@open-mercato/core 0.6.6-develop.6094.1.28b081ea16 → 0.6.6-develop.6126.1.0b9392fdae

package/dist/modules/dashboards/services/widgetDataService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dashboards/services/widgetDataService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { createHash } from 'node:crypto'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  type DateRangePreset,\n  resolveDateRange,\n  getPreviousPeriod,\n  calculatePercentageChange,\n  determineChangeDirection,\n  isValidDateRangePreset,\n} from '@open-mercato/ui/backend/date-range'\nimport {\n  type AggregateFunction,\n  type DateGranularity,\n  buildAggregationQuery,\n} from '../lib/aggregations'\nimport type { AnalyticsRegistry } from './analyticsRegistry'\n\nconst WIDGET_DATA_CACHE_TTL = 120_000\nconst WIDGET_DATA_SEGMENT_TTL = 86_400_000\nconst WIDGET_DATA_SEGMENT_KEY = 'widget-data:__segment__'\n\nconst SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/\n\nexport class WidgetDataValidationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'WidgetDataValidationError'\n  }\n}\n\nfunction assertSafeIdentifier(value: string, name: string): void {\n  if (!SAFE_IDENTIFIER_PATTERN.test(value)) {\n    throw new Error(`Invalid ${name}: ${value}`)\n  }\n}\n\nexport type WidgetDataRequest = {\n  entityType: string\n  metric: {\n    field: string\n    aggregate: AggregateFunction\n  }\n  groupBy?: {\n    field: string\n    granularity?: DateGranularity\n    limit?: number\n    resolveLabels?: boolean\n  }\n  filters?: Array<{\n    field: string\n    operator: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'is_null' | 'is_not_null'\n    value?: unknown\n  }>\n  dateRange?: {\n    field: string\n    preset: DateRangePreset\n  }\n  comparison?: {\n    type: 'previous_period' | 'previous_year'\n  }\n}\n\nexport type WidgetDataItem = {\n  groupKey: unknown\n  groupLabel?: string\n  value: number | null\n}\n\nexport type WidgetDataResponse = {\n  value: number | null\n  data: WidgetDataItem[]\n  comparison?: {\n    value: number | null\n    change: number\n    direction: 'up' | 'down' | 'unchanged'\n  }\n  metadata: {\n    fetchedAt: string\n    recordCount: number\n  }\n}\n\nexport type WidgetDataScope = {\n  tenantId: string\n  organizationIds?: string[]\n}\n\nexport type WidgetDataServiceOptions = {\n  em: EntityManager\n  scope: WidgetDataScope\n  registry: AnalyticsRegistry\n  cache?: CacheStrategy\n}\n\nexport class WidgetDataService {\n  private em: EntityManager\n  private scope: WidgetDataScope\n  private registry: AnalyticsRegistry\n  private cache?: CacheStrategy\n\n  constructor(options: WidgetDataServiceOptions) {\n    this.em = options.em\n    this.scope = options.scope\n    this.registry = options.registry\n    this.cache = options.cache\n  }\n\n  private buildCacheKey(request: WidgetDataRequest): string {\n    const hash = createHash('sha256')\n    hash.update(JSON.stringify({ request, scope: this.scope }))\n    return `widget-data:${hash.digest('hex').slice(0, 16)}`\n  }\n\n  private getCacheTags(entityType: string): string[] {\n    return ['widget-data', `widget-data:${entityType}`]\n  }\n\n  async fetchWidgetData(request: WidgetDataRequest): Promise<WidgetDataResponse> {\n    this.validateRequest(request)\n\n    if (this.cache) {\n      const cacheKey = this.buildCacheKey(request)\n      try {\n        const cached = await this.cache.get(cacheKey)\n        if (cached && typeof cached === 'object' && 'value' in (cached as object)) {\n          return cached as WidgetDataResponse\n        }\n      } catch {\n      }\n    }\n\n    const now = new Date()\n    let dateRangeResolved: { start: Date; end: Date } | undefined\n    let comparisonRange: { start: Date; end: Date } | undefined\n\n    if (request.dateRange) {\n      dateRangeResolved = resolveDateRange(request.dateRange.preset, now)\n      if (request.comparison) {\n        comparisonRange = getPreviousPeriod(dateRangeResolved, request.dateRange.preset)\n      }\n    }\n\n    const mainResult = await this.executeQuery(request, dateRangeResolved)\n\n    let comparisonResult: { value: number | null; data: WidgetDataItem[] } | undefined\n    if (comparisonRange && request.dateRange) {\n      comparisonResult = await this.executeQuery(request, comparisonRange)\n    }\n\n    const response: WidgetDataResponse = {\n      value: mainResult.value,\n      data: mainResult.data,\n      metadata: {\n        fetchedAt: now.toISOString(),\n        recordCount: mainResult.data.length || (mainResult.value !== null ? 1 : 0),\n      },\n    }\n\n    if (comparisonResult && mainResult.value !== null && comparisonResult.value !== null) {\n      response.comparison = {\n        value: comparisonResult.value,\n        change: calculatePercentageChange(mainResult.value, comparisonResult.value),\n        direction: determineChangeDirection(mainResult.value, comparisonResult.value),\n      }\n    }\n\n    if (this.cache) {\n      const cacheKey = this.buildCacheKey(request)\n      const tags = this.getCacheTags(request.entityType)\n      try {\n        await this.cache.set(cacheKey, response, { ttl: WIDGET_DATA_CACHE_TTL, tags })\n        await this.cache.set(\n          WIDGET_DATA_SEGMENT_KEY,\n          { updatedAt: response.metadata.fetchedAt },\n          { ttl: WIDGET_DATA_SEGMENT_TTL, tags: ['widget-data'] },\n        )\n      } catch {\n      }\n    }\n\n    return response\n  }\n\n  private validateRequest(request: WidgetDataRequest): void {\n    if (!this.registry.isValidEntityType(request.entityType)) {\n      throw new WidgetDataValidationError(`Invalid entity type: ${request.entityType}`)\n    }\n\n    if (!request.metric?.field || !request.metric?.aggregate) {\n      throw new WidgetDataValidationError('Metric field and aggregate are required')\n    }\n\n    const metricMapping = this.registry.getFieldMapping(request.entityType, request.metric.field)\n    if (!metricMapping) {\n      throw new WidgetDataValidationError(\n        `Invalid metric field: ${request.metric.field} for entity type: ${request.entityType}`\n      )\n    }\n\n    const validAggregates: AggregateFunction[] = ['count', 'sum', 'avg', 'min', 'max']\n    if (!validAggregates.includes(request.metric.aggregate)) {\n      throw new WidgetDataValidationError(`Invalid aggregate function: ${request.metric.aggregate}`)\n    }\n\n    if (request.dateRange && !isValidDateRangePreset(request.dateRange.preset)) {\n      throw new WidgetDataValidationError(`Invalid date range preset: ${request.dateRange.preset}`)\n    }\n\n    if (request.groupBy) {\n      const groupMapping = this.registry.getFieldMapping(request.entityType, request.groupBy.field)\n      if (!groupMapping) {\n        const [baseField] = request.groupBy.field.split('.')\n        const baseMapping = this.registry.getFieldMapping(request.entityType, baseField)\n        if (!baseMapping || baseMapping.type !== 'jsonb') {\n          throw new WidgetDataValidationError(`Invalid groupBy field: ${request.groupBy.field}`)\n        }\n      }\n    }\n  }\n\n  private async executeQuery(\n    request: WidgetDataRequest,\n    dateRange?: { start: Date; end: Date },\n  ): Promise<{ value: number | null; data: WidgetDataItem[] }> {\n    const query = buildAggregationQuery({\n      entityType: request.entityType,\n      metric: request.metric,\n      groupBy: request.groupBy,\n      dateRange: dateRange && request.dateRange ? { field: request.dateRange.field, ...dateRange } : undefined,\n      filters: request.filters,\n      scope: this.scope,\n      registry: this.registry,\n    })\n\n    if (!query) {\n      throw new Error('Failed to build aggregation query')\n    }\n\n    const rows = await this.em.getConnection().execute(query.sql, query.params)\n    const results = Array.isArray(rows) ? rows : []\n\n    if (request.groupBy) {\n      let data: WidgetDataItem[] = results.map((row: Record<string, unknown>) => ({\n        groupKey: row.group_key,\n        value: row.value !== null ? Number(row.value) : null,\n      }))\n\n      if (request.groupBy.resolveLabels) {\n        data = await this.resolveGroupLabels(data, request.entityType, request.groupBy.field)\n      }\n\n      const totalValue = data.reduce((sum: number, item: WidgetDataItem) => sum + (item.value ?? 0), 0)\n      return { value: totalValue, data }\n    }\n\n    const singleValue = results[0]?.value !== undefined ? Number(results[0].value) : null\n    return { value: singleValue, data: [] }\n  }\n\n  private async resolveGroupLabels(\n    data: WidgetDataItem[],\n    entityType: string,\n    groupByField: string,\n  ): Promise<WidgetDataItem[]> {\n    const config = this.registry.getLabelResolverConfig(entityType, groupByField)\n\n    if (!config) {\n      return data.map((item) => ({\n        ...item,\n        groupLabel: item.groupKey != null && item.groupKey !== '' ? String(item.groupKey) : undefined,\n      }))\n    }\n\n    const ids = data\n      .map((item) => item.groupKey)\n      .filter((id): id is string => {\n        if (typeof id !== 'string' || id.length === 0) return false\n        return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)\n      })\n\n    if (ids.length === 0) {\n      return data.map((item) => ({ ...item, groupLabel: undefined }))\n    }\n\n    const uniqueIds = [...new Set(ids)]\n\n    assertSafeIdentifier(config.table, 'table name')\n    assertSafeIdentifier(config.idColumn, 'id column')\n    assertSafeIdentifier(config.labelColumn, 'label column')\n\n    const meta = this.resolveEntityMetadata(config.table)\n    const idProp = meta ? this.resolveEntityPropertyName(meta, config.idColumn) : null\n    const labelProp = meta ? this.resolveEntityPropertyName(meta, config.labelColumn) : null\n    const tenantProp = meta\n      ? (this.resolveEntityPropertyName(meta, 'tenant_id') ?? this.resolveEntityPropertyName(meta, 'tenantId'))\n      : null\n    const organizationProp = meta\n      ? (this.resolveEntityPropertyName(meta, 'organization_id') ?? this.resolveEntityPropertyName(meta, 'organizationId'))\n      : null\n    const entityName = meta ? ((meta as any).class ?? meta.className ?? meta.name) : null\n\n    if (meta && idProp && labelProp && tenantProp && entityName) {\n      const where: Record<string, unknown> = {\n        [idProp]: { $in: uniqueIds },\n        [tenantProp]: this.scope.tenantId,\n      }\n      if (organizationProp && this.scope.organizationIds && this.scope.organizationIds.length > 0) {\n        where[organizationProp] = { $in: this.scope.organizationIds }\n      }\n\n      try {\n        const records = await findWithDecryption(\n          this.em,\n          entityName,\n          where,\n          { fields: [idProp, labelProp, tenantProp, organizationProp].filter(Boolean) },\n          { tenantId: this.scope.tenantId, organizationId: this.resolveOrganizationId() },\n        )\n\n        const encryptionService = resolveTenantEncryptionService(this.em as any)\n        const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null\n        let hasEncryptedLabels = false\n        let hasDecryptedLabels = false\n\n        const labelMap = new Map<string, string>()\n        for (const record of records as Array<Record<string, unknown>>) {\n          const id = record[idProp]\n          let labelValue = record[labelProp]\n          if (typeof labelValue === 'string' && this.isEncryptedPayload(labelValue)) {\n            hasEncryptedLabels = true\n            if (dek?.key) {\n              const decrypted = this.decryptWithDek(labelValue, dek.key)\n              if (decrypted !== null) {\n                labelValue = decrypted\n                hasDecryptedLabels = true\n              }\n            }\n          } else if (labelValue != null && labelValue !== '') {\n            hasDecryptedLabels = true\n          }\n\n          if (typeof id === 'string' && labelValue != null && labelValue !== '') {\n            labelMap.set(id, String(labelValue))\n          }\n        }\n\n        if (labelMap.size > 0 && (!hasEncryptedLabels || hasDecryptedLabels)) {\n          return data.map((item) => ({\n            ...item,\n            groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)\n              ? labelMap.get(item.groupKey)!\n              : undefined,\n          }))\n        }\n      } catch {\n        // fall through to SQL resolution\n      }\n    }\n\n    const clauses = [`\"${config.idColumn}\" = ANY(?::uuid[])`, 'tenant_id = ?']