@open-mercato/core 0.6.6-develop.6204.1.30b1f58642 → 0.6.6-develop.6227.1.2695efff30

package/dist/modules/entities/backend/entities/user/[entityId]/records/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/entities/backend/entities/user/%5BentityId%5D/records/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport type { ColumnDef, SortingState } from '@tanstack/react-table'\nimport { filterCustomFieldDefs, useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'\nimport type { PreparedExport } from '@open-mercato/shared/lib/crud/exporters'\nimport type { FilterDef } from '@open-mercato/ui/backend/FilterBar'\nimport { ContextHelp } from '@open-mercato/ui/backend/ContextHelp'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport Link from 'next/link'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { ErrorMessage, LoadingMessage } from '@open-mercato/ui/backend/detail'\nimport { useRecordsEntityGuard } from '@open-mercato/core/modules/entities/components/useRecordsEntityGuard'\n\ntype RecordsResponse = {\n  items: any[]\n  total: number\n  page: number\n  pageSize: number\n  totalPages: number\n}\n\nfunction toCsvUrl(base: string, params: URLSearchParams) {\n  // Build a relative URL to avoid SSR/CSR origin mismatch hydration issues\n  const p = new URLSearchParams(params)\n  p.set('format', 'csv')\n  const qs = p.toString()\n  return qs ? `${base}?${qs}` : base\n}\n\nfunction normalizeCell(v: any): string {\n  if (Array.isArray(v)) return v.filter((x) => x != null && x !== '').join(', ')\n  if (v === true) return 'Yes'\n  if (v === false) return 'No'\n  if (v == null) return ''\n  if (v instanceof Date) return v.toISOString()\n  return String(v)\n}\n\nexport default function RecordsPage({ params }: { params: { entityId?: string } }) {\n  const t = useT()\n  const entityId = decodeURIComponent(params?.entityId || '')\n  const guard = useRecordsEntityGuard(entityId)\n  if (guard !== 'allowed') {\n    return (\n      <Page>\n        <PageBody>\n          {guard === 'blocked' ? (\n            <ErrorMessage label={t('entities.userEntities.records.errors.systemEntity', 'This entity is system-managed. Records are available for custom entities only.')} />\n          ) : (\n            <LoadingMessage label={t('entities.userEntities.records.loading', 'Loading records...')} />\n          )}\n        </PageBody>\n      </Page>\n    )\n  }\n  return <RecordsPageInner params={params} />\n}\n\nfunction RecordsPageInner({ params }: { params: { entityId?: string } }) {\n  const entityId = decodeURIComponent(params?.entityId || '')\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'id', desc: false }])\n  const [page, setPage] = React.useState(1)\n  const [pageSize, setPageSize] = React.useState(50)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<Record<string, any>>({})\n  const [columns, setColumns] = React.useState<ColumnDef<any>[]>([])\n  const [rawData, setRawData] = React.useState<any[]>([])\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [loading, setLoading] = React.useState(false)\n  const scopeVersion = useOrganizationScopeVersion()\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const { data: cfDefs = [] } = useCustomFieldDefs(entityId, {\n    enabled: Boolean(entityId),\n    keyExtras: [scopeVersion],\n  })\n\n  // Fetch records whenever paging/sorting/filters change (do NOT refetch on cfDefs/search changes)\n  React.useEffect(() => {\n    let cancelled = false\n    const run = async () => {\n      setLoading(true)\n      try {\n        const params = new URLSearchParams()\n        params.set('entityId', entityId)\n        params.set('page', String(page))\n        params.set('pageSize', String(pageSize))\n        const s = sorting?.[0]\n        if (s?.id) {\n          params.set('sortField', String(s.id))\n          params.set('sortDir', s.desc ? 'desc' : 'asc')\n        }\n        // Flatten filter values into query params\n        for (const [k, v] of Object.entries(filterValues)) {\n          if (v == null) continue\n          if (Array.isArray(v)) {\n            if (v.length) params.set(k, v.join(','))\n          } else if (typeof v === 'object') {\n            // dateRange-like shapes are not supported generically here; skip\n          } else {\n            params.set(k, String(v))\n          }\n        }\n        const j = await readApiResultOrThrow<RecordsResponse>(\n          `/api/entities/records?${params.toString()}`,\n          undefined,\n          {\n            errorMessage: 'Failed to load records',\n            fallback: {\n              items: [],\n              total: 0,\n              page,\n              pageSize,\n              totalPages: 1,\n            },\n          },\n        )\n        if (!cancelled) {\n          setRawData(j.items || [])\n          setTotal(j.total)\n          setTotalPages(j.totalPages)\n        }\n      } catch (e) {\n        if (!cancelled) {\n          setRawData([])\n          setTotal(0)\n          setTotalPages(1)\n        }\n      } finally {\n        if (!cancelled) setLoading(false)\n      }\n    }\n    if (entityId) run()\n    return () => { cancelled = true }\n  }, [entityId, page, pageSize, sorting, filterValues, scopeVersion])\n\n  // Build columns from custom field definitions only (no data round-trip)\n  React.useEffect(() => {\n    const visibleDefs = filterCustomFieldDefs(cfDefs, 'list') as any\n    const maxVisible = 10\n    const cols: ColumnDef<any>[] = visibleDefs.map((d: any, idx: number) => ({\n      accessorKey: d.key,\n      header: d.label || d.key,\n      meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },\n      cell: ({ getValue }: { getValue: () => unknown }) => {\n        const v = getValue() as any\n        return <span className=\"truncate max-w-[24ch] inline-block align-top\" title={normalizeCell(v)}>{normalizeCell(v)}</span>\n      },\n    }))\n    // Ensure hidden 'id' column exists for sorting/state\n    const hasIdCol = cols.some((c) => (c as any).accessorKey === 'id' || (c as any).id === 'id')\n    if (!hasIdCol) cols.unshift({ accessorKey: 'id', header: 'ID', meta: { hidden: true, priority: 6 } } as any)\n    setColumns(cols)\n  }, [cfDefs])\n\n  // Client-side quick search filtering without triggering server refetch\n  const data = React.useMemo(() => {\n    if (!search.trim()) return rawData\n    const q = search.trim().toLowerCase()\n    return (rawData || []).filter((row: any) => {\n      const values = Object.values(row || {})\n      return values.some((v) => normalizeCell(v).toLowerCase().includes(q))\n    })\n  }, [rawData, search])\n\n  const viewExportColumns = React.useMemo(() => {\n    return (columns || [])\n      .map((col) => {\n        const accessorKey = (col as any).accessorKey\n        if (!accessorKey || typeof accessorKey !== 'string') return null\n        if ((col as any).meta?.hidden) return null\n        const header = typeof col.header === 'string'\n          ? col.header\n          : accessorKey.startsWith('cf_')\n            ? accessorKey.slice(3)\n            : accessorKey\n        return { field: accessorKey, header }\n      })\n      .filter((col): col is { field: string; header: string } => !!col)\n  }, [columns])\n\n  const buildFullExportUrl = React.useCallback((format: DataTableExportFormat) => {\n    const qp = new URLSearchParams({\n      entityId,\n      format,\n      exportScope: 'full',\n      all: 'true',\n    })\n    const sort = sorting?.[0]\n    if (sort?.id) {\n      qp.set('sortField', String(sort.id))\n      qp.set('sortDir', sort.desc ? 'desc' : 'asc')\n    }\n    return `/api/entities/records?${qp.toString()}`\n  }, [entityId, sorting])\n\n  const exportConfig = React.useMemo(() => {\n    const safeEntityId = entityId.replace(/[^a-z0-9_-]/gi, '_') || 'records'\n    return {\n      view: {\n        description: 'Exports the current list respecting filters and column visibility.',\n        prepare: async (): Promise<{ prepared: PreparedExport; filename: string }> => {\n          const rowsForExport = data.map((row) => {\n            const out: Record<string, unknown> = {}\n            for (const col of viewExportColumns) {\n              out[col.field] = (row as Record<string, unknown>)[col.field]\n            }\n            return out\n          })\n          const prepared: PreparedExport = {\n            columns: viewExportColumns.map((col) => ({ field: col.field, header: col.header })),\n            rows: rowsForExport,\n          }\n          return { prepared, filename: `${safeEntityId}_view` }\n        },\n      },\n      full: {\n        description: 'Exports raw records with every field and custom field included.',\n        getUrl: (format: DataTableExportFormat) => buildFullExportUrl(format),\n        filename: () => `${safeEntityId}_full`,\n      },\n    }\n  }, [buildFullExportUrl, data, entityId, viewExportColumns])\n\n  const hasAnyFormFields = React.useMemo(() => filterCustomFieldDefs(cfDefs, 'form').length > 0, [cfDefs])\n  const actions = (\n    <>\n      <Button asChild variant=\"outline\" size=\"sm\">\n        <Link href={`/backend/entities/user/${encodeURIComponent(entityId)}`}>\n          Edit Entity Definition\n        </Link>\n      </Button>\n      {hasAnyFormFields && (\n        <Button asChild>\n          <Link href={`/backend/entities/user/${encodeURIComponent(entityId)}/records/create`}>\n            Create\n          </Link>\n        </Button>\n      )}\n    </>\n  )\n\n  // Ensure filters are visible even if no custom fields are marked filterable\n  const baseFilters: FilterDef[] = React.useMemo(() => ([\n    { id: 'id', label: 'ID', type: 'text' },\n  ]), [])\n\n  return (\n    <Page>\n      <PageBody>\n        <ContextHelp bulb title=\"API: Manage Records via cURL\" className=\"mb-4\">\n          <p className=\"mb-2\">\n            Interact with this custom entity via the backend API using cURL. Use API keys for machine-to-machine access\u2014mint one from the{' '}\n            <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/user-guide/api-keys\">\n              Managing API keys guide\n            </a>{' '}\n            or the{' '}\n            <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/cli/api-keys\">\n              API keys CLI documentation\n            </a>{' '}\n            before running these calls.\n          </p>\n          <div className=\"space-y-2\">\n            <div>\n              <div className=\"font-medium mb-1\">1) Configure environment variables</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`export BASE_URL=\"http://localhost:3000/api\"\nexport API_KEY=\"<paste API key secret here>\"           # scoped with entities.features\nexport ENTITY_ID=\"${entityId}\"\nexport RECORD_ID=\"<record uuid>\"`}</code></pre>\n              <p className=\"text-muted-foreground mt-1\">\n                Need a new key? Follow the{' '}\n                <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/user-guide/api-keys\">\n                  Managing API keys\n                </a>{' '}\n                walkthrough or mint one via{' '}\n                <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/cli/api-keys\">\n                  mercato api_keys add\n                </a>\n                .\n              </p>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">2) List records</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -H \"X-Api-Key: $API_KEY\" \\\n  \"$BASE_URL/entities/records?entityId=$ENTITY_ID\" | jq`}</code></pre>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">3) Read a single record (by id)</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -H \"X-Api-Key: $API_KEY\" \\\n  \"$BASE_URL/entities/records?entityId=$ENTITY_ID&id=$RECORD_ID\" | jq`}</code></pre>\n              <p className=\"text-muted-foreground mt-1\">Note: Response is a list; filter by <code>id</code> to get a single item.</p>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">4) Create a record</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -X POST \\\n  -H \"X-Api-Key: $API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \"{\n    \\\\\"entityId\\\\\": \\\\\"$ENTITY_ID\\\\\",\n    \\\\\"values\\\\\": {\n      \\\\\"field_one\\\\\": \\\\\"Example\\\\\",\n      \\\\\"field_two\\\\\": 123\n    }\n  }\" \\\n  \"$BASE_URL/entities/records\" | jq`}</code></pre>\n              <p className=\"text-muted-foreground mt-1\">For custom entities, send field keys without the <code>cf_</code> prefix. The API normalizes this server-side.