@open-mercato/core 0.6.6-develop.6205.1.109e4b6a84 → 0.6.6-develop.6227.1.2695efff30

package/dist/modules/messages/components/message-detail/hooks/useMessageDetailsActions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/components/message-detail/hooks/useMessageDetailsActions.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport type { UseQueryResult } from '@tanstack/react-query'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport type { MessageActionsProps, MessageContentProps } from '@open-mercato/shared/modules/messages/types'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type {\n  ActionResult,\n  MessageAction,\n  MessageAttachment,\n  MessageDetail,\n  PendingActionConfirmation,\n} from '../types'\nimport { isSafeNavigationHref, parseObjectActionId, toErrorMessage } from '../utils'\n\ntype RequestAndRefreshOptions = {\n  skipDetailAutoMarkRead?: boolean\n}\n\ntype ConversationActionKind = 'archiveConversation' | 'deleteConversation' | 'markAllUnread'\n\ntype UseMessageDetailsActionsInput = {\n  id: string\n  t: TranslateFn\n  detail: MessageDetail | null\n  detailQuery: UseQueryResult<MessageDetail | null, Error>\n  attachments: MessageAttachment[] | undefined\n  isArchived: boolean\n  onDeleted: () => void\n  refreshDetailWithoutAutoMarkRead: () => Promise<MessageDetail | null>\n}\n\nexport function useMessageDetailsActions({\n  id,\n  t,\n  detail,\n  detailQuery,\n  attachments,\n  isArchived,\n  onDeleted,\n  refreshDetailWithoutAutoMarkRead,\n}: UseMessageDetailsActionsInput) {\n  const [replyOpen, setReplyOpen] = React.useState(false)\n  const [forwardOpen, setForwardOpen] = React.useState(false)\n  const [editOpen, setEditOpen] = React.useState(false)\n  const [updatingState, setUpdatingState] = React.useState(false)\n  const [executingActionId, setExecutingActionId] = React.useState<string | null>(null)\n  const [pendingActionConfirmation, setPendingActionConfirmation] = React.useState<PendingActionConfirmation | null>(null)\n  const [deleteConfirmationOpen, setDeleteConfirmationOpen] = React.useState(false)\n  const [activeConversationAction, setActiveConversationAction] = React.useState<ConversationActionKind | null>(null)\n\n  const requestAndRefresh = React.useCallback(async (\n    url: string,\n    method: 'PUT' | 'DELETE',\n    options?: RequestAndRefreshOptions,\n  ) => {\n    setUpdatingState(true)\n    try {\n      const call = await apiCall<{ ok?: boolean }>(url, { method })\n      if (!call.ok) {\n        throw new Error(\n          toErrorMessage(call.result)\n          ?? t('messages.errors.stateChangeFailed', 'Failed to update message state.'),\n        )\n      }\n      if (options?.skipDetailAutoMarkRead) {\n        await refreshDetailWithoutAutoMarkRead()\n      } else {\n        await detailQuery.refetch()\n      }\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.stateChangeFailed', 'Failed to update message state.'),\n        'error',\n      )\n    } finally {\n      setUpdatingState(false)\n    }\n  }, [detailQuery, refreshDetailWithoutAutoMarkRead, t])\n\n  const handleDelete = React.useCallback(async () => {\n    setUpdatingState(true)\n    try {\n      const call = await apiCall<{ ok?: boolean }>(`/api/messages/${encodeURIComponent(id)}`, {\n        method: 'DELETE',\n      })\n      if (!call.ok) {\n        throw new Error(toErrorMessage(call.result) ?? t('messages.errors.deleteFailed', 'Failed to delete message.'))\n      }\n      flash(t('messages.flash.deleted', 'Message deleted.'), 'success')\n      onDeleted()\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.deleteFailed', 'Failed to delete message.'),\n        'error',\n      )\n    } finally {\n      setUpdatingState(false)\n    }\n  }, [id, onDeleted, t])\n\n  const runConversationAction = React.useCallback(async (\n    action: ConversationActionKind,\n    options: {\n      url: string\n      method: 'PUT' | 'DELETE'\n      successMessage: string\n      skipDetailAutoMarkRead?: boolean\n      onSuccess?: () => void\n    },\n  ) => {\n    setActiveConversationAction(action)\n    try {\n      const call = await apiCall<{ ok?: boolean; affectedCount?: number }>(options.url, { method: options.method })\n      if (!call.ok) {\n        throw new Error(\n          toErrorMessage(call.result)\n          ?? t('messages.errors.conversationActionFailed', 'Failed to update conversation.'),\n        )\n      }\n\n      flash(options.successMessage, 'success')\n\n      if (options.onSuccess) {\n        options.onSuccess()\n        return\n      }\n\n      if (options.skipDetailAutoMarkRead) {\n        await refreshDetailWithoutAutoMarkRead()\n      } else {\n        await detailQuery.refetch()\n      }\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.conversationActionFailed', 'Failed to update conversation.'),\n        'error',\n      )\n    } finally {\n      setActiveConversationAction(null)\n    }\n  }, [detailQuery, refreshDetailWithoutAutoMarkRead, t])\n\n  const archiveConversation = React.useCallback(async (messageId?: string) => {\n    const targetMessageId = messageId ?? id\n    await runConversationAction('archiveConversation', {\n      url: `/api/messages/${encodeURIComponent(targetMessageId)}/conversation/archive`,\n      method: 'PUT',\n      successMessage: t('messages.flash.conversationArchived', 'Conversation archived.'),\n    })\n  }, [id, runConversationAction, t])\n\n  const markConversationUnread = React.useCallback(async (messageId?: string) => {\n    const targetMessageId = messageId ?? id\n    await runConversationAction('markAllUnread', {\n      url: `/api/messages/${encodeURIComponent(targetMessageId)}/conversation/read`,\n      method: 'DELETE',\n      successMessage: t('messages.flash.conversationMarkedUnread', 'Conversation marked unread.'),\n      skipDetailAutoMarkRead: true,\n    })\n  }, [id, runConversationAction, t])\n\n  const deleteConversation = React.useCallback(async (messageId?: string) => {\n    const targetMessageId = messageId ?? id\n    await runConversationAction('deleteConversation', {\n      url: `/api/messages/${encodeURIComponent(targetMessageId)}/conversation`,\n      method: 'DELETE',\n      successMessage: t('messages.flash.conversationDeleted', 'Conversation deleted.'),\n      onSuccess: onDeleted,\n    })\n  }, [id, onDeleted, runConversationAction, t])\n\n  const handleDeleteDialogKeyDown = React.useCallback((event: React.KeyboardEvent<HTMLDivElement>) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      void handleDelete()\n      return\n    }\n\n    if (event.key === 'Escape') {\n      event.preventDefault()\n      setDeleteConfirmationOpen(false)\n    }\n  }, [handleDelete])\n\n  const executeAction = React.useCallback(async (action: MessageAction, payload?: Record<string, unknown>) => {\n    setExecutingActionId(action.id)\n    try {\n      const call = await apiCall<ActionResult>(\n        `/api/messages/${encodeURIComponent(id)}/actions/${encodeURIComponent(action.id)}`,\n        {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(payload ?? {}),\n        },\n      )\n\n      if (!call.ok) {\n        throw new Error(\n          toErrorMessage(call.result)\n          ?? t('messages.errors.actionFailed', 'Failed to execute action.'),\n        )\n      }\n\n      flash(t('messages.flash.actionSuccess', 'Action completed.'), 'success')\n\n      const redirectTarget = call.result?.result?.redirect\n      if (\n        typeof redirectTarget === 'string'\n        && redirectTarget.trim().length > 0\n        && isSafeNavigationHref(redirectTarget)\n      ) {\n        window.location.href = redirectTarget\n        return\n      }\n\n      await detailQuery.refetch()\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.actionFailed', 'Failed to execute action.'),\n        'error',\n      )\n    } finally {\n      setExecutingActionId(null)\n    }\n  }, [detailQuery, id, t])\n\n  const handleExecuteAction = React.useCallback(async (action: MessageAction, payload?: Record<string, unknown>) => {\n    if (executingActionId || detail?.actionTaken) return\n\n    if (action.confirmRequired) {\n      setPendingActionConfirmation({ action, payload })\n      return\n    }\n\n    await executeAction(action, payload)\n  }, [detail?.actionTaken, executeAction, executingActionId])\n\n  const handleConfirmPendingAction = React.useCallback(async () => {\n    if (!pendingActionConfirmation || executingActionId || detail?.actionTaken) return\n    const { action, payload } = pendingActionConfirmation\n    setPendingActionConfirmation(null)\n    await executeAction(action, payload)\n  }, [detail?.actionTaken, executeAction, executingActionId, pendingActionConfirmation])\n\n  const handleActionConfirmDialogKeyDown = React.useCallback((event: React.KeyboardEvent<HTMLDivElement>) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      void handleConfirmPendingAction()\n      return\n    }\n\n    if (event.key === 'Escape') {\n      event.preventDefault()\n      setPendingActionConfirmation(null)\n    }\n  }, [handleConfirmPendingAction])\n\n  const contentProps = React.useMemo<MessageContentProps>(() => ({\n    message: {\n      id: detail?.id ?? '',\n      type: detail?.type ?? 'default',\n      subject: detail?.subject ?? '',\n      body: detail?.body ?? '',\n      bodyFormat: detail?.bodyFormat ?? 'text',\n      priority: (detail?.priority ?? 'normal') as 'low' | 'normal' | 'high' | 'urgent',\n      sentAt: detail?.sentAt ? new Date(detail.sentAt) : null,\n      senderName: detail?.senderName ?? undefined,\n      senderUserId: detail?.senderUserId ?? '',\n      actionData: detail?.actionData ?? null,\n      actionTaken: detail?.actionTaken ?? null,\n      actionTakenAt: detail?.actionTakenAt ? new Date(detail.actionTakenAt) : null,\n    },\n    objects: (detail?.objects ?? []).map((item) => ({\n      id: item.id,\n      entityModule: item.entityModule,\n      entityType: item.entityType,\n      entityId: item.entityId,\n      actionRequired: item.actionRequired,\n      snapshot: item.snapshot ?? undefined,\n    })),\n    attachments: (attachments ?? []).map((item) => ({\n      id: item.id,\n      fileName: item.fileName,\n      fileSize: item.fileSize,\n      mimeType: item.mimeType,\n      url: item.url,\n    })),\n  }), [attachments, detail])\n\n  const handleExecuteActionById = React.useCallback<MessageActionsProps['onExecuteAction']>(async (actionId, payload) => {\n    const action = detail?.actionData?.actions?.find((entry) => {\n      if (parseObjectActionId(entry.id)) return false\n      return entry.id === actionId\n    })\n    if (!action) return\n    await handleExecuteAction(action, payload)\n  }, [detail?.actionData?.actions, handleExecuteAction])\n\n  const messageActions = React.useMemo(() => {\n    return (detail?.actionData?.actions ?? []).filter((action) => !parseObjectActionId(action.id))\n  }, [detail?.actionData?.actions])\n\n  const objectActionsByObjectId = React.useMemo(() => {\n    const byObjectId = new Map<string, Map<string, MessageAction>>()\n    for (const action of detail?.actionData?.actions ?? []) {\n      const parsed = parseObjectActionId(action.id)\n      if (!parsed) continue\n      const current = byObjectId.get(parsed.objectId) ?? new Map<string, MessageAction>()\n      current.set(parsed.actionId, action)\n      byObjectId.set(parsed.objectId, current)\n    }\n    return byObjectId\n  }, [detail?.actionData?.actions])\n\n  const toggleRead = React.useCallback(async () => {\n    await requestAndRefresh(\n      `/api/messages/${encodeURIComponent(id)}/read`,\n      detail?.isRead ? 