAS;AACtB,mBAAa,cAAc,oBAAI,KAAK;AACpC,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,WAAW;AAAA,QACjD,gBAAgB,aAAa;AAAA,QAC7B,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,gBAAgB,QAAQ,KAAK;AAClD,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,UAAI,aAAa,WAAW,aAAa;AACvC,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,UAAU;AAC/B,mBAAa,SAAS;AACtB,mBAAa,cAAc;AAE3B,UAAI,iBAAiB,UAAU;AAC7B,qBAAa,SAAS;AAAA,MACxB,WAAW,CAAC,aAAa,QAAQ;AAC/B,qBAAa,SAAS,oBAAI,KAAK;AAAA,MACjC;AAEA,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,UAAU;AAAA,QAChD,gBAAgB,aAAa;AAAA,QAC7B,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,gBAAgB,OAAO,KAAK;AAC9C,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,YAAM,aAAa,aAAa;AAChC,YAAM,SAAS,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AAEvE,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,kBAAkB;AAAA,MACpC;AAEA,UAAI,SAAkB;AAEtB,UAAI,OAAO,aAAa,cAAc,WAAW;AAC/C,cAAM,eAAe;AAAA,UACnB,IAAI,aAAa;AAAA,UACjB,GAAG,MAAM;AAAA,QACX;AAGA,cAAM,aAAa;AAAA,UACjB;AAAA,UACA,MAAM;AAAA,YACJ,KAAK,IAAI;AAAA,YACT,UAAU,IAAI;AAAA,YACd,OAAO,IAAI;AAAA,UACb;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB,IAAI,kBAAkB;AAAA,UAC9C,iBAAiB,IAAI,iBAAiB,CAAC,IAAI,cAAc,IAAI;AAAA,QAC/D;AAEA,cAAM,gBAAgB,MAAM,WAAW,QAAQ,OAAO,WAAW;AAAA,UAC/D,OAAO;AAAA,UACP,KAAK;AAAA,UACL,UAAU;AAAA,YACR,UAAU,IAAI;AAAA,YACd,gBAAgB,IAAI;AAAA,YACpB,cAAc;AAAA,UAChB;AAAA,QACF,CAAC;AAED,iBAAS,cAAc;AAAA,MACzB;AAEA,mBAAa,SAAS;AACtB,mBAAa,aAAa,oBAAI,KAAK;AACnC,mBAAa,cAAc,MAAM;AACjC,mBAAa,eAAe;AAE5B,UAAI,CAAC,aAAa,QAAQ;AACxB,qBAAa,SAAS,oBAAI,KAAK;AAAA,MACjC;AAEA,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,UAAU;AAAA,QAChD,gBAAgB,aAAa;AAAA,QAC7B,UAAU,MAAM;AAAA,QAChB,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,aAAO,EAAE,cAAc,OAAO;AAAA,IAChC;AAAA,IAEA,MAAM,eAAe,KAAK;AACxB,YAAM,KAAK,OAAO,KAAK;AACvB,aAAO,GAAG,MAAM,cAAc;AAAA,QAC5B,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,YAAY,KAAK,OAAO;AAC5B,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,UAAmC;AAAA,QACvC,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB;AAEA,UAAI,OAAO;AACT,gBAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,KAAK,EAAE;AAAA,MAC7C;AAEA,YAAM,CAAC,eAAe,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrD,GAAG,KAAK,cAAc,SAAS;AAAA,UAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,UAC7B,OAAO;AAAA,QACT,CAAC;AAAA,QACD,GAAG,MAAM,cAAc;AAAA,UACrB,iBAAiB,IAAI;AAAA,UACrB,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,CAAC;AAED,YAAM,SAAS,cAAc,IAAI,iBAAiB;AAClD,YAAM,SAAS,QAAQ,OAAO,SAAS,IAAI;AAE3C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,OAAO,CAAC,GAAG;AAAA,MACrB;AAAA,IACF;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AAEnB,YAAM,eAAe,MAAM,GACxB,YAAY,eAAsB,EAClC,IAAI;AAAA,QACH,QAAQ;AAAA,QACR,cAAc;AAAA,MAChB,CAAQ,EACP,MAAM,cAAqB,KAAK,UAAU,EAC1C,MAAM,UAAiB,UAAU,CAAC,YAAY,WAAW,CAAC,EAC1D,iBAAiB;AAEpB,aAAO,OAAO,cAAc,kBAAkB,CAAC;AAAA,IACjD;AAAA,IAEA,MAAM,eAAe,kBAAkB,gBAAgB,KAAK;AAC1D,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AAEnB,YAAM,eAAe,MAAM,GACxB,WAAW,eAAsB,EACjC,MAAM,sBAA6B,KAAK,gBAAgB,EACxD,MAAM,oBAA2B,KAAK,cAAc,EACpD,MAAM,aAAoB,KAAK,IAAI,QAAQ,EAC3C,iBAAiB;AAEpB,aAAO,OAAO,cAAc,kBAAkB,CAAC;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,2BAA2B,WAEnB;AACtB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,MAAI;AACJ,MAAI;AACF,iBAAa,UAAU,QAAQ,YAAY;AAAA,EAC7C,QAAQ;AAEN,iBAAa;AAAA,EACf;AAEA,SAAO,0BAA0B,EAAE,IAAI,UAAU,YAAY,UAAU,CAAC;AAC1E;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { type Kysely, sql } from 'kysely'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { Notification, type NotificationStatus } from '../data/entities'\nimport type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'\nimport type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'\nimport { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  buildNotificationEntity,\n  emitNotificationCreated,\n  emitNotificationCreatedBatch,\n  type NotificationContentInput,\n  type NotificationTenantContext,\n} from './notificationFactory'\nimport { toNotificationDto } from './notificationMapper'\nimport { getRecipientUserIdsForFeature, getRecipientUserIdsForRole } from './notificationRecipients'\nimport { assertSafeNotificationHref, sanitizeNotificationActions } from './safeHref'\n\nconst DEBUG = process.env.NOTIFICATIONS_DEBUG === 'true'\n\nfunction debug(...args: unknown[]): void {\n  if (DEBUG) {\n    console.log('[notifications]', ...args)\n  }\n}\n\nfunction getDb(em: EntityManager): Kysely<any> {\n  return em.getKysely<any>()\n}\n\nconst UNIQUE_NOTIFICATION_ACTIVE_STATUSES: NotificationStatus[] = ['unread', 'read', 'actioned']\n\nfunction normalizeOrgScope(organizationId: string | null | undefined): string | null {\n  return organizationId ?? null\n}\n\nfunction applyNotificationContent(\n  notification: Notification,\n  input: NotificationContentInput,\n  recipientUserId: string,\n  ctx: NotificationTenantContext,\n) {\n  const actions = sanitizeNotificationActions(input.actions)\n  const linkHref = assertSafeNotificationHref(input.linkHref)\n\n  notification.recipientUserId = recipientUserId\n  notification.type = input.type\n  notification.titleKey = input.titleKey\n  notification.bodyKey = input.bodyKey\n  notification.titleVariables = input.titleVariables\n  notification.bodyVariables = input.bodyVariables\n  notification.title = input.title || input.titleKey || ''\n  notification.body = input.body\n  notification.icon = input.icon\n  notification.severity = input.severity ?? 'info'\n  notification.actionData = actions\n    ? {\n        actions,\n        primaryActionId: input.primaryActionId,\n      }\n    : null\n  notification.sourceModule = input.sourceModule\n  notification.sourceEntityType = input.sourceEntityType\n  notification.sourceEntityId = input.sourceEntityId\n  notification.linkHref = linkHref\n  notification.groupKey = input.groupKey\n  notification.expiresAt = input.expiresAt ? new Date(input.expiresAt) : null\n  notification.tenantId = ctx.tenantId\n  notification.organizationId = normalizeOrgScope(ctx.organizationId)\n  notification.status = 'unread'\n  notification.readAt = null\n  notification.actionedAt = null\n  notification.dismissedAt = null\n  notification.actionTaken = null\n  notification.actionResult = null\n  notification.createdAt = new Date()\n}\n\nasync function findScopedNotificationOrThrow(\n  em: EntityManager,\n  notificationId: string,\n  ctx: NotificationServiceContext,\n): Promise<Notification> {\n  const notification = await findOneWithDecryption(\n    em,\n    Notification,\n    {\n      id: notificationId,\n      recipientUserId: ctx.userId,\n      tenantId: ctx.tenantId,\n    },\n    undefined,\n    {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId ?? null,\n    },\n  )\n  if (!notification) {\n    throw new CrudHttpError(404, { error: 'Notification not found' })\n  }\n  return notification\n}\n\nasync function emitNotificationSseEvents(\n  eventBus: { emit: (event: string, payload: unknown) => Promise<void> },\n  notifications: Notification[],\n  ctx: NotificationServiceContext,\n  recipientUserIds: string[],\n): Promise<void> {\n  await eventBus.emit(NOTIFICATION_SSE_EVENTS.BATCH_CREATED, {\n    tenantId: ctx.tenantId,\n    organizationId: normalizeOrgScope(ctx.organizationId),\n    recipientUserIds,\n    count: notifications.length,\n  })\n\n  for (const notification of notifications) {\n    await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {\n      tenantId: notification.tenantId,\n      organizationId: notification.organizationId ?? null,\n      recipientUserId: notification.recipientUserId,\n      notification: toNotificationDto(notification),\n    })\n  }\n}\n\nasync function createOrRefreshNotification(\n  em: EntityManager,\n  input: NotificationContentInput,\n  recipientUserId: string,\n  ctx: NotificationTenantContext,\n): Promise<Notification> {\n  if (input.groupKey && input.groupKey.trim().length > 0) {\n    const orgScope = normalizeOrgScope(ctx.organizationId) ?? 'global'\n    const lockKey = `notifications:${ctx.tenantId}:${orgScope}:${recipientUserId}:${input.type}:${input.groupKey}`\n    try {\n      const db = getDb(em)\n      await sql`select pg_advisory_xact_lock(hashtext(${lockKey}))`.execute(db)\n    } catch {\n      // If advisory locks are unavailable, continue with best-effort dedupe.