</p>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">5) Update a record</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -X PUT \\\n  -H \"X-Api-Key: $API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \"{\n    \\\\\"entityId\\\\\": \\\\\"$ENTITY_ID\\\\\",\n    \\\\\"recordId\\\\\": \\\\\"$RECORD_ID\\\\\",\n    \\\\\"values\\\\\": {\n      \\\\\"field_one\\\\\": \\\\\"Updated\\\\\"\n    }\n  }\" \\\n  \"$BASE_URL/entities/records\" | jq`}</code></pre>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">6) Delete a record</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -X DELETE \\\n  -H \"X-Api-Key: $API_KEY\" \\\n  \"$BASE_URL/entities/records?entityId=$ENTITY_ID&recordId=$RECORD_ID\" | jq`}</code></pre>\n            </div>\n\n            <div className=\"text-muted-foreground\">\n              Security notes:\n              <ul className=\"list-disc pl-5 mt-1 space-y-1\">\n                <li>All endpoints require a valid API key. Keys inherit tenant, organization, and feature scope.</li>\n                <li>Rotate keys regularly and delete unused ones in the admin UI.</li>\n                <li>Store the secret in a secure vault; anyone with the header can act within the key&apos;s permissions.</li>\n              </ul>\n            </div>\n          </div>\n        </ContextHelp>\n        <DataTable\n          stickyActionsColumn\n          title={`Records: ${entityId}`}\n          entityId={entityId}\n          actions={actions}\n          columns={columns}\n          data={data}\n          perspective={{ tableId: `entities.user.records.${entityId}` }}\n          exporter={exportConfig}\n          filters={baseFilters}\n          filterValues={filterValues}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },\n                { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {\n                  try {\n                    const confirmed = await confirm({\n                      title: 'Delete this record?',\n                      variant: 'destructive',\n                    })\n                    if (!confirmed) return\n                    const deleteCall = await withScopedApiRequestHeaders(\n                      buildOptimisticLockHeader((row as any).updatedAt),\n                      () => apiCall(\n                        `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(String((row as any).id))}`,\n                        { method: 'DELETE' },\n                      ),\n                    )\n                    if (!deleteCall.ok) {\n                      await raiseCrudError(deleteCall.response, 'Failed to delete record')\n                    }\n                    const j = await readApiResultOrThrow<RecordsResponse>(\n                      `/api/entities/records?entityId=${encodeURIComponent(entityId)}&page=${page}&pageSize=${pageSize}`,\n                      undefined,\n                      {\n                        errorMessage: 'Failed to reload records',\n                        fallback: { items: [], total: 0, page, pageSize, totalPages: 1 },\n                      },\n                    )\n                    setRawData(j.items || [])\n                    setTotal(j.total || 0)\n                    setTotalPages(j.totalPages || 1)\n                    flash('Record has been removed', 'success')\n                  } catch (error) {\n                    const message = error instanceof Error ? error.message : 'Failed to delete record'\n                    flash(message, 'error')\n                  }\n                } },\n              ]}\n            />\n          )}\n          sortable\n          sorting={sorting}\n          onSortingChange={setSorting}\n          searchValue={search}\n          onSearchChange={(v) => { setSearch(v); setPage(1) }}\n          onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}\n          onFiltersClear={() => { setFilterValues({}); setPage(1) }}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n          isLoading={loading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAyDY,SAmLR,UAnLQ,KAmLR,YAnLQ;AAxDZ,YAAY,WAAW;AAGvB,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAA6C;AAGtD,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,OAAO,UAAU;AACjB,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,mCAAmC;AAC5C,SAAS,wBAAwB;AACjC,SAAS,YAAY;AACrB,SAAS,cAAc,sBAAsB;AAC7C,SAAS,6BAA6B;AAUtC,SAAS,SAAS,MAAc,QAAyB;AAEvD,QAAM,IAAI,IAAI,gBAAgB,MAAM;AACpC,IAAE,IAAI,UAAU,KAAK;AACrB,QAAM,KAAK,EAAE,SAAS;AACtB,SAAO,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK;AAChC;AAEA,SAAS,cAAc,GAAgB;AACrC,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,OAAO,CAAC,MAAM,KAAK,QAAQ,MAAM,EAAE,EAAE,KAAK,IAAI;AAC7E,MAAI,MAAM,KAAM,QAAO;AACvB,MAAI,MAAM,MAAO,QAAO;AACxB,MAAI,KAAK,KAAM,QAAO;AACtB,MAAI,aAAa,KAAM,QAAO,EAAE,YAAY;AAC5C,SAAO,OAAO,CAAC;AACjB;AAEe,SAAR,YAA6B,EAAE,OAAO,GAAsC;AACjF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,mBAAmB,QAAQ,YAAY,EAAE;AAC1D,QAAM,QAAQ,sBAAsB,QAAQ;AAC5C,MAAI,UAAU,WAAW;AACvB,WACE,oBAAC,QACC,8BAAC,YACE,oBAAU,YACT,oBAAC,gBAAa,OAAO,EAAE,qDAAqD,gFAAgF,GAAG,IAE/J,oBAAC,kBAAe,OAAO,EAAE,yCAAyC,oBAAoB,GAAG,GAE7F,GACF;AAAA,EAEJ;AACA,SAAO,oBAAC,oBAAiB,QAAgB;AAC3C;AAEA,SAAS,iBAAiB,EAAE,OAAO,GAAsC;AACvE,QAAM,WAAW,mBAAmB,QAAQ,YAAY,EAAE;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,MAAM,MAAM,MAAM,CAAC,CAAC;AACtF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,EAAE;AACjD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAA8B,CAAC,CAAC;AAC9E,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAA2B,CAAC,CAAC;AACjE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAgB,CAAC,CAAC;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,eAAe,4BAA4B;AACjD,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,EAAE,MAAM,SAAS,CAAC,EAAE,IAAI,mBAAmB,UAAU;AAAA,IACzD,SAAS,QAAQ,QAAQ;AAAA,IACzB,WAAW,CAAC,YAAY;AAAA,EAC1B,CAAC;AAGD,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,UAAM,MAAM,YAAY;AACtB,iBAAW,IAAI;AACf,UAAI;AACF,cAAMA,UAAS,IAAI,gBAAgB;AACnC,QAAAA,QAAO,IAAI,YAAY,QAAQ;AAC/B,QAAAA,QAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,QAAAA,QAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,cAAM,IAAI,UAAU,CAAC;AACrB,YAAI,GAAG,IAAI;AACT,UAAAA,QAAO,IAAI,aAAa,OAAO,EAAE,EAAE,CAAC;AACpC,UAAAA,QAAO,IAAI,WAAW,EAAE,OAAO,SAAS,KAAK;AAAA,QAC/C;AAEA,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,YAAY,GAAG;AACjD,cAAI,KAAK,KAAM;AACf,cAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,gBAAI,EAAE,OAAQ,CAAAA,QAAO,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,UACzC,WAAW,OAAO,MAAM,UAAU;AAAA,UAElC,OAAO;AACL,YAAAA,QAAO,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,UACzB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,UACd,yBAAyBA,QAAO,SAAS,CAAC;AAAA,UAC1C;AAAA,UACA;AAAA,YACE,cAAc;AAAA,YACd,UAAU;AAAA,cACR,OAAO,CAAC;AAAA,cACR,OAAO;AAAA,cACP;AAAA,cACA;AAAA,cACA,YAAY;AAAA,YACd;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,qBAAW,EAAE,SAAS,CAAC,CAAC;AACxB,mBAAS,EAAE,KAAK;AAChB,wBAAc,EAAE,UAAU;AAAA,QAC5B;AAAA,MACF,SAAS,GAAG;AACV,YAAI,CAAC,WAAW;AACd,qBAAW,CAAC,CAAC;AACb,mBAAS,CAAC;AACV,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,YAAW,KAAK;AAAA,MAClC;AAAA,IACF;AACA,QAAI,SAAU,KAAI;AAClB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,UAAU,MAAM,UAAU,SAAS,cAAc,YAAY,CAAC;AAGlE,QAAM,UAAU,MAAM;AACpB,UAAM,cAAc,sBAAsB,QAAQ,MAAM;AACxD,UAAM,aAAa;AACnB,UAAM,OAAyB,YAAY,IAAI,CAAC,GAAQ,SAAiB;AAAA,MACvE,aAAa,EAAE;AAAA,MACf,QAAQ,EAAE,SAAS,EAAE;AAAA,MACrB,MAAM,EAAE,UAAU,MAAM,IAAI,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,IAAI,MAAM,aAAa,IAAI,EAAE;AAAA,MACrF,MAAM,CAAC,EAAE,SAAS,MAAmC;AACnD,cAAM,IAAI,SAAS;AACnB,eAAO,oBAAC,UAAK,WAAU,gDAA+C,OAAO,cAAc,CAAC,GAAI,wBAAc,CAAC,GAAE;AAAA,MACnH;AAAA,IACF,EAAE;AAEF,UAAM,WAAW,KAAK,KAAK,CAAC,MAAO,EAAU,gBAAgB,QAAS,EAAU,OAAO,IAAI;AAC3F,QAAI,CAAC,SAAU,MAAK,QAAQ,EAAE,aAAa,MAAM,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,UAAU,EAAE,EAAE,CAAQ;AAC3G,eAAW,IAAI;AAAA,EACjB,GAAG,CAAC,MAAM,CAAC;AAGX,QAAM,OAAO,MAAM,QAAQ,MAAM;AAC/B,QAAI,CAAC,OAAO,KAAK,EAAG,QAAO;AAC3B,UAAM,IAAI,OAAO,KAAK,EAAE,YAAY;AACpC,YAAQ,WAAW,CAAC,GAAG,OAAO,CAAC,QAAa;AAC1C,YAAM,SAAS,OAAO,OAAO,OAAO,CAAC,CAAC;AACtC,aAAO,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAAA,IACtE,CAAC;AAAA,EACH,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,YAAQ,WAAW,CAAC,GACjB,IAAI,CAAC,QAAQ;AACZ,YAAM,cAAe,IAAY;AACjC,UAAI,CAAC,eAAe,OAAO,gBAAgB,SAAU,QAAO;AAC5D,UAAK,IAAY,MAAM,OAAQ,QAAO;AACtC,YAAM,SAAS,OAAO,IAAI,WAAW,WACjC,IAAI,SACJ,YAAY,WAAW,KAAK,IAC1B,YAAY,MAAM,CAAC,IACnB;AACN,aAAO,EAAE,OAAO,aAAa,OAAO;AAAA,IACtC,CAAC,EACA,OAAO,CAAC,QAAkD,CAAC,CAAC,GAAG;AAAA,EACpE,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAkC;AAC9E,UAAM,KAAK,IAAI,gBAAgB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,KAAK;AAAA,IACP,CAAC;AACD,UAAM,OAAO,UAAU,CAAC;AACxB,QAAI,MAAM,IAAI;AACZ,SAAG,IAAI,aAAa,OAAO,KAAK,EAAE,CAAC;AACnC,SAAG,IAAI,WAAW,KAAK,OAAO,SAAS,KAAK;AAAA,IAC9C;AACA,WAAO,yBAAyB,GAAG,SAAS,CAAC;AAAA,EAC/C,GAAG,CAAC,UAAU,OAAO,CAAC;AAEtB,QAAM,eAAe,MAAM,QAAQ,MAAM;AACvC,UAAM,eAAe,SAAS,QAAQ,iBAAiB,GAAG,KAAK;AAC/D,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS,YAAqE;AAC5E,gBAAM,gBAAgB,KAAK,IAAI,CAAC,QAAQ;AACtC,kBAAM,MAA+B,CAAC;AACtC,uBAAW,OAAO,mBAAmB;AACnC,kBAAI,IAAI,KAAK,IAAK,IAAgC,IAAI,KAAK;AAAA,YAC7D;AACA,mBAAO;AAAA,UACT,CAAC;AACD,gBAAM,WAA2B;AAAA,YAC/B,SAAS,kBAAkB,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO,EAAE;AAAA,YAClF,MAAM;AAAA,UACR;AACA,iBAAO,EAAE,UAAU,UAAU,GAAG,YAAY,QAAQ;AAAA,QACtD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,CAAC,WAAkC,mBAAmB,MAAM;AAAA,QACpE,UAAU,MAAM,GAAG,YAAY;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,oBAAoB,MAAM,UAAU,iBAAiB,CAAC;AAE1D,QAAM,mBAAmB,MAAM,QAAQ,MAAM,sBAAsB,QAAQ,MAAM,EAAE,SAAS,GAAG,CAAC,MAAM,CAAC;AACvG,QAAM,UACJ,iCACE;AAAA,wBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAM,0BAA0B,mBAAmB,QAAQ,CAAC,IAAI,oCAEtE,GACF;AAAA,IACC,oBACC,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAM,0BAA0B,mBAAmB,QAAQ,CAAC,mBAAmB,oBAErF,GACF;AAAA,KAEJ;AAIF,QAAM,cAA2B,MAAM,QAAQ,MAAO;AAAA,IACpD,EAAE,IAAI,MAAM,OAAO,MAAM,MAAM,OAAO;AAAA,EACxC,GAAI,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,yBAAC,YACC;AAAA,2BAAC,eAAY,MAAI,MAAC,OAAM,gCAA+B,WAAU,QAC/D;AAAA,6BAAC,OAAE,WAAU,QAAO;AAAA;AAAA,UAC4G;AAAA,UAC9H,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,oDAAmD,qCAElH;AAAA,UAAK;AAAA,UAAI;AAAA,UACF;AAAA,UACP,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,6CAA4C,wCAE3G;AAAA,UAAK;AAAA,UAAI;AAAA,WAEX;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,+BAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gDAAkC;AAAA,YACpE,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM;AAAA;AAAA,oBAE7D,QAAQ;AAAA,mCACM,GAAO;AAAA,YAC3B,qBAAC,OAAE,WAAU,8BAA6B;AAAA;AAAA,cACb;AAAA,cAC3B,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,oDAAmD,+BAElH;AAAA,cAAK;AAAA,cAAI;AAAA,cACmB;AAAA,cAC5B,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,6CAA4C,kCAE3G;AAAA,cAAI;AAAA,eAEN;AAAA,aACF;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,6BAAe;AAAA,YACjD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM,sGACxB,GAAO;AAAA,aACpD;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,6CAA+B;AAAA,YACjE,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM,oHACV,GAAO;AAAA,YAChE,qBAAC,OAAE,WAAU,8BAA6B;AAAA;AAAA,cAAoC,oBAAC,UAAK,gBAAE;AAAA,cAAO;AAAA,eAAsB;AAAA,aACrH;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gCAAkB;AAAA,YACpD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAU5C,GAAO;AAAA,YAC9B,qBAAC,OAAE,WAAU,8BAA6B;AAAA;AAAA,cAAiD,oBAAC,UAAK,iBAAG;AAAA,cAAO;AAAA,eAA6C;AAAA,aAC1J;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gCAAkB;AAAA,YACpD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAU5C,GAAO;AAAA,aAChC;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gCAAkB;AAAA,YACpD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM,sIAEJ,GAAO;AAAA,aACxE;AAAA,UAEA,qBAAC,SAAI,WAAU,yBAAwB;AAAA;AAAA,YAErC,qBAAC,QAAG,WAAU,iCACZ;AAAA,kCAAC,QAAG,0GAA4F;AAAA,cAChG,oBAAC,QAAG,2EAA6D;AAAA,cACjE,oBAAC,QAAG,8GAAqG;AAAA,eAC3G;AAAA,aACF;AAAA,WACF;AAAA,SACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,qBAAmB;AAAA,UACnB,OAAO,YAAY,QAAQ;AAAA,UAC3B;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,EAAE,SAAS,yBAAyB,QAAQ,GAAG;AAAA,UAC5D,UAAU;AAAA,UACV,SAAS;AAAA,UACT;AAAA,UACA,YAAY,CAAC,QACX;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,EAAE,IAAI,QAAQ,OAAO,QAAQ,MAAM,0BAA0B,mBAAmB,QAAQ,CAAC,YAAY,mBAAmB,OAAQ,IAAY,EAAE,CAAC,CAAC,GAAG;AAAA,gBACnJ,EAAE,IAAI,UAAU,OAAO,UAAU,aAAa,MAAM,UAAU,YAAY;AACxE,sBAAI;AACF,0BAAM,YAAY,MAAM,QAAQ;AAAA,sBAC9B,OAAO;AAAA,sBACP,SAAS;AAAA,oBACX,CAAC;AACD,wBAAI,CAAC,UAAW;AAChB,0BAAM,aAAa,MAAM;AAAA,sBACvB,0BAA2B,IAAY,SAAS;AAAA,sBAChD,MAAM;AAAA,wBACJ,kCAAkC,mBAAmB,QAAQ,CAAC,aAAa,mBAAmB,OAAQ,IAAY,EAAE,CAAC,CAAC;AAAA,wBACtH,EAAE,QAAQ,SAAS;AAAA,sBACrB;AAAA,oBACF;AACA,wBAAI,CAAC,WAAW,IAAI;AAClB,4BAAM,eAAe,WAAW,UAAU,yBAAyB;AAAA,oBACrE;AACA,0BAAM,IAAI,MAAM;AAAA,sBACd,kCAAkC,mBAAmB,QAAQ,CAAC,SAAS,IAAI,aAAa,QAAQ;AAAA,sBAChG;AAAA,sBACA;AAAA,wBACE,cAAc;AAAA,wBACd,UAAU,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE;AAAA,sBACjE;AAAA,oBACF;AACA,+BAAW,EAAE,SAAS,CAAC,CAAC;AACxB,6BAAS,EAAE,SAAS,CAAC;AACrB,kCAAc,EAAE,cAAc,CAAC;AAC/B,0BAAM,2BAA2B,SAAS;AAAA,kBAC5C,SAAS,OAAO;AACd,0BAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,0BAAM,SAAS,OAAO;AAAA,kBACxB;AAAA,gBACF,EAAE;AAAA,cACJ;AAAA;AAAA,UACF;AAAA,UAEF,UAAQ;AAAA,UACR;AAAA,UACA,iBAAiB;AAAA,UACjB,aAAa;AAAA,UACb,gBAAgB,CAAC,MAAM;AAAE,sBAAU,CAAC;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UAClD,gBAAgB,CAAC,SAAS;AAAE,4BAAgB,IAAI;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UAC9D,gBAAgB,MAAM;AAAE,4BAAgB,CAAC,CAAC;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UACxD,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA,UACvE,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { useSearchParams } from 'next/navigation'\nimport type { ColumnDef, SortingState } from '@tanstack/react-table'\nimport { filterCustomFieldDefs, useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'\nimport type { PreparedExport } from '@open-mercato/shared/lib/crud/exporters'\nimport type { FilterDef } from '@open-mercato/ui/backend/FilterBar'\nimport { ContextHelp } from '@open-mercato/ui/backend/ContextHelp'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport Link from 'next/link'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { ErrorMessage, LoadingMessage } from '@open-mercato/ui/backend/detail'\nimport { useRecordsEntityGuard } from '@open-mercato/core/modules/entities/components/useRecordsEntityGuard'\n\ntype RecordsResponse = {\n  items: any[]\n  total: number\n  page: number\n  pageSize: number\n  totalPages: number\n}\n\nfunction toCsvUrl(base: string, params: URLSearchParams) {\n  // Build a relative URL to avoid SSR/CSR origin mismatch hydration issues\n  const p = new URLSearchParams(params)\n  p.set('format', 'csv')\n  const qs = p.toString()\n  return qs ? `${base}?${qs}` : base\n}\n\nfunction normalizeCell(v: any): string {\n  if (Array.isArray(v)) return v.filter((x) => x != null && x !== '').join(', ')\n  if (v === true) return 'Yes'\n  if (v === false) return 'No'\n  if (v == null) return ''\n  if (v instanceof Date) return v.toISOString()\n  return String(v)\n}\n\nexport default function RecordsPage({ params }: { params: { entityId?: string } }) {\n  const t = useT()\n  const entityId = decodeURIComponent(params?.entityId || '')\n  const guard = useRecordsEntityGuard(entityId)\n  if (guard !== 'allowed') {\n    return (\n      <Page>\n        <PageBody>\n          {guard === 'blocked' ? (\n            <ErrorMessage label={t('entities.userEntities.records.errors.systemEntity', 'This entity is system-managed. Records are available for custom entities only.')} />\n          ) : (\n            <LoadingMessage label={t('entities.userEntities.records.loading', 'Loading records...')} />\n          )}\n        </PageBody>\n      </Page>\n    )\n  }\n  return <RecordsPageInner params={params} />\n}\n\nfunction RecordsPageInner({ params }: { params: { entityId?: string } }) {\n  const t = useT()\n  const entityId = decodeURIComponent(params?.entityId || '')\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'id', desc: false }])\n  const [page, setPage] = React.useState(1)\n  const [pageSize, setPageSize] = React.useState(50)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<Record<string, any>>({})\n  const [columns, setColumns] = React.useState<ColumnDef<any>[]>([])\n  const [rawData, setRawData] = React.useState<any[]>([])\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [loading, setLoading] = React.useState(false)\n  const scopeVersion = useOrganizationScopeVersion()\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const deleteMutationContextId = `entities.user.records.${entityId}:single-delete`\n  const { runMutation: runDeleteMutation, retryLastMutation: retryDeleteMutation } = useGuardedMutation<{\n    formId: string\n    resourceKind: string\n    resourceId: string\n    retryLastMutation: () => Promise<boolean>\n  }>({\n    contextId: deleteMutationContextId,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n  const { data: cfDefs = [] } = useCustomFieldDefs(entityId, {\n    enabled: Boolean(entityId),\n    keyExtras: [scopeVersion],\n  })\n\n  // Fetch records whenever paging/sorting/filters change (do NOT refetch on cfDefs/search changes)\n  React.useEffect(() => {\n    let cancelled = false\n    const run = async () => {\n      setLoading(true)\n      try {\n        const params = new URLSearchParams()\n        params.set('entityId', entityId)\n        params.set('page', String(page))\n        params.set('pageSize', String(pageSize))\n        const s = sorting?.[0]\n        if (s?.id) {\n          params.set('sortField', String(s.id))\n          params.set('sortDir', s.desc ? 'desc' : 'asc')\n        }\n        // Flatten filter values into query params\n        for (const [k, v] of Object.entries(filterValues)) {\n          if (v == null) continue\n          if (Array.isArray(v)) {\n            if (v.length) params.set(k, v.join(','))\n          } else if (typeof v === 'object') {\n            // dateRange-like shapes are not supported generically here; skip\n          } else {\n            params.set(k, String(v))\n          }\n        }\n        const j = await readApiResultOrThrow<RecordsResponse>(\n          `/api/entities/records?${params.toString()}`,\n          undefined,\n          {\n            errorMessage: 'Failed to load records',\n            fallback: {\n              items: [],\n              total: 0,\n              page,\n              pageSize,\n              totalPages: 1,\n            },\n          },\n        )\n        if (!cancelled) {\n          setRawData(j.items || [])\n          setTotal(j.total)\n          setTotalPages(j.totalPages)\n        }\n      } catch (e) {\n        if (!cancelled) {\n          setRawData([])\n          setTotal(0)\n          setTotalPages(1)\n        }\n      } finally {\n        if (!cancelled) setLoading(false)\n      }\n    }\n    if (entityId) run()\n    return () => { cancelled = true }\n  }, [entityId, page, pageSize, sorting, filterValues, scopeVersion])\n\n  // Build columns from custom field definitions only (no data round-trip)\n  React.useEffect(() => {\n    const visibleDefs = filterCustomFieldDefs(cfDefs, 'list') as any\n    const maxVisible = 10\n    const cols: ColumnDef<any>[] = visibleDefs.map((d: any, idx: number) => ({\n      accessorKey: d.key,\n      header: d.label || d.key,\n      meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },\n      cell: ({ getValue }: { getValue: () => unknown }) => {\n        const v = getValue() as any\n        return <span className=\"truncate max-w-[24ch] inline-block align-top\" title={normalizeCell(v)}>{normalizeCell(v)}</span>\n      },\n    }))\n    // Ensure hidden 'id' column exists for sorting/state\n    const hasIdCol = cols.some((c) => (c as any).accessorKey === 'id' || (c as any).id === 'id')\n    if (!hasIdCol) cols.unshift({ accessorKey: 'id', header: 'ID', meta: { hidden: true, priority: 6 } } as any)\n    setColumns(cols)\n  }, [cfDefs])\n\n  // Client-side quick search filtering without triggering server refetch\n  const data = React.useMemo(() => {\n    if (!search.trim()) return rawData\n    const q = search.trim().toLowerCase()\n    return (rawData || []).filter((row: any) => {\n      const values = Object.values(row || {})\n      return values.some((v) => normalizeCell(v).toLowerCase().includes(q))\n    })\n  }, [rawData, search])\n\n  const viewExportColumns = React.useMemo(() => {\n    return (columns || [])\n      .map((col) => {\n        const accessorKey = (col as any).accessorKey\n        if (!accessorKey || typeof accessorKey !== 'string') return null\n        if ((col as any).meta?.hidden) return null\n        const header = typeof col.header === 'string'\n          ? col.header\n          : accessorKey.startsWith('cf_')\n            ? accessorKey.slice(3)\n            : accessorKey\n        return { field: accessorKey, header }\n      })\n      .filter((col): col is { field: string; header: string } => !!col)\n  }, [columns])\n\n  const buildFullExportUrl = React.useCallback((format: DataTableExportFormat) => {\n    const qp = new URLSearchParams({\n      entityId,\n      format,\n      exportScope: 'full',\n      all: 'true',\n    })\n    const sort = sorting?.[0]\n    if (sort?.id) {\n      qp.set('sortField', String(sort.id))\n      qp.set('sortDir', sort.desc ? 'desc' : 'asc')\n    }\n    return `/api/entities/records?${qp.toString()}`\n  }, [entityId, sorting])\n\n  const exportConfig = React.useMemo(() => {\n    const safeEntityId = entityId.replace(/[^a-z0-9_-]/gi, '_') || 'records'\n    return {\n      view: {\n        description: 'Exports the current list respecting filters and column visibility.',\n        prepare: async (): Promise<{ prepared: PreparedExport; filename: string }> => {\n          const rowsForExport = data.map((row) => {\n            const out: Record<string, unknown> = {}\n            for (const col of viewExportColumns) {\n              out[col.field] = (row as Record<string, unknown>)[col.field]\n            }\n            return out\n          })\n          const prepared: PreparedExport = {\n            columns: viewExportColumns.map((col) => ({ field: col.field, header: col.header })),\n            rows: rowsForExport,\n          }\n          return { prepared, filename: `${safeEntityId}_view` }\n        },\n      },\n      full: {\n        description: 'Exports raw records with every field and custom field included.',\n        getUrl: (format: DataTableExportFormat) => buildFullExportUrl(format),\n        filename: () => `${safeEntityId}_full`,\n      },\n    }\n  }, [buildFullExportUrl, data, entityId, viewExportColumns])\n\n  const hasAnyFormFields = React.useMemo(() => filterCustomFieldDefs(cfDefs, 'form').length > 0, [cfDefs])\n  const actions = (\n    <>\n      <Button asChild variant=\"outline\" size=\"sm\">\n        <Link href={`/backend/entities/user/${encodeURIComponent(entityId)}`}>\n          Edit Entity Definition\n        </Link>\n      </Button>\n      {hasAnyFormFields && (\n        <Button asChild>\n          <Link href={`/backend/entities/user/${encodeURIComponent(entityId)}/records/create`}>\n            Create\n          </Link>\n        </Button>\n      )}\n    </>\n  )\n\n  // Ensure filters are visible even if no custom fields are marked filterable\n  const baseFilters: FilterDef[] = React.useMemo(() => ([\n    { id: 'id', label: 'ID', type: 'text' },\n  ]), [])\n\n  return (\n    <Page>\n      <PageBody>\n        <ContextHelp bulb title=\"API: Manage Records via cURL\" className=\"mb-4\">\n          <p className=\"mb-2\">\n            Interact with this custom entity via the backend API using cURL. Use API keys for machine-to-machine access\u2014mint one from the{' '}\n            <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/user-guide/api-keys\">\n              Managing API keys guide\n            </a>{' '}\n            or the{' '}\n            <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/cli/api-keys\">\n              API keys CLI documentation\n            </a>{' '}\n            before running these calls.\n          </p>\n          <div className=\"space-y-2\">\n            <div>\n              <div className=\"font-medium mb-1\">1) Configure environment variables</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`export BASE_URL=\"http://localhost:3000/api\"\nexport API_KEY=\"<paste API key secret here>\"           # scoped with entities.features\nexport ENTITY_ID=\"${entityId}\"\nexport RECORD_ID=\"<record uuid>\"`}</code></pre>\n              <p className=\"text-muted-foreground mt-1\">\n                Need a new key? Follow the{' '}\n                <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/user-guide/api-keys\">\n                  Managing API keys\n                </a>{' '}\n                walkthrough or mint one via{' '}\n                <a className=\"underline\" target=\"_blank\" rel=\"noreferrer\" href=\"https://docs.openmercato.com/cli/api-keys\">\n                  mercato api_keys add\n                </a>\n                .\n              </p>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">2) List records</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -H \"X-Api-Key: $API_KEY\" \\\n  \"$BASE_URL/entities/records?entityId=$ENTITY_ID\" | jq`}</code></pre>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">3) Read a single record (by id)</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -H \"X-Api-Key: $API_KEY\" \\\n  \"$BASE_URL/entities/records?entityId=$ENTITY_ID&id=$RECORD_ID\" | jq`}</code></pre>\n              <p className=\"text-muted-foreground mt-1\">Note: Response is a list; filter by <code>id</code> to get a single item.