'DELETE' : 'PUT',\n      detail?.isRead ? { skipDetailAutoMarkRead: true } : undefined,\n    )\n  }, [detail?.isRead, id, requestAndRefresh])\n\n  const toggleArchive = React.useCallback(async () => {\n    await requestAndRefresh(\n      `/api/messages/${encodeURIComponent(id)}/archive`,\n      isArchived ? 'DELETE' : 'PUT',\n    )\n  }, [id, isArchived, requestAndRefresh])\n\n  return {\n    replyOpen,\n    setReplyOpen,\n    forwardOpen,\n    setForwardOpen,\n    editOpen,\n    setEditOpen,\n    updatingState,\n    executingActionId,\n    pendingActionConfirmation,\n    setPendingActionConfirmation,\n    deleteConfirmationOpen,\n    setDeleteConfirmationOpen,\n    activeConversationAction,\n    toggleRead,\n    toggleArchive,\n    archiveConversation,\n    deleteConversation,\n    markConversationUnread,\n    requestAndRefresh,\n    handleDelete,\n    handleDeleteDialogKeyDown,\n    handleExecuteAction,\n    handleConfirmPendingAction,\n    handleActionConfirmDialogKeyDown,\n    contentProps,\n    handleExecuteActionById,\n    messageActions,\n    objectActionsByObjectId,\n  }\n}\n"],
-  "mappings": ";AAEA,YAAY,WAAW;AAIvB,SAAS,aAAa;AACtB,SAAS,eAAe;AAQxB,SAAS,sBAAsB,qBAAqB,sBAAsB;AAmBnE,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAkC;AAChC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,KAAK;AAC1D,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAwB,IAAI;AACpF,QAAM,CAAC,2BAA2B,4BAA4B,IAAI,MAAM,SAA2C,IAAI;AACvH,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,MAAM,SAAS,KAAK;AAChF,QAAM,CAAC,0BAA0B,2BAA2B,IAAI,MAAM,SAAwC,IAAI;AAElH,QAAM,oBAAoB,MAAM,YAAY,OAC1C,KACA,QACA,YACG;AACH,qBAAiB,IAAI;AACrB,QAAI;AACF,YAAM,OAAO,MAAM,QAA0B,KAAK,EAAE,OAAO,CAAC;AAC5D,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,IAAI;AAAA,UACR,eAAe,KAAK,MAAM,KACvB,EAAE,qCAAqC,iCAAiC;AAAA,QAC7E;AAAA,MACF;AACA,UAAI,SAAS,wBAAwB;AACnC,cAAM,iCAAiC;AAAA,MACzC,OAAO;AACL,cAAM,YAAY,QAAQ;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,qCAAqC,iCAAiC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF,UAAE;AACA,uBAAiB,KAAK;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,aAAa,kCAAkC,CAAC,CAAC;AAErD,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,qBAAiB,IAAI;AACrB,QAAI;AACF,YAAM,OAAO,MAAM,QAA0B,iBAAiB,mBAAmB,EAAE,CAAC,IAAI;AAAA,QACtF,QAAQ;AAAA,MACV,CAAC;AACD,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,IAAI,MAAM,eAAe,KAAK,MAAM,KAAK,EAAE,gCAAgC,2BAA2B,CAAC;AAAA,MAC/G;AACA,YAAM,EAAE,0BAA0B,kBAAkB,GAAG,SAAS;AAChE,gBAAU;AAAA,IACZ,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,gCAAgC,2BAA2B;AAAA,QACjE;AAAA,MACF;AAAA,IACF,UAAE;AACA,uBAAiB,KAAK;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC;AAErB,QAAM,wBAAwB,MAAM,YAAY,OAC9C,QACA,YAOG;AACH,gCAA4B,MAAM;AAClC,QAAI;AACF,YAAM,OAAO,MAAM,QAAkD,QAAQ,KAAK,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC5G,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,IAAI;AAAA,UACR,eAAe,KAAK,MAAM,KACvB,EAAE,4CAA4C,gCAAgC;AAAA,QACnF;AAAA,MACF;AAEA,YAAM,QAAQ,gBAAgB,SAAS;AAEvC,UAAI,QAAQ,WAAW;AACrB,gBAAQ,UAAU;AAClB;AAAA,MACF;AAEA,UAAI,QAAQ,wBAAwB;AAClC,cAAM,iCAAiC;AAAA,MACzC,OAAO;AACL,cAAM,YAAY,QAAQ;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,4CAA4C,gCAAgC;AAAA,QAClF;AAAA,MACF;AAAA,IACF,UAAE;AACA,kCAA4B,IAAI;AAAA,IAClC;AAAA,EACF,GAAG,CAAC,aAAa,kCAAkC,CAAC,CAAC;AAErD,QAAM,sBAAsB,MAAM,YAAY,OAAO,cAAuB;AAC1E,UAAM,kBAAkB,aAAa;AACrC,UAAM,sBAAsB,uBAAuB;AAAA,MACjD,KAAK,iBAAiB,mBAAmB,eAAe,CAAC;AAAA,MACzD,QAAQ;AAAA,MACR,gBAAgB,EAAE,uCAAuC,wBAAwB;AAAA,IACnF,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;AAEjC,QAAM,yBAAyB,MAAM,YAAY,OAAO,cAAuB;AAC7E,UAAM,kBAAkB,aAAa;AACrC,UAAM,sBAAsB,iBAAiB;AAAA,MAC3C,KAAK,iBAAiB,mBAAmB,eAAe,CAAC;AAAA,MACzD,QAAQ;AAAA,MACR,gBAAgB,EAAE,2CAA2C,6BAA6B;AAAA,MAC1F,wBAAwB;AAAA,IAC1B,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;AAEjC,QAAM,qBAAqB,MAAM,YAAY,OAAO,cAAuB;AACzE,UAAM,kBAAkB,aAAa;AACrC,UAAM,sBAAsB,sBAAsB;AAAA,MAChD,KAAK,iBAAiB,mBAAmB,eAAe,CAAC;AAAA,MACzD,QAAQ;AAAA,MACR,gBAAgB,EAAE,sCAAsC,uBAAuB;AAAA,MAC/E,WAAW;AAAA,IACb,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,WAAW,uBAAuB,CAAC,CAAC;AAE5C,QAAM,4BAA4B,MAAM,YAAY,CAAC,UAA+C;AAClG,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,WAAK,aAAa;AAClB;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,UAAU;AAC1B,YAAM,eAAe;AACrB,gCAA0B,KAAK;AAAA,IACjC;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,gBAAgB,MAAM,YAAY,OAAO,QAAuB,YAAsC;AAC1G,yBAAqB,OAAO,EAAE;AAC9B,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,iBAAiB,mBAAmB,EAAE,CAAC,YAAY,mBAAmB,OAAO,EAAE,CAAC;AAAA,QAChF;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,WAAW,CAAC,CAAC;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,IAAI;AAAA,UACR,eAAe,KAAK,MAAM,KACvB,EAAE,gCAAgC,2BAA2B;AAAA,QAClE;AAAA,MACF;AAEA,YAAM,EAAE,gCAAgC,mBAAmB,GAAG,SAAS;AAEvE,YAAM,iBAAiB,KAAK,QAAQ,QAAQ;AAC5C,UACE,OAAO,mBAAmB,YACvB,eAAe,KAAK,EAAE,SAAS,KAC/B,qBAAqB,cAAc,GACtC;AACA,eAAO,SAAS,OAAO;AACvB;AAAA,MACF;AAEA,YAAM,YAAY,QAAQ;AAAA,IAC5B,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,gCAAgC,2BAA2B;AAAA,QACjE;AAAA,MACF;AAAA,IACF,UAAE;AACA,2BAAqB,IAAI;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC;AAEvB,QAAM,sBAAsB,MAAM,YAAY,OAAO,QAAuB,YAAsC;AAChH,QAAI,qBAAqB,QAAQ,YAAa;AAE9C,QAAI,OAAO,iBAAiB;AAC1B,mCAA6B,EAAE,QAAQ,QAAQ,CAAC;AAChD;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,OAAO;AAAA,EACrC,GAAG,CAAC,QAAQ,aAAa,eAAe,iBAAiB,CAAC;AAE1D,QAAM,6BAA6B,MAAM,YAAY,YAAY;AAC/D,QAAI,CAAC,6BAA6B,qBAAqB,QAAQ,YAAa;AAC5E,UAAM,EAAE,QAAQ,QAAQ,IAAI;AAC5B,iCAA6B,IAAI;AACjC,UAAM,cAAc,QAAQ,OAAO;AAAA,EACrC,GAAG,CAAC,QAAQ,aAAa,eAAe,mBAAmB,yBAAyB,CAAC;AAErF,QAAM,mCAAmC,MAAM,YAAY,CAAC,UAA+C;AACzG,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,WAAK,2BAA2B;AAChC;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,UAAU;AAC1B,YAAM,eAAe;AACrB,mCAA6B,IAAI;AAAA,IACnC;AAAA,EACF,GAAG,CAAC,0BAA0B,CAAC;AAE/B,QAAM,eAAe,MAAM,QAA6B,OAAO;AAAA,IAC7D,SAAS;AAAA,MACP,IAAI,QAAQ,MAAM;AAAA,MAClB,MAAM,QAAQ,QAAQ;AAAA,MACtB,SAAS,QAAQ,WAAW;AAAA,MAC5B,MAAM,QAAQ,QAAQ;AAAA,MACtB,YAAY,QAAQ,cAAc;AAAA,MAClC,UAAW,QAAQ,YAAY;AAAA,MAC/B,QAAQ,QAAQ,SAAS,IAAI,KAAK,OAAO,MAAM,IAAI;AAAA,MACnD,YAAY,QAAQ,cAAc;AAAA,MAClC,cAAc,QAAQ,gBAAgB;AAAA,MACtC,YAAY,QAAQ,cAAc;AAAA,MAClC,aAAa,QAAQ,eAAe;AAAA,MACpC,eAAe,QAAQ,gBAAgB,IAAI,KAAK,OAAO,aAAa,IAAI;AAAA,IAC1E;AAAA,IACA,UAAU,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,UAAU;AAAA,MAC9C,IAAI,KAAK;AAAA,MACT,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK,YAAY;AAAA,IAC7B,EAAE;AAAA,IACF,cAAc,eAAe,CAAC,GAAG,IAAI,CAAC,UAAU;AAAA,MAC9C,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,KAAK,KAAK;AAAA,IACZ,EAAE;AAAA,EACJ,IAAI,CAAC,aAAa,MAAM,CAAC;AAEzB,QAAM,0BAA0B,MAAM,YAAoD,OAAO,UAAU,YAAY;AACrH,UAAM,SAAS,QAAQ,YAAY,SAAS,KAAK,CAAC,UAAU;AAC1D,UAAI,oBAAoB,MAAM,EAAE,EAAG,QAAO;AAC1C,aAAO,MAAM,OAAO;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,OAAQ;AACb,UAAM,oBAAoB,QAAQ,OAAO;AAAA,EAC3C,GAAG,CAAC,QAAQ,YAAY,SAAS,mBAAmB,CAAC;AAErD,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,YAAQ,QAAQ,YAAY,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,OAAO,EAAE,CAAC;AAAA,EAC/F,GAAG,CAAC,QAAQ,YAAY,OAAO,CAAC;AAEhC,QAAM,0BAA0B,MAAM,QAAQ,MAAM;AAClD,UAAM,aAAa,oBAAI,IAAwC;AAC/D,eAAW,UAAU,QAAQ,YAAY,WAAW,CAAC,GAAG;AACtD,YAAM,SAAS,oBAAoB,OAAO,EAAE;AAC5C,UAAI,CAAC,OAAQ;AACb,YAAM,UAAU,WAAW,IAAI,OAAO,QAAQ,KAAK,oBAAI,IAA2B;AAClF,cAAQ,IAAI,OAAO,UAAU,MAAM;AACnC,iBAAW,IAAI,OAAO,UAAU,OAAO;AAAA,IACzC;AACA,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,YAAY,OAAO,CAAC;AAEhC,QAAM,aAAa,MAAM,YAAY,YAAY;AAC/C,UAAM;AAAA,MACJ,iBAAiB,mBAAmB,EAAE,CAAC;AAAA,MACvC,QAAQ,SAAS,WAAW;AAAA,MAC5B,QAAQ,SAAS,EAAE,wBAAwB,KAAK,IAAI;AAAA,IACtD;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,IAAI,iBAAiB,CAAC;AAE1C,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,UAAM;AAAA,MACJ,iBAAiB,mBAAmB,EAAE,CAAC;AAAA,MACvC,aAAa,WAAW;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,IAAI,YAAY,iBAAiB,CAAC;AAEtC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport type { UseQueryResult } from '@tanstack/react-query'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport type { MessageActionsProps, MessageContentProps } from '@open-mercato/shared/modules/messages/types'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type {\n  ActionResult,\n  MessageAction,\n  MessageAttachment,\n  MessageDetail,\n  PendingActionConfirmation,\n} from '../types'\nimport { isSafeNavigationHref, parseObjectActionId, toErrorMessage } from '../utils'\n\ntype RequestAndRefreshOptions = {\n  skipDetailAutoMarkRead?: boolean\n}\n\ntype ConversationActionKind = 'archiveConversation' | 'deleteConversation' | 'markAllUnread'\n\ntype MessageDetailMutationContext = {\n  resourceKind: 'message' | 'conversation'\n  messageId: string\n  action: string\n  retryLastMutation: () => Promise<boolean>\n}\n\ntype UseMessageDetailsActionsInput = {\n  id: string\n  t: TranslateFn\n  detail: MessageDetail | null\n  detailQuery: UseQueryResult<MessageDetail | null, Error>\n  attachments: MessageAttachment[] | undefined\n  isArchived: boolean\n  onDeleted: () => void\n  refreshDetailWithoutAutoMarkRead: () => Promise<MessageDetail | null>\n}\n\nexport function useMessageDetailsActions({\n  id,\n  t,\n  detail,\n  detailQuery,\n  attachments,\n  isArchived,\n  onDeleted,\n  refreshDetailWithoutAutoMarkRead,\n}: UseMessageDetailsActionsInput) {\n  const [replyOpen, setReplyOpen] = React.useState(false)\n  const [forwardOpen, setForwardOpen] = React.useState(false)\n  const [editOpen, setEditOpen] = React.useState(false)\n  const [updatingState, setUpdatingState] = React.useState(false)\n  const [executingActionId, setExecutingActionId] = React.useState<string | null>(null)\n  const [pendingActionConfirmation, setPendingActionConfirmation] = React.useState<PendingActionConfirmation | null>(null)\n  const [deleteConfirmationOpen, setDeleteConfirmationOpen] = React.useState(false)\n  const [activeConversationAction, setActiveConversationAction] = React.useState<ConversationActionKind | null>(null)\n\n  const { runMutation, retryLastMutation } = useGuardedMutation<MessageDetailMutationContext>({\n    contextId: 'messages-detail-actions',\n  })\n\n  const requestAndRefresh = React.useCallback(async (\n    url: string,\n    method: 'PUT' | 'DELETE',\n    options?: RequestAndRefreshOptions,\n  ) => {\n    setUpdatingState(true)\n    try {\n      await runMutation({\n        operation: async () => {\n          const call = await apiCall<{ ok?: boolean }>(url, { method })\n          if (!call.ok) {\n            throw new Error(\n              toErrorMessage(call.result)\n              ?? t('messages.errors.stateChangeFailed', 'Failed to update message state.'),\n            )\n          }\n          if (options?.skipDetailAutoMarkRead) {\n            await refreshDetailWithoutAutoMarkRead()\n          } else {\n            await detailQuery.refetch()\n          }\n        },\n        context: { resourceKind: 'message', messageId: id, action: 'state-change', retryLastMutation },\n        mutationPayload: { messageId: id, action: 'state-change', url, method },\n      })\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.stateChangeFailed', 'Failed to update message state.'),\n        'error',\n      )\n    } finally {\n      setUpdatingState(false)\n    }\n  }, [detailQuery, id, refreshDetailWithoutAutoMarkRead, retryLastMutation, runMutation, t])\n\n  const handleDelete = React.useCallback(async () => {\n    setUpdatingState(true)\n    try {\n      await runMutation({\n        operation: async () => {\n          const call = await apiCall<{ ok?: boolean }>(`/api/messages/${encodeURIComponent(id)}`, {\n            method: 'DELETE',\n          })\n          if (!call.ok) {\n            throw new Error(toErrorMessage(call.result) ?? t('messages.errors.deleteFailed', 'Failed to delete message.'))