@open-mercato/core 0.6.6-develop.6089.1.a7ed560528 → 0.6.6-develop.6121.1.5797a901b3

package/dist/modules/dictionaries/api/[dictionaryId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/dictionaries/api/%5BdictionaryId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesOkSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryIdParamsSchema,\n  dictionaryUpdateSchema,\n  upsertDictionarySchema,\n} from '../openapi'\nimport { dictionaryKeySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\n\nconst paramsSchema = z.object({ dictionaryId: z.string().uuid() })\n// System dictionaries use namespaced keys (e.g. `sales.deal_loss_reason`,\n// `resources.activity-types`) that the strict create-key regex rejects. The\n// manager edit dialog disables the key field but still resubmits the existing\n// key, so the update parse must accept any stored key verbatim. The strict\n// user-key regex is only enforced below when the key actually changes.\nconst updateKeySchema = z.string().trim().min(1).max(100)\nconst updateSchema = upsertDictionarySchema\n  .partial()\n  .extend({ key: updateKeySchema.optional() })\n  .refine((data) => Object.keys(data).length > 0, {\n    message: 'Provide at least one field to update.',\n  })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nfunction isProtectedCurrencyDictionary(dictionary: Dictionary) {\n  const key = dictionary.key?.trim().toLowerCase() ?? ''\n  return key === 'currency' || key === 'currencies'\n}\n\nasync function loadDictionary(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  id: string,\n  options: { allowInherited?: boolean } = {},\n) {\n  const { allowInherited = false } = options\n  if (!allowInherited && !context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const baseFilter = {\n    id,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  }\n  const filter = allowInherited\n    ? {\n        ...baseFilter,\n        ...(context.readableOrganizationIds.length\n          ? { organizationId: { $in: context.readableOrganizationIds } }\n          : {}),\n      }\n    : {\n        ...baseFilter,\n        organizationId: context.organizationId,\n      }\n  const dictionary = await context.em.findOne(Dictionary, filter)\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nexport async function GET(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      organizationId: dictionary.organizationId,\n      isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id.GET] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to load dictionary' }, { status: 500 })\n  }\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const payload = updateSchema.parse(await req.json().catch(() => ({})))\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    enforceCommandOptimisticLock({\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      current: dictionary.updatedAt ?? null,\n      request: req,\n    })\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      if (payload.key && payload.key.trim().toLowerCase() !== dictionary.key) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n      if (payload.isActive === false) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n    }\n\n    if (payload.key) {\n      const key = payload.key.trim().toLowerCase()\n      if (key !== dictionary.key) {\n        const strictKey = dictionaryKeySchema.safeParse(key)\n        if (!strictKey.success) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.invalid_key', 'Use lowercase letters, numbers, hyphen, or underscore.') })\n        }\n        const organizationId = context.organizationId\n        if (!organizationId) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n        }\n        const existing = await context.em.findOne(Dictionary, {\n          key,\n          organizationId,\n          tenantId: context.tenantId,\n          deletedAt: null,\n        })\n        if (existing) {\n          throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n        }\n        dictionary.key = key\n      }\n    }\n\n    if (payload.name) {\n      dictionary.name = payload.name.trim()\n    }\n    if (payload.description !== undefined) {\n      dictionary.description = payload.description ? payload.description.trim() : null\n    }\n    if (payload.isActive !== undefined) {\n      dictionary.isActive = Boolean(payload.isActive)\n      if (!dictionary.isActive) {\n        dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n      } else {\n        dictionary.deletedAt = null\n      }\n    }\n    if (payload.entrySortMode !== undefined) {\n      dictionary.entrySortMode = payload.entrySortMode\n    }\n\n    dictionary.updatedAt = new Date()\n    await context.em.flush()\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: err.issues[0]?.message ?? 'Validation failed' }, { status: 400 })\n    }\n    console.error('[dictionaries/:id.PATCH] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to update dictionary' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n    }\n\n    dictionary.isActive = false\n    dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n    await context.em.flush()\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id.DELETE] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to delete dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionaryGetDoc: OpenApiMethodDoc = {\n  summary: 'Get dictionary',\n  description: 'Returns details for the specified dictionary, including inheritance flags.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary details.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid parameters', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update dictionary',\n  description: 'Updates mutable attributes of the dictionary. Currency dictionaries are protected from modification.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dictionaryUpdateSchema,\n    description: 'Fields to update on the dictionary.',\n  },\n  responses: [\n    { status: 200, description: 'Dictionary updated.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or protected dictionary', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to update dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete dictionary',\n  description: 'Soft deletes the dictionary unless it is the protected currency dictionary.