</p>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">4) Create a record</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -X POST \\\n  -H \"X-Api-Key: $API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \"{\n    \\\\\"entityId\\\\\": \\\\\"$ENTITY_ID\\\\\",\n    \\\\\"values\\\\\": {\n      \\\\\"field_one\\\\\": \\\\\"Example\\\\\",\n      \\\\\"field_two\\\\\": 123\n    }\n  }\" \\\n  \"$BASE_URL/entities/records\" | jq`}</code></pre>\n              <p className=\"text-muted-foreground mt-1\">For custom entities, send field keys without the <code>cf_</code> prefix. The API normalizes this server-side.</p>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">5) Update a record</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -X PUT \\\n  -H \"X-Api-Key: $API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \"{\n    \\\\\"entityId\\\\\": \\\\\"$ENTITY_ID\\\\\",\n    \\\\\"recordId\\\\\": \\\\\"$RECORD_ID\\\\\",\n    \\\\\"values\\\\\": {\n      \\\\\"field_one\\\\\": \\\\\"Updated\\\\\"\n    }\n  }\" \\\n  \"$BASE_URL/entities/records\" | jq`}</code></pre>\n            </div>\n\n            <div>\n              <div className=\"font-medium mb-1\">6) Delete a record</div>\n              <pre className=\"bg-muted p-3 rounded text-xs overflow-auto\"><code>{`curl -s -X DELETE \\\n  -H \"X-Api-Key: $API_KEY\" \\\n  \"$BASE_URL/entities/records?entityId=$ENTITY_ID&recordId=$RECORD_ID\" | jq`}</code></pre>\n            </div>\n\n            <div className=\"text-muted-foreground\">\n              Security notes:\n              <ul className=\"list-disc pl-5 mt-1 space-y-1\">\n                <li>All endpoints require a valid API key. Keys inherit tenant, organization, and feature scope.</li>\n                <li>Rotate keys regularly and delete unused ones in the admin UI.</li>\n                <li>Store the secret in a secure vault; anyone with the header can act within the key&apos;s permissions.</li>\n              </ul>\n            </div>\n          </div>\n        </ContextHelp>\n        <DataTable\n          stickyActionsColumn\n          title={`Records: ${entityId}`}\n          entityId={entityId}\n          actions={actions}\n          columns={columns}\n          data={data}\n          perspective={{ tableId: `entities.user.records.${entityId}` }}\n          exporter={exportConfig}\n          filters={baseFilters}\n          filterValues={filterValues}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },\n                { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {\n                  const recordId = String((row as any).id)\n                  try {\n                    const confirmed = await confirm({\n                      title: 'Delete this record?',\n                      variant: 'destructive',\n                    })\n                    if (!confirmed) return\n                    await runDeleteMutation({\n                      operation: async () => {\n                        const deleteCall = await withScopedApiRequestHeaders(\n                          buildOptimisticLockHeader((row as any).updatedAt),\n                          () => apiCall(\n                            `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,\n                            { method: 'DELETE' },\n                          ),\n                        )\n                        if (!deleteCall.ok) {\n                          await raiseCrudError(deleteCall.response, 'Failed to delete record')\n                        }\n                      },\n                      context: {\n                        formId: deleteMutationContextId,\n                        resourceKind: 'entities.record',\n                        resourceId: recordId,\n                        retryLastMutation: retryDeleteMutation,\n                      },\n                    })\n                    const j = await readApiResultOrThrow<RecordsResponse>(\n                      `/api/entities/records?entityId=${encodeURIComponent(entityId)}&page=${page}&pageSize=${pageSize}`,\n                      undefined,\n                      {\n                        errorMessage: 'Failed to reload records',\n                        fallback: { items: [], total: 0, page, pageSize, totalPages: 1 },\n                      },\n                    )\n                    setRawData(j.items || [])\n                    setTotal(j.total || 0)\n                    setTotalPages(j.totalPages || 1)\n                    flash('Record has been removed', 'success')\n                  } catch (error) {\n                    const message = error instanceof Error ? error.message : 'Failed to delete record'\n                    flash(message, 'error')\n                  }\n                } },\n              ]}\n            />\n          )}\n          sortable\n          sorting={sorting}\n          onSortingChange={setSorting}\n          searchValue={search}\n          onSearchChange={(v) => { setSearch(v); setPage(1) }}\n          onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}\n          onFiltersClear={() => { setFilterValues({}); setPage(1) }}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n          isLoading={loading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA0DY,SA8LR,UA9LQ,KA8LR,YA9LQ;AAzDZ,YAAY,WAAW;AAGvB,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAA6C;AAGtD,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,OAAO,UAAU;AACjB,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,mCAAmC;AAC5C,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,cAAc,sBAAsB;AAC7C,SAAS,6BAA6B;AAUtC,SAAS,SAAS,MAAc,QAAyB;AAEvD,QAAM,IAAI,IAAI,gBAAgB,MAAM;AACpC,IAAE,IAAI,UAAU,KAAK;AACrB,QAAM,KAAK,EAAE,SAAS;AACtB,SAAO,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK;AAChC;AAEA,SAAS,cAAc,GAAgB;AACrC,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,OAAO,CAAC,MAAM,KAAK,QAAQ,MAAM,EAAE,EAAE,KAAK,IAAI;AAC7E,MAAI,MAAM,KAAM,QAAO;AACvB,MAAI,MAAM,MAAO,QAAO;AACxB,MAAI,KAAK,KAAM,QAAO;AACtB,MAAI,aAAa,KAAM,QAAO,EAAE,YAAY;AAC5C,SAAO,OAAO,CAAC;AACjB;AAEe,SAAR,YAA6B,EAAE,OAAO,GAAsC;AACjF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,mBAAmB,QAAQ,YAAY,EAAE;AAC1D,QAAM,QAAQ,sBAAsB,QAAQ;AAC5C,MAAI,UAAU,WAAW;AACvB,WACE,oBAAC,QACC,8BAAC,YACE,oBAAU,YACT,oBAAC,gBAAa,OAAO,EAAE,qDAAqD,gFAAgF,GAAG,IAE/J,oBAAC,kBAAe,OAAO,EAAE,yCAAyC,oBAAoB,GAAG,GAE7F,GACF;AAAA,EAEJ;AACA,SAAO,oBAAC,oBAAiB,QAAgB;AAC3C;AAEA,SAAS,iBAAiB,EAAE,OAAO,GAAsC;AACvE,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,mBAAmB,QAAQ,YAAY,EAAE;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,MAAM,MAAM,MAAM,CAAC,CAAC;AACtF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,EAAE;AACjD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAA8B,CAAC,CAAC;AAC9E,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAA2B,CAAC,CAAC;AACjE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAgB,CAAC,CAAC;AACtD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,eAAe,4BAA4B;AACjD,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,0BAA0B,yBAAyB,QAAQ;AACjE,QAAM,EAAE,aAAa,mBAAmB,mBAAmB,oBAAoB,IAAI,mBAKhF;AAAA,IACD,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AACD,QAAM,EAAE,MAAM,SAAS,CAAC,EAAE,IAAI,mBAAmB,UAAU;AAAA,IACzD,SAAS,QAAQ,QAAQ;AAAA,IACzB,WAAW,CAAC,YAAY;AAAA,EAC1B,CAAC;AAGD,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,UAAM,MAAM,YAAY;AACtB,iBAAW,IAAI;AACf,UAAI;AACF,cAAMA,UAAS,IAAI,gBAAgB;AACnC,QAAAA,QAAO,IAAI,YAAY,QAAQ;AAC/B,QAAAA,QAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,QAAAA,QAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,cAAM,IAAI,UAAU,CAAC;AACrB,YAAI,GAAG,IAAI;AACT,UAAAA,QAAO,IAAI,aAAa,OAAO,EAAE,EAAE,CAAC;AACpC,UAAAA,QAAO,IAAI,WAAW,EAAE,OAAO,SAAS,KAAK;AAAA,QAC/C;AAEA,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,YAAY,GAAG;AACjD,cAAI,KAAK,KAAM;AACf,cAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,gBAAI,EAAE,OAAQ,CAAAA,QAAO,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,UACzC,WAAW,OAAO,MAAM,UAAU;AAAA,UAElC,OAAO;AACL,YAAAA,QAAO,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,UACzB;AAAA,QACF;AACA,cAAM,IAAI,MAAM;AAAA,UACd,yBAAyBA,QAAO,SAAS,CAAC;AAAA,UAC1C;AAAA,UACA;AAAA,YACE,cAAc;AAAA,YACd,UAAU;AAAA,cACR,OAAO,CAAC;AAAA,cACR,OAAO;AAAA,cACP;AAAA,cACA;AAAA,cACA,YAAY;AAAA,YACd;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,qBAAW,EAAE,SAAS,CAAC,CAAC;AACxB,mBAAS,EAAE,KAAK;AAChB,wBAAc,EAAE,UAAU;AAAA,QAC5B;AAAA,MACF,SAAS,GAAG;AACV,YAAI,CAAC,WAAW;AACd,qBAAW,CAAC,CAAC;AACb,mBAAS,CAAC;AACV,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,YAAW,KAAK;AAAA,MAClC;AAAA,IACF;AACA,QAAI,SAAU,KAAI;AAClB,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,UAAU,MAAM,UAAU,SAAS,cAAc,YAAY,CAAC;AAGlE,QAAM,UAAU,MAAM;AACpB,UAAM,cAAc,sBAAsB,QAAQ,MAAM;AACxD,UAAM,aAAa;AACnB,UAAM,OAAyB,YAAY,IAAI,CAAC,GAAQ,SAAiB;AAAA,MACvE,aAAa,EAAE;AAAA,MACf,QAAQ,EAAE,SAAS,EAAE;AAAA,MACrB,MAAM,EAAE,UAAU,MAAM,IAAI,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,IAAI,MAAM,aAAa,IAAI,EAAE;AAAA,MACrF,MAAM,CAAC,EAAE,SAAS,MAAmC;AACnD,cAAM,IAAI,SAAS;AACnB,eAAO,oBAAC,UAAK,WAAU,gDAA+C,OAAO,cAAc,CAAC,GAAI,wBAAc,CAAC,GAAE;AAAA,MACnH;AAAA,IACF,EAAE;AAEF,UAAM,WAAW,KAAK,KAAK,CAAC,MAAO,EAAU,gBAAgB,QAAS,EAAU,OAAO,IAAI;AAC3F,QAAI,CAAC,SAAU,MAAK,QAAQ,EAAE,aAAa,MAAM,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,UAAU,EAAE,EAAE,CAAQ;AAC3G,eAAW,IAAI;AAAA,EACjB,GAAG,CAAC,MAAM,CAAC;AAGX,QAAM,OAAO,MAAM,QAAQ,MAAM;AAC/B,QAAI,CAAC,OAAO,KAAK,EAAG,QAAO;AAC3B,UAAM,IAAI,OAAO,KAAK,EAAE,YAAY;AACpC,YAAQ,WAAW,CAAC,GAAG,OAAO,CAAC,QAAa;AAC1C,YAAM,SAAS,OAAO,OAAO,OAAO,CAAC,CAAC;AACtC,aAAO,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAAA,IACtE,CAAC;AAAA,EACH,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,YAAQ,WAAW,CAAC,GACjB,IAAI,CAAC,QAAQ;AACZ,YAAM,cAAe,IAAY;AACjC,UAAI,CAAC,eAAe,OAAO,gBAAgB,SAAU,QAAO;AAC5D,UAAK,IAAY,MAAM,OAAQ,QAAO;AACtC,YAAM,SAAS,OAAO,IAAI,WAAW,WACjC,IAAI,SACJ,YAAY,WAAW,KAAK,IAC1B,YAAY,MAAM,CAAC,IACnB;AACN,aAAO,EAAE,OAAO,aAAa,OAAO;AAAA,IACtC,CAAC,EACA,OAAO,CAAC,QAAkD,CAAC,CAAC,GAAG;AAAA,EACpE,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAkC;AAC9E,UAAM,KAAK,IAAI,gBAAgB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,KAAK;AAAA,IACP,CAAC;AACD,UAAM,OAAO,UAAU,CAAC;AACxB,QAAI,MAAM,IAAI;AACZ,SAAG,IAAI,aAAa,OAAO,KAAK,EAAE,CAAC;AACnC,SAAG,IAAI,WAAW,KAAK,OAAO,SAAS,KAAK;AAAA,IAC9C;AACA,WAAO,yBAAyB,GAAG,SAAS,CAAC;AAAA,EAC/C,GAAG,CAAC,UAAU,OAAO,CAAC;AAEtB,QAAM,eAAe,MAAM,QAAQ,MAAM;AACvC,UAAM,eAAe,SAAS,QAAQ,iBAAiB,GAAG,KAAK;AAC/D,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS,YAAqE;AAC5E,gBAAM,gBAAgB,KAAK,IAAI,CAAC,QAAQ;AACtC,kBAAM,MAA+B,CAAC;AACtC,uBAAW,OAAO,mBAAmB;AACnC,kBAAI,IAAI,KAAK,IAAK,IAAgC,IAAI,KAAK;AAAA,YAC7D;AACA,mBAAO;AAAA,UACT,CAAC;AACD,gBAAM,WAA2B;AAAA,YAC/B,SAAS,kBAAkB,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO,EAAE;AAAA,YAClF,MAAM;AAAA,UACR;AACA,iBAAO,EAAE,UAAU,UAAU,GAAG,YAAY,QAAQ;AAAA,QACtD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,QAAQ,CAAC,WAAkC,mBAAmB,MAAM;AAAA,QACpE,UAAU,MAAM,GAAG,YAAY;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,oBAAoB,MAAM,UAAU,iBAAiB,CAAC;AAE1D,QAAM,mBAAmB,MAAM,QAAQ,MAAM,sBAAsB,QAAQ,MAAM,EAAE,SAAS,GAAG,CAAC,MAAM,CAAC;AACvG,QAAM,UACJ,iCACE;AAAA,wBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAM,0BAA0B,mBAAmB,QAAQ,CAAC,IAAI,oCAEtE,GACF;AAAA,IACC,oBACC,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAM,0BAA0B,mBAAmB,QAAQ,CAAC,mBAAmB,oBAErF,GACF;AAAA,KAEJ;AAIF,QAAM,cAA2B,MAAM,QAAQ,MAAO;AAAA,IACpD,EAAE,IAAI,MAAM,OAAO,MAAM,MAAM,OAAO;AAAA,EACxC,GAAI,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,yBAAC,YACC;AAAA,2BAAC,eAAY,MAAI,MAAC,OAAM,gCAA+B,WAAU,QAC/D;AAAA,6BAAC,OAAE,WAAU,QAAO;AAAA;AAAA,UAC4G;AAAA,UAC9H,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,oDAAmD,qCAElH;AAAA,UAAK;AAAA,UAAI;AAAA,UACF;AAAA,UACP,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,6CAA4C,wCAE3G;AAAA,UAAK;AAAA,UAAI;AAAA,WAEX;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,+BAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gDAAkC;AAAA,YACpE,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM;AAAA;AAAA,oBAE7D,QAAQ;AAAA,mCACM,GAAO;AAAA,YAC3B,qBAAC,OAAE,WAAU,8BAA6B;AAAA;AAAA,cACb;AAAA,cAC3B,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,oDAAmD,+BAElH;AAAA,cAAK;AAAA,cAAI;AAAA,cACmB;AAAA,cAC5B,oBAAC,OAAE,WAAU,aAAY,QAAO,UAAS,KAAI,cAAa,MAAK,6CAA4C,kCAE3G;AAAA,cAAI;AAAA,eAEN;AAAA,aACF;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,6BAAe;AAAA,YACjD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM,sGACxB,GAAO;AAAA,aACpD;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,6CAA+B;AAAA,YACjE,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM,oHACV,GAAO;AAAA,YAChE,qBAAC,OAAE,WAAU,8BAA6B;AAAA;AAAA,cAAoC,oBAAC,UAAK,gBAAE;AAAA,cAAO;AAAA,eAAsB;AAAA,aACrH;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gCAAkB;AAAA,YACpD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAU5C,GAAO;AAAA,YAC9B,qBAAC,OAAE,WAAU,8BAA6B;AAAA;AAAA,cAAiD,oBAAC,UAAK,iBAAG;AAAA,cAAO;AAAA,eAA6C;AAAA,aAC1J;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gCAAkB;AAAA,YACpD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAU5C,GAAO;AAAA,aAChC;AAAA,UAEA,qBAAC,SACC;AAAA,gCAAC,SAAI,WAAU,oBAAmB,gCAAkB;AAAA,YACpD,oBAAC,SAAI,WAAU,8CAA6C,8BAAC,UAAM,sIAEJ,GAAO;AAAA,aACxE;AAAA,UAEA,qBAAC,SAAI,WAAU,yBAAwB;AAAA;AAAA,YAErC,qBAAC,QAAG,WAAU,iCACZ;AAAA,kCAAC,QAAG,0GAA4F;AAAA,cAChG,oBAAC,QAAG,2EAA6D;AAAA,cACjE,oBAAC,QAAG,8GAAqG;AAAA,eAC3G;AAAA,aACF;AAAA,WACF;AAAA,SACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,qBAAmB;AAAA,UACnB,OAAO,YAAY,QAAQ;AAAA,UAC3B;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,EAAE,SAAS,yBAAyB,QAAQ,GAAG;AAAA,UAC5D,UAAU;AAAA,UACV,SAAS;AAAA,UACT;AAAA,UACA,YAAY,CAAC,QACX;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL,EAAE,IAAI,QAAQ,OAAO,QAAQ,MAAM,0BAA0B,mBAAmB,QAAQ,CAAC,YAAY,mBAAmB,OAAQ,IAAY,EAAE,CAAC,CAAC,GAAG;AAAA,gBACnJ,EAAE,IAAI,UAAU,OAAO,UAAU,aAAa,MAAM,UAAU,YAAY;AACxE,wBAAM,WAAW,OAAQ,IAAY,EAAE;AACvC,sBAAI;AACF,0BAAM,YAAY,MAAM,QAAQ;AAAA,sBAC9B,OAAO;AAAA,sBACP,SAAS;AAAA,oBACX,CAAC;AACD,wBAAI,CAAC,UAAW;AAChB,0BAAM,kBAAkB;AAAA,sBACtB,WAAW,YAAY;AACrB,8BAAM,aAAa,MAAM;AAAA,0BACvB,0BAA2B,IAAY,SAAS;AAAA,0BAChD,MAAM;AAAA,4BACJ,kCAAkC,mBAAmB,QAAQ,CAAC,aAAa,mBAAmB,QAAQ,CAAC;AAAA,4BACvG,EAAE,QAAQ,SAAS;AAAA,0BACrB;AAAA,wBACF;AACA,4BAAI,CAAC,WAAW,IAAI;AAClB,gCAAM,eAAe,WAAW,UAAU,yBAAyB;AAAA,wBACrE;AAAA,sBACF;AAAA,sBACA,SAAS;AAAA,wBACP,QAAQ;AAAA,wBACR,cAAc;AAAA,wBACd,YAAY;AAAA,wBACZ,mBAAmB;AAAA,sBACrB;AAAA,oBACF,CAAC;AACD,0BAAM,IAAI,MAAM;AAAA,sBACd,kCAAkC,mBAAmB,QAAQ,CAAC,SAAS,IAAI,aAAa,QAAQ;AAAA,sBAChG;AAAA,sBACA;AAAA,wBACE,cAAc;AAAA,wBACd,UAAU,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE;AAAA,sBACjE;AAAA,oBACF;AACA,+BAAW,EAAE,SAAS,CAAC,CAAC;AACxB,6BAAS,EAAE,SAAS,CAAC;AACrB,kCAAc,EAAE,cAAc,CAAC;AAC/B,0BAAM,2BAA2B,SAAS;AAAA,kBAC5C,SAAS,OAAO;AACd,0BAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,0BAAM,SAAS,OAAO;AAAA,kBACxB;AAAA,gBACF,EAAE;AAAA,cACJ;AAAA;AAAA,UACF;AAAA,UAEF,UAAQ;AAAA,UACR;AAAA,UACA,iBAAiB;AAAA,UACjB,aAAa;AAAA,UACb,gBAAgB,CAAC,MAAM;AAAE,sBAAU,CAAC;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UAClD,gBAAgB,CAAC,SAAS;AAAE,4BAAgB,IAAI;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UAC9D,gBAAgB,MAAM;AAAE,4BAAgB,CAAC,CAAC;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UACxD,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA,UACvE,WAAW;AAAA;AAAA,MACb;AAAA,OACF;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": ["params"]
 }

package/dist/modules/feature_toggles/api/overrides/route.js

@@ -4,6 +4,10 @@ import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/op
 import { getOverrides } from "../../lib/queries.js";
 import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { logCrudAccess } from "@open-mercato/shared/lib/crud/factory";
 import { FeatureToggleOverride } from "../../data/entities.js";
 import { buildContext } from "../../lib/utils.js";
@@ -61,7 +65,7 @@ async function PUT(req) {
     if (!parsed.success) {
       return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
     }
-    const { scope } = await resolveFeatureCheckContext({
+    const { scope, organizationId } = await resolveFeatureCheckContext({
       container: ctx.container,
       auth: ctx.auth,
       request: req
@@ -84,6 +88,26 @@ async function PUT(req) {
         request: req
       });
     }
+    const guardUserId = ctx.auth?.userId ?? ctx.auth?.sub ?? null;
+    if (!guardUserId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const guardResourceKind = "feature_toggles.feature_toggle_override";
+    const guardResourceId = existingOverride?.id ?? parsed.data.toggleId;
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId: scope.tenantId,
+      organizationId: organizationId ?? null,
+      userId: guardUserId,
+      resourceKind: guardResourceKind,
+      resourceId: guardResourceId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = ctx.container.resolve("commandBus");
     const { result, logEntry } = await commandBus.execute("feature_toggles.overrides.changeState", {
       input: {
@@ -94,6 +118,19 @@ async function PUT(req) {
       },
       ctx
     });
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId: scope.tenantId,
+        organizationId: organizationId ?? null,
+        userId: guardUserId,
+        resourceKind: guardResourceKind,
+        resourceId: result?.overrideToggleId ?? guardResourceId,
+        operation: "update",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const response = NextResponse.json({
       ok: true,
       overrideToggleId: result?.overrideToggleId ?? null

package/dist/modules/feature_toggles/api/overrides/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/feature_toggles/api/overrides/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { getOverrides } from '../../lib/queries'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { FeatureToggleOverride } from '../../data/entities'\nimport { buildContext } from '../../lib/utils'\nimport { resolveFeatureCheckContext } from \"@open-mercato/core/modules/directory/utils/organizationScope\"\nimport { ProcessedChangeOverrideStateInput } from '../../data/validators'\nimport {\n  changeOverrideStateBaseSchema,\n  overrideListQuerySchema,\n  featureTogglesTag,\n  featureToggleOverrideListResponseSchema,\n  featureToggleErrorSchema,\n  changeOverrideStateResponseSchema,\n} from '../openapi'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\n\nexport async function GET(req: Request) {\n  const { auth, ctx, scope } = await buildContext(req)\n\n  const url = new URL(req.url)\n  const parsed = overrideListQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const tenant = await em.findOne(Tenant, {\n    id: scope.tenantId,\n  })\n\n  if (!tenant) {\n    return NextResponse.json({\n      error: 'Tenant context required. Please select a tenant.'\n    }, { status: 400 })\n  }\n\n  const result = await getOverrides(em, tenant, parsed.data)\n\n  await logCrudAccess({\n    container: ctx.container,\n    auth,\n    request: req,\n    items: [...result.raw.toggles, ...result.raw.overrides],\n    idField: 'id',\n    resourceKind: 'feature_toggles.override_list',\n    tenantId: scope.tenantId ?? null,\n    query: parsed.data,\n    accessType: 'read:list',\n    fields: ['id', 'toggleId', 'tenantId', 'identifier', 'name', 'category']\n  })\n\n  return NextResponse.json({\n    items: result.items,\n    total: result.total,\n    totalPages: result.totalPages,\n    page: result.page,\n    pageSize: result.pageSize,\n    isSuperAdmin: auth.isSuperAdmin ?? false\n  })\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const { ctx } = await buildContext(req)\n\n    const parsed = changeOverrideStateBaseSchema.safeParse(await req.json())\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n    }\n\n    const { scope } = await resolveFeatureCheckContext({\n      container: ctx.container,\n      auth: ctx.auth,\n      request: req\n    })\n\n    if (!scope.tenantId) {\n      return NextResponse.json({\n        error: 'Tenant context required. Please select a tenant.'\n      }, { status: 400 })\n    }\n\n    // Optimistic lock: refuse a stale override overwrite when two admins edit the\n    // same global toggle override in parallel. Only enforced when an override row\n    // already exists (first set has no prior version). Strictly additive.\n    const em = ctx.container.resolve('em') as EntityManager\n    const existingOverride = await em.findOne(FeatureToggleOverride, {\n      tenantId: scope.tenantId,\n      toggle: { id: parsed.data.toggleId },\n    })\n    if (existingOverride) {\n      enforceCommandOptimisticLock({\n        resourceKind: 'feature_toggles.feature_toggle_override',\n        resourceId: existingOverride.id,\n        current: existingOverride.updatedAt ?? null,\n        request: req,\n      })\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<ProcessedChangeOverrideStateInput, { overrideToggleId: string | null }>('feature_toggles.overrides.changeState', {\n      input: {\n        toggleId: parsed.data.toggleId,\n        tenantId: scope.tenantId,\n        isOverride: parsed.data.isOverride,\n        overrideValue: parsed.data.overrideValue,\n      },\n      ctx,\n    })\n\n    const response = NextResponse.json({\n      ok: true,\n      overrideToggleId: result?.overrideToggleId ?? null,\n    })\n\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'feature_toggles.override',\n          resourceId: logEntry.resourceId ?? result?.overrideToggleId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n\n    return response\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    if (message === 'NOT_FOUND') return NextResponse.json({ error: 'Not found' }, { status: 404 })\n    if (message === 'INVALID_STATE' || message === 'INVALID_TOGGLE_ID' || message === 'INVALID_TENANT_ID') {\n      return NextResponse.json({ error: message }, { status: 400 })\n    }\n    console.error('feature_toggles.overrides.changeState failed', error)\n    return NextResponse.json({ error: 'Failed to update override' }, { status: 500 })\n  }\n}\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['feature_toggles.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['feature_toggles.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst overrideGetDoc: OpenApiMethodDoc = {\n  summary: 'List overrides',\n  description: 'Returns list of feature toggle overrides.',\n  tags: [featureTogglesTag],\n  query: overrideListQuerySchema,\n  responses: [\n    { status: 200, description: 'List of overrides', schema: featureToggleOverrideListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid query parameters', schema: featureToggleErrorSchema },\n    { status: 401, description: 'Authentication required', schema: featureToggleErrorSchema },\n  ],\n}\n\nconst overridePutDoc: OpenApiMethodDoc = {\n  summary: 'Change override state',\n  description: 'Enable, disable or inherit a feature toggle for a specific tenant.',\n  tags: [featureTogglesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: changeOverrideStateBaseSchema,\n    description: 'Override details.',\n  },\n  responses: [\n    { status: 200, description: 'Override updated', schema: changeOverrideStateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: featureToggleErrorSchema },\n    { status: 401, description: 'Authentication required', schema: featureToggleErrorSchema },\n    { status: 404, description: 'Not found', schema: featureToggleErrorSchema },\n    { status: 500, description: 'Internal server error', schema: featureToggleErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: featureTogglesTag,\n  summary: 'Manage feature toggle overrides',\n  methods: {\n    GET: overrideGetDoc,\n    PUT: overridePutDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,cAAc;AAEvB,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,oCAAoC;AAC7C,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,MAAM,KAAK,MAAM,IAAI,MAAM,aAAa,GAAG;AAEnD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AAC/F,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ;AAAA,IACtC,IAAI,MAAM;AAAA,EACZ,CAAC;AAED,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,IACT,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAEA,QAAM,SAAS,MAAM,aAAa,IAAI,QAAQ,OAAO,IAAI;AAEzD,QAAM,cAAc;AAAA,IAClB,WAAW,IAAI;AAAA,IACf;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,GAAG,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,SAAS;AAAA,IACtD,SAAS;AAAA,IACT,cAAc;AAAA,IACd,UAAU,MAAM,YAAY;AAAA,IAC5B,OAAO,OAAO;AAAA,IACd,YAAY;AAAA,IACZ,QAAQ,CAAC,MAAM,YAAY,YAAY,cAAc,QAAQ,UAAU;AAAA,EACzE,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO;AAAA,IACd,OAAO,OAAO;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,cAAc,KAAK,gBAAgB;AAAA,EACrC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,aAAa,GAAG;AAEtC,UAAM,SAAS,8BAA8B,UAAU,MAAM,IAAI,KAAK,CAAC;AACvE,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AAEA,UAAM,EAAE,MAAM,IAAI,MAAM,2BAA2B;AAAA,MACjD,WAAW,IAAI;AAAA,MACf,MAAM,IAAI;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,MAAM,UAAU;AACnB,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO;AAAA,MACT,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAKA,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,mBAAmB,MAAM,GAAG,QAAQ,uBAAuB;AAAA,MAC/D,UAAU,MAAM;AAAA,MAChB,QAAQ,EAAE,IAAI,OAAO,KAAK,SAAS;AAAA,IACrC,CAAC;AACD,QAAI,kBAAkB;AACpB,mCAA6B;AAAA,QAC3B,cAAc;AAAA,QACd,YAAY,iBAAiB;AAAA,QAC7B,SAAS,iBAAiB,aAAa;AAAA,QACvC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAgF,yCAAyC;AAAA,MACrK,OAAO;AAAA,QACL,UAAU,OAAO,KAAK;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,YAAY,OAAO,KAAK;AAAA,QACxB,eAAe,OAAO,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI;AAAA,MACJ,kBAAkB,QAAQ,oBAAoB;AAAA,IAChD,CAAC;AAED,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,oBAAoB;AAAA,UAC/D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,YAAY,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,QAAI,YAAY,mBAAmB,YAAY,uBAAuB,YAAY,qBAAqB;AACrG,aAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9D;AACA,YAAQ,MAAM,gDAAgD,KAAK;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AAAA,EACpE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACxE;AAEO,MAAM,WAAW;AAExB,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wCAAwC;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,yBAAyB;AAAA,IACzF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,yBAAyB;AAAA,EAC1F;AACF;AAEA,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,EAC5F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,yBAAyB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,yBAAyB;AAAA,IACxF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,yBAAyB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,yBAAyB;AAAA,EACxF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { getOverrides } from '../../lib/queries'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { FeatureToggleOverride } from '../../data/entities'\nimport { buildContext } from '../../lib/utils'\nimport { resolveFeatureCheckContext } from \"@open-mercato/core/modules/directory/utils/organizationScope\"\nimport { ProcessedChangeOverrideStateInput } from '../../data/validators'\nimport {\n  changeOverrideStateBaseSchema,\n  overrideListQuerySchema,\n  featureTogglesTag,\n  featureToggleOverrideListResponseSchema,\n  featureToggleErrorSchema,\n  changeOverrideStateResponseSchema,\n} from '../openapi'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\n\nexport async function GET(req: Request) {\n  const { auth, ctx, scope } = await buildContext(req)\n\n  const url = new URL(req.url)\n  const parsed = overrideListQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const tenant = await em.findOne(Tenant, {\n    id: scope.tenantId,\n  })\n\n  if (!tenant) {\n    return NextResponse.json({\n      error: 'Tenant context required. Please select a tenant.'\n    }, { status: 400 })\n  }\n\n  const result = await getOverrides(em, tenant, parsed.data)\n\n  await logCrudAccess({\n    container: ctx.container,\n    auth,\n    request: req,\n    items: [...result.raw.toggles, ...result.raw.overrides],\n    idField: 'id',\n    resourceKind: 'feature_toggles.override_list',\n    tenantId: scope.tenantId ?? null,\n    query: parsed.data,\n    accessType: 'read:list',\n    fields: ['id', 'toggleId', 'tenantId', 'identifier', 'name', 'category']\n  })\n\n  return NextResponse.json({\n    items: result.items,\n    total: result.total,\n    totalPages: result.totalPages,\n    page: result.page,\n    pageSize: result.pageSize,\n    isSuperAdmin: auth.isSuperAdmin ?? false\n  })\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const { ctx } = await buildContext(req)\n\n    const parsed = changeOverrideStateBaseSchema.safeParse(await req.json())\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n    }\n\n    const { scope, organizationId } = await resolveFeatureCheckContext({\n      container: ctx.container,\n      auth: ctx.auth,\n      request: req\n    })\n\n    if (!scope.tenantId) {\n      return NextResponse.json({\n        error: 'Tenant context required. Please select a tenant.'\n      }, { status: 400 })\n    }\n\n    // Optimistic lock: refuse a stale override overwrite when two admins edit the\n    // same global toggle override in parallel. Only enforced when an override row\n    // already exists (first set has no prior version). Strictly additive.\n    const em = ctx.container.resolve('em') as EntityManager\n    const existingOverride = await em.findOne(FeatureToggleOverride, {\n      tenantId: scope.tenantId,\n      toggle: { id: parsed.data.toggleId },\n    })\n    if (existingOverride) {\n      enforceCommandOptimisticLock({\n        resourceKind: 'feature_toggles.feature_toggle_override',\n        resourceId: existingOverride.id,\n        current: existingOverride.updatedAt ?? null,\n        request: req,\n      })\n    }\n\n    // Run the CRUD mutation guard lifecycle so this custom write route honors\n    // module-level guard injections (and after-success hooks) like every other\n    // mutating endpoint. The override either updates an existing row or creates a\n    // new one, so the resource id falls back to the toggle id when no row exists.\n    const guardUserId = ctx.auth?.userId ?? ctx.auth?.sub ?? null\n    if (!guardUserId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const guardResourceKind = 'feature_toggles.feature_toggle_override'\n    const guardResourceId = existingOverride?.id ?? parsed.data.toggleId\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: scope.tenantId,\n      organizationId: organizationId ?? null,\n      userId: guardUserId,\n      resourceKind: guardResourceKind,\n      resourceId: guardResourceId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<ProcessedChangeOverrideStateInput, { overrideToggleId: string | null }>('feature_toggles.overrides.changeState', {\n      input: {\n        toggleId: parsed.data.toggleId,\n        tenantId: scope.tenantId,\n        isOverride: parsed.data.isOverride,\n        overrideValue: parsed.data.overrideValue,\n      },\n      ctx,\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: scope.tenantId,\n        organizationId: organizationId ?? null,\n        userId: guardUserId,\n        resourceKind: guardResourceKind,\n        resourceId: result?.overrideToggleId ?? guardResourceId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({\n      ok: true,\n      overrideToggleId: result?.overrideToggleId ?? null,\n    })\n\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'feature_toggles.override',\n          resourceId: logEntry.resourceId ?? result?.overrideToggleId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n\n    return response\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    if (message === 'NOT_FOUND') return NextResponse.json({ error: 'Not found' }, { status: 404 })\n    if (message === 'INVALID_STATE' || message === 'INVALID_TOGGLE_ID' || message === 'INVALID_TENANT_ID') {\n      return NextResponse.json({ error: message }, { status: 400 })\n    }\n    console.error('feature_toggles.overrides.changeState failed', error)\n    return NextResponse.json({ error: 'Failed to update override' }, { status: 500 })\n  }\n}\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['feature_toggles.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['feature_toggles.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst overrideGetDoc: OpenApiMethodDoc = {\n  summary: 'List overrides',\n  description: 'Returns list of feature toggle overrides.',\n  tags: [featureTogglesTag],\n  query: overrideListQuerySchema,\n  responses: [\n    { status: 200, description: 'List of overrides', schema: featureToggleOverrideListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid query parameters', schema: featureToggleErrorSchema },\n    { status: 401, description: 'Authentication required', schema: featureToggleErrorSchema },\n  ],\n}\n\nconst overridePutDoc: OpenApiMethodDoc = {\n  summary: 'Change override state',\n  description: 'Enable, disable or inherit a feature toggle for a specific tenant.',\n  tags: [featureTogglesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: changeOverrideStateBaseSchema,\n    description: 'Override details.',\n  },\n  responses: [\n    { status: 200, description: 'Override updated', schema: changeOverrideStateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: featureToggleErrorSchema },\n    { status: 401, description: 'Authentication required', schema: featureToggleErrorSchema },\n    { status: 404, description: 'Not found', schema: featureToggleErrorSchema },\n    { status: 500, description: 'Internal server error', schema: featureToggleErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: featureTogglesTag,\n  summary: 'Manage feature toggle overrides',\n  methods: {\n    GET: overrideGetDoc,\n    PUT: overridePutDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,cAAc;AAEvB,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,MAAM,KAAK,MAAM,IAAI,MAAM,aAAa,GAAG;AAEnD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AAC/F,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ;AAAA,IACtC,IAAI,MAAM;AAAA,EACZ,CAAC;AAED,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,IACT,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAEA,QAAM,SAAS,MAAM,aAAa,IAAI,QAAQ,OAAO,IAAI;AAEzD,QAAM,cAAc;AAAA,IAClB,WAAW,IAAI;AAAA,IACf;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,GAAG,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,SAAS;AAAA,IACtD,SAAS;AAAA,IACT,cAAc;AAAA,IACd,UAAU,MAAM,YAAY;AAAA,IAC5B,OAAO,OAAO;AAAA,IACd,YAAY;AAAA,IACZ,QAAQ,CAAC,MAAM,YAAY,YAAY,cAAc,QAAQ,UAAU;AAAA,EACzE,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO;AAAA,IACd,OAAO,OAAO;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,cAAc,KAAK,gBAAgB;AAAA,EACrC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,aAAa,GAAG;AAEtC,UAAM,SAAS,8BAA8B,UAAU,MAAM,IAAI,KAAK,CAAC;AACvE,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AAEA,UAAM,EAAE,OAAO,eAAe,IAAI,MAAM,2BAA2B;AAAA,MACjE,WAAW,IAAI;AAAA,MACf,MAAM,IAAI;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,MAAM,UAAU;AACnB,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO;AAAA,MACT,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAKA,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,mBAAmB,MAAM,GAAG,QAAQ,uBAAuB;AAAA,MAC/D,UAAU,MAAM;AAAA,MAChB,QAAQ,EAAE,IAAI,OAAO,KAAK,SAAS;AAAA,IACrC,CAAC;AACD,QAAI,kBAAkB;AACpB,mCAA6B;AAAA,QAC3B,cAAc;AAAA,QACd,YAAY,iBAAiB;AAAA,QAC7B,SAAS,iBAAiB,aAAa;AAAA,QACvC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAMA,UAAM,cAAc,IAAI,MAAM,UAAU,IAAI,MAAM,OAAO;AACzD,QAAI,CAAC,aAAa;AAChB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,oBAAoB;AAC1B,UAAM,kBAAkB,kBAAkB,MAAM,OAAO,KAAK;AAC5D,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,kBAAkB;AAAA,MAClC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAgF,yCAAyC;AAAA,MACrK,OAAO;AAAA,QACL,UAAU,OAAO,KAAK;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,YAAY,OAAO,KAAK;AAAA,QACxB,eAAe,OAAO,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,kBAAkB;AAAA,QAClC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,QAAQ,oBAAoB;AAAA,QACxC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI;AAAA,MACJ,kBAAkB,QAAQ,oBAAoB;AAAA,IAChD,CAAC;AAED,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,oBAAoB;AAAA,UAC/D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,YAAY,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,QAAI,YAAY,mBAAmB,YAAY,uBAAuB,YAAY,qBAAqB;AACrG,aAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9D;AACA,YAAQ,MAAM,gDAAgD,KAAK;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AAAA,EACpE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACxE;AAEO,MAAM,WAAW;AAExB,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wCAAwC;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,yBAAyB;AAAA,IACzF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,yBAAyB;AAAA,EAC1F;AACF;AAEA,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,EAC5F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,yBAAyB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,yBAAyB;AAAA,IACxF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,yBAAyB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,yBAAyB;AAAA,EACxF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/inbox_ops/api/emails/[id]/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from "next/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { InboxEmail } from "../../../data/entities.js";
 import {
   resolveRequestContext,
@@ -50,6 +54,19 @@ async function DELETE(req) {
       return NextResponse.json({ error: "Missing email ID" }, { status: 400 });
     }
     const ctx = await resolveRequestContext(req);
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      userId: ctx.userId,
+      resourceKind: "inbox_ops:inbox_email",
+      resourceId: id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const updated = await ctx.em.nativeUpdate(