\n          }\n        },\n        context: { resourceKind: 'message', messageId: id, action: 'delete', retryLastMutation },\n        mutationPayload: { messageId: id, action: 'delete' },\n      })\n      flash(t('messages.flash.deleted', 'Message deleted.'), 'success')\n      onDeleted()\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.deleteFailed', 'Failed to delete message.'),\n        'error',\n      )\n    } finally {\n      setUpdatingState(false)\n    }\n  }, [id, onDeleted, retryLastMutation, runMutation, t])\n\n  const runConversationAction = React.useCallback(async (\n    action: ConversationActionKind,\n    options: {\n      url: string\n      method: 'PUT' | 'DELETE'\n      successMessage: string\n      skipDetailAutoMarkRead?: boolean\n      onSuccess?: () => void\n    },\n  ) => {\n    setActiveConversationAction(action)\n    try {\n      await runMutation({\n        operation: async () => {\n          const call = await apiCall<{ ok?: boolean; affectedCount?: number }>(options.url, { method: options.method })\n          if (!call.ok) {\n            throw new Error(\n              toErrorMessage(call.result)\n              ?? t('messages.errors.conversationActionFailed', 'Failed to update conversation.'),\n            )\n          }\n        },\n        context: { resourceKind: 'conversation', messageId: id, action, retryLastMutation },\n        mutationPayload: { messageId: id, action, url: options.url, method: options.method },\n      })\n\n      flash(options.successMessage, 'success')\n\n      if (options.onSuccess) {\n        options.onSuccess()\n        return\n      }\n\n      if (options.skipDetailAutoMarkRead) {\n        await refreshDetailWithoutAutoMarkRead()\n      } else {\n        await detailQuery.refetch()\n      }\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.conversationActionFailed', 'Failed to update conversation.'),\n        'error',\n      )\n    } finally {\n      setActiveConversationAction(null)\n    }\n  }, [detailQuery, id, refreshDetailWithoutAutoMarkRead, retryLastMutation, runMutation, t])\n\n  const archiveConversation = React.useCallback(async (messageId?: string) => {\n    const targetMessageId = messageId ?? id\n    await runConversationAction('archiveConversation', {\n      url: `/api/messages/${encodeURIComponent(targetMessageId)}/conversation/archive`,\n      method: 'PUT',\n      successMessage: t('messages.flash.conversationArchived', 'Conversation archived.'),\n    })\n  }, [id, runConversationAction, t])\n\n  const markConversationUnread = React.useCallback(async (messageId?: string) => {\n    const targetMessageId = messageId ?? id\n    await runConversationAction('markAllUnread', {\n      url: `/api/messages/${encodeURIComponent(targetMessageId)}/conversation/read`,\n      method: 'DELETE',\n      successMessage: t('messages.flash.conversationMarkedUnread', 'Conversation marked unread.'),\n      skipDetailAutoMarkRead: true,\n    })\n  }, [id, runConversationAction, t])\n\n  const deleteConversation = React.useCallback(async (messageId?: string) => {\n    const targetMessageId = messageId ?? id\n    await runConversationAction('deleteConversation', {\n      url: `/api/messages/${encodeURIComponent(targetMessageId)}/conversation`,\n      method: 'DELETE',\n      successMessage: t('messages.flash.conversationDeleted', 'Conversation deleted.'),\n      onSuccess: onDeleted,\n    })\n  }, [id, onDeleted, runConversationAction, t])\n\n  const handleDeleteDialogKeyDown = React.useCallback((event: React.KeyboardEvent<HTMLDivElement>) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      void handleDelete()\n      return\n    }\n\n    if (event.key === 'Escape') {\n      event.preventDefault()\n      setDeleteConfirmationOpen(false)\n    }\n  }, [handleDelete])\n\n  const executeAction = React.useCallback(async (action: MessageAction, payload?: Record<string, unknown>) => {\n    setExecutingActionId(action.id)\n    try {\n      const call = await runMutation({\n        operation: async () => {\n          const result = await apiCall<ActionResult>(\n            `/api/messages/${encodeURIComponent(id)}/actions/${encodeURIComponent(action.id)}`,\n            {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json' },\n              body: JSON.stringify(payload ?? {}),\n            },\n          )\n\n          if (!result.ok) {\n            throw new Error(\n              toErrorMessage(result.result)\n              ?? t('messages.errors.actionFailed', 'Failed to execute action.'),\n            )\n          }\n\n          return result\n        },\n        context: { resourceKind: 'message', messageId: id, action: 'execute-action', retryLastMutation },\n        mutationPayload: { messageId: id, action: 'execute-action', actionId: action.id },\n      })\n\n      flash(t('messages.flash.actionSuccess', 'Action completed.'), 'success')\n\n      const redirectTarget = call.result?.result?.redirect\n      if (\n        typeof redirectTarget === 'string'\n        && redirectTarget.trim().length > 0\n        && isSafeNavigationHref(redirectTarget)\n      ) {\n        window.location.href = redirectTarget\n        return\n      }\n\n      await detailQuery.refetch()\n    } catch (err) {\n      flash(\n        err instanceof Error\n          ? err.message\n          : t('messages.errors.actionFailed', 'Failed to execute action.'),\n        'error',\n      )\n    } finally {\n      setExecutingActionId(null)\n    }\n  }, [detailQuery, id, retryLastMutation, runMutation, t])\n\n  const handleExecuteAction = React.useCallback(async (action: MessageAction, payload?: Record<string, unknown>) => {\n    if (executingActionId || detail?.actionTaken) return\n\n    if (action.confirmRequired) {\n      setPendingActionConfirmation({ action, payload })\n      return\n    }\n\n    await executeAction(action, payload)\n  }, [detail?.actionTaken, executeAction, executingActionId])\n\n  const handleConfirmPendingAction = React.useCallback(async () => {\n    if (!pendingActionConfirmation || executingActionId || detail?.actionTaken) return\n    const { action, payload } = pendingActionConfirmation\n    setPendingActionConfirmation(null)\n    await executeAction(action, payload)\n  }, [detail?.actionTaken, executeAction, executingActionId, pendingActionConfirmation])\n\n  const handleActionConfirmDialogKeyDown = React.useCallback((event: React.KeyboardEvent<HTMLDivElement>) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      void handleConfirmPendingAction()\n      return\n    }\n\n    if (event.key === 'Escape') {\n      event.preventDefault()\n      setPendingActionConfirmation(null)\n    }\n  }, [handleConfirmPendingAction])\n\n  const contentProps = React.useMemo<MessageContentProps>(() => ({\n    message: {\n      id: detail?.id ?? '',\n      type: detail?.type ?? 'default',\n      subject: detail?.subject ?? '',\n      body: detail?.body ?? '',\n      bodyFormat: detail?.bodyFormat ?? 'text',\n      priority: (detail?.priority ?? 'normal') as 'low' | 'normal' | 'high' | 'urgent',\n      sentAt: detail?.sentAt ? new Date(detail.sentAt) : null,\n      senderName: detail?.senderName ?? undefined,\n      senderUserId: detail?.senderUserId ?? '',\n      actionData: detail?.actionData ?? null,\n      actionTaken: detail?.actionTaken ?? null,\n      actionTakenAt: detail?.actionTakenAt ? new Date(detail.actionTakenAt) : null,\n    },\n    objects: (detail?.objects ?? []).map((item) => ({\n      id: item.id,\n      entityModule: item.entityModule,\n      entityType: item.entityType,\n      entityId: item.entityId,\n      actionRequired: item.actionRequired,\n      snapshot: item.snapshot ?? undefined,\n    })),\n    attachments: (attachments ?? []).map((item) => ({\n      id: item.id,\n      fileName: item.fileName,\n      fileSize: item.fileSize,\n      mimeType: item.mimeType,\n      url: item.url,\n    })),\n  }), [attachments, detail])\n\n  const handleExecuteActionById = React.useCallback<MessageActionsProps['onExecuteAction']>(async (actionId, payload) => {\n    const action = detail?.actionData?.actions?.find((entry) => {\n      if (parseObjectActionId(entry.id)) return false\n      return entry.id === actionId\n    })\n    if (!action) return\n    await handleExecuteAction(action, payload)\n  }, [detail?.actionData?.actions, handleExecuteAction])\n\n  const messageActions = React.useMemo(() => {\n    return (detail?.actionData?.actions ?? []).filter((action) => !parseObjectActionId(action.id))\n  }, [detail?.actionData?.actions])\n\n  const objectActionsByObjectId = React.useMemo(() => {\n    const byObjectId = new Map<string, Map<string, MessageAction>>()\n    for (const action of detail?.actionData?.actions ?? []) {\n      const parsed = parseObjectActionId(action.id)\n      if (!parsed) continue\n      const current = byObjectId.get(parsed.objectId) ?? new Map<string, MessageAction>()\n      current.set(parsed.actionId, action)\n      byObjectId.set(parsed.objectId, current)\n    }\n    return byObjectId\n  }, [detail?.actionData?.actions])\n\n  const toggleRead = React.useCallback(async () => {\n    await requestAndRefresh(\n      `/api/messages/${encodeURIComponent(id)}/read`,\n      detail?.isRead ? 