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary archived.', schema: dictionariesOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Protected dictionary cannot be deleted', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to delete dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary resource',\n  pathParams: dictionaryIdParamsSchema,\n  methods: {\n    GET: dictionaryGetDoc,\n    PATCH: dictionaryPatchDoc,\n    DELETE: dictionaryDeleteDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B,SAAS,uCAAuC;AAChD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oCAAoC;AAE7C;AAAA,EACE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,MAAM,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAMjE,MAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACxD,MAAM,eAAe,uBAClB,QAAQ,EACR,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,EAC1C,OAAO,CAAC,SAAS,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,EAC9C,SAAS;AACX,CAAC;AAEI,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEA,SAAS,8BAA8B,YAAwB;AAC7D,QAAM,MAAM,WAAW,KAAK,KAAK,EAAE,YAAY,KAAK;AACpD,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAEA,eAAe,eACb,SACA,IACA,UAAwC,CAAC,GACzC;AACA,QAAM,EAAE,iBAAiB,MAAM,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,QAAQ,gBAAgB;AAC9C,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,SAAS,iBACX;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,wBAAwB,SAChC,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAAA,EACP,IACA;AAAA,IACE,GAAG;AAAA,IACH,gBAAgB,QAAQ;AAAA,EAC1B;AACJ,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY,MAAM;AAC9D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc,KAA6C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,cAAc,EAAE,gBAAgB,KAAK,CAAC;AACvF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,gBAAgB,WAAW;AAAA,MAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,MAC7F,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,2CAA2C,GAAG;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAsB,MAAM,KAAc,KAA6C;AACrF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,UAAU,aAAa,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AACrE,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW,aAAa;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAED,QAAI,8BAA8B,UAAU,GAAG;AAC7C,UAAI,QAAQ,OAAO,QAAQ,IAAI,KAAK,EAAE,YAAY,MAAM,WAAW,KAAK;AACtE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AACA,UAAI,QAAQ,aAAa,OAAO;AAC9B,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AAAA,IACF;AAEA,QAAI,QAAQ,KAAK;AACf,YAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,UAAI,QAAQ,WAAW,KAAK;AAC1B,cAAM,YAAY,oBAAoB,UAAU,GAAG;AACnD,YAAI,CAAC,UAAU,SAAS;AACtB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,mCAAmC,wDAAwD,EAAE,CAAC;AAAA,QACxJ;AACA,cAAM,iBAAiB,QAAQ;AAC/B,YAAI,CAAC,gBAAgB;AACnB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,QAC5I;AACA,cAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,UACpD;AAAA,UACA;AAAA,UACA,UAAU,QAAQ;AAAA,UAClB,WAAW;AAAA,QACb,CAAC;AACD,YAAI,UAAU;AACZ,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,QACzI;AACA,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM;AAChB,iBAAW,OAAO,QAAQ,KAAK,KAAK;AAAA,IACtC;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACrC,iBAAW,cAAc,QAAQ,cAAc,QAAQ,YAAY,KAAK,IAAI;AAAA,IAC9E;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,iBAAW,WAAW,QAAQ,QAAQ,QAAQ;AAC9C,UAAI,CAAC,WAAW,UAAU;AACxB,mBAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AAAA,MAC1D,OAAO;AACL,mBAAW,YAAY;AAAA,MACzB;AAAA,IACF;AACA,QAAI,QAAQ,kBAAkB,QAAW;AACvC,iBAAW,gBAAgB,QAAQ;AAAA,IACrC;AAEA,eAAW,YAAY,oBAAI,KAAK;AAChC,UAAM,QAAQ,GAAG,MAAM;AAEvB,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,WAAW,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,YAAQ,MAAM,6CAA6C,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,OAAO,KAAc,KAA6C;AACtF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,QAAI,8BAA8B,UAAU,GAAG;AAC7C,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,IAC/J;AAEA,eAAW,WAAW;AACtB,eAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AACxD,UAAM,QAAQ,GAAG,MAAM;AAEvB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,8CAA8C,GAAG;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,mBAAqC;AAAA,EACzC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,wBAAwB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,wBAAwB;AAAA,EAC3F;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,wBAAwB;AAAA,IACzG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,qBAAqB;AAAA,EACnF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,wBAAwB;AAAA,IACtG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesOkSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryIdParamsSchema,\n  dictionaryUpdateSchema,\n  upsertDictionarySchema,\n} from '../openapi'\nimport { dictionaryKeySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\n\nconst paramsSchema = z.object({ dictionaryId: z.string().uuid() })\n// System dictionaries use namespaced keys (e.g. `sales.deal_loss_reason`,\n// `resources.activity-types`) that the strict create-key regex rejects. The\n// manager edit dialog disables the key field but still resubmits the existing\n// key, so the update parse must accept any stored key verbatim. The strict\n// user-key regex is only enforced below when the key actually changes.\nconst updateKeySchema = z.string().trim().min(1).max(100)\nconst updateSchema = upsertDictionarySchema\n  .partial()\n  .extend({ key: updateKeySchema.optional() })\n  .refine((data) => Object.keys(data).length > 0, {\n    message: 'Provide at least one field to update.',\n  })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nfunction isProtectedCurrencyDictionary(dictionary: Dictionary) {\n  const key = dictionary.key?.trim().toLowerCase() ?? ''\n  return key === 'currency' || key === 'currencies'\n}\n\nasync function loadDictionary(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  id: string,\n  options: { allowInherited?: boolean } = {},\n) {\n  const { allowInherited = false } = options\n  if (!allowInherited && !context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const baseFilter = {\n    id,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  }\n  const filter = allowInherited\n    ? {\n        ...baseFilter,\n        ...(context.readableOrganizationIds.length\n          ? { organizationId: { $in: context.readableOrganizationIds } }\n          : {}),\n      }\n    : {\n        ...baseFilter,\n        organizationId: context.organizationId,\n      }\n  const dictionary = await context.em.findOne(Dictionary, filter)\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nexport async function GET(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      organizationId: dictionary.organizationId,\n      isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id.GET] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to load dictionary' }, { status: 500 })\n  }\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const payload = updateSchema.parse(await req.json().catch(() => ({})))\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    enforceCommandOptimisticLock({\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      current: dictionary.updatedAt ?? null,\n      request: req,\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      if (payload.key && payload.key.trim().toLowerCase() !== dictionary.key) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n      if (payload.isActive === false) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n    }\n\n    if (payload.key) {\n      const key = payload.key.trim().toLowerCase()\n      if (key !== dictionary.key) {\n        const strictKey = dictionaryKeySchema.safeParse(key)\n        if (!strictKey.success) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.invalid_key', 'Use lowercase letters, numbers, hyphen, or underscore.') })\n        }\n        const organizationId = context.organizationId\n        if (!organizationId) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n        }\n        const existing = await context.em.findOne(Dictionary, {\n          key,\n          organizationId,\n          tenantId: context.tenantId,\n          deletedAt: null,\n        })\n        if (existing) {\n          throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n        }\n        dictionary.key = key\n      }\n    }\n\n    if (payload.name) {\n      dictionary.name = payload.name.trim()\n    }\n    if (payload.description !