       InboxEmail,
       {
@@ -63,6 +80,19 @@ async function DELETE(req) {
     if (updated === 0) {
       return NextResponse.json({ error: "Email not found" }, { status: 404 });
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        userId: ctx.userId,
+        resourceKind: "inbox_ops:inbox_email",
+        resourceId: id,
+        operation: "delete",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     return NextResponse.json({ ok: true });
   } catch (err) {
     if (err instanceof UnauthorizedError) {

package/dist/modules/inbox_ops/api/emails/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/inbox_ops/api/emails/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { InboxEmail } from '../../../data/entities'\nimport {\n  resolveRequestContext,\n  extractPathSegment,\n  UnauthorizedError,\n} from '../../routeHelpers'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['inbox_ops.log.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const id = extractPathSegment(url, 'emails')\n\n    if (!id) {\n      return NextResponse.json({ error: 'Missing email ID' }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n\n    const email = await findOneWithDecryption(\n      ctx.em,\n      InboxEmail,\n      {\n        id,\n        organizationId: ctx.organizationId,\n        tenantId: ctx.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      ctx.scope,\n    )\n\n    if (!email) {\n      return NextResponse.json({ error: 'Email not found' }, { status: 404 })\n    }\n\n    return NextResponse.json({ email })\n  } catch (err) {\n    if (err instanceof UnauthorizedError) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    console.error('[inbox_ops:emails:detail] Error:', err)\n    return NextResponse.json({ error: 'Failed to load email' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const id = extractPathSegment(url, 'emails')\n\n    if (!id) {\n      return NextResponse.json({ error: 'Missing email ID' }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n\n    const updated = await ctx.em.nativeUpdate(\n      InboxEmail,\n      {\n        id,\n        organizationId: ctx.organizationId,\n        tenantId: ctx.tenantId,\n        deletedAt: null,\n      },\n      { deletedAt: new Date() },\n    )\n\n    if (updated === 0) {\n      return NextResponse.json({ error: 'Email not found' }, { status: 404 })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (err instanceof UnauthorizedError) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    console.error('[inbox_ops:emails:delete] Error:', err)\n    return NextResponse.json({ error: 'Failed to delete email' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Email detail',\n  methods: {\n    GET: {\n      summary: 'Get email detail with parsed thread',\n      responses: [\n        { status: 200, description: 'Email detail' },\n        { status: 404, description: 'Email not found' },\n      ],\n    },\n    DELETE: {\n      summary: 'Soft-delete an inbox email',\n      responses: [\n        { status: 200, description: 'Email deleted' },\n        { status: 404, description: 'Email not found' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,6BAA6B;AACtC,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EAClE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC/E;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,KAAK,mBAAmB,KAAK,QAAQ;AAE3C,QAAI,CAAC,IAAI;AACP,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzE;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAE3C,UAAM,QAAQ,MAAM;AAAA,MAClB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA,gBAAgB,IAAI;AAAA,QACpB,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,IAAI;AAAA,IACN;AAEA,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxE;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,YAAQ,MAAM,oCAAoC,GAAG;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,KAAK,mBAAmB,KAAK,QAAQ;AAE3C,QAAI,CAAC,IAAI;AACP,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzE;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAE3C,UAAM,UAAU,MAAM,IAAI,GAAG;AAAA,MAC3B;AAAA,MACA;AAAA,QACE;AAAA,QACA,gBAAgB,IAAI;AAAA,QACpB,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,MACb;AAAA,MACA,EAAE,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC1B;AAEA,QAAI,YAAY,GAAG;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxE;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,YAAQ,MAAM,oCAAoC,GAAG;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { InboxEmail } from '../../../data/entities'\nimport {\n  resolveRequestContext,\n  extractPathSegment,\n  UnauthorizedError,\n} from '../../routeHelpers'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['inbox_ops.log.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const id = extractPathSegment(url, 'emails')\n\n    if (!id) {\n      return NextResponse.json({ error: 'Missing email ID' }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n\n    const email = await findOneWithDecryption(\n      ctx.em,\n      InboxEmail,\n      {\n        id,\n        organizationId: ctx.organizationId,\n        tenantId: ctx.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      ctx.scope,\n    )\n\n    if (!email) {\n      return NextResponse.json({ error: 'Email not found' }, { status: 404 })\n    }\n\n    return NextResponse.json({ email })\n  } catch (err) {\n    if (err instanceof UnauthorizedError) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    console.error('[inbox_ops:emails:detail] Error:', err)\n    return NextResponse.json({ error: 'Failed to load email' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const id = extractPathSegment(url, 'emails')\n\n    if (!id) {\n      return NextResponse.json({ error: 'Missing email ID' }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      userId: ctx.userId,\n      resourceKind: 'inbox_ops:inbox_email',\n      resourceId: id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const updated = await ctx.em.nativeUpdate(\n      InboxEmail,\n      {\n        id,\n        organizationId: ctx.organizationId,\n        tenantId: ctx.tenantId,\n        deletedAt: null,\n      },\n      { deletedAt: new Date() },\n    )\n\n    if (updated === 0) {\n      return NextResponse.json({ error: 'Email not found' }, { status: 404 })\n    }\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: ctx.userId,\n        resourceKind: 'inbox_ops:inbox_email',\n        resourceId: id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (err instanceof UnauthorizedError) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    console.error('[inbox_ops:emails:delete] Error:', err)\n    return NextResponse.json({ error: 'Failed to delete email' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Email detail',\n  methods: {\n    GET: {\n      summary: 'Get email detail with parsed thread',\n      responses: [\n        { status: 200, description: 'Email detail' },\n        { status: 404, description: 'Email not found' },\n      ],\n    },\n    DELETE: {\n      summary: 'Soft-delete an inbox email',\n      responses: [\n        { status: 200, description: 'Email deleted' },\n        { status: 404, description: 'Email not found' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EAClE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC/E;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,KAAK,mBAAmB,KAAK,QAAQ;AAE3C,QAAI,CAAC,IAAI;AACP,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzE;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAE3C,UAAM,QAAQ,MAAM;AAAA,MAClB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA,gBAAgB,IAAI;AAAA,QACpB,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,IAAI;AAAA,IACN;AAEA,QAAI,CAAC,OAAO;AACV,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxE;AAEA,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,YAAQ,MAAM,oCAAoC,GAAG;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,KAAK,mBAAmB,KAAK,QAAQ;AAE3C,QAAI,CAAC,IAAI;AACP,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzE;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAE3C,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,UAAU,MAAM,IAAI,GAAG;AAAA,MAC3B;AAAA,MACA;AAAA,QACE;AAAA,QACA,gBAAgB,IAAI;AAAA,QACpB,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,MACb;AAAA,MACA,EAAE,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC1B;AAEA,QAAI,YAAY,GAAG;AACjB,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxE;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,YAAQ,MAAM,oCAAoC,GAAG;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/inbox_ops/api/proposals/[id]/accept-all/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from "next/server";
 import { runWithCacheTenant } from "@open-mercato/cache";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { acceptAllActions } from "../../../../lib/executionEngine.js";
 import { resolveCache, invalidateCountsCache } from "../../../../lib/cache.js";
 import {
@@ -18,6 +22,19 @@ async function POST(req) {
     const ctx = await resolveRequestContext(req);
     const proposal = await resolveProposal(new URL(req.url), ctx);
     if (isErrorResponse(proposal)) return proposal;
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      userId: ctx.userId,
+      resourceKind: "inbox_ops:inbox_proposal",
+      resourceId: proposal.id,
+      operation: "custom",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const entities = resolveCrossModuleEntities(ctx.container);
     const { results, stoppedOnFailure } = await acceptAllActions(
       proposal.id,
@@ -25,6 +42,19 @@ async function POST(req) {
     );
     const succeeded = results.filter((r) => r.success).length;
     const failed = results.filter((r) => !r.success).length;
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        userId: ctx.userId,
+        resourceKind: "inbox_ops:inbox_proposal",
+        resourceId: proposal.id,
+        operation: "custom",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const cache = resolveCache(ctx.container);
     await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId));
     return NextResponse.json({ ok: !stoppedOnFailure, succeeded, failed, stoppedOnFailure, results });

package/dist/modules/inbox_ops/api/proposals/[id]/accept-all/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/inbox_ops/api/proposals/%5Bid%5D/accept-all/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { acceptAllActions } from '../../../../lib/executionEngine'\nimport { resolveCache, invalidateCountsCache } from '../../../../lib/cache'\nimport {\n  resolveRequestContext,\n  resolveProposal,\n  resolveCrossModuleEntities,\n  toExecutionContext,\n  handleRouteError,\n  isErrorResponse,\n} from '../../../routeHelpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const ctx = await resolveRequestContext(req)\n    const proposal = await resolveProposal(new URL(req.url), ctx)\n    if (isErrorResponse(proposal)) return proposal\n\n    const entities = resolveCrossModuleEntities(ctx.container)\n    const { results, stoppedOnFailure } = await acceptAllActions(\n      proposal.id,\n      toExecutionContext(ctx, entities),\n    )\n\n    const succeeded = results.filter((r) => r.success).length\n    const failed = results.filter((r) => !r.success).length\n\n    const cache = resolveCache(ctx.container)\n    await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId))\n\n    return NextResponse.json({ ok: !stoppedOnFailure, succeeded, failed, stoppedOnFailure, results })\n  } catch (err) {\n    return handleRouteError(err, 'accept all actions')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Accept all actions',\n  methods: {\n    POST: {\n      summary: 'Accept and execute all pending actions in a proposal',\n      responses: [\n        { status: 200, description: 'All actions processed' },\n        { status: 404, description: 'Proposal not found' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC,SAAS,wBAAwB;AACjC,SAAS,cAAc,6BAA6B;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAC3C,UAAM,WAAW,MAAM,gBAAgB,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG;AAC5D,QAAI,gBAAgB,QAAQ,EAAG,QAAO;AAEtC,UAAM,WAAW,2BAA2B,IAAI,SAAS;AACzD,UAAM,EAAE,SAAS,iBAAiB,IAAI,MAAM;AAAA,MAC1C,SAAS;AAAA,MACT,mBAAmB,KAAK,QAAQ;AAAA,IAClC;AAEA,UAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACnD,UAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE;AAEjD,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,mBAAmB,IAAI,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAEvF,WAAO,aAAa,KAAK,EAAE,IAAI,CAAC,kBAAkB,WAAW,QAAQ,kBAAkB,QAAQ,CAAC;AAAA,EAClG,SAAS,KAAK;AACZ,WAAO,iBAAiB,KAAK,oBAAoB;AAAA,EACnD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { acceptAllActions } from '../../../../lib/executionEngine'\nimport { resolveCache, invalidateCountsCache } from '../../../../lib/cache'\nimport {\n  resolveRequestContext,\n  resolveProposal,\n  resolveCrossModuleEntities,\n  toExecutionContext,\n  handleRouteError,\n  isErrorResponse,\n} from '../../../routeHelpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const ctx = await resolveRequestContext(req)\n    const proposal = await resolveProposal(new URL(req.url), ctx)\n    if (isErrorResponse(proposal)) return proposal\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      userId: ctx.userId,\n      resourceKind: 'inbox_ops:inbox_proposal',\n      resourceId: proposal.