'DELETE' : 'PUT',\n      detail?.isRead ? { skipDetailAutoMarkRead: true } : undefined,\n    )\n  }, [detail?.isRead, id, requestAndRefresh])\n\n  const toggleArchive = React.useCallback(async () => {\n    await requestAndRefresh(\n      `/api/messages/${encodeURIComponent(id)}/archive`,\n      isArchived ? 'DELETE' : 'PUT',\n    )\n  }, [id, isArchived, requestAndRefresh])\n\n  return {\n    replyOpen,\n    setReplyOpen,\n    forwardOpen,\n    setForwardOpen,\n    editOpen,\n    setEditOpen,\n    updatingState,\n    executingActionId,\n    pendingActionConfirmation,\n    setPendingActionConfirmation,\n    deleteConfirmationOpen,\n    setDeleteConfirmationOpen,\n    activeConversationAction,\n    toggleRead,\n    toggleArchive,\n    archiveConversation,\n    deleteConversation,\n    markConversationUnread,\n    requestAndRefresh,\n    handleDelete,\n    handleDeleteDialogKeyDown,\n    handleExecuteAction,\n    handleConfirmPendingAction,\n    handleActionConfirmDialogKeyDown,\n    contentProps,\n    handleExecuteActionById,\n    messageActions,\n    objectActionsByObjectId,\n  }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AAIvB,SAAS,aAAa;AACtB,SAAS,0BAA0B;AACnC,SAAS,eAAe;AAQxB,SAAS,sBAAsB,qBAAqB,sBAAsB;AA0BnE,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAkC;AAChC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,KAAK;AAC1D,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAwB,IAAI;AACpF,QAAM,CAAC,2BAA2B,4BAA4B,IAAI,MAAM,SAA2C,IAAI;AACvH,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,MAAM,SAAS,KAAK;AAChF,QAAM,CAAC,0BAA0B,2BAA2B,IAAI,MAAM,SAAwC,IAAI;AAElH,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAAiD;AAAA,IAC1F,WAAW;AAAA,EACb,CAAC;AAED,QAAM,oBAAoB,MAAM,YAAY,OAC1C,KACA,QACA,YACG;AACH,qBAAiB,IAAI;AACrB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,YAAY;AACrB,gBAAM,OAAO,MAAM,QAA0B,KAAK,EAAE,OAAO,CAAC;AAC5D,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,IAAI;AAAA,cACR,eAAe,KAAK,MAAM,KACvB,EAAE,qCAAqC,iCAAiC;AAAA,YAC7E;AAAA,UACF;AACA,cAAI,SAAS,wBAAwB;AACnC,kBAAM,iCAAiC;AAAA,UACzC,OAAO;AACL,kBAAM,YAAY,QAAQ;AAAA,UAC5B;AAAA,QACF;AAAA,QACA,SAAS,EAAE,cAAc,WAAW,WAAW,IAAI,QAAQ,gBAAgB,kBAAkB;AAAA,QAC7F,iBAAiB,EAAE,WAAW,IAAI,QAAQ,gBAAgB,KAAK,OAAO;AAAA,MACxE,CAAC;AAAA,IACH,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,qCAAqC,iCAAiC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF,UAAE;AACA,uBAAiB,KAAK;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,aAAa,IAAI,kCAAkC,mBAAmB,aAAa,CAAC,CAAC;AAEzF,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,qBAAiB,IAAI;AACrB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,YAAY;AACrB,gBAAM,OAAO,MAAM,QAA0B,iBAAiB,mBAAmB,EAAE,CAAC,IAAI;AAAA,YACtF,QAAQ;AAAA,UACV,CAAC;AACD,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,IAAI,MAAM,eAAe,KAAK,MAAM,KAAK,EAAE,gCAAgC,2BAA2B,CAAC;AAAA,UAC/G;AAAA,QACF;AAAA,QACA,SAAS,EAAE,cAAc,WAAW,WAAW,IAAI,QAAQ,UAAU,kBAAkB;AAAA,QACvF,iBAAiB,EAAE,WAAW,IAAI,QAAQ,SAAS;AAAA,MACrD,CAAC;AACD,YAAM,EAAE,0BAA0B,kBAAkB,GAAG,SAAS;AAChE,gBAAU;AAAA,IACZ,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,gCAAgC,2BAA2B;AAAA,QACjE;AAAA,MACF;AAAA,IACF,UAAE;AACA,uBAAiB,KAAK;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,IAAI,WAAW,mBAAmB,aAAa,CAAC,CAAC;AAErD,QAAM,wBAAwB,MAAM,YAAY,OAC9C,QACA,YAOG;AACH,gCAA4B,MAAM;AAClC,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,YAAY;AACrB,gBAAM,OAAO,MAAM,QAAkD,QAAQ,KAAK,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC5G,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,IAAI;AAAA,cACR,eAAe,KAAK,MAAM,KACvB,EAAE,4CAA4C,gCAAgC;AAAA,YACnF;AAAA,UACF;AAAA,QACF;AAAA,QACA,SAAS,EAAE,cAAc,gBAAgB,WAAW,IAAI,QAAQ,kBAAkB;AAAA,QAClF,iBAAiB,EAAE,WAAW,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,QAAQ,OAAO;AAAA,MACrF,CAAC;AAED,YAAM,QAAQ,gBAAgB,SAAS;AAEvC,UAAI,QAAQ,WAAW;AACrB,gBAAQ,UAAU;AAClB;AAAA,MACF;AAEA,UAAI,QAAQ,wBAAwB;AAClC,cAAM,iCAAiC;AAAA,MACzC,OAAO;AACL,cAAM,YAAY,QAAQ;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,4CAA4C,gCAAgC;AAAA,QAClF;AAAA,MACF;AAAA,IACF,UAAE;AACA,kCAA4B,IAAI;AAAA,IAClC;AAAA,EACF,GAAG,CAAC,aAAa,IAAI,kCAAkC,mBAAmB,aAAa,CAAC,CAAC;AAEzF,QAAM,sBAAsB,MAAM,YAAY,OAAO,cAAuB;AAC1E,UAAM,kBAAkB,aAAa;AACrC,UAAM,sBAAsB,uBAAuB;AAAA,MACjD,KAAK,iBAAiB,mBAAmB,eAAe,CAAC;AAAA,MACzD,QAAQ;AAAA,MACR,gBAAgB,EAAE,uCAAuC,wBAAwB;AAAA,IACnF,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;AAEjC,QAAM,yBAAyB,MAAM,YAAY,OAAO,cAAuB;AAC7E,UAAM,kBAAkB,aAAa;AACrC,UAAM,sBAAsB,iBAAiB;AAAA,MAC3C,KAAK,iBAAiB,mBAAmB,eAAe,CAAC;AAAA,MACzD,QAAQ;AAAA,MACR,gBAAgB,EAAE,2CAA2C,6BAA6B;AAAA,MAC1F,wBAAwB;AAAA,IAC1B,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;AAEjC,QAAM,qBAAqB,MAAM,YAAY,OAAO,cAAuB;AACzE,UAAM,kBAAkB,aAAa;AACrC,UAAM,sBAAsB,sBAAsB;AAAA,MAChD,KAAK,iBAAiB,mBAAmB,eAAe,CAAC;AAAA,MACzD,QAAQ;AAAA,MACR,gBAAgB,EAAE,sCAAsC,uBAAuB;AAAA,MAC/E,WAAW;AAAA,IACb,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,WAAW,uBAAuB,CAAC,CAAC;AAE5C,QAAM,4BAA4B,MAAM,YAAY,CAAC,UAA+C;AAClG,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,WAAK,aAAa;AAClB;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,UAAU;AAC1B,YAAM,eAAe;AACrB,gCAA0B,KAAK;AAAA,IACjC;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,gBAAgB,MAAM,YAAY,OAAO,QAAuB,YAAsC;AAC1G,yBAAqB,OAAO,EAAE;AAC9B,QAAI;AACF,YAAM,OAAO,MAAM,YAAY;AAAA,QAC7B,WAAW,YAAY;AACrB,gBAAM,SAAS,MAAM;AAAA,YACnB,iBAAiB,mBAAmB,EAAE,CAAC,YAAY,mBAAmB,OAAO,EAAE,CAAC;AAAA,YAChF;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,WAAW,CAAC,CAAC;AAAA,YACpC;AAAA,UACF;AAEA,cAAI,CAAC,OAAO,IAAI;AACd,kBAAM,IAAI;AAAA,cACR,eAAe,OAAO,MAAM,KACzB,EAAE,gCAAgC,2BAA2B;AAAA,YAClE;AAAA,UACF;AAEA,iBAAO;AAAA,QACT;AAAA,QACA,SAAS,EAAE,cAAc,WAAW,WAAW,IAAI,QAAQ,kBAAkB,kBAAkB;AAAA,QAC/F,iBAAiB,EAAE,WAAW,IAAI,QAAQ,kBAAkB,UAAU,OAAO,GAAG;AAAA,MAClF,CAAC;AAED,YAAM,EAAE,gCAAgC,mBAAmB,GAAG,SAAS;AAEvE,YAAM,iBAAiB,KAAK,QAAQ,QAAQ;AAC5C,UACE,OAAO,mBAAmB,YACvB,eAAe,KAAK,EAAE,SAAS,KAC/B,qBAAqB,cAAc,GACtC;AACA,eAAO,SAAS,OAAO;AACvB;AAAA,MACF;AAEA,YAAM,YAAY,QAAQ;AAAA,IAC5B,SAAS,KAAK;AACZ;AAAA,QACE,eAAe,QACX,IAAI,UACJ,EAAE,gCAAgC,2BAA2B;AAAA,QACjE;AAAA,MACF;AAAA,IACF,UAAE;AACA,2BAAqB,IAAI;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,aAAa,IAAI,mBAAmB,aAAa,CAAC,CAAC;AAEvD,QAAM,sBAAsB,MAAM,YAAY,OAAO,QAAuB,YAAsC;AAChH,QAAI,qBAAqB,QAAQ,YAAa;AAE9C,QAAI,OAAO,iBAAiB;AAC1B,mCAA6B,EAAE,QAAQ,QAAQ,CAAC;AAChD;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,OAAO;AAAA,EACrC,GAAG,CAAC,QAAQ,aAAa,eAAe,iBAAiB,CAAC;AAE1D,QAAM,6BAA6B,MAAM,YAAY,YAAY;AAC/D,QAAI,CAAC,6BAA6B,qBAAqB,QAAQ,YAAa;AAC5E,UAAM,EAAE,QAAQ,QAAQ,IAAI;AAC5B,iCAA6B,IAAI;AACjC,UAAM,cAAc,QAAQ,OAAO;AAAA,EACrC,GAAG,CAAC,QAAQ,aAAa,eAAe,mBAAmB,yBAAyB,CAAC;AAErF,QAAM,mCAAmC,MAAM,YAAY,CAAC,UAA+C;AACzG,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,WAAK,2BAA2B;AAChC;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,UAAU;AAC1B,YAAM,eAAe;AACrB,mCAA6B,IAAI;AAAA,IACnC;AAAA,EACF,GAAG,CAAC,0BAA0B,CAAC;AAE/B,QAAM,eAAe,MAAM,QAA6B,OAAO;AAAA,IAC7D,SAAS;AAAA,MACP,IAAI,QAAQ,MAAM;AAAA,MAClB,MAAM,QAAQ,QAAQ;AAAA,MACtB,SAAS,QAAQ,WAAW;AAAA,MAC5B,MAAM,QAAQ,QAAQ;AAAA,MACtB,YAAY,QAAQ,cAAc;AAAA,MAClC,UAAW,QAAQ,YAAY;AAAA,MAC/B,QAAQ,QAAQ,SAAS,IAAI,KAAK,OAAO,MAAM,IAAI;AAAA,MACnD,YAAY,QAAQ,cAAc;AAAA,MAClC,cAAc,QAAQ,gBAAgB;AAAA,MACtC,YAAY,QAAQ,cAAc;AAAA,MAClC,aAAa,QAAQ,eAAe;AAAA,MACpC,eAAe,QAAQ,gBAAgB,IAAI,KAAK,OAAO,aAAa,IAAI;AAAA,IAC1E;AAAA,IACA,UAAU,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,UAAU;AAAA,MAC9C,IAAI,KAAK;AAAA,MACT,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK,YAAY;AAAA,IAC7B,EAAE;AAAA,IACF,cAAc,eAAe,CAAC,GAAG,IAAI,CAAC,UAAU;AAAA,MAC9C,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,KAAK,KAAK;AAAA,IACZ,EAAE;AAAA,EACJ,IAAI,CAAC,aAAa,MAAM,CAAC;AAEzB,QAAM,0BAA0B,MAAM,YAAoD,OAAO,UAAU,YAAY;AACrH,UAAM,SAAS,QAAQ,YAAY,SAAS,KAAK,CAAC,UAAU;AAC1D,UAAI,oBAAoB,MAAM,EAAE,EAAG,QAAO;AAC1C,aAAO,MAAM,OAAO;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,OAAQ;AACb,UAAM,oBAAoB,QAAQ,OAAO;AAAA,EAC3C,GAAG,CAAC,QAAQ,YAAY,SAAS,mBAAmB,CAAC;AAErD,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,YAAQ,QAAQ,YAAY,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,oBAAoB,OAAO,EAAE,CAAC;AAAA,EAC/F,GAAG,CAAC,QAAQ,YAAY,OAAO,CAAC;AAEhC,QAAM,0BAA0B,MAAM,QAAQ,MAAM;AAClD,UAAM,aAAa,oBAAI,IAAwC;AAC/D,eAAW,UAAU,QAAQ,YAAY,WAAW,CAAC,GAAG;AACtD,YAAM,SAAS,oBAAoB,OAAO,EAAE;AAC5C,UAAI,CAAC,OAAQ;AACb,YAAM,UAAU,WAAW,IAAI,OAAO,QAAQ,KAAK,oBAAI,IAA2B;AAClF,cAAQ,IAAI,OAAO,UAAU,MAAM;AACnC,iBAAW,IAAI,OAAO,UAAU,OAAO;AAAA,IACzC;AACA,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,YAAY,OAAO,CAAC;AAEhC,QAAM,aAAa,MAAM,YAAY,YAAY;AAC/C,UAAM;AAAA,MACJ,iBAAiB,mBAAmB,EAAE,CAAC;AAAA,MACvC,QAAQ,SAAS,WAAW;AAAA,MAC5B,QAAQ,SAAS,EAAE,wBAAwB,KAAK,IAAI;AAAA,IACtD;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,IAAI,iBAAiB,CAAC;AAE1C,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,UAAM;AAAA,MACJ,iBAAiB,mBAAmB,EAAE,CAAC;AAAA,MACvC,aAAa,WAAW;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,IAAI,YAAY,iBAAiB,CAAC;AAEtC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/notifications/frontend/NotificationSettingsPageClient.js

@@ -3,6 +3,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { apiCall, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { Input } from "@open-mercato/ui/primitives/input";
@@ -18,12 +19,17 @@ const emptySettings = {
     custom: {}
   }
 };
+const SETTINGS_CONTEXT_ID = "notifications-settings";
 function NotificationSettingsPageClient() {
   const t = useT();
   const [settings, setSettings] = React.useState(null);
   const [loading, setLoading] = React.useState(true);
   const [saving, setSaving] = React.useState(false);
   const [error, setError] = React.useState(null);
+  const { runMutation, retryLastMutation } = useGuardedMutation({
+    contextId: SETTINGS_CONTEXT_ID,
+    blockedMessage: t("ui.forms.flash.saveBlocked", "Save blocked by validation")
+  });
   const fetchSettings = React.useCallback(async () => {
     setLoading(true);
     setError(null);
@@ -71,10 +77,14 @@ function NotificationSettingsPageClient() {
     if (!settings) return;
     setSaving(true);
     try {
-      const response = await apiCall("/api/notifications/settings", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(settings)
+      const response = await runMutation({
+        operation: () => apiCall("/api/notifications/settings", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(settings)
+        }),
+        context: { formId: SETTINGS_CONTEXT_ID, resourceKind: "notifications.settings", retryLastMutation },
+        mutationPayload: { settings }
       });
       if (!response.ok) {
         const message = response.result?.error || t("notifications.settings.saveError", "Failed to save notification settings");