\n    const params: unknown[] = [`{${uniqueIds.join(',')}}`, this.scope.tenantId]\n\n    if (this.scope.organizationIds && this.scope.organizationIds.length > 0) {\n      clauses.push('organization_id = ANY(?::uuid[])')\n      params.push(`{${this.scope.organizationIds.join(',')}}`)\n    }\n\n    const sql = `SELECT \"${config.idColumn}\" as id, \"${config.labelColumn}\" as label, tenant_id, organization_id FROM \"${config.table}\" WHERE ${clauses.join(\n      ' AND ',\n    )}`\n\n    try {\n      const labelRows = await this.em.getConnection().execute(sql, params)\n      const entityId = this.resolveEntityId(meta)\n      const encryptionService = resolveTenantEncryptionService(this.em as any)\n      const organizationId = this.resolveOrganizationId()\n      const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null\n\n      const labelMap = new Map<string, string>()\n      for (const row of labelRows as Array<{ id: string; label: string | null; tenant_id?: string | null; organization_id?: string | null }>) {\n        let labelValue = row.label\n        if (entityId && encryptionService?.isEnabled() && labelValue != null) {\n          const rowOrgId = row.organization_id ?? organizationId ?? null\n          const decrypted = await encryptionService.decryptEntityPayload(\n            entityId,\n            { [config.labelColumn]: labelValue },\n            this.scope.tenantId,\n            rowOrgId,\n          )\n          const resolved = decrypted[config.labelColumn]\n          if (typeof resolved === 'string' || typeof resolved === 'number') {\n            labelValue = String(resolved)\n          }\n        }\n\n        if (labelValue && dek?.key && this.isEncryptedPayload(labelValue)) {\n          const decrypted = this.decryptWithDek(labelValue, dek.key)\n          if (decrypted !== null) {\n            labelValue = decrypted\n          }\n        }\n\n        if (row.id && labelValue != null && labelValue !== '') {\n          labelMap.set(row.id, labelValue)\n        }\n      }\n\n      return data.map((item) => ({\n        ...item,\n        groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)\n          ? labelMap.get(item.groupKey)!\n          : undefined,\n      }))\n    } catch {\n      return data.map((item) => ({\n        ...item,\n        groupLabel: undefined,\n      }))\n    }\n  }\n\n  private resolveOrganizationId(): string | null {\n    if (!this.scope.organizationIds || this.scope.organizationIds.length !== 1) return null\n    return this.scope.organizationIds[0] ?? null\n  }\n\n  private resolveEntityMetadata(tableName: string): Record<string, any> | null {\n    const registry = (this.em as any)?.getMetadata?.()\n    if (!registry) return null\n    const entries =\n      (typeof registry.getAll === 'function' && registry.getAll()) ||\n      (Array.isArray(registry.metadata) ? registry.metadata : Object.values(registry.metadata ?? {}))\n    const metas = Array.isArray(entries) ? entries : Object.values(entries ?? {})\n    const match = metas.find((meta: any) => {\n      const table = meta?.tableName ?? meta?.collection\n      if (typeof table !== 'string') return false\n      if (table === tableName) return true\n      return table.split('.').pop() === tableName\n    })\n    return match ?? null\n  }\n\n  private resolveEntityPropertyName(meta: Record<string, any>, columnName: string): string | null {\n    const properties = meta?.properties ? Object.values(meta.properties) : []\n    for (const prop of properties as Array<Record<string, any>>) {\n      const fieldName = prop?.fieldName\n      const fieldNames = prop?.fieldNames\n      if (typeof fieldName === 'string' && fieldName === columnName) return prop?.name ?? null\n      if (Array.isArray(fieldNames) && fieldNames.includes(columnName)) return prop?.name ?? null\n      if (prop?.name === columnName) return prop?.name ?? null\n    }\n    return null\n  }\n\n  private resolveEntityId(meta: Record<string, any> | null): string | null {\n    if (!meta) return null\n    try {\n      return resolveEntityIdFromMetadata(meta as any)\n    } catch {\n      return null\n    }\n  }\n\n  private isEncryptedPayload(value: string): boolean {\n    const parts = value.split(':')\n    return parts.length === 4 && parts[3] === 'v1'\n  }\n\n  private decryptWithDek(value: string, dek: string): string | null {\n    const first = decryptWithAesGcm(value, dek)\n    if (first === null) return null\n    if (!this.isEncryptedPayload(first)) return first\n    return decryptWithAesGcm(first, dek) ?? first\n  }\n}\n\nexport function createWidgetDataService(\n  em: EntityManager,\n  scope: WidgetDataScope,\n  registry: AnalyticsRegistry,\n  cache?: CacheStrategy,\n): WidgetDataService {\n  return new WidgetDataService({ em, scope, registry, cache })\n}\n"],
-  "mappings": "AAEA,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAClC,SAAS,sCAAsC;AAC/C,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,OACK;AAGP,MAAM,wBAAwB;AAC9B,MAAM,0BAA0B;AAChC,MAAM,0BAA0B;AAEhC,MAAM,0BAA0B;AAEzB,MAAM,kCAAkC,MAAM;AAAA,EACnD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,qBAAqB,OAAe,MAAoB;AAC/D,MAAI,CAAC,wBAAwB,KAAK,KAAK,GAAG;AACxC,UAAM,IAAI,MAAM,WAAW,IAAI,KAAK,KAAK,EAAE;AAAA,EAC7C;AACF;AA4DO,MAAM,kBAAkB;AAAA,EAM7B,YAAY,SAAmC;AAC7C,SAAK,KAAK,QAAQ;AAClB,SAAK,QAAQ,QAAQ;AACrB,SAAK,WAAW,QAAQ;AACxB,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEQ,cAAc,SAAoC;AACxD,UAAM,OAAO,WAAW,QAAQ;AAChC,SAAK,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,KAAK,MAAM,CAAC,CAAC;AAC1D,WAAO,eAAe,KAAK,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,EACvD;AAAA,EAEQ,aAAa,YAA8B;AACjD,WAAO,CAAC,eAAe,eAAe,UAAU,EAAE;AAAA,EACpD;AAAA,EAEA,MAAM,gBAAgB,SAAyD;AAC7E,SAAK,gBAAgB,OAAO;AAE5B,QAAI,KAAK,OAAO;AACd,YAAM,WAAW,KAAK,cAAc,OAAO;AAC3C,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,YAAI,UAAU,OAAO,WAAW,YAAY,WAAY,QAAmB;AACzE,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI;AACJ,QAAI;AAEJ,QAAI,QAAQ,WAAW;AACrB,0BAAoB,iBAAiB,QAAQ,UAAU,QAAQ,GAAG;AAClE,UAAI,QAAQ,YAAY;AACtB,0BAAkB,kBAAkB,mBAAmB,QAAQ,UAAU,MAAM;AAAA,MACjF;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,KAAK,aAAa,SAAS,iBAAiB;AAErE,QAAI;AACJ,QAAI,mBAAmB,QAAQ,WAAW;AACxC,yBAAmB,MAAM,KAAK,aAAa,SAAS,eAAe;AAAA,IACrE;AAEA,UAAM,WAA+B;AAAA,MACnC,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,IAAI,YAAY;AAAA,QAC3B,aAAa,WAAW,KAAK,WAAW,WAAW,UAAU,OAAO,IAAI;AAAA,MAC1E;AAAA,IACF;AAEA,QAAI,oBAAoB,WAAW,UAAU,QAAQ,iBAAiB,UAAU,MAAM;AACpF,eAAS,aAAa;AAAA,QACpB,OAAO,iBAAiB;AAAA,QACxB,QAAQ,0BAA0B,WAAW,OAAO,iBAAiB,KAAK;AAAA,QAC1E,WAAW,yBAAyB,WAAW,OAAO,iBAAiB,KAAK;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,KAAK,OAAO;AACd,YAAM,WAAW,KAAK,cAAc,OAAO;AAC3C,YAAM,OAAO,KAAK,aAAa,QAAQ,UAAU;AACjD,UAAI;AACF,cAAM,KAAK,MAAM,IAAI,UAAU,UAAU,EAAE,KAAK,uBAAuB,KAAK,CAAC;AAC7E,cAAM,KAAK,MAAM;AAAA,UACf;AAAA,UACA,EAAE,WAAW,SAAS,SAAS,UAAU;AAAA,UACzC,EAAE,KAAK,yBAAyB,MAAM,CAAC,aAAa,EAAE;AAAA,QACxD;AAAA,MACF,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,SAAkC;AACxD,QAAI,CAAC,KAAK,SAAS,kBAAkB,QAAQ,UAAU,GAAG;AACxD,YAAM,IAAI,0BAA0B,wBAAwB,QAAQ,UAAU,EAAE;AAAA,IAClF;AAEA,QAAI,CAAC,QAAQ,QAAQ,SAAS,CAAC,QAAQ,QAAQ,WAAW;AACxD,YAAM,IAAI,0BAA0B,yCAAyC;AAAA,IAC/E;AAEA,UAAM,gBAAgB,KAAK,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,OAAO,KAAK;AAC5F,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR,yBAAyB,QAAQ,OAAO,KAAK,qBAAqB,QAAQ,UAAU;AAAA,MACtF;AAAA,IACF;AAEA,UAAM,kBAAuC,CAAC,SAAS,OAAO,OAAO,OAAO,KAAK;AACjF,QAAI,CAAC,gBAAgB,SAAS,QAAQ,OAAO,SAAS,GAAG;AACvD,YAAM,IAAI,0BAA0B,+BAA+B,QAAQ,OAAO,SAAS,EAAE;AAAA,IAC/F;AAEA,QAAI,QAAQ,aAAa,CAAC,uBAAuB,QAAQ,UAAU,MAAM,GAAG;AAC1E,YAAM,IAAI,0BAA0B,8BAA8B,QAAQ,UAAU,MAAM,EAAE;AAAA,IAC9F;AAEA,QAAI,QAAQ,SAAS;AACnB,YAAM,eAAe,KAAK,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,QAAQ,KAAK;AAC5F,UAAI,CAAC,cAAc;AACjB,cAAM,CAAC,SAAS,IAAI,QAAQ,QAAQ,MAAM,MAAM,GAAG;AACnD,cAAM,cAAc,KAAK,SAAS,gBAAgB,QAAQ,YAAY,SAAS;AAC/E,YAAI,CAAC,eAAe,YAAY,SAAS,SAAS;AAChD,gBAAM,IAAI,0BAA0B,0BAA0B,QAAQ,QAAQ,KAAK,EAAE;AAAA,QACvF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,WAC2D;AAC3D,UAAM,QAAQ,sBAAsB;AAAA,MAClC,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,WAAW,aAAa,QAAQ,YAAY,EAAE,OAAO,QAAQ,UAAU,OAAO,GAAG,UAAU,IAAI;AAAA,MAC/F,SAAS,QAAQ;AAAA,MACjB,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,OAAO,MAAM,KAAK,GAAG,cAAc,EAAE,QAAQ,MAAM,KAAK,MAAM,MAAM;AAC1E,UAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAE9C,QAAI,QAAQ,SAAS;AACnB,UAAI,OAAyB,QAAQ,IAAI,CAAC,SAAkC;AAAA,QAC1E,UAAU,IAAI;AAAA,QACd,OAAO,IAAI,UAAU,OAAO,OAAO,IAAI,KAAK,IAAI;AAAA,MAClD,EAAE;AAEF,UAAI,QAAQ,QAAQ,eAAe;AACjC,eAAO,MAAM,KAAK,mBAAmB,MAAM,QAAQ,YAAY,QAAQ,QAAQ,KAAK;AAAA,MACtF;AAEA,YAAM,aAAa,KAAK,OAAO,CAAC,KAAa,SAAyB,OAAO,KAAK,SAAS,IAAI,CAAC;AAChG,aAAO,EAAE,OAAO,YAAY,KAAK;AAAA,IACnC;AAEA,UAAM,cAAc,QAAQ,CAAC,GAAG,UAAU,SAAY,OAAO,QAAQ,CAAC,EAAE,KAAK,IAAI;AACjF,WAAO,EAAE,OAAO,aAAa,MAAM,CAAC,EAAE;AAAA,EACxC;AAAA,EAEA,MAAc,mBACZ,MACA,YACA,cAC2B;AAC3B,UAAM,SAAS,KAAK,SAAS,uBAAuB,YAAY,YAAY;AAE5E,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,IAAI,CAAC,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,YAAY,KAAK,YAAY,QAAQ,KAAK,aAAa,KAAK,OAAO,KAAK,QAAQ,IAAI;AAAA,MACtF,EAAE;AAAA,IACJ;AAEA,UAAM,MAAM,KACT,IAAI,CAAC,SAAS,KAAK,QAAQ,EAC3B,OAAO,CAAC,OAAqB;AAC5B,UAAI,OAAO,OAAO,YAAY,GAAG,WAAW,EAAG,QAAO;AACtD,aAAO,kEAAkE,KAAK,EAAE;AAAA,IAClF,CAAC;AAEH,QAAI,IAAI,WAAW,GAAG;AACpB,aAAO,KAAK,IAAI,CAAC,UAAU,EAAE,GAAG,MAAM,YAAY,OAAU,EAAE;AAAA,IAChE;AAEA,UAAM,YAAY,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AAElC,yBAAqB,OAAO,OAAO,YAAY;AAC/C,yBAAqB,OAAO,UAAU,WAAW;AACjD,yBAAqB,OAAO,aAAa,cAAc;AAEvD,UAAM,OAAO,KAAK,sBAAsB,OAAO,KAAK;AACpD,UAAM,SAAS,OAAO,KAAK,0BAA0B,MAAM,OAAO,QAAQ,IAAI;AAC9E,UAAM,YAAY,OAAO,KAAK,0BAA0B,MAAM,OAAO,WAAW,IAAI;AACpF,UAAM,aAAa,OACd,KAAK,0BAA0B,MAAM,WAAW,KAAK,KAAK,0BAA0B,MAAM,UAAU,IACrG;AACJ,UAAM,mBAAmB,OACpB,KAAK,0BAA0B,MAAM,iBAAiB,KAAK,KAAK,0BAA0B,MAAM,gBAAgB,IACjH;AACJ,UAAM,aAAa,OAAS,KAAa,SAAS,KAAK,aAAa,KAAK,OAAQ;AAEjF,QAAI,QAAQ,UAAU,aAAa,cAAc,YAAY;AAC3D,YAAM,QAAiC;AAAA,QACrC,CAAC,MAAM,GAAG,EAAE,KAAK,UAAU;AAAA,QAC3B,CAAC,UAAU,GAAG,KAAK,MAAM;AAAA,MAC3B;AACA,UAAI,oBAAoB,KAAK,MAAM,mBAAmB,KAAK,MAAM,gBAAgB,SAAS,GAAG;AAC3F,cAAM,gBAAgB,IAAI,EAAE,KAAK,KAAK,MAAM,gBAAgB;AAAA,MAC9D;AAEA,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,CAAC,QAAQ,WAAW,YAAY,gBAAgB,EAAE,OAAO,OAAO,EAAE;AAAA,UAC5E,EAAE,UAAU,KAAK,MAAM,UAAU,gBAAgB,KAAK,sBAAsB,EAAE;AAAA,QAChF;AAEA,cAAM,oBAAoB,+BAA+B,KAAK,EAAS;AACvE,cAAM,MAAM,mBAAmB,UAAU,IAAI,MAAM,kBAAkB,OAAO,KAAK,MAAM,QAAQ,IAAI;AACnG,YAAI,qBAAqB;AACzB,YAAI,qBAAqB;AAEzB,cAAM,WAAW,oBAAI,IAAoB;AACzC,mBAAW,UAAU,SAA2C;AAC9D,gBAAM,KAAK,OAAO,MAAM;AACxB,cAAI,aAAa,OAAO,SAAS;AACjC,cAAI,OAAO,eAAe,YAAY,KAAK,mBAAmB,UAAU,GAAG;AACzE,iCAAqB;AACrB,gBAAI,KAAK,KAAK;AACZ,oBAAM,YAAY,KAAK,eAAe,YAAY,IAAI,GAAG;AACzD,kBAAI,cAAc,MAAM;AACtB,6BAAa;AACb,qCAAqB;AAAA,cACvB;AAAA,YACF;AAAA,UACF,WAAW,cAAc,QAAQ,eAAe,IAAI;AAClD,iCAAqB;AAAA,UACvB;AAEA,cAAI,OAAO,OAAO,YAAY,cAAc,QAAQ,eAAe,IAAI;AACrE,qBAAS,IAAI,IAAI,OAAO,UAAU,CAAC;AAAA,UACrC;AAAA,QACF;AAEA,YAAI,SAAS,OAAO,MAAM,CAAC,sBAAsB,qBAAqB;AACpE,iBAAO,KAAK,IAAI,CAAC,UAAU;AAAA,YACzB,GAAG;AAAA,YACH,YAAY,OAAO,KAAK,aAAa,YAAY,SAAS,IAAI,KAAK,QAAQ,IACvE,SAAS,IAAI,KAAK,QAAQ,IAC1B;AAAA,UACN,EAAE;AAAA,QACJ;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,UAAU,CAAC,IAAI,OAAO,QAAQ,sBAAsB,eAAe;AACzE,UAAM,SAAoB,CAAC,IAAI,UAAU,KAAK,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ;AAE1E,QAAI,KAAK,MAAM,mBAAmB,KAAK,MAAM,gBAAgB,SAAS,GAAG;AACvE,cAAQ,KAAK,kCAAkC;AAC/C,aAAO,KAAK,IAAI,KAAK,MAAM,gBAAgB,KAAK,GAAG,CAAC,GAAG;AAAA,IACzD;AAEA,UAAM,MAAM,WAAW,OAAO,QAAQ,aAAa,OAAO,WAAW,gDAAgD,OAAO,KAAK,WAAW,QAAQ;AAAA,MAClJ;AAAA,IACF,CAAC;AAED,QAAI;AACF,YAAM,YAAY,MAAM,KAAK,GAAG,cAAc,EAAE,QAAQ,KAAK,MAAM;AACnE,YAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,YAAM,oBAAoB,+BAA+B,KAAK,EAAS;AACvE,YAAM,iBAAiB,KAAK,sBAAsB;AAClD,YAAM,MAAM,mBAAmB,UAAU,IAAI,MAAM,kBAAkB,OAAO,KAAK,MAAM,QAAQ,IAAI;AAEnG,YAAM,WAAW,oBAAI,IAAoB;AACzC,iBAAW,OAAO,WAAsH;AACtI,YAAI,aAAa,IAAI;AACrB,YAAI,YAAY,mBAAmB,UAAU,KAAK,cAAc,MAAM;AACpE,gBAAM,WAAW,IAAI,mBAAmB,kBAAkB;AAC1D,gBAAM,YAAY,MAAM,kBAAkB;AAAA,YACxC;AAAA,YACA,EAAE,CAAC,OAAO,WAAW,GAAG,WAAW;AAAA,YACnC,KAAK,MAAM;AAAA,YACX;AAAA,UACF;AACA,gBAAM,WAAW,UAAU,OAAO,WAAW;AAC7C,cAAI,OAAO,aAAa,YAAY,OAAO,aAAa,UAAU;AAChE,yBAAa,OAAO,QAAQ;AAAA,UAC9B;AAAA,QACF;AAEA,YAAI,cAAc,KAAK,OAAO,KAAK,mBAAmB,UAAU,GAAG;AACjE,gBAAM,YAAY,KAAK,eAAe,YAAY,IAAI,GAAG;AACzD,cAAI,cAAc,MAAM;AACtB,yBAAa;AAAA,UACf;AAAA,QACF;AAEA,YAAI,IAAI,MAAM,cAAc,QAAQ,eAAe,IAAI;AACrD,mBAAS,IAAI,IAAI,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAEA,aAAO,KAAK,IAAI,CAAC,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,YAAY,OAAO,KAAK,aAAa,YAAY,SAAS,IAAI,KAAK,QAAQ,IACvE,SAAS,IAAI,KAAK,QAAQ,IAC1B;AAAA,MACN,EAAE;AAAA,IACJ,QAAQ;AACN,aAAO,KAAK,IAAI,CAAC,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,YAAY;AAAA,MACd,EAAE;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,wBAAuC;AAC7C,QAAI,CAAC,KAAK,MAAM,mBAAmB,KAAK,MAAM,gBAAgB,WAAW,EAAG,QAAO;AACnF,WAAO,KAAK,MAAM,gBAAgB,CAAC,KAAK;AAAA,EAC1C;AAAA,EAEQ,sBAAsB,WAA+C;AAC3E,UAAM,WAAY,KAAK,IAAY,cAAc;AACjD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,UACH,OAAO,SAAS,WAAW,cAAc,SAAS,OAAO,MACzD,MAAM,QAAQ,SAAS,QAAQ,IAAI,SAAS,WAAW,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC;AAC/F,UAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,UAAU,OAAO,OAAO,WAAW,CAAC,CAAC;AAC5E,UAAM,QAAQ,MAAM,KAAK,CAAC,SAAc;AACtC,YAAM,QAAQ,MAAM,aAAa,MAAM;AACvC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAI,UAAU,UAAW,QAAO;AAChC,aAAO,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM;AAAA,IACpC,CAAC;AACD,WAAO,SAAS;AAAA,EAClB;AAAA,EAEQ,0BAA0B,MAA2B,YAAmC;AAC9F,UAAM,aAAa,MAAM,aAAa,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC;AACxE,eAAW,QAAQ,YAA0C;AAC3D,YAAM,YAAY,MAAM;AACxB,YAAM,aAAa,MAAM;AACzB,UAAI,OAAO,cAAc,YAAY,cAAc,WAAY,QAAO,MAAM,QAAQ;AACpF,UAAI,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,UAAU,EAAG,QAAO,MAAM,QAAQ;AACvF,UAAI,MAAM,SAAS,WAAY,QAAO,MAAM,QAAQ;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAiD;AACvE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI;AACF,aAAO,4BAA4B,IAAW;AAAA,IAChD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,mBAAmB,OAAwB;AACjD,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,WAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAAA,EAC5C;AAAA,EAEQ,eAAe,OAAe,KAA4B;AAChE,UAAM,QAAQ,kBAAkB,OAAO,GAAG;AAC1C,QAAI,UAAU,KAAM,QAAO;AAC3B,QAAI,CAAC,KAAK,mBAAmB,KAAK,EAAG,QAAO;AAC5C,WAAO,kBAAkB,OAAO,GAAG,KAAK;AAAA,EAC1C;AACF;AAEO,SAAS,wBACd,IACA,OACA,UACA,OACmB;AACnB,SAAO,IAAI,kBAAkB,EAAE,IAAI,OAAO,UAAU,MAAM,CAAC;AAC7D;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { createHash } from 'node:crypto'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  type DateRangePreset,\n  resolveDateRange,\n  getPreviousPeriod,\n  calculatePercentageChange,\n  determineChangeDirection,\n  isValidDateRangePreset,\n} from '@open-mercato/ui/backend/date-range'\nimport {\n  type AggregateFunction,\n  type DateGranularity,\n  buildAggregationQuery,\n} from '../lib/aggregations'\nimport type { AnalyticsRegistry } from './analyticsRegistry'\n\nconst WIDGET_DATA_CACHE_TTL = 120_000\nconst WIDGET_DATA_SEGMENT_TTL = 86_400_000\nconst WIDGET_DATA_SEGMENT_KEY = 'widget-data:__segment__'\n\nconst SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/\n\nexport class WidgetDataValidationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'WidgetDataValidationError'\n  }\n}\n\nfunction assertSafeIdentifier(value: string, name: string): void {\n  if (!SAFE_IDENTIFIER_PATTERN.test(value)) {\n    throw new Error(`Invalid ${name}: ${value}`)\n  }\n}\n\nexport type WidgetDataRequest = {\n  entityType: string\n  metric: {\n    field: string\n    aggregate: AggregateFunction\n  }\n  groupBy?: {\n    field: string\n    granularity?: DateGranularity\n    limit?: number\n    resolveLabels?: boolean\n  }\n  filters?: Array<{\n    field: string\n    operator: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'is_null' | 'is_not_null'\n    value?: unknown\n  }>\n  dateRange?: {\n    field: string\n    preset: DateRangePreset\n  }\n  comparison?: {\n    type: 'previous_period' | 'previous_year'\n  }\n}\n\nexport type WidgetDataItem = {\n  groupKey: unknown\n  groupLabel?: string\n  value: number | null\n}\n\nexport type WidgetDataResponse = {\n  value: number | null\n  data: WidgetDataItem[]\n  comparison?: {\n    value: number | null\n    change: number\n    direction: 'up' | 'down' | 'unchanged'\n  }\n  metadata: {\n    fetchedAt: string\n    recordCount: number\n  }\n}\n\nexport type WidgetDataScope = {\n  tenantId: string\n  organizationIds?: string[]\n}\n\nexport type WidgetDataServiceOptions = {\n  em: EntityManager\n  scope: WidgetDataScope\n  registry: AnalyticsRegistry\n  cache?: CacheStrategy\n}\n\nexport class WidgetDataService {\n  private em: EntityManager\n  private scope: WidgetDataScope\n  private registry: AnalyticsRegistry\n  private cache?: CacheStrategy\n\n  constructor(options: WidgetDataServiceOptions) {\n    this.em = options.em\n    this.scope = options.scope\n    this.registry = options.registry\n    this.cache = options.cache\n  }\n\n  private buildCacheKey(request: WidgetDataRequest): string {\n    const hash = createHash('sha256')\n    hash.update(JSON.stringify({ request, scope: this.scope }))\n    return `widget-data:${hash.digest('hex').slice(0, 16)}`\n  }\n\n  private getCacheTags(entityType: string): string[] {\n    return ['widget-data', `widget-data:${entityType}`]\n  }\n\n  async fetchWidgetData(request: WidgetDataRequest): Promise<WidgetDataResponse> {\n    this.validateRequest(request)\n\n    if (this.cache) {\n      const cacheKey = this.buildCacheKey(request)\n      try {\n        const cached = await this.cache.get(cacheKey)\n        if (cached && typeof cached === 'object' && 'value' in (cached as object)) {\n          return cached as WidgetDataResponse\n        }\n      } catch {\n      }\n    }\n\n    const now = new Date()\n    let dateRangeResolved: { start: Date; end: Date } | undefined\n    let comparisonRange: { start: Date; end: Date } | undefined\n\n    if (request.dateRange) {\n      dateRangeResolved = resolveDateRange(request.dateRange.preset, now)\n      if (request.comparison) {\n        comparisonRange = getPreviousPeriod(dateRangeResolved, request.dateRange.preset)\n      }\n    }\n\n    const shouldFetchComparison = Boolean(comparisonRange && request.dateRange)\n\n    const [mainResult, comparisonResult] = await Promise.all([\n      this.executeQuery(request, dateRangeResolved),\n      shouldFetchComparison && comparisonRange\n        ? this.executeQuery(request, comparisonRange)\n        : Promise.resolve<{ value: number | null; data: WidgetDataItem[] } | undefined>(undefined),\n    ])\n\n    const response: WidgetDataResponse = {\n      value: mainResult.value,\n      data: mainResult.data,\n      metadata: {\n        fetchedAt: now.toISOString(),\n        recordCount: mainResult.data.length || (mainResult.value !== null ? 1 : 0),\n      },\n    }\n\n    if (comparisonResult && mainResult.value !== null && comparisonResult.value !== null) {\n      response.comparison = {\n        value: comparisonResult.value,\n        change: calculatePercentageChange(mainResult.value, comparisonResult.value),\n        direction: determineChangeDirection(mainResult.value, comparisonResult.value),\n      }\n    }\n\n    if (this.cache) {\n      const cacheKey = this.buildCacheKey(request)\n      const tags = this.getCacheTags(request.entityType)\n      try {\n        await this.cache.set(cacheKey, response, { ttl: WIDGET_DATA_CACHE_TTL, tags })\n        await this.cache.set(\n          WIDGET_DATA_SEGMENT_KEY,\n          { updatedAt: response.metadata.fetchedAt },\n          { ttl: WIDGET_DATA_SEGMENT_TTL, tags: ['widget-data'] },\n        )\n      } catch {\n      }\n    }\n\n    return response\n  }\n\n  private validateRequest(request: WidgetDataRequest): void {\n    if (!this.registry.isValidEntityType(request.entityType)) {\n      throw new WidgetDataValidationError(`Invalid entity type: ${request.entityType}`)\n    }\n\n    if (!request.metric?.field || !request.metric?.aggregate) {\n      throw new WidgetDataValidationError('Metric field and aggregate are required')\n    }\n\n    const metricMapping = this.registry.getFieldMapping(request.entityType, request.metric.field)\n    if (!metricMapping) {\n      throw new WidgetDataValidationError(\n        `Invalid metric field: ${request.metric.field} for entity type: ${request.entityType}`\n      )\n    }\n\n    const validAggregates: AggregateFunction[] = ['count', 'sum', 'avg', 'min', 'max']\n    if (!validAggregates.includes(request.metric.aggregate)) {\n      throw new WidgetDataValidationError(`Invalid aggregate function: ${request.metric.aggregate}`)\n    }\n\n    if (request.dateRange && !isValidDateRangePreset(request.dateRange.preset)) {\n      throw new WidgetDataValidationError(`Invalid date range preset: ${request.dateRange.preset}`)\n    }\n\n    if (request.groupBy) {\n      const groupMapping = this.registry.getFieldMapping(request.entityType, request.groupBy.field)\n      if (!groupMapping) {\n        const [baseField] = request.groupBy.field.split('.')\n        const baseMapping = this.registry.getFieldMapping(request.entityType, baseField)\n        if (!baseMapping || baseMapping.type !== 'jsonb') {\n          throw new WidgetDataValidationError(`Invalid groupBy field: ${request.groupBy.field}`)\n        }\n      }\n    }\n  }\n\n  private async executeQuery(\n    request: WidgetDataRequest,\n    dateRange?: { start: Date; end: Date },\n  ): Promise<{ value: number | null; data: WidgetDataItem[] }> {\n    const query = buildAggregationQuery({\n      entityType: request.entityType,\n      metric: request.metric,\n      groupBy: request.groupBy,\n      dateRange: dateRange && request.dateRange ? { field: request.dateRange.field, ...dateRange } : undefined,\n      filters: request.filters,\n      scope: this.scope,\n      registry: this.registry,\n    })\n\n    if (!query) {\n      throw new Error('Failed to build aggregation query')\n    }\n\n    const rows = await this.em.getConnection().execute(query.sql, query.params)\n    const results = Array.isArray(rows) ? rows : []\n\n    if (request.groupBy) {\n      let data: WidgetDataItem[] = results.map((row: Record<string, unknown>) => ({\n        groupKey: row.group_key,\n        value: row.value !== null ? Number(row.value) : null,\n      }))\n\n      if (request.groupBy.resolveLabels) {\n        data = await this.resolveGroupLabels(data, request.entityType, request.groupBy.field)\n      }\n\n      const totalValue = data.reduce((sum: number, item: WidgetDataItem) => sum + (item.value ?? 0), 0)\n      return { value: totalValue, data }\n    }\n\n    const singleValue = results[0]?.value !== undefined ? Number(results[0].value) : null\n    return { value: singleValue, data: [] }\n  }\n\n  private async resolveGroupLabels(\n    data: WidgetDataItem[],\n    entityType: string,\n    groupByField: string,\n  ): Promise<WidgetDataItem[]> {\n    const config = this.registry.getLabelResolverConfig(entityType, groupByField)\n\n    if (!config) {\n      return data.map((item) => ({\n        ...item,\n        groupLabel: item.groupKey != null && item.groupKey !== '' ? String(item.groupKey) : undefined,\n      }))\n    }\n\n    const ids = data\n      .map((item) => item.groupKey)\n      .filter((id): id is string => {\n        if (typeof id !== 'string' || id.length === 0) return false\n        return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)\n      })\n\n    if (ids.length === 0) {\n      return data.map((item) => ({ ...item, groupLabel: undefined }))\n    }\n\n    const uniqueIds = [...new Set(ids)]\n\n    assertSafeIdentifier(config.table, 'table name')\n    assertSafeIdentifier(config.idColumn, 'id column')\n    assertSafeIdentifier(config.labelColumn, 'label column')\n\n    const meta = this.resolveEntityMetadata(config.table)\n    const idProp = meta ? this.resolveEntityPropertyName(meta, config.idColumn) : null\n    const labelProp = meta ? this.resolveEntityPropertyName(meta, config.labelColumn) : null\n    const tenantProp = meta\n      ? (this.resolveEntityPropertyName(meta, 'tenant_id') ?? this.resolveEntityPropertyName(meta, 'tenantId'))\n      : null\n    const organizationProp = meta\n      ? (this.resolveEntityPropertyName(meta, 'organization_id') ?? this.resolveEntityPropertyName(meta, 'organizationId'))\n      : null\n    const entityName = meta ? ((meta as any).class ?? meta.className ?? meta.name) : null\n\n    if (meta && idProp && labelProp && tenantProp && entityName) {\n      const where: Record<string, unknown> = {\n        [idProp]: { $in: uniqueIds },\n        [tenantProp]: this.scope.tenantId,\n      }\n      if (organizationProp && this.scope.organizationIds && this.scope.organizationIds.length > 0) {\n        where[organizationProp] = { $in: this.scope.organizationIds }\n      }\n\n      try {\n        const records = await findWithDecryption(\n          this.em,\n          entityName,\n          where,\n          { fields: [idProp, labelProp, tenantProp, organizationProp].filter(Boolean) },\n          { tenantId: this.scope.tenantId, organizationId: this.resolveOrganizationId() },\n        )\n\n        const encryptionService = resolveTenantEncryptionService(this.em as any)\n        const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null\n        let hasEncryptedLabels = false\n        let hasDecryptedLabels = false\n\n        const labelMap = new Map<string, string>()\n        for (const record of records as Array<Record<string, unknown>>) {\n          const id = record[idProp]\n          let labelValue = record[labelProp]\n          if (typeof labelValue === 'string' && this.isEncryptedPayload(labelValue)) {\n            hasEncryptedLabels = true\n            if (dek?.key) {\n              const decrypted = this.decryptWithDek(labelValue, dek.key)\n              if (decrypted !== null) {\n                labelValue = decrypted\n                hasDecryptedLabels = true\n              }\n            }\n          } else if (labelValue != null && labelValue !