\n    }\n\n    const existing = await em.findOne(Notification, {\n      recipientUserId,\n      tenantId: ctx.tenantId,\n      organizationId: normalizeOrgScope(ctx.organizationId),\n      type: input.type,\n      groupKey: input.groupKey,\n      status: { $in: UNIQUE_NOTIFICATION_ACTIVE_STATUSES },\n    }, {\n      orderBy: { createdAt: 'desc' },\n    })\n\n    if (existing) {\n      applyNotificationContent(existing, input, recipientUserId, ctx)\n      return existing\n    }\n  }\n\n  return buildNotificationEntity(em, input, recipientUserId, ctx)\n}\n\nexport interface NotificationServiceContext {\n  tenantId: string\n  organizationId?: string | null\n  userId?: string | null\n}\n\nexport interface NotificationService {\n  create(input: CreateNotificationInput, ctx: NotificationServiceContext): Promise<Notification>\n  createBatch(input: CreateBatchNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  createForRole(input: CreateRoleNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  createForFeature(input: CreateFeatureNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  markAsRead(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>\n  markAllAsRead(ctx: NotificationServiceContext): Promise<number>\n  dismiss(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>\n  restoreDismissed(\n    notificationId: string,\n    status: 'read' | 'unread' | undefined,\n    ctx: NotificationServiceContext\n  ): Promise<Notification>\n  executeAction(\n    notificationId: string,\n    input: ExecuteActionInput,\n    ctx: NotificationServiceContext\n  ): Promise<{ notification: Notification; result: unknown }>\n  getUnreadCount(ctx: NotificationServiceContext): Promise<number>\n  getPollData(ctx: NotificationServiceContext, since?: string): Promise<NotificationPollData>\n  cleanupExpired(): Promise<number>\n  deleteBySource(\n    sourceEntityType: string,\n    sourceEntityId: string,\n    ctx: NotificationServiceContext\n  ): Promise<number>\n}\n\nexport interface NotificationServiceDeps {\n  em: EntityManager\n  eventBus: { emit: (event: string, payload: unknown) => Promise<void> }\n  commandBus?: {\n    execute: (\n      commandId: string,\n      options: { input: unknown; ctx: unknown; metadata?: unknown }\n    ) => Promise<{ result: unknown }>\n  }\n  container?: { resolve: (name: string) => unknown }\n}\n\nexport function createNotificationService(deps: NotificationServiceDeps): NotificationService {\n  const { em: rootEm, eventBus, commandBus, container } = deps\n\n  return {\n    async create(input, ctx) {\n      const { recipientUserId, ...content } = input\n      const writeEm = rootEm.fork()\n      const notification = await writeEm.transactional(async (tx) => {\n        const entity = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n        await tx.flush()\n        return entity\n      })\n\n      await emitNotificationCreated(eventBus, notification, ctx)\n      await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {\n        tenantId: notification.tenantId,\n        organizationId: notification.organizationId ?? null,\n        recipientUserId: notification.recipientUserId,\n        notification: toNotificationDto(notification),\n      })\n\n      return notification\n    },\n\n    async createBatch(input, ctx) {\n      const recipientUserIds = Array.from(new Set(input.recipientUserIds))\n      const { recipientUserIds: _recipientUserIds, ...content } = input\n      const notifications: Notification[] = []\n      const writeEm = rootEm.fork()\n\n      await writeEm.transactional(async (tx) => {\n        for (const recipientUserId of recipientUserIds) {\n          const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n          notifications.push(notification)\n        }\n        await tx.flush()\n      })\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n      await emitNotificationSseEvents(eventBus, notifications, ctx, recipientUserIds)\n\n      return notifications\n    },\n\n    async createForRole(input, ctx) {\n      const em = rootEm.fork()\n\n      const db = getDb(em)\n      const recipientUserIds = await getRecipientUserIdsForRole(db, ctx.tenantId, input.roleId)\n      if (recipientUserIds.length === 0) {\n        return []\n      }\n\n      const { roleId: _roleId, ...content } = input\n      const notifications: Notification[] = []\n      const uniqueRecipientUserIds = Array.from(new Set(recipientUserIds))\n      const writeEm = rootEm.fork()\n\n      await writeEm.transactional(async (tx) => {\n        for (const recipientUserId of uniqueRecipientUserIds) {\n          const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n          notifications.push(notification)\n        }\n        await tx.flush()\n      })\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n      await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds)\n\n      return notifications\n    },\n\n    async createForFeature(input, ctx) {\n      const em = rootEm.fork()\n      const db = getDb(em)\n      const recipientUserIds = await getRecipientUserIdsForFeature(db, ctx.tenantId, input.requiredFeature)\n\n      if (recipientUserIds.length === 0) {\n        debug('No users found with feature:', input.requiredFeature, 'in tenant:', ctx.tenantId)\n        return []\n      }\n\n      debug('Creating notifications for', recipientUserIds.length, 'user(s) with feature:', input.requiredFeature)\n\n      const { requiredFeature: _requiredFeature, ...content } = input\n      const notifications: Notification[] = []\n      const uniqueRecipientUserIds = Array.from(new Set(recipientUserIds))\n      const writeEm = rootEm.fork()\n\n      await writeEm.transactional(async (tx) => {\n        for (const recipientUserId of uniqueRecipientUserIds) {\n          const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)\n          notifications.push(notification)\n        }\n        await tx.flush()\n      })\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n      await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds)\n\n      return notifications\n    },\n\n    async markAsRead(notificationId, ctx) {\n      const em = rootEm.fork()\n      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)\n\n      if (notification.status === 'unread') {\n        notification.status = 'read'\n        notification.readAt = new Date()\n        await em.flush()\n\n        await eventBus.emit(NOTIFICATION_EVENTS.READ, {\n          notificationId: notification.id,\n          userId: ctx.userId,\n          tenantId: ctx.tenantId,\n        })\n      }\n\n      return notification\n    },\n\n    async markAllAsRead(ctx) {\n      const em = rootEm.fork()\n      const db = getDb(em)\n      const applyScope = <QB extends { where: (...args: any[]) => QB }>(q: QB): QB => {\n        let chain = q\n          .where('recipient_user_id' as any, '=', ctx.userId as any)\n          .where('tenant_id' as any, '=', ctx.tenantId)\n          .where('status' as any, '=', 'unread')\n        if (ctx.organizationId) {\n          chain = chain.where('organization_id' as any, '=', ctx.organizationId)\n        }\n        return chain\n      }\n\n      const targetRows = await applyScope(\n        db\n          .selectFrom('notifications' as any)\n          .select([\n            'id' as any,\n            'organization_id' as any,\n            'recipient_user_id' as any,\n          ]),\n      ).execute() as Array<{ id: string }>\n\n      if (!targetRows.length) {\n        return 0\n      }\n\n      const updateResult = await applyScope(\n        db.updateTable('notifications' as any).set({\n          status: 'read',\n          read_at: sql`now()`,\n        } as any) as any,\n      ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined\n      const result = Number(updateResult?.numUpdatedRows ?? targetRows.length)\n\n      const notifications = await findWithDecryption(em, Notification, {\n        id: { $in: targetRows.map((row) => row.id) },\n      }, undefined, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId ?? null,\n      })\n\n      for (const notification of notifications) {\n        await eventBus.emit(NOTIFICATION_EVENTS.READ, {\n          notificationId: notification.id,\n          userId: ctx.userId,\n          tenantId: ctx.tenantId,\n        })\n\n        await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {\n          tenantId: notification.tenantId,\n          organizationId: notification.organizationId ?? null,\n          recipientUserId: notification.recipientUserId,\n          notification: toNotificationDto(notification),\n        })\n      }\n\n      return result\n    },\n\n    async dismiss(notificationId, ctx) {\n      const em = rootEm.fork()\n      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)\n\n      notification.status = 'dismissed'\n      notification.dismissedAt = new Date()\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {\n        notificationId: notification.id,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      return notification\n    },\n\n    async restoreDismissed(notificationId, status, ctx) {\n      const em = rootEm.fork()\n      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)\n\n      if (notification.status !