package/dist/modules/notifications/frontend/NotificationSettingsPageClient.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/frontend/NotificationSettingsPageClient.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { Switch } from '@open-mercato/ui/primitives/switch'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@open-mercato/ui/primitives/card'\n\ntype NotificationDeliveryConfig = {\n  appUrl?: string\n  panelPath: string\n  strategies: {\n    database: { enabled: boolean }\n    email: { enabled: boolean; from?: string; replyTo?: string; subjectPrefix?: string }\n    custom?: Record<string, { enabled?: boolean; config?: unknown }>\n  }\n}\n\ntype SettingsResponse = {\n  settings?: NotificationDeliveryConfig\n  error?: string\n}\n\nconst emptySettings: NotificationDeliveryConfig = {\n  panelPath: '/backend/notifications',\n  strategies: {\n    database: { enabled: true },\n    email: { enabled: true },\n    custom: {},\n  },\n}\n\nexport function NotificationSettingsPageClient() {\n  const t = useT()\n  const [settings, setSettings] = React.useState<NotificationDeliveryConfig | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [saving, setSaving] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n\n  const fetchSettings = React.useCallback(async () => {\n    setLoading(true)\n    setError(null)\n    try {\n      const body = await readApiResultOrThrow<SettingsResponse>(\n        '/api/notifications/settings',\n        undefined,\n        { errorMessage: t('notifications.settings.loadError', 'Failed to load notification settings'), allowNullResult: true },\n      )\n      if (body?.settings) {\n        setSettings(body.settings)\n      } else {\n        setSettings(emptySettings)\n      }\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('notifications.settings.loadError', 'Failed to load notification settings')\n      setError(message)\n      flash(message, 'error')\n    } finally {\n      setLoading(false)\n    }\n  }, [t])\n\n  React.useEffect(() => {\n    fetchSettings()\n  }, [fetchSettings])\n\n  const updateSettings = (patch: Partial<NotificationDeliveryConfig>) => {\n    setSettings((prev) => (prev ? { ...prev, ...patch } : prev))\n  }\n\n  const updateStrategy = (\n    strategy: keyof NotificationDeliveryConfig['strategies'],\n    patch: Partial<NotificationDeliveryConfig['strategies'][keyof NotificationDeliveryConfig['strategies']]>,\n  ) => {\n    setSettings((prev) => {\n      if (!prev) return prev\n      return {\n        ...prev,\n        strategies: {\n          ...prev.strategies,\n          [strategy]: {\n            ...prev.strategies[strategy],\n            ...patch,\n          },\n        },\n      }\n    })\n  }\n\n  const handleSave = async () => {\n    if (!settings) return\n    setSaving(true)\n    try {\n      const response = await apiCall<SettingsResponse>('/api/notifications/settings', {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(settings),\n      })\n      if (!response.ok) {\n        const message = response.result?.error || t('notifications.settings.saveError', 'Failed to save notification settings')\n        throw new Error(message)\n      }\n      if (response.result?.settings) {\n        setSettings(response.result.settings)\n      }\n      flash(t('notifications.settings.saveSuccess', 'Notification settings saved'), 'success')\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('notifications.settings.saveError', 'Failed to save notification settings')\n      flash(message, 'error')\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  if (loading || !settings) {\n    return (\n      <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n        <Spinner size=\"sm\" />\n        {t('notifications.settings.loading', 'Loading notification settings...')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"flex flex-col gap-6\">\n      <div>\n        <h1 className=\"text-2xl font-semibold\">{t('notifications.settings.pageTitle', 'Notification Delivery')}</h1>\n        <p className=\"text-muted-foreground text-sm\">\n          {t('notifications.settings.pageDescription', 'Configure delivery strategies for in-app notifications.')}\n        </p>\n      </div>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('notifications.settings.core.title', 'Core delivery')}</CardTitle>\n          <CardDescription>{t('notifications.settings.core.description', 'Control the default notification center and panel link used by external channels.')}</CardDescription>\n        </CardHeader>\n        <CardContent className=\"grid gap-4 md:grid-cols-2\">\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-app-url\">{t('notifications.settings.core.appUrl', 'Application URL')}</Label>\n            <Input\n              id=\"notifications-app-url\"\n              value={settings.appUrl ?? ''}\n              placeholder=\"https://app.open-mercato.com\"\n              onChange={(event) => updateSettings({ appUrl: event.target.value || undefined })}\n            />\n            <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.core.appUrlHint', 'Used to build absolute links in email notifications.')}</p>\n          </div>\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-panel-path\">{t('notifications.settings.core.panelPath', 'Notification panel path')}</Label>\n            <Input\n              id=\"notifications-panel-path\"\n              value={settings.panelPath}\n              onChange={(event) => updateSettings({ panelPath: event.target.value })}\n            />\n            <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.core.panelPathHint', 'Relative path for the read-only notification panel.')}</p>\n          </div>\n          <div className=\"flex items-center justify-between rounded-lg border p-3\">\n            <div>\n              <p className=\"text-sm font-medium\">{t('notifications.settings.core.databaseLabel', 'In-app notifications')}</p>\n              <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.core.databaseHint', 'Store notifications in the database for the panel and bell.')}</p>\n            </div>\n            <Switch\n              checked={settings.strategies.database.enabled}\n              disabled\n              onCheckedChange={(checked) => updateStrategy('database', { enabled: checked })}\n            />\n          </div>\n        </CardContent>\n      </Card>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('notifications.settings.email.title', 'Email strategy')}</CardTitle>\n          <CardDescription>{t('notifications.settings.email.description', 'Send notification copies via Resend using React templates.')}</CardDescription>\n        </CardHeader>\n        <CardContent className=\"grid gap-4 md:grid-cols-2\">\n          <div className=\"flex items-center justify-between rounded-lg border p-3 md:col-span-2\">\n            <div>\n              <p className=\"text-sm font-medium\">{t('notifications.settings.email.enabledLabel', 'Enable email delivery')}</p>\n              <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.email.enabledHint', 'Email actions are read-only and link back to the notification center.')}</p>\n            </div>\n            <Switch\n              checked={settings.strategies.email.enabled}\n              onCheckedChange={(checked) => updateStrategy('email', { enabled: checked })}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-email-from\">{t('notifications.settings.email.from', 'From address')}</Label>\n            <Input\n              id=\"notifications-email-from\"\n              value={settings.strategies.email.from ?? ''}\n              placeholder=\"notifications@open-mercato.com\"\n              onChange={(event) => updateStrategy('email', { from: event.target.value || undefined })}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-email-reply\">{t('notifications.settings.email.replyTo', 'Reply-to')}</Label>\n            <Input\n              id=\"notifications-email-reply\"\n              value={settings.strategies.email.replyTo ?? ''}\n              placeholder=\"support@open-mercato.com\"\n              onChange={(event) => updateStrategy('email', { replyTo: event.target.value || undefined })}\n            />\n          </div>\n          <div className=\"space-y-2 md:col-span-2\">\n            <Label htmlFor=\"notifications-email-subject-prefix\">{t('notifications.settings.email.subjectPrefix', 'Subject prefix')}</Label>\n            <Input\n              id=\"notifications-email-subject-prefix\"\n              value={settings.strategies.email.subjectPrefix ?? ''}\n              placeholder=\"[Open Mercato]\"\n              onChange={(event) => updateStrategy('email', { subjectPrefix: event.target.value || undefined })}\n            />\n          </div>\n        </CardContent>\n      </Card>\n\n      <div className=\"flex items-center gap-3\">\n        <Button type=\"button\" onClick={handleSave} disabled={saving}>\n          {saving ? t('notifications.settings.saving', 'Saving...') : t('notifications.settings.save', 'Save settings')}\n        </Button>\n        {error && <span className=\"text-sm text-destructive\">{error}</span>}\n      </div>\n    </div>\n  )\n}\n\nexport default NotificationSettingsPageClient\n"],
-  "mappings": ";AAyHM,SACE,KADF;AAvHN,YAAY,WAAW;AACvB,SAAS,YAAY;AACrB,SAAS,SAAS,4BAA4B;AAC9C,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,MAAM,aAAa,iBAAiB,YAAY,iBAAiB;AAiB1E,MAAM,gBAA4C;AAAA,EAChD,WAAW;AAAA,EACX,YAAY;AAAA,IACV,UAAU,EAAE,SAAS,KAAK;AAAA,IAC1B,OAAO,EAAE,SAAS,KAAK;AAAA,IACvB,QAAQ,CAAC;AAAA,EACX;AACF;AAEO,SAAS,iCAAiC;AAC/C,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAA4C,IAAI;AACtF,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAE5D,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,cAAc,EAAE,oCAAoC,sCAAsC,GAAG,iBAAiB,KAAK;AAAA,MACvH;AACA,UAAI,MAAM,UAAU;AAClB,oBAAY,KAAK,QAAQ;AAAA,MAC3B,OAAO;AACL,oBAAY,aAAa;AAAA,MAC3B;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,oCAAoC,sCAAsC;AACjI,eAAS,OAAO;AAChB,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM;AACpB,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAElB,QAAM,iBAAiB,CAAC,UAA+C;AACrE,gBAAY,CAAC,SAAU,OAAO,EAAE,GAAG,MAAM,GAAG,MAAM,IAAI,IAAK;AAAA,EAC7D;AAEA,QAAM,iBAAiB,CACrB,UACA,UACG;AACH,gBAAY,CAAC,SAAS;AACpB,UAAI,CAAC,KAAM,QAAO;AAClB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY;AAAA,UACV,GAAG,KAAK;AAAA,UACR,CAAC,QAAQ,GAAG;AAAA,YACV,GAAG,KAAK,WAAW,QAAQ;AAAA,YAC3B,GAAG;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,SAAU;AACf,cAAU,IAAI;AACd,QAAI;AACF,YAAM,WAAW,MAAM,QAA0B,+BAA+B;AAAA,QAC9E,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC/B,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,SAAS,QAAQ,SAAS,EAAE,oCAAoC,sCAAsC;AACtH,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AACA,UAAI,SAAS,QAAQ,UAAU;AAC7B,oBAAY,SAAS,OAAO,QAAQ;AAAA,MACtC;AACA,YAAM,EAAE,sCAAsC,6BAA6B,GAAG,SAAS;AAAA,IACzF,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,oCAAoC,sCAAsC;AACjI,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,gBAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,WAAW,CAAC,UAAU;AACxB,WACE,qBAAC,SAAI,WAAU,yDACb;AAAA,0BAAC,WAAQ,MAAK,MAAK;AAAA,MAClB,EAAE,kCAAkC,kCAAkC;AAAA,OACzE;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,uBACb;AAAA,yBAAC,SACC;AAAA,0BAAC,QAAG,WAAU,0BAA0B,YAAE,oCAAoC,uBAAuB,GAAE;AAAA,MACvG,oBAAC,OAAE,WAAU,iCACV,YAAE,0CAA0C,yDAAyD,GACxG;AAAA,OACF;AAAA,IAEA,qBAAC,QACC;AAAA,2BAAC,cACC;AAAA,4BAAC,aAAW,YAAE,qCAAqC,eAAe,GAAE;AAAA,QACpE,oBAAC,mBAAiB,YAAE,2CAA2C,mFAAmF,GAAE;AAAA,SACtJ;AAAA,MACA,qBAAC,eAAY,WAAU,6BACrB;AAAA,6BAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,yBAAyB,YAAE,sCAAsC,iBAAiB,GAAE;AAAA,UACnG;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,UAAU;AAAA,cAC1B,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,EAAE,QAAQ,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UACjF;AAAA,UACA,oBAAC,OAAE,WAAU,iCAAiC,YAAE,0CAA0C,sDAAsD,GAAE;AAAA,WACpJ;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,4BAA4B,YAAE,yCAAyC,yBAAyB,GAAE;AAAA,UACjH;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS;AAAA,cAChB,UAAU,CAAC,UAAU,eAAe,EAAE,WAAW,MAAM,OAAO,MAAM,CAAC;AAAA;AAAA,UACvE;AAAA,UACA,oBAAC,OAAE,WAAU,iCAAiC,YAAE,6CAA6C,qDAAqD,GAAE;AAAA,WACtJ;AAAA,QACA,qBAAC,SAAI,WAAU,2DACb;AAAA,+BAAC,SACC;AAAA,gCAAC,OAAE,WAAU,uBAAuB,YAAE,6CAA6C,sBAAsB,GAAE;AAAA,YAC3G,oBAAC,OAAE,WAAU,iCAAiC,YAAE,4CAA4C,6DAA6D,GAAE;AAAA,aAC7J;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,SAAS,WAAW,SAAS;AAAA,cACtC,UAAQ;AAAA,cACR,iBAAiB,CAAC,YAAY,eAAe,YAAY,EAAE,SAAS,QAAQ,CAAC;AAAA;AAAA,UAC/E;AAAA,WACF;AAAA,SACF;AAAA,OACF;AAAA,IAEA,qBAAC,QACC;AAAA,2BAAC,cACC;AAAA,4BAAC,aAAW,YAAE,sCAAsC,gBAAgB,GAAE;AAAA,QACtE,oBAAC,mBAAiB,YAAE,4CAA4C,4DAA4D,GAAE;AAAA,SAChI;AAAA,MACA,qBAAC,eAAY,WAAU,6BACrB;AAAA,6BAAC,SAAI,WAAU,yEACb;AAAA,+BAAC,SACC;AAAA,gCAAC,OAAE,WAAU,uBAAuB,YAAE,6CAA6C,uBAAuB,GAAE;AAAA,YAC5G,oBAAC,OAAE,WAAU,iCAAiC,YAAE,4CAA4C,uEAAuE,GAAE;AAAA,aACvK;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,SAAS,WAAW,MAAM;AAAA,cACnC,iBAAiB,CAAC,YAAY,eAAe,SAAS,EAAE,SAAS,QAAQ,CAAC;AAAA;AAAA,UAC5E;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,4BAA4B,YAAE,qCAAqC,cAAc,GAAE;AAAA,UAClG;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,WAAW,MAAM,QAAQ;AAAA,cACzC,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,SAAS,EAAE,MAAM,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UACxF;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,6BAA6B,YAAE,wCAAwC,UAAU,GAAE;AAAA,UAClG;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,WAAW,MAAM,WAAW;AAAA,cAC5C,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,SAAS,EAAE,SAAS,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UAC3F;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,2BACb;AAAA,8BAAC,SAAM,SAAQ,sCAAsC,YAAE,8CAA8C,gBAAgB,GAAE;AAAA,UACvH;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,WAAW,MAAM,iBAAiB;AAAA,cAClD,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,SAAS,EAAE,eAAe,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UACjG;AAAA,WACF;AAAA,SACF;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,2BACb;AAAA,0BAAC,UAAO,MAAK,UAAS,SAAS,YAAY,UAAU,QAClD,mBAAS,EAAE,iCAAiC,WAAW,IAAI,EAAE,+BAA+B,eAAe,GAC9G;AAAA,MACC,SAAS,oBAAC,UAAK,WAAU,4BAA4B,iBAAM;AAAA,OAC9D;AAAA,KACF;AAEJ;AAEA,IAAO,yCAAQ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { Switch } from '@open-mercato/ui/primitives/switch'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@open-mercato/ui/primitives/card'\n\ntype NotificationDeliveryConfig = {\n  appUrl?: string\n  panelPath: string\n  strategies: {\n    database: { enabled: boolean }\n    email: { enabled: boolean; from?: string; replyTo?: string; subjectPrefix?: string }\n    custom?: Record<string, { enabled?: boolean; config?: unknown }>\n  }\n}\n\ntype SettingsResponse = {\n  settings?: NotificationDeliveryConfig\n  error?: string\n}\n\nconst emptySettings: NotificationDeliveryConfig = {\n  panelPath: '/backend/notifications',\n  strategies: {\n    database: { enabled: true },\n    email: { enabled: true },\n    custom: {},\n  },\n}\n\nconst SETTINGS_CONTEXT_ID = 'notifications-settings'\n\nexport function NotificationSettingsPageClient() {\n  const t = useT()\n  const [settings, setSettings] = React.useState<NotificationDeliveryConfig | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [saving, setSaving] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n\n  const { runMutation, retryLastMutation } = useGuardedMutation<{\n    formId: string\n    resourceKind: string\n    retryLastMutation: () => Promise<boolean>\n  }>({\n    contextId: SETTINGS_CONTEXT_ID,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n\n  const fetchSettings = React.useCallback(async () => {\n    setLoading(true)\n    setError(null)\n    try {\n      const body = await readApiResultOrThrow<SettingsResponse>(\n        '/api/notifications/settings',\n        undefined,\n        { errorMessage: t('notifications.settings.loadError', 'Failed to load notification settings'), allowNullResult: true },\n      )\n      if (body?.settings) {\n        setSettings(body.settings)\n      } else {\n        setSettings(emptySettings)\n      }\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('notifications.settings.loadError', 'Failed to load notification settings')\n      setError(message)\n      flash(message, 'error')\n    } finally {\n      setLoading(false)\n    }\n  }, [t])\n\n  React.useEffect(() => {\n    fetchSettings()\n  }, [fetchSettings])\n\n  const updateSettings = (patch: Partial<NotificationDeliveryConfig>) => {\n    setSettings((prev) => (prev ? { ...prev, ...patch } : prev))\n  }\n\n  const updateStrategy = (\n    strategy: keyof NotificationDeliveryConfig['strategies'],\n    patch: Partial<NotificationDeliveryConfig['strategies'][keyof NotificationDeliveryConfig['strategies']]>,\n  ) => {\n    setSettings((prev) => {\n      if (!prev) return prev\n      return {\n        ...prev,\n        strategies: {\n          ...prev.strategies,\n          [strategy]: {\n            ...prev.strategies[strategy],\n            ...patch,\n          },\n        },\n      }\n    })\n  }\n\n  const handleSave = async () => {\n    if (!settings) return\n    setSaving(true)\n    try {\n      const response = await runMutation({\n        operation: () =>\n          apiCall<SettingsResponse>('/api/notifications/settings', {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/json' },\n            body: JSON.stringify(settings),\n          }),\n        context: { formId: SETTINGS_CONTEXT_ID, resourceKind: 'notifications.settings', retryLastMutation },\n        mutationPayload: { settings },\n      })\n      if (!response.ok) {\n        const message = response.result?.error || t('notifications.settings.saveError', 'Failed to save notification settings')\n        throw new Error(message)\n      }\n      if (response.result?.settings) {\n        setSettings(response.result.settings)\n      }\n      flash(t('notifications.settings.saveSuccess', 'Notification settings saved'), 'success')\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('notifications.settings.saveError', 'Failed to save notification settings')\n      flash(message, 'error')\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  if (loading || !settings) {\n    return (\n      <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n        <Spinner size=\"sm\" />\n        {t('notifications.settings.loading', 'Loading notification settings...')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"flex flex-col gap-6\">\n      <div>\n        <h1 className=\"text-2xl font-semibold\">{t('notifications.settings.pageTitle', 'Notification Delivery')}</h1>\n        <p className=\"text-muted-foreground text-sm\">\n          {t('notifications.settings.pageDescription', 'Configure delivery strategies for in-app notifications.')}\n        </p>\n      </div>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('notifications.settings.core.title', 'Core delivery')}</CardTitle>\n          <CardDescription>{t('notifications.settings.core.description', 'Control the default notification center and panel link used by external channels.')}</CardDescription>\n        </CardHeader>\n        <CardContent className=\"grid gap-4 md:grid-cols-2\">\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-app-url\">{t('notifications.settings.core.appUrl', 'Application URL')}</Label>\n            <Input\n              id=\"notifications-app-url\"\n              value={settings.appUrl ?? ''}\n              placeholder=\"https://app.open-mercato.com\"\n              onChange={(event) => updateSettings({ appUrl: event.target.value || undefined })}\n            />\n            <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.core.appUrlHint', 'Used to build absolute links in email notifications.')}</p>\n          </div>\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-panel-path\">{t('notifications.settings.core.panelPath', 'Notification panel path')}</Label>\n            <Input\n              id=\"notifications-panel-path\"\n              value={settings.panelPath}\n              onChange={(event) => updateSettings({ panelPath: event.target.value })}\n            />\n            <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.core.panelPathHint', 'Relative path for the read-only notification panel.')}</p>\n          </div>\n          <div className=\"flex items-center justify-between rounded-lg border p-3\">\n            <div>\n              <p className=\"text-sm font-medium\">{t('notifications.settings.core.databaseLabel', 'In-app notifications')}</p>\n              <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.core.databaseHint', 'Store notifications in the database for the panel and bell.')}</p>\n            </div>\n            <Switch\n              checked={settings.strategies.database.enabled}\n              disabled\n              onCheckedChange={(checked) => updateStrategy('database', { enabled: checked })}\n            />\n          </div>\n        </CardContent>\n      </Card>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('notifications.settings.email.title', 'Email strategy')}</CardTitle>\n          <CardDescription>{t('notifications.settings.email.description', 'Send notification copies via Resend using React templates.')}</CardDescription>\n        </CardHeader>\n        <CardContent className=\"grid gap-4 md:grid-cols-2\">\n          <div className=\"flex items-center justify-between rounded-lg border p-3 md:col-span-2\">\n            <div>\n              <p className=\"text-sm font-medium\">{t('notifications.settings.email.enabledLabel', 'Enable email delivery')}</p>\n              <p className=\"text-xs text-muted-foreground\">{t('notifications.settings.email.enabledHint', 'Email actions are read-only and link back to the notification center.')