== undefined) {\n      dictionary.description = payload.description ? payload.description.trim() : null\n    }\n    if (payload.isActive !== undefined) {\n      dictionary.isActive = Boolean(payload.isActive)\n      if (!dictionary.isActive) {\n        dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n      } else {\n        dictionary.deletedAt = null\n      }\n    }\n    if (payload.entrySortMode !== undefined) {\n      dictionary.entrySortMode = payload.entrySortMode\n    }\n\n    dictionary.updatedAt = new Date()\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: err.issues[0]?.message ?? 'Validation failed' }, { status: 400 })\n    }\n    console.error('[dictionaries/:id.PATCH] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to update dictionary' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n    }\n\n    dictionary.isActive = false\n    dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id.DELETE] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to delete dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionaryGetDoc: OpenApiMethodDoc = {\n  summary: 'Get dictionary',\n  description: 'Returns details for the specified dictionary, including inheritance flags.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary details.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid parameters', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update dictionary',\n  description: 'Updates mutable attributes of the dictionary. Currency dictionaries are protected from modification.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dictionaryUpdateSchema,\n    description: 'Fields to update on the dictionary.',\n  },\n  responses: [\n    { status: 200, description: 'Dictionary updated.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or protected dictionary', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to update dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete dictionary',\n  description: 'Soft deletes the dictionary unless it is the protected currency dictionary.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary archived.', schema: dictionariesOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Protected dictionary cannot be deleted', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to delete dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary resource',\n  pathParams: dictionaryIdParamsSchema,\n  methods: {\n    GET: dictionaryGetDoc,\n    PATCH: dictionaryPatchDoc,\n    DELETE: dictionaryDeleteDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,MAAM,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAMjE,MAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACxD,MAAM,eAAe,uBAClB,QAAQ,EACR,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,EAC1C,OAAO,CAAC,SAAS,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,EAC9C,SAAS;AACX,CAAC;AAEI,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEA,SAAS,8BAA8B,YAAwB;AAC7D,QAAM,MAAM,WAAW,KAAK,KAAK,EAAE,YAAY,KAAK;AACpD,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAEA,eAAe,eACb,SACA,IACA,UAAwC,CAAC,GACzC;AACA,QAAM,EAAE,iBAAiB,MAAM,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,QAAQ,gBAAgB;AAC9C,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,SAAS,iBACX;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,wBAAwB,SAChC,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAAA,EACP,IACA;AAAA,IACE,GAAG;AAAA,IACH,gBAAgB,QAAQ;AAAA,EAC1B;AACJ,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY,MAAM;AAC9D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc,KAA6C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,cAAc,EAAE,gBAAgB,KAAK,CAAC;AACvF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,gBAAgB,WAAW;AAAA,MAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,MAC7F,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,2CAA2C,GAAG;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAsB,MAAM,KAAc,KAA6C;AACrF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,UAAU,aAAa,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AACrE,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW,aAAa;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI,8BAA8B,UAAU,GAAG;AAC7C,UAAI,QAAQ,OAAO,QAAQ,IAAI,KAAK,EAAE,YAAY,MAAM,WAAW,KAAK;AACtE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AACA,UAAI,QAAQ,aAAa,OAAO;AAC9B,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AAAA,IACF;AAEA,QAAI,QAAQ,KAAK;AACf,YAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,UAAI,QAAQ,WAAW,KAAK;AAC1B,cAAM,YAAY,oBAAoB,UAAU,GAAG;AACnD,YAAI,CAAC,UAAU,SAAS;AACtB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,mCAAmC,wDAAwD,EAAE,CAAC;AAAA,QACxJ;AACA,cAAM,iBAAiB,QAAQ;AAC/B,YAAI,CAAC,gBAAgB;AACnB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,QAC5I;AACA,cAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,UACpD;AAAA,UACA;AAAA,UACA,UAAU,QAAQ;AAAA,UAClB,WAAW;AAAA,QACb,CAAC;AACD,YAAI,UAAU;AACZ,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,QACzI;AACA,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM;AAChB,iBAAW,OAAO,QAAQ,KAAK,KAAK;AAAA,IACtC;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACrC,iBAAW,cAAc,QAAQ,cAAc,QAAQ,YAAY,KAAK,IAAI;AAAA,IAC9E;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,iBAAW,WAAW,QAAQ,QAAQ,QAAQ;AAC9C,UAAI,CAAC,WAAW,UAAU;AACxB,mBAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AAAA,MAC1D,OAAO;AACL,mBAAW,YAAY;AAAA,MACzB;AAAA,IACF;AACA,QAAI,QAAQ,kBAAkB,QAAW;AACvC,iBAAW,gBAAgB,QAAQ;AAAA,IACrC;AAEA,eAAW,YAAY,oBAAI,KAAK;AAChC,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,WAAW,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,YAAQ,MAAM,6CAA6C,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,OAAO,KAAc,KAA6C;AACtF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI,8BAA8B,UAAU,GAAG;AAC7C,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,IAC/J;AAEA,eAAW,WAAW;AACtB,eAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AACxD,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,8CAA8C,GAAG;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,mBAAqC;AAAA,EACzC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,wBAAwB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,wBAAwB;AAAA,EAC3F;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,wBAAwB;AAAA,IACzG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,qBAAqB;AAAA,EACnF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,wBAAwB;AAAA,IACtG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/dictionaries/api/route.js

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
 import { Dictionary } from "@open-mercato/core/modules/dictionaries/data/entities";
-import { resolveDictionariesRouteContext } from "@open-mercato/core/modules/dictionaries/api/context";
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from "@open-mercato/core/modules/dictionaries/api/context";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import {