== '') {\n            hasDecryptedLabels = true\n          }\n\n          if (typeof id === 'string' && labelValue != null && labelValue !== '') {\n            labelMap.set(id, String(labelValue))\n          }\n        }\n\n        if (labelMap.size > 0 && (!hasEncryptedLabels || hasDecryptedLabels)) {\n          return data.map((item) => ({\n            ...item,\n            groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)\n              ? labelMap.get(item.groupKey)!\n              : undefined,\n          }))\n        }\n      } catch {\n        // fall through to SQL resolution\n      }\n    }\n\n    const clauses = [`\"${config.idColumn}\" = ANY(?::uuid[])`, 'tenant_id = ?']\n    const params: unknown[] = [`{${uniqueIds.join(',')}}`, this.scope.tenantId]\n\n    if (this.scope.organizationIds && this.scope.organizationIds.length > 0) {\n      clauses.push('organization_id = ANY(?::uuid[])')\n      params.push(`{${this.scope.organizationIds.join(',')}}`)\n    }\n\n    const sql = `SELECT \"${config.idColumn}\" as id, \"${config.labelColumn}\" as label, tenant_id, organization_id FROM \"${config.table}\" WHERE ${clauses.join(\n      ' AND ',\n    )}`\n\n    try {\n      const labelRows = await this.em.getConnection().execute(sql, params)\n      const entityId = this.resolveEntityId(meta)\n      const encryptionService = resolveTenantEncryptionService(this.em as any)\n      const organizationId = this.resolveOrganizationId()\n      const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null\n\n      const labelMap = new Map<string, string>()\n      for (const row of labelRows as Array<{ id: string; label: string | null; tenant_id?: string | null; organization_id?: string | null }>) {\n        let labelValue = row.label\n        if (entityId && encryptionService?.isEnabled() && labelValue != null) {\n          const rowOrgId = row.organization_id ?? organizationId ?? null\n          const decrypted = await encryptionService.decryptEntityPayload(\n            entityId,\n            { [config.labelColumn]: labelValue },\n            this.scope.tenantId,\n            rowOrgId,\n          )\n          const resolved = decrypted[config.labelColumn]\n          if (typeof resolved === 'string' || typeof resolved === 'number') {\n            labelValue = String(resolved)\n          }\n        }\n\n        if (labelValue && dek?.key && this.isEncryptedPayload(labelValue)) {\n          const decrypted = this.decryptWithDek(labelValue, dek.key)\n          if (decrypted !== null) {\n            labelValue = decrypted\n          }\n        }\n\n        if (row.id && labelValue != null && labelValue !== '') {\n          labelMap.set(row.id, labelValue)\n        }\n      }\n\n      return data.map((item) => ({\n        ...item,\n        groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)\n          ? labelMap.get(item.groupKey)!\n          : undefined,\n      }))\n    } catch {\n      return data.map((item) => ({\n        ...item,\n        groupLabel: undefined,\n      }))\n    }\n  }\n\n  private resolveOrganizationId(): string | null {\n    if (!this.scope.organizationIds || this.scope.organizationIds.length !== 1) return null\n    return this.scope.organizationIds[0] ?? null\n  }\n\n  private resolveEntityMetadata(tableName: string): Record<string, any> | null {\n    const registry = (this.em as any)?.getMetadata?.()\n    if (!registry) return null\n    const entries =\n      (typeof registry.getAll === 'function' && registry.getAll()) ||\n      (Array.isArray(registry.metadata) ? registry.metadata : Object.values(registry.metadata ?? {}))\n    const metas = Array.isArray(entries) ? entries : Object.values(entries ?? {})\n    const match = metas.find((meta: any) => {\n      const table = meta?.tableName ?? meta?.collection\n      if (typeof table !== 'string') return false\n      if (table === tableName) return true\n      return table.split('.').pop() === tableName\n    })\n    return match ?? null\n  }\n\n  private resolveEntityPropertyName(meta: Record<string, any>, columnName: string): string | null {\n    const properties = meta?.properties ? Object.values(meta.properties) : []\n    for (const prop of properties as Array<Record<string, any>>) {\n      const fieldName = prop?.fieldName\n      const fieldNames = prop?.fieldNames\n      if (typeof fieldName === 'string' && fieldName === columnName) return prop?.name ?? null\n      if (Array.isArray(fieldNames) && fieldNames.includes(columnName)) return prop?.name ?? null\n      if (prop?.name === columnName) return prop?.name ?? null\n    }\n    return null\n  }\n\n  private resolveEntityId(meta: Record<string, any> | null): string | null {\n    if (!meta) return null\n    try {\n      return resolveEntityIdFromMetadata(meta as any)\n    } catch {\n      return null\n    }\n  }\n\n  private isEncryptedPayload(value: string): boolean {\n    const parts = value.split(':')\n    return parts.length === 4 && parts[3] === 'v1'\n  }\n\n  private decryptWithDek(value: string, dek: string): string | null {\n    const first = decryptWithAesGcm(value, dek)\n    if (first === null) return null\n    if (!this.isEncryptedPayload(first)) return first\n    return decryptWithAesGcm(first, dek) ?? first\n  }\n}\n\nexport function createWidgetDataService(\n  em: EntityManager,\n  scope: WidgetDataScope,\n  registry: AnalyticsRegistry,\n  cache?: CacheStrategy,\n): WidgetDataService {\n  return new WidgetDataService({ em, scope, registry, cache })\n}\n"],
+  "mappings": "AAEA,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAClC,SAAS,sCAAsC;AAC/C,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,OACK;AAGP,MAAM,wBAAwB;AAC9B,MAAM,0BAA0B;AAChC,MAAM,0BAA0B;AAEhC,MAAM,0BAA0B;AAEzB,MAAM,kCAAkC,MAAM;AAAA,EACnD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,qBAAqB,OAAe,MAAoB;AAC/D,MAAI,CAAC,wBAAwB,KAAK,KAAK,GAAG;AACxC,UAAM,IAAI,MAAM,WAAW,IAAI,KAAK,KAAK,EAAE;AAAA,EAC7C;AACF;AA4DO,MAAM,kBAAkB;AAAA,EAM7B,YAAY,SAAmC;AAC7C,SAAK,KAAK,QAAQ;AAClB,SAAK,QAAQ,QAAQ;AACrB,SAAK,WAAW,QAAQ;AACxB,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEQ,cAAc,SAAoC;AACxD,UAAM,OAAO,WAAW,QAAQ;AAChC,SAAK,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,KAAK,MAAM,CAAC,CAAC;AAC1D,WAAO,eAAe,KAAK,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,EACvD;AAAA,EAEQ,aAAa,YAA8B;AACjD,WAAO,CAAC,eAAe,eAAe,UAAU,EAAE;AAAA,EACpD;AAAA,EAEA,MAAM,gBAAgB,SAAyD;AAC7E,SAAK,gBAAgB,OAAO;AAE5B,QAAI,KAAK,OAAO;AACd,YAAM,WAAW,KAAK,cAAc,OAAO;AAC3C,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,YAAI,UAAU,OAAO,WAAW,YAAY,WAAY,QAAmB;AACzE,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI;AACJ,QAAI;AAEJ,QAAI,QAAQ,WAAW;AACrB,0BAAoB,iBAAiB,QAAQ,UAAU,QAAQ,GAAG;AAClE,UAAI,QAAQ,YAAY;AACtB,0BAAkB,kBAAkB,mBAAmB,QAAQ,UAAU,MAAM;AAAA,MACjF;AAAA,IACF;AAEA,UAAM,wBAAwB,QAAQ,mBAAmB,QAAQ,SAAS;AAE1E,UAAM,CAAC,YAAY,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvD,KAAK,aAAa,SAAS,iBAAiB;AAAA,MAC5C,yBAAyB,kBACrB,KAAK,aAAa,SAAS,eAAe,IAC1C,QAAQ,QAAsE,MAAS;AAAA,IAC7F,CAAC;AAED,UAAM,WAA+B;AAAA,MACnC,OAAO,WAAW;AAAA,MAClB,MAAM,WAAW;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,IAAI,YAAY;AAAA,QAC3B,aAAa,WAAW,KAAK,WAAW,WAAW,UAAU,OAAO,IAAI;AAAA,MAC1E;AAAA,IACF;AAEA,QAAI,oBAAoB,WAAW,UAAU,QAAQ,iBAAiB,UAAU,MAAM;AACpF,eAAS,aAAa;AAAA,QACpB,OAAO,iBAAiB;AAAA,QACxB,QAAQ,0BAA0B,WAAW,OAAO,iBAAiB,KAAK;AAAA,QAC1E,WAAW,yBAAyB,WAAW,OAAO,iBAAiB,KAAK;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,KAAK,OAAO;AACd,YAAM,WAAW,KAAK,cAAc,OAAO;AAC3C,YAAM,OAAO,KAAK,aAAa,QAAQ,UAAU;AACjD,UAAI;AACF,cAAM,KAAK,MAAM,IAAI,UAAU,UAAU,EAAE,KAAK,uBAAuB,KAAK,CAAC;AAC7E,cAAM,KAAK,MAAM;AAAA,UACf;AAAA,UACA,EAAE,WAAW,SAAS,SAAS,UAAU;AAAA,UACzC,EAAE,KAAK,yBAAyB,MAAM,CAAC,aAAa,EAAE;AAAA,QACxD;AAAA,MACF,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,SAAkC;AACxD,QAAI,CAAC,KAAK,SAAS,kBAAkB,QAAQ,UAAU,GAAG;AACxD,YAAM,IAAI,0BAA0B,wBAAwB,QAAQ,UAAU,EAAE;AAAA,IAClF;AAEA,QAAI,CAAC,QAAQ,QAAQ,SAAS,CAAC,QAAQ,QAAQ,WAAW;AACxD,YAAM,IAAI,0BAA0B,yCAAyC;AAAA,IAC/E;AAEA,UAAM,gBAAgB,KAAK,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,OAAO,KAAK;AAC5F,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR,yBAAyB,QAAQ,OAAO,KAAK,qBAAqB,QAAQ,UAAU;AAAA,MACtF;AAAA,IACF;AAEA,UAAM,kBAAuC,CAAC,SAAS,OAAO,OAAO,OAAO,KAAK;AACjF,QAAI,CAAC,gBAAgB,SAAS,QAAQ,OAAO,SAAS,GAAG;AACvD,YAAM,IAAI,0BAA0B,+BAA+B,QAAQ,OAAO,SAAS,EAAE;AAAA,IAC/F;AAEA,QAAI,QAAQ,aAAa,CAAC,uBAAuB,QAAQ,UAAU,MAAM,GAAG;AAC1E,YAAM,IAAI,0BAA0B,8BAA8B,QAAQ,UAAU,MAAM,EAAE;AAAA,IAC9F;AAEA,QAAI,QAAQ,SAAS;AACnB,YAAM,eAAe,KAAK,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,QAAQ,KAAK;AAC5F,UAAI,CAAC,cAAc;AACjB,cAAM,CAAC,SAAS,IAAI,QAAQ,QAAQ,MAAM,MAAM,GAAG;AACnD,cAAM,cAAc,KAAK,SAAS,gBAAgB,QAAQ,YAAY,SAAS;AAC/E,YAAI,CAAC,eAAe,YAAY,SAAS,SAAS;AAChD,gBAAM,IAAI,0BAA0B,0BAA0B,QAAQ,QAAQ,KAAK,EAAE;AAAA,QACvF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,aACZ,SACA,WAC2D;AAC3D,UAAM,QAAQ,sBAAsB;AAAA,MAClC,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,WAAW,aAAa,QAAQ,YAAY,EAAE,OAAO,QAAQ,UAAU,OAAO,GAAG,UAAU,IAAI;AAAA,MAC/F,SAAS,QAAQ;AAAA,MACjB,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,OAAO,MAAM,KAAK,GAAG,cAAc,EAAE,QAAQ,MAAM,KAAK,MAAM,MAAM;AAC1E,UAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAE9C,QAAI,QAAQ,SAAS;AACnB,UAAI,OAAyB,QAAQ,IAAI,CAAC,SAAkC;AAAA,QAC1E,UAAU,IAAI;AAAA,QACd,OAAO,IAAI,UAAU,OAAO,OAAO,IAAI,KAAK,IAAI;AAAA,MAClD,EAAE;AAEF,UAAI,QAAQ,QAAQ,eAAe;AACjC,eAAO,MAAM,KAAK,mBAAmB,MAAM,QAAQ,YAAY,QAAQ,QAAQ,KAAK;AAAA,MACtF;AAEA,YAAM,aAAa,KAAK,OAAO,CAAC,KAAa,SAAyB,OAAO,KAAK,SAAS,IAAI,CAAC;AAChG,aAAO,EAAE,OAAO,YAAY,KAAK;AAAA,IACnC;AAEA,UAAM,cAAc,QAAQ,CAAC,GAAG,UAAU,SAAY,OAAO,QAAQ,CAAC,EAAE,KAAK,IAAI;AACjF,WAAO,EAAE,OAAO,aAAa,MAAM,CAAC,EAAE;AAAA,EACxC;AAAA,EAEA,MAAc,mBACZ,MACA,YACA,cAC2B;AAC3B,UAAM,SAAS,KAAK,SAAS,uBAAuB,YAAY,YAAY;AAE5E,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,IAAI,CAAC,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,YAAY,KAAK,YAAY,QAAQ,KAAK,aAAa,KAAK,OAAO,KAAK,QAAQ,IAAI;AAAA,MACtF,EAAE;AAAA,IACJ;AAEA,UAAM,MAAM,KACT,IAAI,CAAC,SAAS,KAAK,QAAQ,EAC3B,OAAO,CAAC,OAAqB;AAC5B,UAAI,OAAO,OAAO,YAAY,GAAG,WAAW,EAAG,QAAO;AACtD,aAAO,kEAAkE,KAAK,EAAE;AAAA,IAClF,CAAC;AAEH,QAAI,IAAI,WAAW,GAAG;AACpB,aAAO,KAAK,IAAI,CAAC,UAAU,EAAE,GAAG,MAAM,YAAY,OAAU,EAAE;AAAA,IAChE;AAEA,UAAM,YAAY,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AAElC,yBAAqB,OAAO,OAAO,YAAY;AAC/C,yBAAqB,OAAO,UAAU,WAAW;AACjD,yBAAqB,OAAO,aAAa,cAAc;AAEvD,UAAM,OAAO,KAAK,sBAAsB,OAAO,KAAK;AACpD,UAAM,SAAS,OAAO,KAAK,0BAA0B,MAAM,OAAO,QAAQ,IAAI;AAC9E,UAAM,YAAY,OAAO,KAAK,0BAA0B,MAAM,OAAO,WAAW,IAAI;AACpF,UAAM,aAAa,OACd,KAAK,0BAA0B,MAAM,WAAW,KAAK,KAAK,0BAA0B,MAAM,UAAU,IACrG;AACJ,UAAM,mBAAmB,OACpB,KAAK,0BAA0B,MAAM,iBAAiB,KAAK,KAAK,0BAA0B,MAAM,gBAAgB,IACjH;AACJ,UAAM,aAAa,OAAS,KAAa,SAAS,KAAK,aAAa,KAAK,OAAQ;AAEjF,QAAI,QAAQ,UAAU,aAAa,cAAc,YAAY;AAC3D,YAAM,QAAiC;AAAA,QACrC,CAAC,MAAM,GAAG,EAAE,KAAK,UAAU;AAAA,QAC3B,CAAC,UAAU,GAAG,KAAK,MAAM;AAAA,MAC3B;AACA,UAAI,oBAAoB,KAAK,MAAM,mBAAmB,KAAK,MAAM,gBAAgB,SAAS,GAAG;AAC3F,cAAM,gBAAgB,IAAI,EAAE,KAAK,KAAK,MAAM,gBAAgB;AAAA,MAC9D;AAEA,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,CAAC,QAAQ,WAAW,YAAY,gBAAgB,EAAE,OAAO,OAAO,EAAE;AAAA,UAC5E,EAAE,UAAU,KAAK,MAAM,UAAU,gBAAgB,KAAK,sBAAsB,EAAE;AAAA,QAChF;AAEA,cAAM,oBAAoB,+BAA+B,KAAK,EAAS;AACvE,cAAM,MAAM,mBAAmB,UAAU,IAAI,MAAM,kBAAkB,OAAO,KAAK,MAAM,QAAQ,IAAI;AACnG,YAAI,qBAAqB;AACzB,YAAI,qBAAqB;AAEzB,cAAM,WAAW,oBAAI,IAAoB;AACzC,mBAAW,UAAU,SAA2C;AAC9D,gBAAM,KAAK,OAAO,MAAM;AACxB,cAAI,aAAa,OAAO,SAAS;AACjC,cAAI,OAAO,eAAe,YAAY,KAAK,mBAAmB,UAAU,GAAG;AACzE,iCAAqB;AACrB,gBAAI,KAAK,KAAK;AACZ,oBAAM,YAAY,KAAK,eAAe,YAAY,IAAI,GAAG;AACzD,kBAAI,cAAc,MAAM;AACtB,6BAAa;AACb,qCAAqB;AAAA,cACvB;AAAA,YACF;AAAA,UACF,WAAW,cAAc,QAAQ,eAAe,IAAI;AAClD,iCAAqB;AAAA,UACvB;AAEA,cAAI,OAAO,OAAO,YAAY,cAAc,QAAQ,eAAe,IAAI;AACrE,qBAAS,IAAI,IAAI,OAAO,UAAU,CAAC;AAAA,UACrC;AAAA,QACF;AAEA,YAAI,SAAS,OAAO,MAAM,CAAC,sBAAsB,qBAAqB;AACpE,iBAAO,KAAK,IAAI,CAAC,UAAU;AAAA,YACzB,GAAG;AAAA,YACH,YAAY,OAAO,KAAK,aAAa,YAAY,SAAS,IAAI,KAAK,QAAQ,IACvE,SAAS,IAAI,KAAK,QAAQ,IAC1B;AAAA,UACN,EAAE;AAAA,QACJ;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,UAAU,CAAC,IAAI,OAAO,QAAQ,sBAAsB,eAAe;AACzE,UAAM,SAAoB,CAAC,IAAI,UAAU,KAAK,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ;AAE1E,QAAI,KAAK,MAAM,mBAAmB,KAAK,MAAM,gBAAgB,SAAS,GAAG;AACvE,cAAQ,KAAK,kCAAkC;AAC/C,aAAO,KAAK,IAAI,KAAK,MAAM,gBAAgB,KAAK,GAAG,CAAC,GAAG;AAAA,IACzD;AAEA,UAAM,MAAM,WAAW,OAAO,QAAQ,aAAa,OAAO,WAAW,gDAAgD,OAAO,KAAK,WAAW,QAAQ;AAAA,MAClJ;AAAA,IACF,CAAC;AAED,QAAI;AACF,YAAM,YAAY,MAAM,KAAK,GAAG,cAAc,EAAE,QAAQ,KAAK,MAAM;AACnE,YAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,YAAM,oBAAoB,+BAA+B,KAAK,EAAS;AACvE,YAAM,iBAAiB,KAAK,sBAAsB;AAClD,YAAM,MAAM,mBAAmB,UAAU,IAAI,MAAM,kBAAkB,OAAO,KAAK,MAAM,QAAQ,IAAI;AAEnG,YAAM,WAAW,oBAAI,IAAoB;AACzC,iBAAW,OAAO,WAAsH;AACtI,YAAI,aAAa,IAAI;AACrB,YAAI,YAAY,mBAAmB,UAAU,KAAK,cAAc,MAAM;AACpE,gBAAM,WAAW,IAAI,mBAAmB,kBAAkB;AAC1D,gBAAM,YAAY,MAAM,kBAAkB;AAAA,YACxC;AAAA,YACA,EAAE,CAAC,OAAO,WAAW,GAAG,WAAW;AAAA,YACnC,