== 'dismissed') {\n        return notification\n      }\n\n      const targetStatus = status ?? 'read'\n      notification.status = targetStatus\n      notification.dismissedAt = null\n\n      if (targetStatus === 'unread') {\n        notification.readAt = null\n      } else if (!notification.readAt) {\n        notification.readAt = new Date()\n      }\n\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {\n        notificationId: notification.id,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n        status: targetStatus,\n      })\n\n      return notification\n    },\n\n    async executeAction(notificationId, input, ctx) {\n      const em = rootEm.fork()\n      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)\n\n      const actionData = notification.actionData\n      const action = actionData?.actions?.find((a) => a.id === input.actionId)\n\n      if (!action) {\n        throw new Error('Action not found')\n      }\n\n      let result: unknown = null\n\n      if (action.commandId && commandBus && container) {\n        const commandInput = {\n          id: notification.sourceEntityId,\n          ...input.payload,\n        }\n\n        // Build a CommandRuntimeContext from the notification service context\n        const commandCtx = {\n          container,\n          auth: {\n            sub: ctx.userId,\n            tenantId: ctx.tenantId,\n            orgId: ctx.organizationId,\n          },\n          organizationScope: null,\n          selectedOrganizationId: ctx.organizationId ?? null,\n          organizationIds: ctx.organizationId ? [ctx.organizationId] : null,\n        }\n\n        const commandResult = await commandBus.execute(action.commandId, {\n          input: commandInput,\n          ctx: commandCtx,\n          metadata: {\n            tenantId: ctx.tenantId,\n            organizationId: ctx.organizationId,\n            resourceKind: 'notifications',\n          },\n        })\n\n        result = commandResult.result\n      }\n\n      notification.status = 'actioned'\n      notification.actionedAt = new Date()\n      notification.actionTaken = input.actionId\n      notification.actionResult = result as Record<string, unknown>\n\n      if (!notification.readAt) {\n        notification.readAt = new Date()\n      }\n\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {\n        notificationId: notification.id,\n        actionId: input.actionId,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      return { notification, result }\n    },\n\n    async getUnreadCount(ctx) {\n      const em = rootEm.fork()\n      return em.count(Notification, {\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n        status: 'unread',\n      })\n    },\n\n    async getPollData(ctx, since) {\n      const em = rootEm.fork()\n      const filters: Record<string, unknown> = {\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      }\n\n      if (since) {\n        filters.createdAt = { $gt: new Date(since) }\n      }\n\n      const [notifications, unreadCount] = await Promise.all([\n        em.find(Notification, filters, {\n          orderBy: { createdAt: 'desc' },\n          limit: 50,\n        }),\n        em.count(Notification, {\n          recipientUserId: ctx.userId,\n          tenantId: ctx.tenantId,\n          status: 'unread',\n        }),\n      ])\n\n      const recent = notifications.map(toNotificationDto)\n      const hasNew = since ? recent.length > 0 : false\n\n      return {\n        unreadCount,\n        recent,\n        hasNew,\n        lastId: recent[0]?.id,\n      }\n    },\n\n    async cleanupExpired() {\n      const em = rootEm.fork()\n      const db = getDb(em)\n\n      const updateResult = await db\n        .updateTable('notifications' as any)\n        .set({\n          status: 'dismissed',\n          dismissed_at: sql`now()`,\n        } as any)\n        .where('expires_at' as any, '<', sql`now()`)\n        .where('status' as any, 'not in', ['actioned', 'dismissed'])\n        .executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined\n\n      return Number(updateResult?.numUpdatedRows ?? 0)\n    },\n\n    async deleteBySource(sourceEntityType, sourceEntityId, ctx) {\n      const em = rootEm.fork()\n      const db = getDb(em)\n\n      const deleteResult = await db\n        .deleteFrom('notifications' as any)\n        .where('source_entity_type' as any, '=', sourceEntityType)\n        .where('source_entity_id' as any, '=', sourceEntityId)\n        .where('tenant_id' as any, '=', ctx.tenantId)\n        .executeTakeFirst() as { numDeletedRows?: bigint | number } | undefined\n\n      return Number(deleteResult?.numDeletedRows ?? 0)\n    },\n  }\n}\n\n/**\n * Helper to create notification service from a DI container.\n * Use this in API routes and commands to avoid DI resolution issues.\n */\nexport function resolveNotificationService(container: {\n  resolve: (name: string) => unknown\n}): NotificationService {\n  const em = container.resolve('em') as EntityManager\n  const eventBus = container.resolve('eventBus') as { emit: (event: string, payload: unknown) => Promise<void> }\n\n  // commandBus may not be registered in all contexts, so resolve it safely\n  let commandBus: NotificationServiceDeps['commandBus']\n  try {\n    commandBus = container.resolve('commandBus') as typeof commandBus\n  } catch {\n    // commandBus not available - actions with commandId won't work\n    commandBus = undefined\n  }\n\n  return createNotificationService({ em, eventBus, commandBus, container })\n}\n"],
+  "mappings": "AACA,SAAsB,WAAW;AACjC,SAAS,qBAAqB;AAC9B,SAAS,oBAA6C;AAGtD,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yBAAyB;AAClC,SAAS,+BAA+B,kCAAkC;AAC1E,SAAS,4BAA4B,mCAAmC;AAExE,MAAM,QAAQ,QAAQ,IAAI,wBAAwB;AAElD,SAAS,SAAS,MAAuB;AACvC,MAAI,OAAO;AACT,YAAQ,IAAI,mBAAmB,GAAG,IAAI;AAAA,EACxC;AACF;AAEA,SAAS,MAAM,IAAgC;AAC7C,SAAO,GAAG,UAAe;AAC3B;AAEA,MAAM,sCAA4D,CAAC,UAAU,QAAQ,UAAU;AAE/F,SAAS,kBAAkB,gBAA0D;AACnF,SAAO,kBAAkB;AAC3B;AAEA,SAAS,yBACP,cACA,OACA,iBACA,KACA;AACA,QAAM,UAAU,4BAA4B,MAAM,OAAO;AACzD,QAAM,WAAW,2BAA2B,MAAM,QAAQ;AAE1D,eAAa,kBAAkB;AAC/B,eAAa,OAAO,MAAM;AAC1B,eAAa,WAAW,MAAM;AAC9B,eAAa,UAAU,MAAM;AAC7B,eAAa,iBAAiB,MAAM;AACpC,eAAa,gBAAgB,MAAM;AACnC,eAAa,QAAQ,MAAM,SAAS,MAAM,YAAY;AACtD,eAAa,OAAO,MAAM;AAC1B,eAAa,OAAO,MAAM;AAC1B,eAAa,WAAW,MAAM,YAAY;AAC1C,eAAa,aAAa,UACtB;AAAA,IACE;AAAA,IACA,iBAAiB,MAAM;AAAA,EACzB,IACA;AACJ,eAAa,eAAe,MAAM;AAClC,eAAa,mBAAmB,MAAM;AACtC,eAAa,iBAAiB,MAAM;AACpC,eAAa,WAAW;AACxB,eAAa,WAAW,MAAM;AAC9B,eAAa,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,IAAI;AACvE,eAAa,WAAW,IAAI;AAC5B,eAAa,iBAAiB,kBAAkB,IAAI,cAAc;AAClE,eAAa,SAAS;AACtB,eAAa,SAAS;AACtB,eAAa,aAAa;AAC1B,eAAa,cAAc;AAC3B,eAAa,cAAc;AAC3B,eAAa,eAAe;AAC5B,eAAa,YAAY,oBAAI,KAAK;AACpC;AAEA,eAAe,8BACb,IACA,gBACA,KACuB;AACvB,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI,kBAAkB;AAAA,IACxC;AAAA,EACF;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,eAAe,0BACb,UACA,eACA,KACA,kBACe;AACf,QAAM,SAAS,KAAK,wBAAwB,eAAe;AAAA,IACzD,UAAU,IAAI;AAAA,IACd,gBAAgB,kBAAkB,IAAI,cAAc;AAAA,IACpD;AAAA,IACA,OAAO,cAAc;AAAA,EACvB,CAAC;AAED,aAAW,gBAAgB,eAAe;AACxC,UAAM,SAAS,KAAK,wBAAwB,SAAS;AAAA,MACnD,UAAU,aAAa;AAAA,MACvB,gBAAgB,aAAa,kBAAkB;AAAA,MAC/C,iBAAiB,aAAa;AAAA,MAC9B,cAAc,kBAAkB,YAAY;AAAA,IAC9C,CAAC;AAAA,EACH;AACF;AAEA,eAAe,4BACb,IACA,OACA,iBACA,KACuB;AACvB,MAAI,MAAM,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AACtD,UAAM,WAAW,kBAAkB,IAAI,cAAc,KAAK;AAC1D,UAAM,UAAU,iBAAiB,IAAI,QAAQ,IAAI,QAAQ,IAAI,eAAe,IAAI,MAAM,IAAI,IAAI,MAAM,QAAQ;AAC5G,QAAI;AACF,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,4CAA4C,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC1E,QAAQ;AAAA,IAER;AAEA,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C;AAAA,MACA,UAAU,IAAI;AAAA,MACd,gBAAgB,kBAAkB,IAAI,cAAc;AAAA,MACpD,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,EAAE,KAAK,oCAAoC;AAAA,IACrD,GAAG;AAAA,MACD,SAAS,EAAE,WAAW,OAAO;AAAA,IAC/B,CAAC;AAED,QAAI,UAAU;AACZ,+BAAyB,UAAU,OAAO,iBAAiB,GAAG;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,wBAAwB,IAAI,OAAO,iBAAiB,GAAG;AAChE;AAgDO,SAAS,0BAA0B,MAAoD;AAC5F,QAAM,EAAE,IAAI,QAAQ,UAAU,YAAY,UAAU,IAAI;AAExD,SAAO;AAAA,IACL,MAAM,OAAO,OAAO,KAAK;AACvB,YAAM,EAAE,iBAAiB,GAAG,QAAQ,IAAI;AACxC,YAAM,UAAU,OAAO,KAAK;AAC5B,YAAM,eAAe,MAAM,QAAQ,cAAc,OAAO,OAAO;AAC7D,cAAM,SAAS,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AAClF,cAAM,GAAG,MAAM;AACf,eAAO;AAAA,MACT,CAAC;AAED,YAAM,wBAAwB,UAAU,cAAc,GAAG;AACzD,YAAM,SAAS,KAAK,wBAAwB,SAAS;AAAA,QACnD,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa,kBAAkB;AAAA,QAC/C,iBAAiB,aAAa;AAAA,QAC9B,cAAc,kBAAkB,YAAY;AAAA,MAC9C,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO,KAAK;AAC5B,YAAM,mBAAmB,MAAM,KAAK,IAAI,IAAI,MAAM,gBAAgB,CAAC;AACnE,YAAM,EAAE,kBAAkB,mBAAmB,GAAG,QAAQ,IAAI;AAC5D,YAAM,gBAAgC,CAAC;AACvC,YAAM,UAAU,OAAO,KAAK;AAE5B,YAAM,QAAQ,cAAc,OAAO,OAAO;AACxC,mBAAW,mBAAmB,kBAAkB;AAC9C,gBAAM,eAAe,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AACxF,wBAAc,KAAK,YAAY;AAAA,QACjC;AACA,cAAM,GAAG,MAAM;AAAA,MACjB,CAAC;AAED,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAC/D,YAAM,0BAA0B,UAAU,eAAe,KAAK,gBAAgB;AAE9E,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,OAAO,KAAK;AAC9B,YAAM,KAAK,OAAO,KAAK;AAEvB,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,mBAAmB,MAAM,2BAA2B,IAAI,IAAI,UAAU,MAAM,MAAM;AACxF,UAAI,iBAAiB,WAAW,GAAG;AACjC,eAAO,CAAC;AAAA,MACV;AAEA,YAAM,EAAE,QAAQ,SAAS,GAAG,QAAQ,IAAI;AACxC,YAAM,gBAAgC,CAAC;AACvC,YAAM,yBAAyB,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC;AACnE,YAAM,UAAU,OAAO,KAAK;AAE5B,YAAM,QAAQ,cAAc,OAAO,OAAO;AACxC,mBAAW,mBAAmB,wBAAwB;AACpD,gBAAM,eAAe,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AACxF,wBAAc,KAAK,YAAY;AAAA,QACjC;AACA,cAAM,GAAG,MAAM;AAAA,MACjB,CAAC;AAED,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAC/D,YAAM,0BAA0B,UAAU,eAAe,KAAK,sBAAsB;AAEpF,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,OAAO,KAAK;AACjC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,mBAAmB,MAAM,8BAA8B,IAAI,IAAI,UAAU,MAAM,eAAe;AAEpG,UAAI,iBAAiB,WAAW,GAAG;AACjC,cAAM,gCAAgC,MAAM,iBAAiB,cAAc,IAAI,QAAQ;AACvF,eAAO,CAAC;AAAA,MACV;AAEA,YAAM,8BAA8B,iBAAiB,QAAQ,yBAAyB,MAAM,eAAe;AAE3G,YAAM,EAAE,iBAAiB,kBAAkB,GAAG,QAAQ,IAAI;AAC1D,YAAM,gBAAgC,CAAC;AACvC,YAAM,yBAAyB,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC;AACnE,YAAM,UAAU,OAAO,KAAK;AAE5B,YAAM,QAAQ,cAAc,OAAO,OAAO;AACxC,mBAAW,mBAAmB,wBAAwB;AACpD,gBAAM,eAAe,MAAM,4BAA4B,IAAI,SAAS,iBAAiB,GAAG;AACxF,wBAAc,KAAK,YAAY;AAAA,QACjC;AACA,cAAM,GAAG,MAAM;AAAA,MACjB,CAAC;AAED,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAC/D,YAAM,0BAA0B,UAAU,eAAe,KAAK,sBAAsB;AAEpF,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,WAAW,gBAAgB,KAAK;AACpC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,8BAA8B,IAAI,gBAAgB,GAAG;AAEhF,UAAI,aAAa,WAAW,UAAU;AACpC,qBAAa,SAAS;AACtB,qBAAa,SAAS,oBAAI,KAAK;AAC/B,cAAM,GAAG,MAAM;AAEf,cAAM,SAAS,KAAK,oBAAoB,MAAM;AAAA,UAC5C,gBAAgB,aAAa;AAAA,UAC7B,QAAQ,IAAI;AAAA,UACZ,UAAU,IAAI;AAAA,QAChB,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AACnB,YAAM,aAAa,CAA+C,MAAc;AAC9E,YAAI,QAAQ,EACT,MAAM,qBAA4B,KAAK,IAAI,MAAa,EACxD,MAAM,aAAoB,KAAK,IAAI,QAAQ,EAC3C,MAAM,UAAiB,KAAK,QAAQ;AACvC,YAAI,IAAI,gBAAgB;AACtB,kBAAQ,MAAM,MAAM,mBAA0B,KAAK,IAAI,cAAc;AAAA,QACvE;AACA,eAAO;AAAA,MACT;AAEA,YAAM,aAAa,MAAM;AAAA,QACvB,GACG,WAAW,eAAsB,EACjC,OAAO;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACL,EAAE,QAAQ;AAEV,UAAI,CAAC,WAAW,QAAQ;AACtB,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,MAAM;AAAA,QACzB,GAAG,YAAY,eAAsB,EAAE,IAAI;AAAA,UACzC,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAQ;AAAA,MACV,EAAE,iBAAiB;AACnB,YAAM,SAAS,OAAO,cAAc,kBAAkB,WAAW,MAAM;AAEvE,YAAM,gBAAgB,MAAM,mBAAmB,IAAI,cAAc;AAAA,QAC/D,IAAI,EAAE,KAAK,WAAW,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE;AAAA,MAC7C,GAAG,QAAW;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI,kBAAkB;AAAA,MACxC,CAAC;AAED,iBAAW,gBAAgB,eAAe;AACxC,cAAM,SAAS,KAAK,oBAAoB,MAAM;AAAA,UAC5C,gBAAgB,aAAa;AAAA,UAC7B,QAAQ,IAAI;AAAA,UACZ,UAAU,IAAI;AAAA,QAChB,CAAC;AAED,cAAM,SAAS,KAAK,wBAAwB,SAAS;AAAA,UACnD,UAAU,aAAa;AAAA,UACvB,gBAAgB,aAAa,kBAAkB;AAAA,UAC/C,iBAAiB,aAAa;AAAA,UAC9B,cAAc,kBAAkB,YAAY;AAAA,QAC9C,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,gBAAgB,KAAK;AACjC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,8BAA8B,IAAI,gBAAgB,GAAG;AAEhF,mBAAa,SAAS;AACtB,mBAAa,cAAc,oBAAI,KAAK;AACpC,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,WAAW;AAAA,QACjD,gBAAgB,aAAa;AAAA,QAC7B,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,gBAAgB,QAAQ,KAAK;AAClD,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,8BAA8B,IAAI,gBAAgB,GAAG;AAEhF,UAAI,aAAa,WAAW,aAAa;AACvC,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,UAAU;AAC/B,mBAAa,SAAS;AACtB,mBAAa,cAAc;AAE3B,UAAI,iBAAiB,UAAU;AAC7B,qBAAa,SAAS;AAAA,MACxB,WAAW,CAAC,aAAa,QAAQ;AAC/B,qBAAa,SAAS,oBAAI,KAAK;AAAA,MACjC;AAEA,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,UAAU;AAAA,QAChD,gBAAgB,aAAa;AAAA,QAC7B,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,gBAAgB,OAAO,KAAK;AAC9C,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,8BAA8B,IAAI,gBAAgB,GAAG;AAEhF,YAAM,aAAa,aAAa;AAChC,YAAM,SAAS,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AAEvE,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,kBAAkB;AAAA,MACpC;AAEA,UAAI,SAAkB;AAEtB,UAAI,OAAO,aAAa,cAAc,WAAW;AAC/C,cAAM,eAAe;AAAA,UACnB,IAAI,aAAa;AAAA,UACjB,GAAG,MAAM;AAAA,QACX;AAGA,cAAM,aAAa;AAAA,UACjB;AAAA,UACA,MAAM;AAAA,YACJ,KAAK,IAAI;AAAA,YACT,UAAU,IAAI;AAAA,YACd,OAAO,IAAI;AAAA,UACb;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB,IAAI,kBAAkB;AAAA,UAC9C,iBAAiB,IAAI,iBAAiB,CAAC,IAAI,cAAc,IAAI;AAAA,QAC/D;AAEA,cAAM,gBAAgB,MAAM,WAAW,QAAQ,OAAO,WAAW;AAAA,UAC/D,OAAO;AAAA,UACP,KAAK;AAAA,UACL,UAAU;AAAA,YACR,UAAU,IAAI;AAAA,YACd,gBAAgB,IAAI;AAAA,YACpB,cAAc;AAAA,UAChB;AAAA,QACF,CAAC;AAED,iBAAS,cAAc;AAAA,MACzB;AAEA,mBAAa,SAAS;AACtB,mBAAa,aAAa,oBAAI,KAAK;AACnC,mBAAa,cAAc,MAAM;AACjC,mBAAa,eAAe;AAE5B,UAAI,CAAC,aAAa,QAAQ;AACxB,qBAAa,SAAS,oBAAI,KAAK;AAAA,MACjC;AAEA,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,UAAU;AAAA,QAChD,gBAAgB,aAAa;AAAA,QAC7B,UAAU,MAAM;AAAA,QAChB,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,aAAO,EAAE,cAAc,OAAO;AAAA,IAChC;AAAA,IAEA,MAAM,eAAe,KAAK;AACxB,YAAM,KAAK,OAAO,KAAK;AACvB,aAAO,GAAG,MAAM,cAAc;AAAA,QAC5B,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,YAAY,KAAK,OAAO;AAC5B,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,UAAmC;AAAA,QACvC,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB;AAEA,UAAI,OAAO;AACT,gBAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,KAAK,EAAE;AAAA,MAC7C;AAEA,YAAM,CAAC,eAAe,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrD,GAAG,KAAK,cAAc,SAAS;AAAA,UAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,UAC7B,OAAO;AAAA,QACT,CAAC;AAAA,QACD,GAAG,MAAM,cAAc;AAAA,UACrB,iBAAiB,IAAI;AAAA,UACrB,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,CAAC;AAED,YAAM,SAAS,cAAc,IAAI,iBAAiB;AAClD,YAAM,SAAS,QAAQ,OAAO,SAAS,IAAI;AAE3C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,OAAO,CAAC,GAAG;AAAA,MACrB;AAAA,IACF;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AAEnB,YAAM,eAAe,MAAM,GACxB,YAAY,eAAsB,EAClC,IAAI;AAAA,QACH,QAAQ;AAAA,QACR,cAAc;AAAA,MAChB,CAAQ,EACP,MAAM,cAAqB,KAAK,UAAU,EAC1C,MAAM,UAAiB,UAAU,CAAC,YAAY,WAAW,CAAC,EAC1D,iBAAiB;AAEpB,aAAO,OAAO,cAAc,kBAAkB,CAAC;AAAA,IACjD;AAAA,IAEA,MAAM,eAAe,kBAAkB,gBAAgB,KAAK;AAC1D,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,KAAK,MAAM,EAAE;AAEnB,YAAM,eAAe,MAAM,GACxB,WAAW,eAAsB,EACjC,MAAM,sBAA6B,KAAK,gBAAgB,EACxD,MAAM,oBAA2B,KAAK,cAAc,EACpD,MAAM,aAAoB,KAAK,IAAI,QAAQ,EAC3C,iBAAiB;AAEpB,aAAO,OAAO,cAAc,kBAAkB,CAAC;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,2BAA2B,WAEnB;AACtB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,MAAI;AACJ,MAAI;AACF,iBAAa,UAAU,QAAQ,YAAY;AAAA,EAC7C,QAAQ;AAEN,iBAAa;AAAA,EACf;AAEA,SAAO,0BAA0B,EAAE,IAAI,UAAU,YAAY,UAAU,CAAC;AAC1E;",
   "names": []
 }

package/dist/modules/notifications/lib/routeHelpers.js

@@ -1,6 +1,27 @@
 import { z } from "zod";
 import { resolveRequestContext } from "@open-mercato/shared/lib/api/context";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveNotificationService } from "./notificationService.js";
+function formatZodIssues(error) {
+  return error.issues.map((issue) => {
+    const path = issue.path.length ? `${issue.path.join(".")}: ` : "";
+    return `${path}${issue.message}`;
+  }).join("; ");
+}
+async function notificationValidationErrorResponse(error) {
+  const { t } = await resolveTranslations();
+  const prefix = t("api.errors.invalidPayload", "Invalid request body");
+  const details = formatZodIssues(error);
+  return Response.json(
+    { error: details ? `${prefix}: ${details}` : prefix },
+    { status: 400 }
+  );
+}
+function notificationCrudErrorResponse(error) {
+  if (!isCrudHttpError(error)) return null;
+  return Response.json(error.body ?? { error: "Notification request failed" }, { status: error.status });
+}
 async function resolveNotificationContext(req) {
   const { ctx } = await resolveRequestContext(req);
   return {
@@ -17,13 +38,22 @@ function createBulkNotificationRoute(schema, serviceMethod) {
   return async function POST(req) {
     const { service, scope } = await resolveNotificationContext(req);
     const body = await req.json().catch(() => ({}));
-    const input = schema.parse(body);
-    const notifications = await service[serviceMethod](input, scope);
-    return Response.json({
-      ok: true,
-      count: notifications.length,
-      ids: notifications.map((n) => n.id)
-    }, { status: 201 });
+    const parsed = schema.safeParse(body);
+    if (!parsed.success) {
+      return notificationValidationErrorResponse(parsed.error);
+    }
+    try {
+      const notifications = await service[serviceMethod](parsed.data, scope);
+      return Response.json({
+        ok: true,
+        count: notifications.length,
+        ids: notifications.map((n) => n.id)
+      }, { status: 201 });
+    } catch (error) {
+      const errorResponse = notificationCrudErrorResponse(error);
+      if (errorResponse) return errorResponse;
+      throw error;
+    }
   };
 }
 function createBulkNotificationOpenApi(schema, summary, description) {
@@ -61,7 +91,13 @@ function createSingleNotificationActionRoute(serviceMethod) {
   return async function PUT(req, { params }) {
     const { id } = await params;
     const { service, scope } = await resolveNotificationContext(req);
-    await service[serviceMethod](id, scope);
+    try {
+      await service[serviceMethod](id, scope);
+    } catch (error) {
+      const errorResponse = notificationCrudErrorResponse(error);
+      if (errorResponse) return errorResponse;
+      throw error;
+    }
     return Response.json({ ok: true });
   };
 }
@@ -96,6 +132,8 @@ export {
   createBulkNotificationRoute,
   createSingleNotificationActionOpenApi,
   createSingleNotificationActionRoute,
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
   resolveNotificationContext
 };
 //# sourceMappingURL=routeHelpers.js.map