   DEFAULT_DICTIONARY_ENTRY_SORT_MODE,
   resolveDictionaryEntrySortMode
@@ -89,8 +93,36 @@ async function POST(req) {
       createdAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date()
     });
+    const guardUserId = resolveDictionaryActorId(context.auth);
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: "dictionaries.dictionary",
+      resourceId: dictionary.id,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     context.em.persist(dictionary);
     await context.em.flush();
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: "dictionaries.dictionary",
+        resourceId: dictionary.id,
+        operation: "create",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     return NextResponse.json({
       id: dictionary.id,
       key: dictionary.key,

package/dist/modules/dictionaries/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dictionaries/api/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryListQuerySchema,\n  dictionaryListResponseSchema,\n  upsertDictionarySchema,\n} from './openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  POST: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const url = new URL(req.url)\n    const includeInactive = parseBooleanToken(url.searchParams.get('includeInactive')) === true\n\n    const organizationFilter = context.readableOrganizationIds.length\n      ? { organizationId: { $in: context.readableOrganizationIds } }\n      : {}\n\n    const items = await context.em.find(\n      Dictionary,\n      {\n        ...organizationFilter,\n        tenantId: context.tenantId,\n        deletedAt: null,\n        ...(includeInactive ? {} : { isActive: true }),\n      },\n      { orderBy: { name: 'asc' } },\n    )\n\n    return NextResponse.json({\n      items: items.map((dictionary) => ({\n        id: dictionary.id,\n        key: dictionary.key,\n        name: dictionary.name,\n        description: dictionary.description,\n        isSystem: dictionary.isSystem,\n        isActive: dictionary.isActive,\n        managerVisibility: dictionary.managerVisibility,\n        entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n        organizationId: dictionary.organizationId,\n        isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n        createdAt: dictionary.createdAt,\n        updatedAt: dictionary.updatedAt,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries.GET] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to load dictionaries' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const payload = upsertDictionarySchema.parse(await req.json().catch(() => ({})))\n    const key = payload.key.trim().toLowerCase()\n    if (!context.organizationId) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n    }\n\n    const existing = await context.em.findOne(Dictionary, {\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      key,\n      deletedAt: null,\n    })\n    if (existing) {\n      throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n    }\n\n    const dictionary = context.em.create(Dictionary, {\n      key,\n      name: payload.name.trim(),\n      description: payload.description?.trim() || null,\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      isSystem: payload.isSystem ?? false,\n      isActive: payload.isActive ?? true,\n      managerVisibility: 'default',\n      entrySortMode: payload.entrySortMode ?? DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    context.em.persist(dictionary)\n    await context.em.flush()\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    }, { status: 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries.POST] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to create dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionariesGetDoc: OpenApiMethodDoc = {\n  summary: 'List dictionaries',\n  description: 'Returns dictionaries accessible to the current organization, optionally including inactive records.',\n  tags: [dictionariesTag],\n  query: dictionaryListQuerySchema,\n  responses: [\n    { status: 200, description: 'Dictionary collection.', schema: dictionaryListResponseSchema },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionaries', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionariesPostDoc: OpenApiMethodDoc = {\n  summary: 'Create dictionary',\n  description: 'Registers a dictionary scoped to the current organization.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: upsertDictionarySchema,\n    description: 'Dictionary definition including unique key and display name.',\n  },\n  responses: [\n    { status: 201, description: 'Dictionary created.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to create dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionaries collection',\n  methods: {\n    GET: dictionariesGetDoc,\n    POST: dictionariesPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,uCAAuC;AAChD,SAAS,eAAe,uBAAuB;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,kBAAkB,kBAAkB,IAAI,aAAa,IAAI,iBAAiB,CAAC,MAAM;AAEvF,UAAM,qBAAqB,QAAQ,wBAAwB,SACvD,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAEL,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,WAAW;AAAA,QACX,GAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC9C;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE;AAAA,IAC7B;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,IAAI,CAAC,gBAAgB;AAAA,QAChC,IAAI,WAAW;AAAA,QACf,KAAK,WAAW;AAAA,QAChB,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW;AAAA,QACxB,UAAU,WAAW;AAAA,QACrB,UAAU,WAAW;AAAA,QACrB,mBAAmB,WAAW;AAAA,QAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,QACtE,gBAAgB,WAAW;AAAA,QAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,QAC7F,WAAW,WAAW;AAAA,QACtB,WAAW,WAAW;AAAA,MACxB,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,uCAAuC,GAAG;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,UAAU,uBAAuB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC/E,UAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,IAC5I;AAEA,UAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,MACpD,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,IACzI;AAEA,UAAM,aAAa,QAAQ,GAAG,OAAO,YAAY;AAAA,MAC/C;AAAA,MACA,MAAM,QAAQ,KAAK,KAAK;AAAA,MACxB,aAAa,QAAQ,aAAa,KAAK,KAAK;AAAA,MAC5C,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,mBAAmB;AAAA,MACnB,eAAe,QAAQ,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,YAAQ,GAAG,QAAQ,UAAU;AAC7B,UAAM,QAAQ,GAAG,MAAM;AAEvB,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,wCAAwC,GAAG;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,6BAA6B;AAAA,EAC7F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryListQuerySchema,\n  dictionaryListResponseSchema,\n  upsertDictionarySchema,\n} from './openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  POST: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const url = new URL(req.url)\n    const includeInactive = parseBooleanToken(url.searchParams.get('includeInactive')) === true\n\n    const organizationFilter = context.readableOrganizationIds.length\n      ? { organizationId: { $in: context.readableOrganizationIds } }\n      : {}\n\n    const items = await context.em.find(\n      Dictionary,\n      {\n        ...organizationFilter,\n        tenantId: context.tenantId,\n        deletedAt: null,\n        ...