KAAK,MAAM;AAAA,YACX;AAAA,UACF;AACA,gBAAM,WAAW,UAAU,OAAO,WAAW;AAC7C,cAAI,OAAO,aAAa,YAAY,OAAO,aAAa,UAAU;AAChE,yBAAa,OAAO,QAAQ;AAAA,UAC9B;AAAA,QACF;AAEA,YAAI,cAAc,KAAK,OAAO,KAAK,mBAAmB,UAAU,GAAG;AACjE,gBAAM,YAAY,KAAK,eAAe,YAAY,IAAI,GAAG;AACzD,cAAI,cAAc,MAAM;AACtB,yBAAa;AAAA,UACf;AAAA,QACF;AAEA,YAAI,IAAI,MAAM,cAAc,QAAQ,eAAe,IAAI;AACrD,mBAAS,IAAI,IAAI,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAEA,aAAO,KAAK,IAAI,CAAC,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,YAAY,OAAO,KAAK,aAAa,YAAY,SAAS,IAAI,KAAK,QAAQ,IACvE,SAAS,IAAI,KAAK,QAAQ,IAC1B;AAAA,MACN,EAAE;AAAA,IACJ,QAAQ;AACN,aAAO,KAAK,IAAI,CAAC,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,YAAY;AAAA,MACd,EAAE;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,wBAAuC;AAC7C,QAAI,CAAC,KAAK,MAAM,mBAAmB,KAAK,MAAM,gBAAgB,WAAW,EAAG,QAAO;AACnF,WAAO,KAAK,MAAM,gBAAgB,CAAC,KAAK;AAAA,EAC1C;AAAA,EAEQ,sBAAsB,WAA+C;AAC3E,UAAM,WAAY,KAAK,IAAY,cAAc;AACjD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,UACH,OAAO,SAAS,WAAW,cAAc,SAAS,OAAO,MACzD,MAAM,QAAQ,SAAS,QAAQ,IAAI,SAAS,WAAW,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC;AAC/F,UAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,UAAU,OAAO,OAAO,WAAW,CAAC,CAAC;AAC5E,UAAM,QAAQ,MAAM,KAAK,CAAC,SAAc;AACtC,YAAM,QAAQ,MAAM,aAAa,MAAM;AACvC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAI,UAAU,UAAW,QAAO;AAChC,aAAO,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM;AAAA,IACpC,CAAC;AACD,WAAO,SAAS;AAAA,EAClB;AAAA,EAEQ,0BAA0B,MAA2B,YAAmC;AAC9F,UAAM,aAAa,MAAM,aAAa,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC;AACxE,eAAW,QAAQ,YAA0C;AAC3D,YAAM,YAAY,MAAM;AACxB,YAAM,aAAa,MAAM;AACzB,UAAI,OAAO,cAAc,YAAY,cAAc,WAAY,QAAO,MAAM,QAAQ;AACpF,UAAI,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,UAAU,EAAG,QAAO,MAAM,QAAQ;AACvF,UAAI,MAAM,SAAS,WAAY,QAAO,MAAM,QAAQ;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAiD;AACvE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI;AACF,aAAO,4BAA4B,IAAW;AAAA,IAChD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,mBAAmB,OAAwB;AACjD,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,WAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAAA,EAC5C;AAAA,EAEQ,eAAe,OAAe,KAA4B;AAChE,UAAM,QAAQ,kBAAkB,OAAO,GAAG;AAC1C,QAAI,UAAU,KAAM,QAAO;AAC3B,QAAI,CAAC,KAAK,mBAAmB,KAAK,EAAG,QAAO;AAC5C,WAAO,kBAAkB,OAAO,GAAG,KAAK;AAAA,EAC1C;AACF;AAEO,SAAS,wBACd,IACA,OACA,UACA,OACmB;AACnB,SAAO,IAAI,kBAAkB,EAAE,IAAI,OAAO,UAAU,MAAM,CAAC;AAC7D;",
   "names": []
 }

package/dist/modules/dictionaries/api/[dictionaryId]/entries/[entryId]/route.js

@@ -1,10 +1,14 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { Dictionary, DictionaryEntry } from "@open-mercato/core/modules/dictionaries/data/entities";
-import { resolveDictionariesRouteContext } from "@open-mercato/core/modules/dictionaries/api/context";
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from "@open-mercato/core/modules/dictionaries/api/context";
 import { updateDictionaryEntrySchema } from "@open-mercato/core/modules/dictionaries/data/validators";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import {
@@ -70,6 +74,21 @@ async function PATCH(req, ctx) {
     });
     const rawBody = await req.json().catch(() => ({}));
     const payload = updateDictionaryEntrySchema.parse(rawBody);
+    const guardUserId = resolveDictionaryActorId(context.auth);
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: "dictionaries.entry",
+      resourceId: entry.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = context.container.resolve("commandBus");
     const input = { ...payload, id: entryId };
     const { result, logEntry } = await commandBus.execute("dictionaries.entries.update", {
@@ -81,6 +100,19 @@ async function PATCH(req, ctx) {
     if (!updatedEntryId) {
       throw new CrudHttpError(500, { error: context.translate("dictionaries.errors.entry_update_failed", "Failed to update dictionary entry") });
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: "dictionaries.entry",
+        resourceId: updatedEntryId,
+        operation: "update",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const updated = await findOneWithDecryption(
       context.em.fork(),
       DictionaryEntry,
@@ -134,11 +166,39 @@ async function DELETE(req, ctx) {
     });
     const dictionary = await loadDictionary(context, dictionaryId);
     const entry = await loadEntry(context, dictionary, entryId);
+    const guardUserId = resolveDictionaryActorId(context.auth);
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: "dictionaries.entry",
+      resourceId: entry.id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = context.container.resolve("commandBus");
     const { logEntry } = await commandBus.execute("dictionaries.entries.delete", {
       input: { body: { id: entry.id } },
       ctx: context.ctx
     });
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: "dictionaries.entry",
+        resourceId: entry.id,
+        operation: "delete",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const response = NextResponse.json({ ok: true });
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/dist/modules/dictionaries/api/[dictionaryId]/entries/[entryId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/dictionaries/api/%5BdictionaryId%5D/entries/%5BentryId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { updateDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  dictionaryEntryParamsSchema,\n  dictionaryEntryResponseSchema,\n  dictionariesErrorSchema,\n  dictionariesOkSchema,\n  dictionariesTag,\n  updateDictionaryEntrySchema as updateEntryDocSchema,\n} from '../../../openapi'\nconst paramsSchema = z.object({\n  dictionaryId: z.string().uuid(),\n  entryId: z.string().uuid(),\n})\n\nasync function loadDictionary(context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>, id: string) {\n  if (!context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const dictionary = await context.em.findOne(Dictionary, {\n    id,\n    organizationId: context.organizationId,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  })\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nasync function loadEntry(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  dictionary: Dictionary,\n  entryId: string,\n) {\n  const entry = await context.em.findOne(DictionaryEntry, {\n    id: entryId,\n    dictionary,\n    organizationId: dictionary.organizationId,\n    tenantId: context.tenantId,\n  })\n  if (!entry) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.entry_not_found', 'Dictionary entry not found') })\n  }\n  return entry\n}\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { dictionaryId?: string; entryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    if (!context.auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const { dictionaryId, entryId } = paramsSchema.parse({\n      dictionaryId: ctx.params?.dictionaryId,\n      entryId: ctx.params?.entryId,\n    })\n    const dictionary = await loadDictionary(context, dictionaryId)\n    const entry = await loadEntry(context, dictionary, entryId)\n    enforceCommandOptimisticLock({\n      resourceKind: 'dictionaries.entry',\n      resourceId: entry.id,\n      current: entry.updatedAt ?? null,\n      request: req,\n    })\n    const rawBody = await req.json().catch(() => ({}))\n    const payload = updateDictionaryEntrySchema.parse(rawBody)\n    // These nested routes don't use the CRUD factory, so invoke the command bus explicitly.\n    const commandBus = (context.container.resolve('commandBus') as CommandBus)\n    const input = { ...(payload as Record<string, unknown>), id: entryId }\n    const { result, logEntry } = await commandBus.execute('dictionaries.entries.update', {\n      input,\n      ctx: context.ctx,\n    })\n    const updateResult = (result ?? {}) as { entryId?: string | null }\n    const updatedEntryId = typeof updateResult.entryId === 'string' ? updateResult.entryId : null\n    if (!updatedEntryId) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_update_failed', 'Failed to update dictionary entry') })\n    }\n    const updated = await findOneWithDecryption(\n      context.em.fork(),\n      DictionaryEntry,\n      updatedEntryId,\n      { populate: ['dictionary'] },\n      { tenantId: context.auth.tenantId ?? null, organizationId: context.auth.orgId ?? null },\n    )\n    if (!updated) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_update_failed', 'Failed to update dictionary entry') })\n    }\n    const response = NextResponse.json({\n      id: updated.id,\n      value: updated.value,\n      label: updated.label,\n      color: updated.color,\n      icon: updated.icon,\n      position: updated.position ?? 0,\n      isDefault: updated.isDefault ?? false,\n      createdAt: updated.createdAt,\n      updatedAt: updated.updatedAt,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'dictionaries.entry',\n          resourceId: updatedEntryId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries/:entryId.PATCH] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to update dictionary entry' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { dictionaryId?: string; entryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId, entryId } = paramsSchema.parse({\n      dictionaryId: ctx.params?.dictionaryId,\n      entryId: ctx.params?.entryId,\n    })\n    const dictionary = await loadDictionary(context, dictionaryId)\n    const entry = await loadEntry(context, dictionary, entryId)\n    const commandBus = (context.container.resolve('commandBus') as CommandBus)\n    const { logEntry } = await commandBus.execute('dictionaries.entries.delete', {\n      input: { body: { id: entry.id } },\n      ctx: context.ctx,\n    })\n    const response = NextResponse.json({ ok: true })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'dictionaries.entry',\n          resourceId: entry.id,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries/:entryId.DELETE] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to delete dictionary entry' }, { status: 500 })\n  }\n}\n\nconst dictionaryEntryPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update dictionary entry',\n  description: 'Updates the specified dictionary entry using the command bus pipeline.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: updateEntryDocSchema,\n    description: 'Fields to update on the dictionary entry.',\n  },\n  responses: [\n    { status: 200, description: 'Dictionary entry updated.', schema: dictionaryEntryResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary or entry not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to update entry', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryEntryDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete dictionary entry',\n  description: 'Deletes the specified dictionary entry via the command bus.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Entry deleted.', schema: dictionariesOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary or entry not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to delete entry', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary entry resource',\n  pathParams: dictionaryEntryParamsSchema,\n  methods: {\n    PATCH: dictionaryEntryPatchDoc,\n    DELETE: dictionaryEntryDeleteDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,YAAY,uBAAuB;AAC5C,SAAS,uCAAuC;AAChD,SAAS,mCAAmC;AAC5C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oCAAoC;AAE7C,SAAS,kCAAkC;AAE3C,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,+BAA+B;AAAA,OAC1B;AACP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAED,eAAe,eAAe,SAAsE,IAAY;AAC9G,MAAI,CAAC,QAAQ,gBAAgB;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,IACtD;AAAA,IACA,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEA,eAAe,UACb,SACA,YACA,SACA;AACA,QAAM,QAAQ,MAAM,QAAQ,GAAG,QAAQ,iBAAiB;AAAA,IACtD,IAAI;AAAA,IACJ;AAAA,IACA,gBAAgB,WAAW;AAAA,IAC3B,UAAU,QAAQ;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,4BAA4B,EAAE,CAAC;AAAA,EAChI;AACA,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEA,eAAsB,MAAM,KAAc,KAA+D;AACvG,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,EAAE,cAAc,QAAQ,IAAI,aAAa,MAAM;AAAA,MACnD,cAAc,IAAI,QAAQ;AAAA,MAC1B,SAAS,IAAI,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAC7D,UAAM,QAAQ,MAAM,UAAU,SAAS,YAAY,OAAO;AAC1D,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM,aAAa;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AACD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,UAAU,4BAA4B,MAAM,OAAO;AAEzD,UAAM,aAAc,QAAQ,UAAU,QAAQ,YAAY;AAC1D,UAAM,QAAQ,EAAE,GAAI,SAAqC,IAAI,QAAQ;AACrE,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MACnF;AAAA,MACA,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,UAAM,eAAgB,UAAU,CAAC;AACjC,UAAM,iBAAiB,OAAO,aAAa,YAAY,WAAW,aAAa,UAAU;AACzF,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ,GAAG,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,EAAE,UAAU,CAAC,YAAY,EAAE;AAAA,MAC3B,EAAE,UAAU,QAAQ,KAAK,YAAY,MAAM,gBAAgB,QAAQ,KAAK,SAAS,KAAK;AAAA,IACxF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,QAAQ;AAAA,MACZ,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,MAChC,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY;AAAA,UACZ,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,8DAA8D,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,eAAsB,OAAO,KAAc,KAA+D;AACxG,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,cAAc,QAAQ,IAAI,aAAa,MAAM;AAAA,MACnD,cAAc,IAAI,QAAQ;AAAA,MAC1B,SAAS,IAAI,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAC7D,UAAM,QAAQ,MAAM,UAAU,SAAS,YAAY,OAAO;AAC1D,UAAM,aAAc,QAAQ,UAAU,QAAQ,YAAY;AAC1D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MAC3E,OAAO,EAAE,MAAM,EAAE,IAAI,MAAM,GAAG,EAAE;AAAA,MAChC,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAC/C,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,MAAM;AAAA,UAClB,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,+DAA+D,GAAG;AAChF,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,MAAM,0BAA4C;AAAA,EAChD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,8BAA8B;AAAA,EACjG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,wBAAwB;AAAA,EACxF;AACF;AAEA,MAAM,2BAA6C;AAAA,EACjD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,qBAAqB;AAAA,EAC7E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,wBAAwB;AAAA,EACxF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { updateDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  dictionaryEntryParamsSchema,\n  dictionaryEntryResponseSchema,\n  dictionariesErrorSchema,\n  dictionariesOkSchema,\n  dictionariesTag,\n  updateDictionaryEntrySchema as updateEntryDocSchema,\n} from '../../../openapi'\nconst paramsSchema = z.object({\n  dictionaryId: z.string().uuid(),\n  entryId: z.string().uuid(),\n})\n\nasync function loadDictionary(context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>, id: string) {\n  if (!context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const dictionary = await context.em.findOne(Dictionary, {\n    id,\n    organizationId: context.organizationId,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  })\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nasync function loadEntry(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  dictionary: Dictionary,\n  entryId: string,\n) {\n  const entry = await context.em.findOne(DictionaryEntry, {\n    id: entryId,\n    dictionary,\n    organizationId: dictionary.organizationId,\n    tenantId: context.tenantId,\n  })\n  if (!entry) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.entry_not_found', 'Dictionary entry not found') })\n  }\n  return entry\n}\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { dictionaryId?: string; entryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    if (!context.auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const { dictionaryId, entryId } = paramsSchema.parse({\n      dictionaryId: ctx.params?.dictionaryId,\n      entryId: ctx.params?.entryId,\n    })\n    const dictionary = await loadDictionary(context, dictionaryId)\n    const entry = await loadEntry(context, dictionary, entryId)\n    enforceCommandOptimisticLock({\n      resourceKind: 'dictionaries.entry',\n      resourceId: entry.id,\n      current: entry.updatedAt ?? null,\n      request: req,\n    })\n    const rawBody = await req.json().catch(() => ({}))\n    const payload = updateDictionaryEntrySchema.parse(rawBody)\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.entry',\n      resourceId: entry.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    // These nested routes don't use the CRUD factory, so invoke the command bus explicitly.\n    const commandBus = (context.container.resolve('commandBus') as CommandBus)\n    const input = { ...(payload as Record<string, unknown>), id: entryId }\n    const { result, logEntry } = await commandBus.execute('dictionaries.entries.update', {\n      input,\n      ctx: context.ctx,\n    })\n    const updateResult = (result ?? {}) as { entryId?: string | null }\n    const updatedEntryId = typeof updateResult.entryId === 'string' ? updateResult.entryId : null\n    if (!updatedEntryId) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_update_failed', 'Failed to update dictionary entry') })\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.entry',\n        resourceId: updatedEntryId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const updated = await findOneWithDecryption(\n      context.em.fork(),\n      DictionaryEntry,\n      updatedEntryId,\n      { populate: ['dictionary'] },\n      { tenantId: context.auth.tenantId ?? null, organizationId: context.auth.orgId ?? null },\n    )\n    if (!updated) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_update_failed', 'Failed to update dictionary entry') })\n    }\n    const response = NextResponse.json({\n      id: updated.id,\n      value: updated.value,\n      label: updated.label,\n      color: updated.color,\n      icon: updated.icon,\n      position: updated.position ?? 0,\n      isDefault: updated.isDefault ?? false,\n      createdAt: updated.createdAt,\n      updatedAt: updated.updatedAt,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'dictionaries.entry',\n          resourceId: updatedEntryId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries/:entryId.PATCH] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to update dictionary entry' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { dictionaryId?: string; entryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId, entryId } = paramsSchema.parse({\n      dictionaryId: ctx.params?.dictionaryId,\n      entryId: ctx.params?.entryId,\n    })\n    const dictionary = await loadDictionary(context, dictionaryId)\n    const entry = await loadEntry(context, dictionary, entryId)\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.entry',\n      resourceId: entry.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = (context.container.resolve('commandBus') as CommandBus)\n    const { logEntry } = await commandBus.execute('dictionaries.entries.delete', {\n      input: { body: { id: entry.id } },\n      ctx: context.ctx,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.entry',\n        resourceId: entry.id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const response = NextResponse.json({ ok: true })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'dictionaries.entry',\n          resourceId: entry.id,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries/:entryId.DELETE] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to delete dictionary entry' }, { status: 500 })\n  }\n}\n\nconst dictionaryEntryPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update dictionary entry',\n  description: 'Updates the specified dictionary entry using the command bus pipeline.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: updateEntryDocSchema,\n    description: 'Fields to update on the dictionary entry.',\n  },\n  responses: [\n    { status: 200, description: 'Dictionary entry updated.', schema: dictionaryEntryResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary or entry not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to update entry', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryEntryDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete dictionary entry',\n  description: 'Deletes the specified dictionary entry via the command bus.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Entry deleted.', schema: dictionariesOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary or entry not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to delete entry', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary entry resource',\n  pathParams: dictionaryEntryParamsSchema,\n  methods: {\n    PATCH: dictionaryEntryPatchDoc,\n    DELETE: dictionaryEntryDeleteDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,YAAY,uBAAuB;AAC5C,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,mCAAmC;AAC5C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,kCAAkC;AAE3C,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,+BAA+B;AAAA,OAC1B;AACP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAED,eAAe,eAAe,SAAsE,IAAY;AAC9G,MAAI,CAAC,QAAQ,gBAAgB;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,IACtD;AAAA,IACA,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEA,eAAe,UACb,SACA,YACA,SACA;AACA,QAAM,QAAQ,MAAM,QAAQ,GAAG,QAAQ,iBAAiB;AAAA,IACtD,IAAI;AAAA,IACJ;AAAA,IACA,gBAAgB,WAAW;AAAA,IAC3B,UAAU,QAAQ;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,4BAA4B,EAAE,CAAC;AAAA,EAChI;AACA,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEA,eAAsB,MAAM,KAAc,KAA+D;AACvG,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,EAAE,cAAc,QAAQ,IAAI,aAAa,MAAM;AAAA,MACnD,cAAc,IAAI,QAAQ;AAAA,MAC1B,SAAS,IAAI,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAC7D,UAAM,QAAQ,MAAM,UAAU,SAAS,YAAY,OAAO;AAC1D,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM,aAAa;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AACD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,UAAU,4BAA4B,MAAM,OAAO;AACzD,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,QAAQ,UAAU,QAAQ,YAAY;AAC1D,UAAM,QAAQ,EAAE,GAAI,SAAqC,IAAI,QAAQ;AACrE,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MACnF;AAAA,MACA,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,UAAM,eAAgB,UAAU,CAAC;AACjC,UAAM,iBAAiB,OAAO,aAAa,YAAY,WAAW,aAAa,UAAU;AACzF,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ,GAAG,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,EAAE,UAAU,CAAC,YAAY,EAAE;AAAA,MAC3B,EAAE,UAAU,QAAQ,KAAK,YAAY,MAAM,gBAAgB,QAAQ,KAAK,SAAS,KAAK;AAAA,IACxF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,QAAQ;AAAA,MACZ,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,MAChC,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY;AAAA,UACZ,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,8DAA8D,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,eAAsB,OAAO,KAAc,KAA+D;AACxG,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,cAAc,QAAQ,IAAI,aAAa,MAAM;AAAA,MACnD,cAAc,IAAI,QAAQ;AAAA,MAC1B,SAAS,IAAI,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAC7D,UAAM,QAAQ,MAAM,UAAU,SAAS,YAAY,OAAO;AAC1D,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAc,QAAQ,UAAU,QAAQ,YAAY;AAC1D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MAC3E,OAAO,EAAE,MAAM,EAAE,IAAI,MAAM,GAAG,EAAE;AAAA,MAChC,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAC/C,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,MAAM;AAAA,UAClB,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,+DAA+D,GAAG;AAChF,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,MAAM,0BAA4C;AAAA,EAChD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,8BAA8B;AAAA,EACjG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,wBAAwB;AAAA,EACxF;AACF;AAEA,MAAM,2BAA6C;AAAA,EACjD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,qBAAqB;AAAA,EAC7E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,wBAAwB;AAAA,EACxF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/dictionaries/api/[dictionaryId]/entries/route.js

@@ -2,9 +2,13 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { runWithCacheTenant } from "@open-mercato/cache";
 import { Dictionary, DictionaryEntry } from "@open-mercato/core/modules/dictionaries/data/entities";
-import { resolveDictionariesRouteContext } from "@open-mercato/core/modules/dictionaries/api/context";
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from "@open-mercato/core/modules/dictionaries/api/context";
 import { createDictionaryEntrySchema } from "@open-mercato/core/modules/dictionaries/data/validators";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import {
   createDictionaryEntrySchema as createEntryDocSchema,
@@ -135,6 +139,21 @@ async function POST(req, ctx) {
     }
     const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId });
     const payload = createDictionaryEntrySchema.parse(await req.json().catch(() => ({})));
+    const guardUserId = resolveDictionaryActorId(context.auth);
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: DICTIONARY_ENTRY_RESOURCE,
+      resourceId: dictionaryId,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = context.container.resolve("commandBus");
     const { result, logEntry } = await commandBus.execute("dictionaries.entries.create", {
       input: { ...payload, dictionaryId },
@@ -145,6 +164,19 @@ async function POST(req, ctx) {
     if (!createdEntryId) {
       throw new CrudHttpError(500, { error: context.translate("dictionaries.errors.entry_create_failed", "Failed to create dictionary entry") });
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: DICTIONARY_ENTRY_RESOURCE,
+        resourceId: createdEntryId,