package/dist/modules/notifications/lib/routeHelpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/lib/routeHelpers.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { resolveNotificationService, type NotificationService } from './notificationService'\n\n/**\n * Notification scope context for service calls\n */\nexport interface NotificationScope {\n  tenantId: string\n  organizationId: string | null\n  userId: string | null\n}\n\n/**\n * Resolved notification context from a request\n */\nexport interface NotificationRequestContext {\n  service: NotificationService\n  scope: NotificationScope\n  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx']\n}\n\n/**\n * Resolve notification service and scope from a request.\n * Centralizes the common pattern used across all notification API routes.\n */\nexport async function resolveNotificationContext(req: Request): Promise<NotificationRequestContext> {\n  const { ctx } = await resolveRequestContext(req)\n  return {\n    service: resolveNotificationService(ctx.container),\n    scope: {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? null,\n      userId: ctx.auth?.sub ?? null,\n    },\n    ctx,\n  }\n}\n\n/**\n * Create a POST handler for bulk notification creation routes.\n * Used by batch, role, and feature notification endpoints.\n */\nexport function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  serviceMethod: 'createBatch' | 'createForRole' | 'createForFeature'\n) {\n  return async function POST(req: Request) {\n    const { service, scope } = await resolveNotificationContext(req)\n\n    const body = await req.json().catch(() => ({}))\n    const input = schema.parse(body)\n\n    const notifications = await service[serviceMethod](input as never, scope)\n\n    return Response.json({\n      ok: true,\n      count: notifications.length,\n      ids: notifications.map((n) => n.id),\n    }, { status: 201 })\n  }\n}\n\n/**\n * Create OpenAPI spec for bulk notification creation routes.\n */\nexport function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  summary: string,\n  description?: string\n) {\n  return {\n    POST: {\n      summary,\n      description,\n      tags: ['Notifications'],\n      requestBody: {\n        required: true,\n        content: {\n          'application/json': {\n            schema,\n          },\n        },\n      },\n      responses: {\n        201: {\n          description: 'Notifications created',\n          content: {\n            'application/json': {\n              schema: z.object({\n                ok: z.boolean(),\n                count: z.number(),\n                ids: z.array(z.string().uuid()),\n              }),\n            },\n          },\n        },\n      },\n    },\n  }\n}\n\n/**\n * Create a PUT handler for single notification action routes.\n * Used by read and dismiss endpoints.\n */\nexport function createSingleNotificationActionRoute(\n  serviceMethod: 'markAsRead' | 'dismiss'\n) {\n  return async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {\n    const { id } = await params\n    const { service, scope } = await resolveNotificationContext(req)\n\n    await service[serviceMethod](id, scope)\n\n    return Response.json({ ok: true })\n  }\n}\n\n/**\n * Create OpenAPI spec for single notification action routes.\n */\nexport function createSingleNotificationActionOpenApi(\n  summary: string,\n  description: string\n) {\n  return {\n    PUT: {\n      summary,\n      tags: ['Notifications'],\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n      ],\n      responses: {\n        200: {\n          description,\n          content: {\n            'application/json': {\n              schema: z.object({ ok: z.boolean() }),\n            },\n          },\n        },\n      },\n    },\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC,SAAS,kCAA4D;AAwBrE,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,SAAO;AAAA,IACL,SAAS,2BAA2B,IAAI,SAAS;AAAA,IACjD,OAAO;AAAA,MACL,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B;AAAA,MAC9C,QAAQ,IAAI,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,4BACd,QACA,eACA;AACA,SAAO,eAAe,KAAK,KAAc;AACvC,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,OAAO,MAAM,IAAI;AAE/B,UAAM,gBAAgB,MAAM,QAAQ,aAAa,EAAE,OAAgB,KAAK;AAExE,WAAO,SAAS,KAAK;AAAA,MACnB,IAAI;AAAA,MACJ,OAAO,cAAc;AAAA,MACrB,KAAK,cAAc,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IACpC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACF;AAKO,SAAS,8BACd,QACA,SACA,aACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,MAAM,CAAC,eAAe;AAAA,MACtB,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,KAAK;AAAA,UACH,aAAa;AAAA,UACb,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ,EAAE,OAAO;AAAA,gBACf,IAAI,EAAE,QAAQ;AAAA,gBACd,OAAO,EAAE,OAAO;AAAA,gBAChB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,cAChC,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMO,SAAS,oCACd,eACA;AACA,SAAO,eAAe,IAAI,KAAc,EAAE,OAAO,GAAwC;AACvF,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,UAAM,QAAQ,aAAa,EAAE,IAAI,KAAK;AAEtC,WAAO,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACnC;AACF;AAKO,SAAS,sCACd,SACA,aACA;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA,MAAM,CAAC,eAAe;AAAA,MACtB,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,KAAK;AAAA,UACH;AAAA,UACA,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAAA,YACtC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveNotificationService, type NotificationService } from './notificationService'\n\n/**\n * Notification scope context for service calls\n */\nexport interface NotificationScope {\n  tenantId: string\n  organizationId: string | null\n  userId: string | null\n}\n\n/**\n * Resolved notification context from a request\n */\nexport interface NotificationRequestContext {\n  service: NotificationService\n  scope: NotificationScope\n  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx']\n}\n\nfunction formatZodIssues(error: z.ZodError): string {\n  return error.issues\n    .map((issue) => {\n      const path = issue.path.length ? `${issue.path.join('.')}: ` : ''\n      return `${path}${issue.message}`\n    })\n    .join('; ')\n}\n\nexport async function notificationValidationErrorResponse(error: z.ZodError): Promise<Response> {\n  const { t } = await resolveTranslations()\n  const prefix = t('api.errors.invalidPayload', 'Invalid request body')\n  const details = formatZodIssues(error)\n  return Response.json(\n    { error: details ? `${prefix}: ${details}` : prefix },\n    { status: 400 },\n  )\n}\n\nexport function notificationCrudErrorResponse(error: unknown): Response | null {\n  if (!isCrudHttpError(error)) return null\n  return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })\n}\n\n/**\n * Resolve notification service and scope from a request.\n * Centralizes the common pattern used across all notification API routes.\n */\nexport async function resolveNotificationContext(req: Request): Promise<NotificationRequestContext> {\n  const { ctx } = await resolveRequestContext(req)\n  return {\n    service: resolveNotificationService(ctx.container),\n    scope: {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? null,\n      userId: ctx.auth?.sub ?? null,\n    },\n    ctx,\n  }\n}\n\n/**\n * Create a POST handler for bulk notification creation routes.\n * Used by batch, role, and feature notification endpoints.\n */\nexport function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  serviceMethod: 'createBatch' | 'createForRole' | 'createForFeature'\n) {\n  return async function POST(req: Request) {\n    const { service, scope } = await resolveNotificationContext(req)\n\n    const body = await req.json().catch(() => ({}))\n    const parsed = schema.safeParse(body)\n    if (!parsed.success) {\n      return notificationValidationErrorResponse(parsed.error)\n    }\n\n    try {\n      const notifications = await service[serviceMethod](parsed.data as never, scope)\n\n      return Response.json({\n        ok: true,\n        count: notifications.length,\n        ids: notifications.map((n) => n.id),\n      }, { status: 201 })\n    } catch (error) {\n      const errorResponse = notificationCrudErrorResponse(error)\n      if (errorResponse) return errorResponse\n      throw error\n    }\n  }\n}\n\n/**\n * Create OpenAPI spec for bulk notification creation routes.\n */\nexport function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  summary: string,\n  description?: string\n) {\n  return {\n    POST: {\n      summary,\n      description,\n      tags: ['Notifications'],\n      requestBody: {\n        required: true,\n        content: {\n          'application/json': {\n            schema,\n          },\n        },\n      },\n      responses: {\n        201: {\n          description: 'Notifications created',\n          content: {\n            'application/json': {\n              schema: z.object({\n                ok: z.boolean(),\n                count: z.number(),\n                ids: z.array(z.string().uuid()),\n              }),\n            },\n          },\n        },\n      },\n    },\n  }\n}\n\n/**\n * Create a PUT handler for single notification action routes.\n * Used by read and dismiss endpoints.\n */\nexport function createSingleNotificationActionRoute(\n  serviceMethod: 'markAsRead' | 'dismiss'\n) {\n  return async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {\n    const { id } = await params\n    const { service, scope } = await resolveNotificationContext(req)\n\n    try {\n      await service[serviceMethod](id, scope)\n    } catch (error) {\n      const errorResponse = notificationCrudErrorResponse(error)\n      if (errorResponse) return errorResponse\n      throw error\n    }\n\n    return Response.json({ ok: true })\n  }\n}\n\n/**\n * Create OpenAPI spec for single notification action routes.\n */\nexport function createSingleNotificationActionOpenApi(\n  summary: string,\n  description: string\n) {\n  return {\n    PUT: {\n      summary,\n      tags: ['Notifications'],\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n      ],\n      responses: {\n        200: {\n          description,\n          content: {\n            'application/json': {\n              schema: z.object({ ok: z.boolean() }),\n            },\n          },\n        },\n      },\n    },\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,2BAA2B;AACpC,SAAS,kCAA4D;AAoBrE,SAAS,gBAAgB,OAA2B;AAClD,SAAO,MAAM,OACV,IAAI,CAAC,UAAU;AACd,UAAM,OAAO,MAAM,KAAK,SAAS,GAAG,MAAM,KAAK,KAAK,GAAG,CAAC,OAAO;AAC/D,WAAO,GAAG,IAAI,GAAG,MAAM,OAAO;AAAA,EAChC,CAAC,EACA,KAAK,IAAI;AACd;AAEA,eAAsB,oCAAoC,OAAsC;AAC9F,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,SAAS,EAAE,6BAA6B,sBAAsB;AACpE,QAAM,UAAU,gBAAgB,KAAK;AACrC,SAAO,SAAS;AAAA,IACd,EAAE,OAAO,UAAU,GAAG,MAAM,KAAK,OAAO,KAAK,OAAO;AAAA,IACpD,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,SAAS,8BAA8B,OAAiC;AAC7E,MAAI,CAAC,gBAAgB,KAAK,EAAG,QAAO;AACpC,SAAO,SAAS,KAAK,MAAM,QAAQ,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,MAAM,OAAO,CAAC;AACvG;AAMA,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,SAAO;AAAA,IACL,SAAS,2BAA2B,IAAI,SAAS;AAAA,IACjD,OAAO;AAAA,MACL,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B;AAAA,MAC9C,QAAQ,IAAI,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,4BACd,QACA,eACA;AACA,SAAO,eAAe,KAAK,KAAc;AACvC,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,OAAO,UAAU,IAAI;AACpC,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,oCAAoC,OAAO,KAAK;AAAA,IACzD;AAEA,QAAI;AACF,YAAM,gBAAgB,MAAM,QAAQ,aAAa,EAAE,OAAO,MAAe,KAAK;AAE9E,aAAO,SAAS,KAAK;AAAA,QACnB,IAAI;AAAA,QACJ,OAAO,cAAc;AAAA,QACrB,KAAK,cAAc,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,MACpC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB,SAAS,OAAO;AACd,YAAM,gBAAgB,8BAA8B,KAAK;AACzD,UAAI,cAAe,QAAO;AAC1B,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAKO,SAAS,8BACd,QACA,SACA,aACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,MAAM,CAAC,eAAe;AAAA,MACtB,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,KAAK;AAAA,UACH,aAAa;AAAA,UACb,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ,EAAE,OAAO;AAAA,gBACf,IAAI,EAAE,QAAQ;AAAA,gBACd,OAAO,EAAE,OAAO;AAAA,gBAChB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,cAChC,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMO,SAAS,oCACd,eACA;AACA,SAAO,eAAe,IAAI,KAAc,EAAE,OAAO,GAAwC;AACvF,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,QAAI;AACF,YAAM,QAAQ,aAAa,EAAE,IAAI,KAAK;AAAA,IACxC,SAAS,OAAO;AACd,YAAM,gBAAgB,8BAA8B,KAAK;AACzD,UAAI,cAAe,QAAO;AAC1B,YAAM;AAAA,IACR;AAEA,WAAO,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACnC;AACF;AAKO,SAAS,sCACd,SACA,aACA;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA,MAAM,CAAC,eAAe;AAAA,MACtB,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,KAAK;AAAA,UACH;AAAA,UACA,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAAA,YACtC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.5-develop.4616.1.0cd64e1448",
+  "version": "0.6.5-develop.4629.1.3ef70cd6a4",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -245,16 +245,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.5-develop.4616.1.0cd64e1448",
-    "@open-mercato/shared": "0.6.5-develop.4616.1.0cd64e1448",
-    "@open-mercato/ui": "0.6.5-develop.4616.1.0cd64e1448",
+    "@open-mercato/ai-assistant": "0.6.5-develop.4629.1.3ef70cd6a4",
+    "@open-mercato/shared": "0.6.5-develop.4629.1.3ef70cd6a4",
+    "@open-mercato/ui": "0.6.5-develop.4629.1.3ef70cd6a4",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.5-develop.4616.1.0cd64e1448",
-    "@open-mercato/shared": "0.6.5-develop.4616.1.0cd64e1448",
-    "@open-mercato/ui": "0.6.5-develop.4616.1.0cd64e1448",
+    "@open-mercato/ai-assistant": "0.6.5-develop.4629.1.3ef70cd6a4",
+    "@open-mercato/shared": "0.6.5-develop.4629.1.3ef70cd6a4",
+    "@open-mercato/ui": "0.6.5-develop.4629.1.3ef70cd6a4",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/undoHarness.ts