(includeInactive ? {} : { isActive: true }),\n      },\n      { orderBy: { name: 'asc' } },\n    )\n\n    return NextResponse.json({\n      items: items.map((dictionary) => ({\n        id: dictionary.id,\n        key: dictionary.key,\n        name: dictionary.name,\n        description: dictionary.description,\n        isSystem: dictionary.isSystem,\n        isActive: dictionary.isActive,\n        managerVisibility: dictionary.managerVisibility,\n        entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n        organizationId: dictionary.organizationId,\n        isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n        createdAt: dictionary.createdAt,\n        updatedAt: dictionary.updatedAt,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries.GET] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to load dictionaries' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const payload = upsertDictionarySchema.parse(await req.json().catch(() => ({})))\n    const key = payload.key.trim().toLowerCase()\n    if (!context.organizationId) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n    }\n\n    const existing = await context.em.findOne(Dictionary, {\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      key,\n      deletedAt: null,\n    })\n    if (existing) {\n      throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n    }\n\n    const dictionary = context.em.create(Dictionary, {\n      key,\n      name: payload.name.trim(),\n      description: payload.description?.trim() || null,\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      isSystem: payload.isSystem ?? false,\n      isActive: payload.isActive ?? true,\n      managerVisibility: 'default',\n      entrySortMode: payload.entrySortMode ?? DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    context.em.persist(dictionary)\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    }, { status: 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries.POST] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to create dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionariesGetDoc: OpenApiMethodDoc = {\n  summary: 'List dictionaries',\n  description: 'Returns dictionaries accessible to the current organization, optionally including inactive records.',\n  tags: [dictionariesTag],\n  query: dictionaryListQuerySchema,\n  responses: [\n    { status: 200, description: 'Dictionary collection.', schema: dictionaryListResponseSchema },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionaries', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionariesPostDoc: OpenApiMethodDoc = {\n  summary: 'Create dictionary',\n  description: 'Registers a dictionary scoped to the current organization.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: upsertDictionarySchema,\n    description: 'Dictionary definition including unique key and display name.',\n  },\n  responses: [\n    { status: 201, description: 'Dictionary created.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to create dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionaries collection',\n  methods: {\n    GET: dictionariesGetDoc,\n    POST: dictionariesPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,eAAe,uBAAuB;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,kBAAkB,kBAAkB,IAAI,aAAa,IAAI,iBAAiB,CAAC,MAAM;AAEvF,UAAM,qBAAqB,QAAQ,wBAAwB,SACvD,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAEL,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,WAAW;AAAA,QACX,GAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC9C;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE;AAAA,IAC7B;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,IAAI,CAAC,gBAAgB;AAAA,QAChC,IAAI,WAAW;AAAA,QACf,KAAK,WAAW;AAAA,QAChB,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW;AAAA,QACxB,UAAU,WAAW;AAAA,QACrB,UAAU,WAAW;AAAA,QACrB,mBAAmB,WAAW;AAAA,QAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,QACtE,gBAAgB,WAAW;AAAA,QAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,QAC7F,WAAW,WAAW;AAAA,QACtB,WAAW,WAAW;AAAA,MACxB,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,uCAAuC,GAAG;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,UAAU,uBAAuB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC/E,UAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,IAC5I;AAEA,UAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,MACpD,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,IACzI;AAEA,UAAM,aAAa,QAAQ,GAAG,OAAO,YAAY;AAAA,MAC/C;AAAA,MACA,MAAM,QAAQ,KAAK,KAAK;AAAA,MACxB,aAAa,QAAQ,aAAa,KAAK,KAAK;AAAA,MAC5C,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,mBAAmB;AAAA,MACnB,eAAe,QAAQ,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,YAAQ,GAAG,QAAQ,UAAU;AAC7B,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,wCAAwC,GAAG;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,6BAA6B;AAAA,EAC7F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/feature_toggles/lib/queries.js

@@ -1,5 +1,7 @@
+import { QueryOrder } from "@mikro-orm/postgresql";
 import { FeatureToggle, FeatureToggleOverride } from "../data/entities.js";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+const SORTABLE_FIELDS = /* @__PURE__ */ new Set(["identifier", "name", "category"]);
 async function getOverrides(em, tenant, query) {
   const filters = { deletedAt: null };
   if (query.category) {
@@ -11,63 +13,45 @@ async function getOverrides(em, tenant, query) {
   if (query.identifier) {
     filters.identifier = { $ilike: `%${escapeLikePattern(query.identifier)}%` };
   }
-  const globalToggles = await em.find(FeatureToggle, filters);
-  const overrides = await em.find(FeatureToggleOverride, {
+  const page = query.page ?? 1;
+  const pageSize = query.pageSize ?? 25;
+  const offset = (page - 1) * pageSize;
+  const direction = query.sortDir === "desc" ? QueryOrder.DESC : QueryOrder.ASC;
+  const orderBy = {};
+  if (query.sortField && SORTABLE_FIELDS.has(query.sortField)) {
+    orderBy[query.sortField] = direction;
+  }
+  orderBy.id = QueryOrder.ASC;
+  const totalItems = await em.count(FeatureToggle, filters);
+  const globalToggles = await em.find(FeatureToggle, filters, {
+    orderBy,
+    limit: pageSize,
+    offset
+  });
+  const overrides = globalToggles.length ? await em.find(FeatureToggleOverride, {
     tenantId: tenant.id,
     toggle: { id: { $in: globalToggles.map((toggle) => toggle.id) } }
-  });
-  const response = [];
-  globalToggles.forEach((toggle) => {
-    const override = overrides.find((o) => o.toggle.id === toggle.id);
-    if (override) {
-      response.push({
-        id: override?.id ?? "",
-        toggleId: toggle.id,
-        tenantName: tenant.name,
-        tenantId: tenant.id,
-        identifier: toggle.identifier,
-        name: toggle.name,
-        category: toggle.category ?? "",
-        isOverride: true
-      });
-    } else {
-      response.push({
-        id: "",
-        toggleId: toggle.id,
-        tenantName: tenant.name,
-        tenantId: tenant.id,
-        identifier: toggle.identifier,