+        operation: "create",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const entry = await findOneWithDecryption(
       context.em.fork(),
       DictionaryEntry,

package/dist/modules/dictionaries/api/[dictionaryId]/entries/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/dictionaries/api/%5BdictionaryId%5D/entries/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { createDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  createDictionaryEntrySchema as createEntryDocSchema,\n  dictionaryEntryListResponseSchema,\n  dictionaryEntryResponseSchema,\n  dictionaryIdParamsSchema,\n  dictionariesErrorSchema,\n  dictionariesTag,\n} from '../../openapi'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  buildCollectionTags,\n  buildRecordTag,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport {\n  resolveDictionaryEntrySortMode,\n  sortDictionaryEntries,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\n\nconst paramsSchema = z.object({ dictionaryId: z.string().uuid() })\n\nconst DICTIONARY_ENTRY_RESOURCE = 'dictionaries.entry'\nconst DICTIONARY_DEFINITION_RESOURCE = 'dictionaries.dictionary'\nconst DICTIONARY_ENTRIES_TTL_MS = 5 * 60_000\n\nfunction buildEntriesCacheKey(params: {\n  dictionaryId: string\n  organizationId: string | null\n  sortMode: string\n}): string {\n  return `dictionaries:entries:${params.dictionaryId}:org=${params.organizationId ?? 'null'}:sort=${params.sortMode}`\n}\n\nasync function loadDictionary(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  id: string,\n  options: { allowInherited?: boolean } = {},\n) {\n  const { allowInherited = false } = options\n  if (!allowInherited && !context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const baseFilter = {\n    id,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  }\n  const filter = allowInherited\n    ? {\n        ...baseFilter,\n        ...(context.readableOrganizationIds.length\n          ? { organizationId: { $in: context.readableOrganizationIds } }\n          : {}),\n      }\n    : {\n        ...baseFilter,\n        organizationId: context.organizationId,\n      }\n  const dictionary = await context.em.findOne(Dictionary, filter)\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  POST: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function GET(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    if (!context.auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })\n    const dictionaryTenantId = dictionary.tenantId\n    const dictionaryOrgId = dictionary.organizationId ?? null\n    const sortMode = resolveDictionaryEntrySortMode(dictionary.entrySortMode)\n\n    // Dictionary CF selects hit this on every CrudForm open, so cache the\n    // decrypted+sorted options payload. The entry writes flow through the\n    // command bus (resourceKind dictionaries.entry), which already flushes the\n    // matching collection tag post-commit \u2014 no new invalidation wiring needed.\n    const cache = isCrudCacheEnabled() ? resolveCrudCache(context.container) : null\n    const cacheKey = cache\n      ? buildEntriesCacheKey({ dictionaryId, organizationId: dictionaryOrgId, sortMode })\n      : null\n\n    if (cache && cacheKey) {\n      const cached = await runWithCacheTenant(dictionaryTenantId, () => cache.get(cacheKey))\n      if (cached) {\n        return NextResponse.json(cached)\n      }\n    }\n\n    const entries = await findWithDecryption(\n      context.em,\n      DictionaryEntry,\n      {\n        dictionary,\n        organizationId: dictionary.organizationId,\n        tenantId: dictionary.tenantId,\n      },\n      {},\n      { tenantId: dictionary.tenantId, organizationId: dictionary.organizationId },\n    )\n    const sortedEntries = sortDictionaryEntries(entries, sortMode)\n\n    const payload = {\n      items: sortedEntries.map((entry) => ({\n        id: entry.id,\n        value: entry.value,\n        label: entry.label,\n        color: entry.color,\n        icon: entry.icon,\n        position: entry.position ?? 0,\n        isDefault: entry.isDefault ?? false,\n        createdAt: entry.createdAt,\n        updatedAt: entry.updatedAt,\n      })),\n    }\n\n    if (cache && cacheKey) {\n      try {\n        await runWithCacheTenant(dictionaryTenantId, () =>\n          cache.set(cacheKey, payload, {\n            ttl: DICTIONARY_ENTRIES_TTL_MS,\n            tags: [\n              ...buildCollectionTags(DICTIONARY_ENTRY_RESOURCE, dictionaryTenantId, [dictionaryOrgId]),\n              buildRecordTag(DICTIONARY_DEFINITION_RESOURCE, dictionaryTenantId, dictionaryId),\n            ],\n          }),\n        )\n      } catch {}\n    }\n\n    return NextResponse.json(payload)\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries.GET] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to load dictionary entries' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    if (!context.auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const payload = createDictionaryEntrySchema.parse(await req.json().catch(() => ({})))\n    // These nested routes do not use makeCrudRoute, so we invoke the command bus directly.\n    const commandBus = (context.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute('dictionaries.entries.create', {\n      input: { ...payload, dictionaryId },\n      ctx: context.ctx,\n    })\n    const createResult = (result ?? {}) as { entryId?: string | null }\n    const createdEntryId = typeof createResult.entryId === 'string' ? createResult.entryId : null\n    if (!createdEntryId) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_create_failed', 'Failed to create dictionary entry') })\n    }\n    const entry = await findOneWithDecryption(\n      context.em.fork(),\n      DictionaryEntry,\n      createdEntryId,\n      { populate: ['dictionary'] },\n      { tenantId: context.auth.tenantId ?? null, organizationId: context.auth.orgId ?? null },\n    )\n    if (!entry) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_create_failed', 'Failed to create dictionary entry') })\n    }\n    const response = NextResponse.json({\n      id: entry.id,\n      value: entry.value,\n      label: entry.label,\n      color: entry.color,\n      icon: entry.icon,\n      position: entry.position ?? 0,\n      isDefault: entry.isDefault ?? false,\n      createdAt: entry.createdAt,\n      updatedAt: entry.updatedAt,\n    }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'dictionaries.entry',\n          resourceId: createdEntryId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries.POST] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to create dictionary entry' }, { status: 500 })\n  }\n}\n\nconst dictionaryEntriesGetDoc: OpenApiMethodDoc = {\n  summary: 'List dictionary entries',\n  description: 'Returns entries for the specified dictionary ordered by its configured entry sort mode.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary entries.', schema: dictionaryEntryListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid parameters', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionary entries', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryEntriesPostDoc: OpenApiMethodDoc = {\n  summary: 'Create dictionary entry',\n  description: 'Creates a new entry in the specified dictionary.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: createEntryDocSchema,\n    description: 'Entry value, label, and optional presentation metadata.',\n  },\n  responses: [\n    { status: 201, description: 'Dictionary entry created.', schema: dictionaryEntryResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to create dictionary entry', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary entries collection',\n  pathParams: dictionaryIdParamsSchema,\n  methods: {\n    GET: dictionaryEntriesGetDoc,\n    POST: dictionaryEntriesPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,uCAAuC;AAChD,SAAS,mCAAmC;AAC5C,SAAS,eAAe,uBAAuB;AAE/C,SAAS,kCAAkC;AAE3C;AAAA,EACE,+BAA+B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEjE,MAAM,4BAA4B;AAClC,MAAM,iCAAiC;AACvC,MAAM,4BAA4B,IAAI;AAEtC,SAAS,qBAAqB,QAInB;AACT,SAAO,wBAAwB,OAAO,YAAY,QAAQ,OAAO,kBAAkB,MAAM,SAAS,OAAO,QAAQ;AACnH;AAEA,eAAe,eACb,SACA,IACA,UAAwC,CAAC,GACzC;AACA,QAAM,EAAE,iBAAiB,MAAM,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,QAAQ,gBAAgB;AAC9C,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,SAAS,iBACX;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,wBAAwB,SAChC,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAAA,EACP,IACA;AAAA,IACE,GAAG;AAAA,IACH,gBAAgB,QAAQ;AAAA,EAC1B;AACJ,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY,MAAM;AAC9D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,KAA6C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,cAAc,EAAE,gBAAgB,KAAK,CAAC;AACvF,UAAM,qBAAqB,WAAW;AACtC,UAAM,kBAAkB,WAAW,kBAAkB;AACrD,UAAM,WAAW,+BAA+B,WAAW,aAAa;AAMxE,UAAM,QAAQ,mBAAmB,IAAI,iBAAiB,QAAQ,SAAS,IAAI;AAC3E,UAAM,WAAW,QACb,qBAAqB,EAAE,cAAc,gBAAgB,iBAAiB,SAAS,CAAC,IAChF;AAEJ,QAAI,SAAS,UAAU;AACrB,YAAM,SAAS,MAAM,mBAAmB,oBAAoB,MAAM,MAAM,IAAI,QAAQ,CAAC;AACrF,UAAI,QAAQ;AACV,eAAO,aAAa,KAAK,MAAM;AAAA,MACjC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE;AAAA,QACA,gBAAgB,WAAW;AAAA,QAC3B,UAAU,WAAW;AAAA,MACvB;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E;AACA,UAAM,gBAAgB,sBAAsB,SAAS,QAAQ;AAE7D,UAAM,UAAU;AAAA,MACd,OAAO,cAAc,IAAI,CAAC,WAAW;AAAA,QACnC,IAAI,MAAM;AAAA,QACV,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,UAAU,MAAM,YAAY;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,QAC9B,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MACnB,EAAE;AAAA,IACJ;AAEA,QAAI,SAAS,UAAU;AACrB,UAAI;AACF,cAAM;AAAA,UAAmB;AAAA,UAAoB,MAC3C,MAAM,IAAI,UAAU,SAAS;AAAA,YAC3B,KAAK;AAAA,YACL,MAAM;AAAA,cACJ,GAAG,oBAAoB,2BAA2B,oBAAoB,CAAC,eAAe,CAAC;AAAA,cACvF,eAAe,gCAAgC,oBAAoB,YAAY;AAAA,YACjF;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,QAAQ;AAAA,MAAC;AAAA,IACX;AAEA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,mDAAmD,GAAG;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,eAAsB,KAAK,KAAc,KAA6C;AACpF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,UAAU,4BAA4B,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAEpF,UAAM,aAAc,QAAQ,UAAU,QAAQ,YAAY;AAC1D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MACnF,OAAO,EAAE,GAAG,SAAS,aAAa;AAAA,MAClC,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,UAAM,eAAgB,UAAU,CAAC;AACjC,UAAM,iBAAiB,OAAO,aAAa,YAAY,WAAW,aAAa,UAAU;AACzF,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ,GAAG,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,EAAE,UAAU,CAAC,YAAY,EAAE;AAAA,MAC3B,EAAE,UAAU,QAAQ,KAAK,YAAY,MAAM,gBAAgB,QAAQ,KAAK,SAAS,KAAK;AAAA,IACxF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM,YAAY;AAAA,MAC5B,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClB,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY;AAAA,UACZ,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,oDAAoD,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,MAAM,0BAA4C;AAAA,EAChD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,kCAAkC;AAAA,EAC/F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,wBAAwB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,wBAAwB;AAAA,EACnG;AACF;AAEA,MAAM,2BAA6C;AAAA,EACjD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,8BAA8B;AAAA,EACjG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,wBAAwB;AAAA,EACnG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { createDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  createDictionaryEntrySchema as createEntryDocSchema,\n  dictionaryEntryListResponseSchema,\n  dictionaryEntryResponseSchema,\n  dictionaryIdParamsSchema,\n  dictionariesErrorSchema,\n  dictionariesTag,\n} from '../../openapi'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  buildCollectionTags,\n  buildRecordTag,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport {\n  resolveDictionaryEntrySortMode,\n  sortDictionaryEntries,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\n\nconst paramsSchema = z.object({ dictionaryId: z.string().uuid() })\n\nconst DICTIONARY_ENTRY_RESOURCE = 'dictionaries.entry'\nconst DICTIONARY_DEFINITION_RESOURCE = 'dictionaries.dictionary'\nconst DICTIONARY_ENTRIES_TTL_MS = 5 * 60_000\n\nfunction buildEntriesCacheKey(params: {\n  dictionaryId: string\n  organizationId: string | null\n  sortMode: string\n}): string {\n  return `dictionaries:entries:${params.dictionaryId}:org=${params.organizationId ?? 'null'}:sort=${params.sortMode}`\n}\n\nasync function loadDictionary(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  id: string,\n  options: { allowInherited?: boolean } = {},\n) {\n  const { allowInherited = false } = options\n  if (!allowInherited && !context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const baseFilter = {\n    id,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  }\n  const filter = allowInherited\n    ? {\n        ...baseFilter,\n        ...