}</p>\n            </div>\n            <Switch\n              checked={settings.strategies.email.enabled}\n              onCheckedChange={(checked) => updateStrategy('email', { enabled: checked })}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-email-from\">{t('notifications.settings.email.from', 'From address')}</Label>\n            <Input\n              id=\"notifications-email-from\"\n              value={settings.strategies.email.from ?? ''}\n              placeholder=\"notifications@open-mercato.com\"\n              onChange={(event) => updateStrategy('email', { from: event.target.value || undefined })}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <Label htmlFor=\"notifications-email-reply\">{t('notifications.settings.email.replyTo', 'Reply-to')}</Label>\n            <Input\n              id=\"notifications-email-reply\"\n              value={settings.strategies.email.replyTo ?? ''}\n              placeholder=\"support@open-mercato.com\"\n              onChange={(event) => updateStrategy('email', { replyTo: event.target.value || undefined })}\n            />\n          </div>\n          <div className=\"space-y-2 md:col-span-2\">\n            <Label htmlFor=\"notifications-email-subject-prefix\">{t('notifications.settings.email.subjectPrefix', 'Subject prefix')}</Label>\n            <Input\n              id=\"notifications-email-subject-prefix\"\n              value={settings.strategies.email.subjectPrefix ?? ''}\n              placeholder=\"[Open Mercato]\"\n              onChange={(event) => updateStrategy('email', { subjectPrefix: event.target.value || undefined })}\n            />\n          </div>\n        </CardContent>\n      </Card>\n\n      <div className=\"flex items-center gap-3\">\n        <Button type=\"button\" onClick={handleSave} disabled={saving}>\n          {saving ? t('notifications.settings.saving', 'Saving...') : t('notifications.settings.save', 'Save settings')}\n        </Button>\n        {error && <span className=\"text-sm text-destructive\">{error}</span>}\n      </div>\n    </div>\n  )\n}\n\nexport default NotificationSettingsPageClient\n"],
+  "mappings": ";AA0IM,SACE,KADF;AAxIN,YAAY,WAAW;AACvB,SAAS,YAAY;AACrB,SAAS,SAAS,4BAA4B;AAC9C,SAAS,0BAA0B;AACnC,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,MAAM,aAAa,iBAAiB,YAAY,iBAAiB;AAiB1E,MAAM,gBAA4C;AAAA,EAChD,WAAW;AAAA,EACX,YAAY;AAAA,IACV,UAAU,EAAE,SAAS,KAAK;AAAA,IAC1B,OAAO,EAAE,SAAS,KAAK;AAAA,IACvB,QAAQ,CAAC;AAAA,EACX;AACF;AAEA,MAAM,sBAAsB;AAErB,SAAS,iCAAiC;AAC/C,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAA4C,IAAI;AACtF,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAE5D,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAIxC;AAAA,IACD,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AAED,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,cAAc,EAAE,oCAAoC,sCAAsC,GAAG,iBAAiB,KAAK;AAAA,MACvH;AACA,UAAI,MAAM,UAAU;AAClB,oBAAY,KAAK,QAAQ;AAAA,MAC3B,OAAO;AACL,oBAAY,aAAa;AAAA,MAC3B;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,oCAAoC,sCAAsC;AACjI,eAAS,OAAO;AAChB,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM;AACpB,kBAAc;AAAA,EAChB,GAAG,CAAC,aAAa,CAAC;AAElB,QAAM,iBAAiB,CAAC,UAA+C;AACrE,gBAAY,CAAC,SAAU,OAAO,EAAE,GAAG,MAAM,GAAG,MAAM,IAAI,IAAK;AAAA,EAC7D;AAEA,QAAM,iBAAiB,CACrB,UACA,UACG;AACH,gBAAY,CAAC,SAAS;AACpB,UAAI,CAAC,KAAM,QAAO;AAClB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY;AAAA,UACV,GAAG,KAAK;AAAA,UACR,CAAC,QAAQ,GAAG;AAAA,YACV,GAAG,KAAK,WAAW,QAAQ;AAAA,YAC3B,GAAG;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,SAAU;AACf,cAAU,IAAI;AACd,QAAI;AACF,YAAM,WAAW,MAAM,YAAY;AAAA,QACjC,WAAW,MACT,QAA0B,+BAA+B;AAAA,UACvD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,QAAQ;AAAA,QAC/B,CAAC;AAAA,QACH,SAAS,EAAE,QAAQ,qBAAqB,cAAc,0BAA0B,kBAAkB;AAAA,QAClG,iBAAiB,EAAE,SAAS;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,SAAS,QAAQ,SAAS,EAAE,oCAAoC,sCAAsC;AACtH,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AACA,UAAI,SAAS,QAAQ,UAAU;AAC7B,oBAAY,SAAS,OAAO,QAAQ;AAAA,MACtC;AACA,YAAM,EAAE,sCAAsC,6BAA6B,GAAG,SAAS;AAAA,IACzF,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,oCAAoC,sCAAsC;AACjI,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,gBAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,WAAW,CAAC,UAAU;AACxB,WACE,qBAAC,SAAI,WAAU,yDACb;AAAA,0BAAC,WAAQ,MAAK,MAAK;AAAA,MAClB,EAAE,kCAAkC,kCAAkC;AAAA,OACzE;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,uBACb;AAAA,yBAAC,SACC;AAAA,0BAAC,QAAG,WAAU,0BAA0B,YAAE,oCAAoC,uBAAuB,GAAE;AAAA,MACvG,oBAAC,OAAE,WAAU,iCACV,YAAE,0CAA0C,yDAAyD,GACxG;AAAA,OACF;AAAA,IAEA,qBAAC,QACC;AAAA,2BAAC,cACC;AAAA,4BAAC,aAAW,YAAE,qCAAqC,eAAe,GAAE;AAAA,QACpE,oBAAC,mBAAiB,YAAE,2CAA2C,mFAAmF,GAAE;AAAA,SACtJ;AAAA,MACA,qBAAC,eAAY,WAAU,6BACrB;AAAA,6BAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,yBAAyB,YAAE,sCAAsC,iBAAiB,GAAE;AAAA,UACnG;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,UAAU;AAAA,cAC1B,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,EAAE,QAAQ,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UACjF;AAAA,UACA,oBAAC,OAAE,WAAU,iCAAiC,YAAE,0CAA0C,sDAAsD,GAAE;AAAA,WACpJ;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,4BAA4B,YAAE,yCAAyC,yBAAyB,GAAE;AAAA,UACjH;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS;AAAA,cAChB,UAAU,CAAC,UAAU,eAAe,EAAE,WAAW,MAAM,OAAO,MAAM,CAAC;AAAA;AAAA,UACvE;AAAA,UACA,oBAAC,OAAE,WAAU,iCAAiC,YAAE,6CAA6C,qDAAqD,GAAE;AAAA,WACtJ;AAAA,QACA,qBAAC,SAAI,WAAU,2DACb;AAAA,+BAAC,SACC;AAAA,gCAAC,OAAE,WAAU,uBAAuB,YAAE,6CAA6C,sBAAsB,GAAE;AAAA,YAC3G,oBAAC,OAAE,WAAU,iCAAiC,YAAE,4CAA4C,6DAA6D,GAAE;AAAA,aAC7J;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,SAAS,WAAW,SAAS;AAAA,cACtC,UAAQ;AAAA,cACR,iBAAiB,CAAC,YAAY,eAAe,YAAY,EAAE,SAAS,QAAQ,CAAC;AAAA;AAAA,UAC/E;AAAA,WACF;AAAA,SACF;AAAA,OACF;AAAA,IAEA,qBAAC,QACC;AAAA,2BAAC,cACC;AAAA,4BAAC,aAAW,YAAE,sCAAsC,gBAAgB,GAAE;AAAA,QACtE,oBAAC,mBAAiB,YAAE,4CAA4C,4DAA4D,GAAE;AAAA,SAChI;AAAA,MACA,qBAAC,eAAY,WAAU,6BACrB;AAAA,6BAAC,SAAI,WAAU,yEACb;AAAA,+BAAC,SACC;AAAA,gCAAC,OAAE,WAAU,uBAAuB,YAAE,6CAA6C,uBAAuB,GAAE;AAAA,YAC5G,oBAAC,OAAE,WAAU,iCAAiC,YAAE,4CAA4C,uEAAuE,GAAE;AAAA,aACvK;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,SAAS,WAAW,MAAM;AAAA,cACnC,iBAAiB,CAAC,YAAY,eAAe,SAAS,EAAE,SAAS,QAAQ,CAAC;AAAA;AAAA,UAC5E;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,4BAA4B,YAAE,qCAAqC,cAAc,GAAE;AAAA,UAClG;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,WAAW,MAAM,QAAQ;AAAA,cACzC,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,SAAS,EAAE,MAAM,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UACxF;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,aACb;AAAA,8BAAC,SAAM,SAAQ,6BAA6B,YAAE,wCAAwC,UAAU,GAAE;AAAA,UAClG;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,WAAW,MAAM,WAAW;AAAA,cAC5C,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,SAAS,EAAE,SAAS,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UAC3F;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,2BACb;AAAA,8BAAC,SAAM,SAAQ,sCAAsC,YAAE,8CAA8C,gBAAgB,GAAE;AAAA,UACvH;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO,SAAS,WAAW,MAAM,iBAAiB;AAAA,cAClD,aAAY;AAAA,cACZ,UAAU,CAAC,UAAU,eAAe,SAAS,EAAE,eAAe,MAAM,OAAO,SAAS,OAAU,CAAC;AAAA;AAAA,UACjG;AAAA,WACF;AAAA,SACF;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,2BACb;AAAA,0BAAC,UAAO,MAAK,UAAS,SAAS,YAAY,UAAU,QAClD,mBAAS,EAAE,iCAAiC,WAAW,IAAI,EAAE,+BAA+B,eAAe,GAC9G;AAAA,MACC,SAAS,oBAAC,UAAK,WAAU,4BAA4B,iBAAM;AAAA,OAC9D;AAAA,KACF;AAEJ;AAEA,IAAO,yCAAQ;",
   "names": []
 }

package/dist/modules/payment_gateways/api/cancel/route.js

@@ -4,6 +4,12 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { cancelSchema } from "../../data/validators.js";
 import { paymentGatewaysTag } from "../openapi.js";
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards
+} from "../guards.js";
+const gatewayTransactionResourceKind = "payment_gateways.gateway_transaction";
 const metadata = {
   path: "/payment_gateways/cancel",
   POST: { requireAuth: true, requireFeatures: ["payment_gateways.manage"] }
@@ -19,6 +25,27 @@ async function POST(req) {
     return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 422 });
   }
   const container = await createRequestContainer();
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    },
+    resolveUserFeatures(auth)
+  );
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const service = container.resolve("paymentGatewayService");
   try {
     const result = await service.cancelPayment(
@@ -26,6 +53,16 @@ async function POST(req) {
       parsed.data.reason,
       { organizationId: auth.orgId, tenantId: auth.tenantId }
     );
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return NextResponse.json(result);
   } catch (err) {
     const message = err instanceof Error ? err.message : "Cancel failed";

package/dist/modules/payment_gateways/api/cancel/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/payment_gateways/api/cancel/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { cancelSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\n\nexport const metadata = {\n  path: '/payment_gateways/cancel',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.manage'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = cancelSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const result = await service.cancelPayment(\n      parsed.data.transactionId,\n      parsed.data.reason,\n      { organizationId: auth.orgId as string, tenantId: auth.tenantId },\n    )\n    return NextResponse.json(result)\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Cancel failed'\n    return NextResponse.json({ error: message }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Cancel/void an authorized payment',\n  methods: {\n    POST: {\n      summary: 'Cancel payment',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Payment cancelled' },\n        { status: 422, description: 'Invalid payload' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,aAAa,UAAU,OAAO;AAC7C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAAA,IAClE;AACA,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,QAC9C,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { cancelSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\nimport {\n  resolveUserFeatures,\n  runPaymentGatewayMutationGuardAfterSuccess,\n  runPaymentGatewayMutationGuards,\n} from '../guards'\n\nconst gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'\n\nexport const metadata = {\n  path: '/payment_gateways/cancel',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.manage'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = cancelSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runPaymentGatewayMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: parsed.data.transactionId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const result = await service.cancelPayment(\n      parsed.data.transactionId,\n      parsed.data.reason,\n      { organizationId: auth.orgId as string, tenantId: auth.tenantId },\n    )\n    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: parsed.data.transactionId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return NextResponse.json(result)\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Cancel failed'\n    return NextResponse.json({ error: message }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Cancel/void an authorized payment',\n  methods: {\n    POST: {\n      summary: 'Cancel payment',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Payment cancelled' },\n        { status: 422, description: 'Invalid payload' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,aAAa,UAAU,OAAO;AAC7C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAAA,IAClE;AACA,UAAM,2CAA2C,YAAY,uBAAuB;AAAA,MAClF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,QAC9C,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/payment_gateways/api/capture/route.js