-        name: toggle.name,
-        category: toggle.category ?? "",
-        isOverride: false
-      });
-    }
-  });
-  if (query.sortField && query.sortDir) {
-    const sortField = query.sortField;
-    const sortDir = query.sortDir;
-    response.sort((a, b) => {
-      let aValue = a[sortField];
-      let bValue = b[sortField];
-      if (typeof aValue === "string" && typeof bValue === "string") {
-        const comparison = aValue.localeCompare(bValue);
-        return sortDir === "asc" ? comparison : -comparison;
-      }
-      if (typeof aValue === "number" && typeof bValue === "number") {
-        return sortDir === "asc" ? aValue - bValue : bValue - aValue;
-      }
-      return 0;
-    });
+  }) : [];
+  const overridesByToggleId = /* @__PURE__ */ new Map();
+  for (const override of overrides) {
+    overridesByToggleId.set(override.toggle.id, override);
   }
-  const totalItems = response.length;
-  const page = query.page ?? 1;
-  const pageSize = query.pageSize ?? 25;
+  const items = globalToggles.map((toggle) => {
+    const override = overridesByToggleId.get(toggle.id);
+    return {
+      id: override?.id ?? "",
+      toggleId: toggle.id,
+      tenantName: tenant.name,
+      tenantId: tenant.id,
+      identifier: toggle.identifier,
+      name: toggle.name,
+      category: toggle.category ?? "",
+      isOverride: Boolean(override)
+    };
+  });
   const totalPages = Math.ceil(totalItems / pageSize);
-  const startIndex = (page - 1) * pageSize;
-  const endIndex = startIndex + pageSize;
-  const paginatedItems = response.slice(startIndex, endIndex);
   return {
-    items: paginatedItems,
+    items,
     total: totalItems,
     totalPages,
     page,

package/dist/modules/feature_toggles/lib/queries.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/feature_toggles/lib/queries.ts"],
-  "sourcesContent": ["import { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { FeatureToggle, FeatureToggleOverride } from '../data/entities'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { OverrideListResponse } from '../data/validators'\n\nexport type FeatureToggleOverrideResponse = {\n    id: string\n    toggleId: string\n    overrideState: 'enabled' | 'disabled' | 'inherit'\n    tenantName: string\n    tenantId: string\n    identifier: string\n    name: string\n    category: string\n    defaultState: boolean\n}\n\nexport type GetOverridesQuery = {\n    category?: string\n    name?: string\n    identifier?: string\n    defaultState?: 'enabled' | 'disabled'\n    overrideState?: 'enabled' | 'disabled' | 'inherit'\n    sortField?: 'identifier' | 'name' | 'category' | 'defaultState' | 'overrideState'\n    sortDir?: 'asc' | 'desc'\n    page?: number\n    pageSize?: number\n}\n\ntype GetOverridesResult = {\n    items: OverrideListResponse[]\n    total: number\n    totalPages: number\n    page: number\n    pageSize: number\n    raw: {\n        toggles: FeatureToggle[]\n        overrides: FeatureToggleOverride[]\n    }\n}\n\nexport async function getOverrides(\n    em: EntityManager,\n    tenant: Tenant,\n    query: GetOverridesQuery\n): Promise<GetOverridesResult> {\n    const filters: FilterQuery<FeatureToggle> = { deletedAt: null }\n    if (query.category) {\n        filters.category = { $ilike: `%${escapeLikePattern(query.category)}%` }\n    }\n    if (query.name) {\n        filters.name = { $ilike: `%${escapeLikePattern(query.name)}%` }\n    }\n    if (query.identifier) {\n        filters.identifier = { $ilike: `%${escapeLikePattern(query.identifier)}%` }\n    }\n\n    const globalToggles = await em.find(FeatureToggle, filters)\n\n    const overrides = await em.find(FeatureToggleOverride, {\n        tenantId: tenant.id,\n        toggle: { id: { $in: globalToggles.map((toggle) => toggle.id) } },\n    })\n\n    const response: OverrideListResponse[] = []\n\n    globalToggles.forEach((toggle) => {\n        const override = overrides.find((o) => o.toggle.id === toggle.id)\n        if (override) {\n            response.push({\n                id: override?.id ?? '',\n                toggleId: toggle.id,\n                tenantName: tenant.name,\n                tenantId: tenant.id,\n                identifier: toggle.identifier,\n                name: toggle.name,\n                category: toggle.category ?? '',\n                isOverride: true,\n            })\n        } else {\n            response.push({\n                id: '',\n                toggleId: toggle.id,\n                tenantName: tenant.name,\n                tenantId: tenant.id,\n                identifier: toggle.identifier,\n                name: toggle.name,\n                category: toggle.category ?? '',\n                isOverride: false,\n            })\n        }\n    })\n\n    if (query.sortField && query.sortDir) {\n        const sortField = query.sortField\n        const sortDir = query.sortDir\n\n        response.sort((a, b) => {\n            let aValue: any = a[sortField as keyof typeof a]\n            let bValue: any = b[sortField as keyof typeof b]\n\n\n\n            if (typeof aValue === 'string' && typeof bValue === 'string') {\n                const comparison = aValue.localeCompare(bValue)\n                return sortDir === 'asc' ? comparison : -comparison\n            }\n\n            if (typeof aValue === 'number' && typeof bValue === 'number') {\n                return sortDir === 'asc' ? aValue - bValue : bValue - aValue\n            }\n\n            return 0\n        })\n    }\n\n    const totalItems = response.length\n    const page = query.page ?? 1\n    const pageSize = query.pageSize ?? 25\n    const totalPages = Math.ceil(totalItems / pageSize)\n    const startIndex = (page - 1) * pageSize\n    const endIndex = startIndex + pageSize\n\n    const paginatedItems = response.slice(startIndex, endIndex)\n\n    return {\n        items: paginatedItems,\n        total: totalItems,\n        totalPages,\n        page,\n        pageSize,\n        raw: {\n            toggles: globalToggles,\n            overrides,\n        },\n    }\n}\n"],
-  "mappings": "AACA,SAAS,eAAe,6BAA6B;AAErD,SAAS,yBAAyB;AAuClC,eAAsB,aAClB,IACA,QACA,OAC2B;AAC3B,QAAM,UAAsC,EAAE,WAAW,KAAK;AAC9D,MAAI,MAAM,UAAU;AAChB,YAAQ,WAAW,EAAE,QAAQ,IAAI,kBAAkB,MAAM,QAAQ,CAAC,IAAI;AAAA,EAC1E;AACA,MAAI,MAAM,MAAM;AACZ,YAAQ,OAAO,EAAE,QAAQ,IAAI,kBAAkB,MAAM,IAAI,CAAC,IAAI;AAAA,EAClE;AACA,MAAI,MAAM,YAAY;AAClB,YAAQ,aAAa,EAAE,QAAQ,IAAI,kBAAkB,MAAM,UAAU,CAAC,IAAI;AAAA,EAC9E;AAEA,QAAM,gBAAgB,MAAM,GAAG,KAAK,eAAe,OAAO;AAE1D,QAAM,YAAY,MAAM,GAAG,KAAK,uBAAuB;AAAA,IACnD,UAAU,OAAO;AAAA,IACjB,QAAQ,EAAE,IAAI,EAAE,KAAK,cAAc,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,EAAE;AAAA,EACpE,CAAC;AAED,QAAM,WAAmC,CAAC;AAE1C,gBAAc,QAAQ,CAAC,WAAW;AAC9B,UAAM,WAAW,UAAU,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,OAAO,EAAE;AAChE,QAAI,UAAU;AACV,eAAS,KAAK;AAAA,QACV,IAAI,UAAU,MAAM;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,MAAM,OAAO;AAAA,QACb,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY;AAAA,MAChB,CAAC;AAAA,IACL,OAAO;AACH,eAAS,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,MAAM,OAAO;AAAA,QACb,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY;AAAA,MAChB,CAAC;AAAA,IACL;AAAA,EACJ,CAAC;AAED,MAAI,MAAM,aAAa,MAAM,SAAS;AAClC,UAAM,YAAY,MAAM;AACxB,UAAM,UAAU,MAAM;AAEtB,aAAS,KAAK,CAAC,GAAG,MAAM;AACpB,UAAI,SAAc,EAAE,SAA2B;AAC/C,UAAI,SAAc,EAAE,SAA2B;AAI/C,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW,UAAU;AAC1D,cAAM,aAAa,OAAO,cAAc,MAAM;AAC9C,eAAO,YAAY,QAAQ,aAAa,CAAC;AAAA,MAC7C;AAEA,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW,UAAU;AAC1D,eAAO,YAAY,QAAQ,SAAS,SAAS,SAAS;AAAA,MAC1D;AAEA,aAAO;AAAA,IACX,CAAC;AAAA,EACL;AAEA,QAAM,aAAa,SAAS;AAC5B,QAAM,OAAO,MAAM,QAAQ;AAC3B,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,aAAa,KAAK,KAAK,aAAa,QAAQ;AAClD,QAAM,cAAc,OAAO,KAAK;AAChC,QAAM,WAAW,aAAa;AAE9B,QAAM,iBAAiB,SAAS,MAAM,YAAY,QAAQ;AAE1D,SAAO;AAAA,IACH,OAAO;AAAA,IACP,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,MACD,SAAS;AAAA,MACT;AAAA,IACJ;AAAA,EACJ;AACJ;",