(context.readableOrganizationIds.length\n          ? { organizationId: { $in: context.readableOrganizationIds } }\n          : {}),\n      }\n    : {\n        ...baseFilter,\n        organizationId: context.organizationId,\n      }\n  const dictionary = await context.em.findOne(Dictionary, filter)\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  POST: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function GET(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    if (!context.auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })\n    const dictionaryTenantId = dictionary.tenantId\n    const dictionaryOrgId = dictionary.organizationId ?? null\n    const sortMode = resolveDictionaryEntrySortMode(dictionary.entrySortMode)\n\n    // Dictionary CF selects hit this on every CrudForm open, so cache the\n    // decrypted+sorted options payload. The entry writes flow through the\n    // command bus (resourceKind dictionaries.entry), which already flushes the\n    // matching collection tag post-commit \u2014 no new invalidation wiring needed.\n    const cache = isCrudCacheEnabled() ? resolveCrudCache(context.container) : null\n    const cacheKey = cache\n      ? buildEntriesCacheKey({ dictionaryId, organizationId: dictionaryOrgId, sortMode })\n      : null\n\n    if (cache && cacheKey) {\n      const cached = await runWithCacheTenant(dictionaryTenantId, () => cache.get(cacheKey))\n      if (cached) {\n        return NextResponse.json(cached)\n      }\n    }\n\n    const entries = await findWithDecryption(\n      context.em,\n      DictionaryEntry,\n      {\n        dictionary,\n        organizationId: dictionary.organizationId,\n        tenantId: dictionary.tenantId,\n      },\n      {},\n      { tenantId: dictionary.tenantId, organizationId: dictionary.organizationId },\n    )\n    const sortedEntries = sortDictionaryEntries(entries, sortMode)\n\n    const payload = {\n      items: sortedEntries.map((entry) => ({\n        id: entry.id,\n        value: entry.value,\n        label: entry.label,\n        color: entry.color,\n        icon: entry.icon,\n        position: entry.position ?? 0,\n        isDefault: entry.isDefault ?? false,\n        createdAt: entry.createdAt,\n        updatedAt: entry.updatedAt,\n      })),\n    }\n\n    if (cache && cacheKey) {\n      try {\n        await runWithCacheTenant(dictionaryTenantId, () =>\n          cache.set(cacheKey, payload, {\n            ttl: DICTIONARY_ENTRIES_TTL_MS,\n            tags: [\n              ...buildCollectionTags(DICTIONARY_ENTRY_RESOURCE, dictionaryTenantId, [dictionaryOrgId]),\n              buildRecordTag(DICTIONARY_DEFINITION_RESOURCE, dictionaryTenantId, dictionaryId),\n            ],\n          }),\n        )\n      } catch {}\n    }\n\n    return NextResponse.json(payload)\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries.GET] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to load dictionary entries' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    if (!context.auth) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const payload = createDictionaryEntrySchema.parse(await req.json().catch(() => ({})))\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: DICTIONARY_ENTRY_RESOURCE,\n      resourceId: dictionaryId,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    // These nested routes do not use makeCrudRoute, so we invoke the command bus directly.\n    const commandBus = (context.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute('dictionaries.entries.create', {\n      input: { ...payload, dictionaryId },\n      ctx: context.ctx,\n    })\n    const createResult = (result ?? {}) as { entryId?: string | null }\n    const createdEntryId = typeof createResult.entryId === 'string' ? createResult.entryId : null\n    if (!createdEntryId) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_create_failed', 'Failed to create dictionary entry') })\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: DICTIONARY_ENTRY_RESOURCE,\n        resourceId: createdEntryId,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const entry = await findOneWithDecryption(\n      context.em.fork(),\n      DictionaryEntry,\n      createdEntryId,\n      { populate: ['dictionary'] },\n      { tenantId: context.auth.tenantId ?? null, organizationId: context.auth.orgId ?? null },\n    )\n    if (!entry) {\n      throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_create_failed', 'Failed to create dictionary entry') })\n    }\n    const response = NextResponse.json({\n      id: entry.id,\n      value: entry.value,\n      label: entry.label,\n      color: entry.color,\n      icon: entry.icon,\n      position: entry.position ?? 0,\n      isDefault: entry.isDefault ?? false,\n      createdAt: entry.createdAt,\n      updatedAt: entry.updatedAt,\n    }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'dictionaries.entry',\n          resourceId: createdEntryId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[dictionaries/:id/entries.POST] Unexpected error', err)\n    return NextResponse.json({ error: 'Failed to create dictionary entry' }, { status: 500 })\n  }\n}\n\nconst dictionaryEntriesGetDoc: OpenApiMethodDoc = {\n  summary: 'List dictionary entries',\n  description: 'Returns entries for the specified dictionary ordered by its configured entry sort mode.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary entries.', schema: dictionaryEntryListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid parameters', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionary entries', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryEntriesPostDoc: OpenApiMethodDoc = {\n  summary: 'Create dictionary entry',\n  description: 'Creates a new entry in the specified dictionary.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: createEntryDocSchema,\n    description: 'Entry value, label, and optional presentation metadata.',\n  },\n  responses: [\n    { status: 201, description: 'Dictionary entry created.', schema: dictionaryEntryResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to create dictionary entry', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary entries collection',\n  pathParams: dictionaryIdParamsSchema,\n  methods: {\n    GET: dictionaryEntriesGetDoc,\n    POST: dictionaryEntriesPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,mCAAmC;AAC5C,SAAS,eAAe,uBAAuB;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,kCAAkC;AAE3C;AAAA,EACE,+BAA+B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEjE,MAAM,4BAA4B;AAClC,MAAM,iCAAiC;AACvC,MAAM,4BAA4B,IAAI;AAEtC,SAAS,qBAAqB,QAInB;AACT,SAAO,wBAAwB,OAAO,YAAY,QAAQ,OAAO,kBAAkB,MAAM,SAAS,OAAO,QAAQ;AACnH;AAEA,eAAe,eACb,SACA,IACA,UAAwC,CAAC,GACzC;AACA,QAAM,EAAE,iBAAiB,MAAM,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,QAAQ,gBAAgB;AAC9C,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,SAAS,iBACX;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,wBAAwB,SAChC,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAAA,EACP,IACA;AAAA,IACE,GAAG;AAAA,IACH,gBAAgB,QAAQ;AAAA,EAC1B;AACJ,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY,MAAM;AAC9D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,KAA6C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,cAAc,EAAE,gBAAgB,KAAK,CAAC;AACvF,UAAM,qBAAqB,WAAW;AACtC,UAAM,kBAAkB,WAAW,kBAAkB;AACrD,UAAM,WAAW,+BAA+B,WAAW,aAAa;AAMxE,UAAM,QAAQ,mBAAmB,IAAI,iBAAiB,QAAQ,SAAS,IAAI;AAC3E,UAAM,WAAW,QACb,qBAAqB,EAAE,cAAc,gBAAgB,iBAAiB,SAAS,CAAC,IAChF;AAEJ,QAAI,SAAS,UAAU;AACrB,YAAM,SAAS,MAAM,mBAAmB,oBAAoB,MAAM,MAAM,IAAI,QAAQ,CAAC;AACrF,UAAI,QAAQ;AACV,eAAO,aAAa,KAAK,MAAM;AAAA,MACjC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE;AAAA,QACA,gBAAgB,WAAW;AAAA,QAC3B,UAAU,WAAW;AAAA,MACvB;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E;AACA,UAAM,gBAAgB,sBAAsB,SAAS,QAAQ;AAE7D,UAAM,UAAU;AAAA,MACd,OAAO,cAAc,IAAI,CAAC,WAAW;AAAA,QACnC,IAAI,MAAM;AAAA,QACV,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,UAAU,MAAM,YAAY;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,QAC9B,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MACnB,EAAE;AAAA,IACJ;AAEA,QAAI,SAAS,UAAU;AACrB,UAAI;AACF,cAAM;AAAA,UAAmB;AAAA,UAAoB,MAC3C,MAAM,IAAI,UAAU,SAAS;AAAA,YAC3B,KAAK;AAAA,YACL,MAAM;AAAA,cACJ,GAAG,oBAAoB,2BAA2B,oBAAoB,CAAC,eAAe,CAAC;AAAA,cACvF,eAAe,gCAAgC,oBAAoB,YAAY;AAAA,YACjF;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,QAAQ;AAAA,MAAC;AAAA,IACX;AAEA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,mDAAmD,GAAG;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,eAAsB,KAAK,KAAc,KAA6C;AACpF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,UAAU,4BAA4B,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AACpF,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,QAAQ,UAAU,QAAQ,YAAY;AAC1D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MACnF,OAAO,EAAE,GAAG,SAAS,aAAa;AAAA,MAClC,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,UAAM,eAAgB,UAAU,CAAC;AACjC,UAAM,iBAAiB,OAAO,aAAa,YAAY,WAAW,aAAa,UAAU;AACzF,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ,GAAG,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,EAAE,UAAU,CAAC,YAAY,EAAE;AAAA,MAC3B,EAAE,UAAU,QAAQ,KAAK,YAAY,MAAM,gBAAgB,QAAQ,KAAK,SAAS,KAAK;AAAA,IACxF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,mCAAmC,EAAE,CAAC;AAAA,IAC3I;AACA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM,YAAY;AAAA,MAC5B,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClB,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY;AAAA,UACZ,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,oDAAoD,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;AAEA,MAAM,0BAA4C;AAAA,EAChD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,kCAAkC;AAAA,EAC/F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,wBAAwB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,wBAAwB;AAAA,EACnG;AACF;AAEA,MAAM,2BAA6C;AAAA,EACjD,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,8BAA8B;AAAA,EACjG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,wBAAwB;AAAA,EACnG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/dictionaries/api/[dictionaryId]/route.js

@@ -1,9 +1,13 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { Dictionary } from "@open-mercato/core/modules/dictionaries/data/entities";
-import { resolveDictionariesRouteContext } from "@open-mercato/core/modules/dictionaries/api/context";
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from "@open-mercato/core/modules/dictionaries/api/context";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import {
   resolveDictionaryEntrySortMode
 } from "@open-mercato/core/modules/dictionaries/lib/entrySort";
@@ -93,6 +97,21 @@ async function PATCH(req, ctx) {
       current: dictionary.updatedAt ?? null,
       request: req
     });
+    const guardUserId = resolveDictionaryActorId(context.auth);
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: "dictionaries.dictionary",
+      resourceId: dictionary.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     if (isProtectedCurrencyDictionary(dictionary)) {
       if (payload.key && payload.key.trim().toLowerCase() !== dictionary.key) {
         throw new CrudHttpError(400, { error: context.translate("dictionaries.errors.currency_protected", "The currency dictionary cannot be modified or deleted.") });
@@ -143,6 +162,19 @@ async function PATCH(req, ctx) {
     }
     dictionary.updatedAt = /* @__PURE__ */ new Date();
     await context.em.flush();
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: "dictionaries.dictionary",
+        resourceId: dictionary.id,
+        operation: "update",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     return NextResponse.json({
       id: dictionary.id,
       key: dictionary.key,
@@ -171,12 +203,40 @@ async function DELETE(req, ctx) {
     const context = await resolveDictionariesRouteContext(req);
     const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId });
     const dictionary = await loadDictionary(context, dictionaryId);
+    const guardUserId = resolveDictionaryActorId(context.auth);
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: "dictionaries.dictionary",
+      resourceId: dictionary.id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     if (isProtectedCurrencyDictionary(dictionary)) {
       throw new CrudHttpError(400, { error: context.translate("dictionaries.errors.currency_protected", "The currency dictionary cannot be modified or deleted.") });
     }
     dictionary.isActive = false;
     dictionary.deletedAt = dictionary.deletedAt ?? /* @__PURE__ */ new Date();
     await context.em.flush();
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: "dictionaries.dictionary",
+        resourceId: dictionary.id,
+        operation: "delete",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     return NextResponse.json({ ok: true });
   } catch (err) {
     if (isCrudHttpError(err)) {