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const entities = resolveCrossModuleEntities(ctx.container)\n    const { results, stoppedOnFailure } = await acceptAllActions(\n      proposal.id,\n      toExecutionContext(ctx, entities),\n    )\n\n    const succeeded = results.filter((r) => r.success).length\n    const failed = results.filter((r) => !r.success).length\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: ctx.userId,\n        resourceKind: 'inbox_ops:inbox_proposal',\n        resourceId: proposal.id,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const cache = resolveCache(ctx.container)\n    await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId))\n\n    return NextResponse.json({ ok: !stoppedOnFailure, succeeded, failed, stoppedOnFailure, results })\n  } catch (err) {\n    return handleRouteError(err, 'accept all actions')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Accept all actions',\n  methods: {\n    POST: {\n      summary: 'Accept and execute all pending actions in a proposal',\n      responses: [\n        { status: 200, description: 'All actions processed' },\n        { status: 404, description: 'Proposal not found' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,cAAc,6BAA6B;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAC3C,UAAM,WAAW,MAAM,gBAAgB,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG;AAC5D,QAAI,gBAAgB,QAAQ,EAAG,QAAO;AAEtC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,cAAc;AAAA,MACd,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,WAAW,2BAA2B,IAAI,SAAS;AACzD,UAAM,EAAE,SAAS,iBAAiB,IAAI,MAAM;AAAA,MAC1C,SAAS;AAAA,MACT,mBAAmB,KAAK,QAAQ;AAAA,IAClC;AAEA,UAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACnD,UAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE;AAEjD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,mBAAmB,IAAI,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAEvF,WAAO,aAAa,KAAK,EAAE,IAAI,CAAC,kBAAkB,WAAW,QAAQ,kBAAkB,QAAQ,CAAC;AAAA,EAClG,SAAS,KAAK;AACZ,WAAO,iBAAiB,KAAK,oBAAoB;AAAA,EACnD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/inbox_ops/api/proposals/[id]/actions/[actionId]/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from "next/server";
 import { runWithCacheTenant } from "@open-mercato/cache";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { actionEditSchema, validateActionPayloadForType } from "../../../../../data/validators.js";
 import { emitInboxOpsEvent } from "../../../../../events.js";
 import { resolveCache, invalidateCountsCache } from "../../../../../lib/cache.js";
@@ -31,8 +35,35 @@ async function PATCH(req) {
     if (!payloadValidation.success) {
       return NextResponse.json({ error: payloadValidation.error }, { status: 400 });
     }
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      userId: ctx.userId,
+      resourceKind: "inbox_ops:inbox_proposal_action",
+      resourceId: action.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     action.payload = mergedPayload;
     await ctx.em.flush();
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        userId: ctx.userId,
+        resourceKind: "inbox_ops:inbox_proposal_action",
+        resourceId: action.id,
+        operation: "update",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const cache = resolveCache(ctx.container);
     await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId));
     try {

package/dist/modules/inbox_ops/api/proposals/[id]/actions/[actionId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/inbox_ops/api/proposals/%5Bid%5D/actions/%5BactionId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { actionEditSchema, validateActionPayloadForType } from '../../../../../data/validators'\nimport { emitInboxOpsEvent } from '../../../../../events'\nimport { resolveCache, invalidateCountsCache } from '../../../../../lib/cache'\nimport {\n  resolveRequestContext,\n  resolveActionAndProposal,\n  handleRouteError,\n  isErrorResponse,\n} from '../../../../routeHelpers'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function PATCH(req: Request) {\n  try {\n    const body = await req.json()\n    const parsed = actionEditSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n    const resolved = await resolveActionAndProposal(new URL(req.url), ctx)\n    if (isErrorResponse(resolved)) return resolved\n\n    const { action } = resolved\n\n    if (action.status !== 'pending' && action.status !== 'failed') {\n      return NextResponse.json({ error: 'Action already processed' }, { status: 409 })\n    }\n\n    const mergedPayload = { ...action.payload as Record<string, unknown>, ...parsed.data.payload }\n    const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload)\n    if (!payloadValidation.success) {\n      return NextResponse.json({ error: payloadValidation.error }, { status: 400 })\n    }\n\n    action.payload = mergedPayload\n    await ctx.em.flush()\n\n    const cache = resolveCache(ctx.container)\n    await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId))\n\n    try {\n      await emitInboxOpsEvent('inbox_ops.action.edited', {\n        actionId: action.id,\n        proposalId: action.proposalId,\n        actionType: action.actionType,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n      })\n    } catch (eventError) {\n      console.error('[inbox_ops:action:edit] Failed to emit event:', eventError)\n    }\n\n    return NextResponse.json({ ok: true, action })\n  } catch (err) {\n    return handleRouteError(err, 'edit action')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Edit action',\n  methods: {\n    PATCH: {\n      summary: 'Edit action payload before accepting',\n      responses: [\n        { status: 200, description: 'Action updated' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already processed' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC,SAAS,kBAAkB,oCAAoC;AAC/D,SAAS,yBAAyB;AAClC,SAAS,cAAc,6BAA6B;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC9E;AAEA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtG;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAC3C,UAAM,WAAW,MAAM,yBAAyB,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG;AACrE,QAAI,gBAAgB,QAAQ,EAAG,QAAO;AAEtC,UAAM,EAAE,OAAO,IAAI;AAEnB,QAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC7D,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,gBAAgB,EAAE,GAAG,OAAO,SAAoC,GAAG,OAAO,KAAK,QAAQ;AAC7F,UAAM,oBAAoB,6BAA6B,OAAO,YAAY,aAAa;AACvF,QAAI,CAAC,kBAAkB,SAAS;AAC9B,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,WAAO,UAAU;AACjB,UAAM,IAAI,GAAG,MAAM;AAEnB,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,mBAAmB,IAAI,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAEvF,QAAI;AACF,YAAM,kBAAkB,2BAA2B;AAAA,QACjD,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,YAAY;AACnB,cAAQ,MAAM,iDAAiD,UAAU;AAAA,IAC3E;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,WAAO,iBAAiB,KAAK,aAAa;AAAA,EAC5C;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { actionEditSchema, validateActionPayloadForType } from '../../../../../data/validators'\nimport { emitInboxOpsEvent } from '../../../../../events'\nimport { resolveCache, invalidateCountsCache } from '../../../../../lib/cache'\nimport {\n  resolveRequestContext,\n  resolveActionAndProposal,\n  handleRouteError,\n  isErrorResponse,\n} from '../../../../routeHelpers'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function PATCH(req: Request) {\n  try {\n    const body = await req.json()\n    const parsed = actionEditSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n    const resolved = await resolveActionAndProposal(new URL(req.url), ctx)\n    if (isErrorResponse(resolved)) return resolved\n\n    const { action } = resolved\n\n    if (action.status !== 'pending' && action.status !== 'failed') {\n      return NextResponse.json({ error: 'Action already processed' }, { status: 409 })\n    }\n\n    const mergedPayload = { ...action.payload as Record<string, unknown>, ...parsed.data.payload }\n    const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload)\n    if (!payloadValidation.success) {\n      return NextResponse.json({ error: payloadValidation.error }, { status: 400 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      userId: ctx.userId,\n      resourceKind: 'inbox_ops:inbox_proposal_action',\n      resourceId: action.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    action.payload = mergedPayload\n    await ctx.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: ctx.userId,\n        resourceKind: 'inbox_ops:inbox_proposal_action',\n        resourceId: action.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const cache = resolveCache(ctx.container)\n    await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId))\n\n    try {\n      await emitInboxOpsEvent('inbox_ops.action.edited', {\n        actionId: action.id,\n        proposalId: action.proposalId,\n        actionType: action.actionType,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n      })\n    } catch (eventError) {\n      console.error('[inbox_ops:action:edit] Failed to emit event:', eventError)\n    }\n\n    return NextResponse.json({ ok: true, action })\n  } catch (err) {\n    return handleRouteError(err, 'edit action')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Edit action',\n  methods: {\n    PATCH: {\n      summary: 'Edit action payload before accepting',\n      responses: [\n        { status: 200, description: 'Action updated' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already processed' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,oCAAoC;AAC/D,SAAS,yBAAyB;AAClC,SAAS,cAAc,6BAA6B;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC9E;AAEA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtG;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAC3C,UAAM,WAAW,MAAM,yBAAyB,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG;AACrE,QAAI,gBAAgB,QAAQ,EAAG,QAAO;AAEtC,UAAM,EAAE,OAAO,IAAI;AAEnB,QAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC7D,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,gBAAgB,EAAE,GAAG,OAAO,SAAoC,GAAG,OAAO,KAAK,QAAQ;AAC7F,UAAM,oBAAoB,6BAA6B,OAAO,YAAY,aAAa;AACvF,QAAI,CAAC,kBAAkB,SAAS;AAC9B,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,WAAO,UAAU;AACjB,UAAM,IAAI,GAAG,MAAM;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,mBAAmB,IAAI,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAEvF,QAAI;AACF,YAAM,kBAAkB,2BAA2B;AAAA,QACjD,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,YAAY;AACnB,cAAQ,MAAM,iDAAiD,UAAU;AAAA,IAC3E;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,WAAO,iBAAiB,KAAK,aAAa;AAAA,EAC5C;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/inbox_ops/api/proposals/[id]/categorize/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from "next/server";
 import { runWithCacheTenant } from "@open-mercato/cache";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { categorizeProposalSchema } from "../../../../data/validators.js";
 import { resolveCache, invalidateCountsCache } from "../../../../lib/cache.js";
 import {
@@ -22,9 +26,36 @@ async function POST(req) {
       const issues = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
       return NextResponse.json({ error: `Invalid category: ${issues}` }, { status: 400 });
     }
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      userId: ctx.userId,
+      resourceKind: "inbox_ops:inbox_proposal",
+      resourceId: proposal.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const previousCategory = proposal.category || null;
     proposal.category = parsed.data.category;
     await ctx.em.flush();
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        userId: ctx.userId,
+        resourceKind: "inbox_ops:inbox_proposal",
+        resourceId: proposal.id,
+        operation: "update",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const cache = resolveCache(ctx.container);
     await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId));
     return NextResponse.json({