+  "sourcesContent": ["import { EntityManager, FilterQuery, QueryOrder } from '@mikro-orm/postgresql'\nimport { FeatureToggle, FeatureToggleOverride } from '../data/entities'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { OverrideListResponse } from '../data/validators'\n\nexport type FeatureToggleOverrideResponse = {\n    id: string\n    toggleId: string\n    overrideState: 'enabled' | 'disabled' | 'inherit'\n    tenantName: string\n    tenantId: string\n    identifier: string\n    name: string\n    category: string\n    defaultState: boolean\n}\n\nexport type GetOverridesQuery = {\n    category?: string\n    name?: string\n    identifier?: string\n    defaultState?: 'enabled' | 'disabled'\n    overrideState?: 'enabled' | 'disabled' | 'inherit'\n    sortField?: 'identifier' | 'name' | 'category' | 'defaultState' | 'overrideState'\n    sortDir?: 'asc' | 'desc'\n    page?: number\n    pageSize?: number\n}\n\nconst SORTABLE_FIELDS = new Set<keyof FeatureToggle>(['identifier', 'name', 'category'])\n\ntype GetOverridesResult = {\n    items: OverrideListResponse[]\n    total: number\n    totalPages: number\n    page: number\n    pageSize: number\n    raw: {\n        toggles: FeatureToggle[]\n        overrides: FeatureToggleOverride[]\n    }\n}\n\nexport async function getOverrides(\n    em: EntityManager,\n    tenant: Tenant,\n    query: GetOverridesQuery\n): Promise<GetOverridesResult> {\n    const filters: FilterQuery<FeatureToggle> = { deletedAt: null }\n    if (query.category) {\n        filters.category = { $ilike: `%${escapeLikePattern(query.category)}%` }\n    }\n    if (query.name) {\n        filters.name = { $ilike: `%${escapeLikePattern(query.name)}%` }\n    }\n    if (query.identifier) {\n        filters.identifier = { $ilike: `%${escapeLikePattern(query.identifier)}%` }\n    }\n\n    const page = query.page ?? 1\n    const pageSize = query.pageSize ?? 25\n    const offset = (page - 1) * pageSize\n\n    const direction = query.sortDir === 'desc' ? QueryOrder.DESC : QueryOrder.ASC\n    const orderBy: Partial<Record<keyof FeatureToggle, QueryOrder>> = {}\n    if (query.sortField && SORTABLE_FIELDS.has(query.sortField as keyof FeatureToggle)) {\n        orderBy[query.sortField as keyof FeatureToggle] = direction\n    }\n    orderBy.id = QueryOrder.ASC\n\n    const totalItems = await em.count(FeatureToggle, filters)\n\n    const globalToggles = await em.find(FeatureToggle, filters, {\n        orderBy,\n        limit: pageSize,\n        offset,\n    })\n\n    const overrides = globalToggles.length\n        ? await em.find(FeatureToggleOverride, {\n              tenantId: tenant.id,\n              toggle: { id: { $in: globalToggles.map((toggle) => toggle.id) } },\n          })\n        : []\n\n    const overridesByToggleId = new Map<string, FeatureToggleOverride>()\n    for (const override of overrides) {\n        overridesByToggleId.set(override.toggle.id, override)\n    }\n\n    const items: OverrideListResponse[] = globalToggles.map((toggle) => {\n        const override = overridesByToggleId.get(toggle.id)\n        return {\n            id: override?.id ?? '',\n            toggleId: toggle.id,\n            tenantName: tenant.name,\n            tenantId: tenant.id,\n            identifier: toggle.identifier,\n            name: toggle.name,\n            category: toggle.category ?? '',\n            isOverride: Boolean(override),\n        }\n    })\n\n    const totalPages = Math.ceil(totalItems / pageSize)\n\n    return {\n        items,\n        total: totalItems,\n        totalPages,\n        page,\n        pageSize,\n        raw: {\n            toggles: globalToggles,\n            overrides,\n        },\n    }\n}\n"],
+  "mappings": "AAAA,SAAqC,kBAAkB;AACvD,SAAS,eAAe,6BAA6B;AAErD,SAAS,yBAAyB;AA2BlC,MAAM,kBAAkB,oBAAI,IAAyB,CAAC,cAAc,QAAQ,UAAU,CAAC;AAcvF,eAAsB,aAClB,IACA,QACA,OAC2B;AAC3B,QAAM,UAAsC,EAAE,WAAW,KAAK;AAC9D,MAAI,MAAM,UAAU;AAChB,YAAQ,WAAW,EAAE,QAAQ,IAAI,kBAAkB,MAAM,QAAQ,CAAC,IAAI;AAAA,EAC1E;AACA,MAAI,MAAM,MAAM;AACZ,YAAQ,OAAO,EAAE,QAAQ,IAAI,kBAAkB,MAAM,IAAI,CAAC,IAAI;AAAA,EAClE;AACA,MAAI,MAAM,YAAY;AAClB,YAAQ,aAAa,EAAE,QAAQ,IAAI,kBAAkB,MAAM,UAAU,CAAC,IAAI;AAAA,EAC9E;AAEA,QAAM,OAAO,MAAM,QAAQ;AAC3B,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,UAAU,OAAO,KAAK;AAE5B,QAAM,YAAY,MAAM,YAAY,SAAS,WAAW,OAAO,WAAW;AAC1E,QAAM,UAA4D,CAAC;AACnE,MAAI,MAAM,aAAa,gBAAgB,IAAI,MAAM,SAAgC,GAAG;AAChF,YAAQ,MAAM,SAAgC,IAAI;AAAA,EACtD;AACA,UAAQ,KAAK,WAAW;AAExB,QAAM,aAAa,MAAM,GAAG,MAAM,eAAe,OAAO;AAExD,QAAM,gBAAgB,MAAM,GAAG,KAAK,eAAe,SAAS;AAAA,IACxD;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACJ,CAAC;AAED,QAAM,YAAY,cAAc,SAC1B,MAAM,GAAG,KAAK,uBAAuB;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,QAAQ,EAAE,IAAI,EAAE,KAAK,cAAc,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,EAAE;AAAA,EACpE,CAAC,IACD,CAAC;AAEP,QAAM,sBAAsB,oBAAI,IAAmC;AACnE,aAAW,YAAY,WAAW;AAC9B,wBAAoB,IAAI,SAAS,OAAO,IAAI,QAAQ;AAAA,EACxD;AAEA,QAAM,QAAgC,cAAc,IAAI,CAAC,WAAW;AAChE,UAAM,WAAW,oBAAoB,IAAI,OAAO,EAAE;AAClD,WAAO;AAAA,MACH,IAAI,UAAU,MAAM;AAAA,MACpB,UAAU,OAAO;AAAA,MACjB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,YAAY,OAAO;AAAA,MACnB,MAAM,OAAO;AAAA,MACb,UAAU,OAAO,YAAY;AAAA,MAC7B,YAAY,QAAQ,QAAQ;AAAA,IAChC;AAAA,EACJ,CAAC;AAED,QAAM,aAAa,KAAK,KAAK,aAAa,QAAQ;AAElD,SAAO;AAAA,IACH;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,MACD,SAAS;AAAA,MACT;AAAA,IACJ;AAAA,EACJ;AACJ;",
   "names": []
 }

package/dist/modules/messages/commands/actions.js

@@ -13,13 +13,23 @@ import {
 } from "../lib/actions.js";
 import { getMessageType } from "../lib/message-types-registry.js";
 import { assertOrganizationAccess } from "./shared.js";
+const actionStateSnapshotSchema = z.object({
+  actionTaken: z.string().nullable(),
+  actionTakenByUserId: z.string().nullable(),
+  actionTakenAt: z.string().nullable(),
+  actionResult: z.record(z.string(), z.unknown()).nullable()
+});
 const recordTerminalActionSchema = z.object({
   messageId: z.string().uuid(),
   actionId: z.string().min(1),
   result: z.record(z.string(), z.unknown()),
   tenantId: z.string().uuid(),
   organizationId: z.string().uuid().nullable(),
-  userId: z.string().uuid()
+  userId: z.string().uuid(),
+  // Optional pre-claim snapshot supplied by `messages.actions.execute` so the
+  // undo log records the true (un-taken) state even though the terminal action
+  // was atomically claimed before this finalizer runs.