@@ -0,0 +1,111 @@
+import { type APIRequestContext, type APIResponse, expect } from '@playwright/test'
+import { apiRequest } from './api'
+
+/**
+ * Shared harness for verifying Undo/Redo correctness against the real command bus.
+ *
+ * Every mutating Open Mercato API response carries the operation metadata in the
+ * `x-om-operation` header (`omop:<urlencoded JSON>`) containing the `undoToken` and the
+ * audit log `id` (used as `logId` for redo). These helpers extract that envelope and drive
+ * the real undo/redo endpoints so tests can assert full state restoration per TC-UNDO-001.
+ */
+
+const HEADER_PREFIX = 'omop:'
+const UNDO_PATH = '/api/audit_logs/audit-logs/actions/undo'
+const REDO_PATH = '/api/audit_logs/audit-logs/actions/redo'
+const ACTIONS_PATH = '/api/audit_logs/audit-logs/actions'
+
+export type Operation = {
+  logId: string
+  undoToken: string
+  commandId: string
+  resourceKind: string | null
+  resourceId: string | null
+}
+
+/** Parse the `x-om-operation` header into a structured operation, or null when absent/malformed. */
+export function extractOperation(response: APIResponse): Operation | null {
+  const header = response.headers()['x-om-operation']
+  if (!header || typeof header !== 'string') return null
+  const trimmed = header.startsWith(HEADER_PREFIX) ? header.slice(HEADER_PREFIX.length) : header
+  try {
+    const parsed = JSON.parse(decodeURIComponent(trimmed)) as Record<string, unknown>
+    if (typeof parsed.id !== 'string' || typeof parsed.commandId !== 'string') return null
+    if (typeof parsed.undoToken !== 'string' || !parsed.undoToken) return null
+    return {
+      logId: parsed.id,
+      undoToken: parsed.undoToken,
+      commandId: parsed.commandId,
+      resourceKind: (parsed.resourceKind as string) ?? null,
+      resourceId: (parsed.resourceId as string) ?? null,
+    }
+  } catch {
+    return null
+  }
+}
+
+/** Like extractOperation but fails the test if no undo token was issued. */
+export function expectOperation(response: APIResponse, context: string): Operation {
+  const op = extractOperation(response)
+  expect(op, `Expected an undo token (x-om-operation header) for ${context}, got none`).toBeTruthy()
+  return op as Operation
+}
+
+export async function undoByToken(request: APIRequestContext, token: string, undoToken: string): Promise<APIResponse> {
+  return apiRequest(request, 'POST', UNDO_PATH, { token, data: { undoToken } })
+}
+
+export async function redoByLogId(request: APIRequestContext, token: string, logId: string): Promise<APIResponse> {
+  return apiRequest(request, 'POST', REDO_PATH, { token, data: { logId } })
+}
+
+/** Undo and assert success; returns the resolved logId. */
+export async function undoOk(request: APIRequestContext, token: string, undoToken: string, context: string): Promise<string> {
+  const res = await undoByToken(request, token, undoToken)
+  const body = (await res.json().catch(() => null)) as { ok?: boolean; logId?: string } | null
+  expect(res.ok(), `Undo failed for ${context}: status ${res.status()} body ${JSON.stringify(body)}`).toBeTruthy()
+  expect(body?.ok, `Undo not ok for ${context}: ${JSON.stringify(body)}`).toBeTruthy()
+  return body?.logId as string
+}
+
+/** Redo and assert success; returns the new operation (new undoToken + logId). */
+export async function redoOk(request: APIRequestContext, token: string, logId: string, context: string): Promise<{ logId: string; undoToken: string | null }> {
+  const res = await redoByLogId(request, token, logId)
+  const body = (await res.json().catch(() => null)) as { ok?: boolean; logId?: string; undoToken?: string } | null
+  expect(res.ok(), `Redo failed for ${context}: status ${res.status()} body ${JSON.stringify(body)}`).toBeTruthy()
+  expect(body?.ok, `Redo not ok for ${context}: ${JSON.stringify(body)}`).toBeTruthy()
+  return { logId: body?.logId as string, undoToken: body?.undoToken ?? null }
+}
+
+/** Assert that undoing an already-consumed token is rejected (token consumption / no double-undo). */
+export async function expectTokenConsumed(request: APIRequestContext, token: string, undoToken: string, context: string): Promise<void> {
+  const res = await undoByToken(request, token, undoToken)
+  expect(res.ok(), `Expected double-undo to be rejected for ${context}, but it succeeded`).toBeFalsy()
+}
+
+/** Fetch undoable actions list (for Version History assertions). */
+export async function listUndoable(request: APIRequestContext, token: string, params: Record<string, string> = {}): Promise<unknown> {
+  const qs = new URLSearchParams({ undoableOnly: 'true', ...params }).toString()
+  const res = await apiRequest(request, 'GET', `${ACTIONS_PATH}?${qs}`, { token })
+  return res.json().catch(() => null)
+}
+
+/**
+ * Deep-equality assertion for a selected set of fields between two entity snapshots.
+ * Reports the first mismatching field with context for clear bug triage.
+ */
+export function assertFieldsEqual(
+  actual: Record<string, unknown> | null | undefined,
+  expected: Record<string, unknown> | null | undefined,
+  fields: string[],
+  context: string,
+): void {
+  expect(actual, `${context}: actual entity missing`).toBeTruthy()
+  expect(expected, `${context}: expected entity missing`).toBeTruthy()
+  for (const field of fields) {
+    expect(
+      JSON.stringify((actual as Record<string, unknown>)[field]),
+      `${context}: field "${field}" not restored (expected ${JSON.stringify((expected as Record<string, unknown>)[field])}, got ${JSON.stringify((actual as Record<string, unknown>)[field])})`,
+    ).toBe(JSON.stringify((expected as Record<string, unknown>)[field]))
+  }
+}