+  previousState: actionStateSnapshotSchema.optional()
 });
 const executeActionSchema = z.object({
   messageId: z.string().uuid(),
@@ -100,12 +110,29 @@ const recordTerminalActionCommand = {
     const input = recordTerminalActionSchema.parse(rawInput);
     const em = ctx.container.resolve("em").fork();
     const message = await requireActionTarget(em, input);
-    if (message.actionTaken) {
-      throw new Error("Action already taken");
+    const claimedByCaller = message.actionTaken === input.actionId && message.actionTakenByUserId === input.userId;
+    if (!claimedByCaller) {
+      if (message.actionTaken) {
+        throw new Error("Action already taken");
+      }
+      const claimedRows = await em.nativeUpdate(
+        Message,
+        { id: input.messageId, tenantId: input.tenantId, actionTaken: null, deletedAt: null },
+        {
+          actionTaken: input.actionId,
+          actionTakenByUserId: input.userId,
+          actionTakenAt: /* @__PURE__ */ new Date()
+        }
+      );
+      if (claimedRows === 0) {
+        throw new Error("Action already taken");
+      }
+      message.actionTaken = input.actionId;
+      message.actionTakenByUserId = input.userId;
+    }
+    if (!message.actionTakenAt) {
+      message.actionTakenAt = /* @__PURE__ */ new Date();
     }
-    message.actionTaken = input.actionId;
-    message.actionTakenByUserId = input.userId;
-    message.actionTakenAt = /* @__PURE__ */ new Date();
     message.actionResult = input.result;
     await em.flush();
     return { ok: true };
@@ -118,6 +145,7 @@ const recordTerminalActionCommand = {
   },
   buildLog: async ({ input, snapshots }) => {
     const parsed = recordTerminalActionSchema.parse(input);
+    const before = parsed.previousState ?? snapshots.before ?? null;
     return {
       actionLabel: "Execute message terminal action",
       resourceKind: "messages.message",
@@ -126,11 +154,11 @@ const recordTerminalActionCommand = {
       organizationId: parsed.organizationId,
       payload: {
         undo: {
-          before: snapshots.before ?? null,
+          before,
           after: snapshots.after ?? null
         }
       },
-      snapshotBefore: snapshots.before ?? null,
+      snapshotBefore: before,
       snapshotAfter: snapshots.after ?? null
     };
   },
@@ -179,6 +207,46 @@ const executeActionCommand = {
         }
       }
     }
+    const previousState = snapshotActionState(message);
+    let claimedTerminal = false;
+    const releaseTerminalClaim = async () => {
+      if (!claimedTerminal) return;
+      claimedTerminal = false;
+      await em.nativeUpdate(
+        Message,
+        {
+          id: message.id,
+          tenantId: input.tenantId,
+          actionTaken: action.id,
+          actionTakenByUserId: input.userId
+        },
+        { actionTaken: null, actionTakenByUserId: null, actionTakenAt: null }
+      );
+    };
+    if (shouldRecordActionTaken) {
+      const claimedRows = await em.nativeUpdate(
+        Message,
+        { id: message.id, tenantId: input.tenantId, actionTaken: null, deletedAt: null },
+        {
+          actionTaken: action.id,
+          actionTakenByUserId: input.userId,
+          actionTakenAt: /* @__PURE__ */ new Date()
+        }
+      );
+      if (claimedRows === 0) {
+        const current = await findOneWithDecryption(
+          em,
+          Message,
+          { id: message.id, tenantId: input.tenantId, deletedAt: null },
+          void 0,
+          { tenantId: input.tenantId, organizationId: input.organizationId }
+        );
+        throw Object.assign(new Error("Action already taken"), {
+          actionTaken: current?.actionTaken ?? message.actionTaken ?? action.id
+        });
+      }
+      claimedTerminal = true;
+    }
     const commandBus = ctx.container.resolve("commandBus");
     let result = {};
     let operationLogEntry = null;
@@ -223,6 +291,7 @@ const executeActionCommand = {
         operationLogEntry = commandResult.logEntry ?? null;
       } catch (err) {
         console.error("[messages] executeActionCommand sub-command failed", err);
+        await releaseTerminalClaim();
         throw new Error("Action failed");
       }
     } else if (action.href) {
@@ -232,10 +301,12 @@ const executeActionCommand = {
         userId: input.userId
       });
       if (!safeRedirect) {
+        await releaseTerminalClaim();
         throw new Error("Action has an unsafe redirect target");
       }
       result = { redirect: safeRedirect };
     } else {
+      await releaseTerminalClaim();
       throw new Error("Action has no executable target");
     }
     if (shouldRecordActionTaken) {
@@ -246,7 +317,8 @@ const executeActionCommand = {
           result,
           tenantId: input.tenantId,
           organizationId: input.organizationId,
-          userId: input.userId
+          userId: input.userId,
+          previousState
         },
         ctx: {
           container: ctx.container,