package/src/modules/entities/lib/helpers.ts

@@ -128,9 +128,7 @@ export async function setRecordCustomFields(
     // When array: remove existing values for key and create multiple rows
     if (isArray) {
       const arr = raw as Primitive[]
-      // Clear existing for this key
-      const existing = await em.find(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })
-      if (existing.length) existing.forEach((e) => em.remove(e))
+      const replacements: CustomFieldValue[] = []
       for (const val of arr) {
         const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)
         const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })
@@ -146,8 +144,10 @@ export async function setRecordCustomFields(
           case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break
           default: cf.valueText = stored == null ? null : String(stored); break
         }
-        toPersist.push(cf)
+        replacements.push(cf)
       }
+      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })
+      toPersist.push(...replacements)
       continue
     }
 

package/src/modules/notifications/api/[id]/action/route.ts

@@ -1,6 +1,10 @@
 import { executeActionSchema } from '../../../data/validators'
 import { actionResultResponseSchema, errorResponseSchema } from '../../openapi'
-import { resolveNotificationContext } from '../../../lib/routeHelpers'
+import {
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
+  resolveNotificationContext,
+} from '../../../lib/routeHelpers'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 
 export const metadata = {
@@ -12,7 +16,11 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   const { service, scope } = await resolveNotificationContext(req)
 
   const body = await req.json().catch(() => ({}))
-  const input = executeActionSchema.parse(body)
+  const parsed = executeActionSchema.safeParse(body)
+  if (!parsed.success) {
+    return notificationValidationErrorResponse(parsed.error)
+  }
+  const input = parsed.data
 
   try {
     const { notification, result } = await service.executeAction(id, input, scope)
@@ -26,6 +34,9 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
       href,
     })
   } catch (error) {
+    const errorResponse = notificationCrudErrorResponse(error)
+    if (errorResponse) return errorResponse
+
     const { t } = await resolveTranslations()
     const fallback = t('notifications.error.action', 'Failed to execute action')
     const message = error instanceof Error && error.message ? error.message : fallback

package/src/modules/notifications/api/route.ts

@@ -3,7 +3,11 @@ import type { EntityManager } from '@mikro-orm/core'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
-import { resolveNotificationContext } from '../lib/routeHelpers'
+import {
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
+  resolveNotificationContext,
+} from '../lib/routeHelpers'
 import {
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
@@ -73,11 +77,20 @@ export async function POST(req: Request) {
   const { service, scope } = await resolveNotificationContext(req)
 
   const body = await req.json().catch(() => ({}))
-  const input = createNotificationSchema.parse(body)
+  const parsed = createNotificationSchema.safeParse(body)
+  if (!parsed.success) {
+    return notificationValidationErrorResponse(parsed.error)
+  }
 
-  const notification = await service.create(input, scope)
+  try {
+    const notification = await service.create(parsed.data, scope)
 
-  return Response.json({ id: notification.id }, { status: 201 })
+    return Response.json({ id: notification.id }, { status: 201 })
+  } catch (error) {
+    const errorResponse = notificationCrudErrorResponse(error)
+    if (errorResponse) return errorResponse
+    throw error
+  }
 }
 
 export const openApi = buildNotificationsCrudOpenApi({

package/src/modules/notifications/lib/notificationService.ts

@@ -1,10 +1,11 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql } from 'kysely'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { Notification, type NotificationStatus } from '../data/entities'
 import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
 import type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
   buildNotificationEntity,
   emitNotificationCreated,
@@ -76,6 +77,31 @@ function applyNotificationContent(
   notification.createdAt = new Date()
 }
 
+async function findScopedNotificationOrThrow(
+  em: EntityManager,
+  notificationId: string,
+  ctx: NotificationServiceContext,
+): Promise<Notification> {
+  const notification = await findOneWithDecryption(
+    em,
+    Notification,
+    {
+      id: notificationId,
+      recipientUserId: ctx.userId,
+      tenantId: ctx.tenantId,
+    },
+    undefined,
+    {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId ?? null,
+    },
+  )
+  if (!notification) {
+    throw new CrudHttpError(404, { error: 'Notification not found' })
+  }
+  return notification
+}
+
 async function emitNotificationSseEvents(
   eventBus: { emit: (event: string, payload: unknown) => Promise<void> },
   notifications: Notification[],
@@ -286,11 +312,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async markAsRead(notificationId, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       if (notification.status === 'unread') {
         notification.status = 'read'
@@ -370,11 +392,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async dismiss(notificationId, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       notification.status = 'dismissed'
       notification.dismissedAt = new Date()
@@ -391,11 +409,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async restoreDismissed(notificationId, status, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       if (notification.status !== 'dismissed') {
         return notification
@@ -425,11 +439,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async executeAction(notificationId, input, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       const actionData = notification.actionData
       const action = actionData?.actions?.find((a) => a.id === input.actionId)

package/src/modules/notifications/lib/routeHelpers.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod'
 import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveNotificationService, type NotificationService } from './notificationService'
 
 /**
@@ -20,6 +22,30 @@ export interface NotificationRequestContext {
   ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx']
 }
 
+function formatZodIssues(error: z.ZodError): string {
+  return error.issues
+    .map((issue) => {
+      const path = issue.path.length ? `${issue.path.join('.')}: ` : ''
+      return `${path}${issue.message}`
+    })
+    .join('; ')
+}
+
+export async function notificationValidationErrorResponse(error: z.ZodError): Promise<Response> {
+  const { t } = await resolveTranslations()
+  const prefix = t('api.errors.invalidPayload', 'Invalid request body')
+  const details = formatZodIssues(error)
+  return Response.json(
+    { error: details ? `${prefix}: ${details}` : prefix },
+    { status: 400 },
+  )
+}
+
+export function notificationCrudErrorResponse(error: unknown): Response | null {
+  if (!isCrudHttpError(error)) return null
+  return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })
+}
+
 /**
  * Resolve notification service and scope from a request.
  * Centralizes the common pattern used across all notification API routes.
@@ -49,15 +75,24 @@ export function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(
     const { service, scope } = await resolveNotificationContext(req)
 
     const body = await req.json().catch(() => ({}))
-    const input = schema.parse(body)
+    const parsed = schema.safeParse(body)
+    if (!parsed.success) {
+      return notificationValidationErrorResponse(parsed.error)
+    }
 
-    const notifications = await service[serviceMethod](input as never, scope)
+    try {
+      const notifications = await service[serviceMethod](parsed.data as never, scope)
 
-    return Response.json({
-      ok: true,
-      count: notifications.length,
-      ids: notifications.map((n) => n.id),
-    }, { status: 201 })
+      return Response.json({
+        ok: true,
+        count: notifications.length,
+        ids: notifications.map((n) => n.id),
+      }, { status: 201 })
+    } catch (error) {
+      const errorResponse = notificationCrudErrorResponse(error)
+      if (errorResponse) return errorResponse
+      throw error
+    }
   }
 }
 
@@ -111,7 +146,13 @@ export function createSingleNotificationActionRoute(
     const { id } = await params
     const { service, scope } = await resolveNotificationContext(req)
 
-    await service[serviceMethod](id, scope)
+    try {
+      await service[serviceMethod](id, scope)
+    } catch (error) {
+      const errorResponse = notificationCrudErrorResponse(error)
+      if (errorResponse) return errorResponse
+      throw error
+    }
 
     return Response.json({ ok: true })
   }