@@ -4,6 +4,12 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { captureSchema } from "../../data/validators.js";
 import { paymentGatewaysTag } from "../openapi.js";
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards
+} from "../guards.js";
+const gatewayTransactionResourceKind = "payment_gateways.gateway_transaction";
 const metadata = {
   path: "/payment_gateways/capture",
   POST: { requireAuth: true, requireFeatures: ["payment_gateways.capture"] }
@@ -19,6 +25,27 @@ async function POST(req) {
     return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 422 });
   }
   const container = await createRequestContainer();
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    },
+    resolveUserFeatures(auth)
+  );
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const service = container.resolve("paymentGatewayService");
   try {
     const result = await service.capturePayment(
@@ -26,6 +53,16 @@ async function POST(req) {
       parsed.data.amount,
       { organizationId: auth.orgId, tenantId: auth.tenantId }
     );
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return NextResponse.json(result);
   } catch (err) {
     const message = err instanceof Error ? err.message : "Capture failed";

package/dist/modules/payment_gateways/api/capture/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/payment_gateways/api/capture/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { captureSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\n\nexport const metadata = {\n  path: '/payment_gateways/capture',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.capture'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = captureSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const result = await service.capturePayment(\n      parsed.data.transactionId,\n      parsed.data.amount,\n      { organizationId: auth.orgId as string, tenantId: auth.tenantId },\n    )\n    return NextResponse.json(result)\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Capture failed'\n    return NextResponse.json({ error: message }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Capture an authorized payment',\n  methods: {\n    POST: {\n      summary: 'Capture payment',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Payment captured' },\n        { status: 422, description: 'Invalid payload' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAE9B,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,cAAc,UAAU,OAAO;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAAA,IAClE;AACA,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,QAC9C,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { captureSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\nimport {\n  resolveUserFeatures,\n  runPaymentGatewayMutationGuardAfterSuccess,\n  runPaymentGatewayMutationGuards,\n} from '../guards'\n\nconst gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'\n\nexport const metadata = {\n  path: '/payment_gateways/capture',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.capture'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = captureSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runPaymentGatewayMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: parsed.data.transactionId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const result = await service.capturePayment(\n      parsed.data.transactionId,\n      parsed.data.amount,\n      { organizationId: auth.orgId as string, tenantId: auth.tenantId },\n    )\n    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: parsed.data.transactionId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return NextResponse.json(result)\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Capture failed'\n    return NextResponse.json({ error: message }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Capture an authorized payment',\n  methods: {\n    POST: {\n      summary: 'Capture payment',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Payment captured' },\n        { status: 422, description: 'Invalid payload' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAE9B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,cAAc,UAAU,OAAO;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAAA,IAClE;AACA,UAAM,2CAA2C,YAAY,uBAAuB;AAAA,MAClF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,QAC9C,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/payment_gateways/api/guards.js

@@ -0,0 +1,31 @@
+import {
+  bridgeLegacyGuard,
+  runMutationGuards
+} from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+function resolveUserFeatures(auth) {
+  const features = auth?.features;
+  if (!Array.isArray(features)) return [];
+  return features.filter((value) => typeof value === "string");
+}
+async function runPaymentGatewayMutationGuards(container, input, userFeatures) {
+  const legacyGuard = bridgeLegacyGuard(container);
+  if (!legacyGuard) {
+    return { ok: true, afterSuccessCallbacks: [] };
+  }
+  return runMutationGuards([legacyGuard], input, { userFeatures });
+}
+async function runPaymentGatewayMutationGuardAfterSuccess(callbacks, input) {
+  for (const callback of callbacks) {
+    if (!callback.guard.afterSuccess) continue;
+    await callback.guard.afterSuccess({
+      ...input,
+      metadata: callback.metadata ?? null
+    });
+  }
+}
+export {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards
+};
+//# sourceMappingURL=guards.js.map

package/dist/modules/payment_gateways/api/guards.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/payment_gateways/api/guards.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\n\ntype GuardAfterCallback = {\n  guard: MutationGuard\n  metadata: Record<string, unknown> | null\n}\n\nexport function resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nexport async function runPaymentGatewayMutationGuards(\n  container: AwilixContainer,\n  input: MutationGuardInput,\n  userFeatures: string[],\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  modifiedPayload?: Record<string, unknown>\n  afterSuccessCallbacks: GuardAfterCallback[]\n}> {\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, { userFeatures })\n}\n\nexport async function runPaymentGatewayMutationGuardAfterSuccess(\n  callbacks: GuardAfterCallback[],\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAOA,SAAS,oBAAoB,MAAyB;AAC3D,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAsB,gCACpB,WACA,OACA,cAOC;AACD,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO,EAAE,aAAa,CAAC;AACjE;AAEA,eAAsB,2CACpB,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/modules/payment_gateways/api/refund/route.js

@@ -4,6 +4,12 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { refundSchema } from "../../data/validators.js";
 import { paymentGatewaysTag } from "../openapi.js";
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards
+} from "../guards.js";
+const gatewayTransactionResourceKind = "payment_gateways.gateway_transaction";
 const metadata = {
   path: "/payment_gateways/refund",
   POST: { requireAuth: true, requireFeatures: ["payment_gateways.refund"] }
@@ -19,6 +25,27 @@ async function POST(req) {
     return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 422 });
   }
   const container = await createRequestContainer();
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    },
+    resolveUserFeatures(auth)
+  );
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const service = container.resolve("paymentGatewayService");
   try {
     const result = await service.refundPayment(
@@ -27,6 +54,16 @@ async function POST(req) {
       parsed.data.reason,
       { organizationId: auth.orgId, tenantId: auth.tenantId }
     );
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: parsed.data.transactionId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return NextResponse.json(result);
   } catch (err) {
     const message = err instanceof Error ? err.message : "Refund failed";

package/dist/modules/payment_gateways/api/refund/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/payment_gateways/api/refund/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { refundSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\n\nexport const metadata = {\n  path: '/payment_gateways/refund',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.refund'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = refundSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const result = await service.refundPayment(\n      parsed.data.transactionId,\n      parsed.data.amount,\n      parsed.data.reason,\n      { organizationId: auth.orgId as string, tenantId: auth.tenantId },\n    )\n    return NextResponse.json(result)\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Refund failed'\n    return NextResponse.json({ error: message }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Refund a captured payment',\n  methods: {\n    POST: {\n      summary: 'Refund payment',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Payment refunded' },\n        { status: 422, description: 'Invalid payload' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,aAAa,UAAU,OAAO;AAC7C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAAA,IAClE;AACA,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,QAC9C,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { refundSchema } from '../../data/validators'\nimport type { PaymentGatewayService } from '../../lib/gateway-service'\nimport { paymentGatewaysTag } from '../openapi'\nimport {\n  resolveUserFeatures,\n  runPaymentGatewayMutationGuardAfterSuccess,\n  runPaymentGatewayMutationGuards,\n} from '../guards'\n\nconst gatewayTransactionResourceKind = 'payment_gateways.gateway_transaction'\n\nexport const metadata = {\n  path: '/payment_gateways/refund',\n  POST: { requireAuth: true, requireFeatures: ['payment_gateways.refund'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe<unknown>(req)\n  const parsed = refundSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runPaymentGatewayMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: parsed.data.transactionId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const service = container.resolve('paymentGatewayService') as PaymentGatewayService\n\n  try {\n    const result = await service.refundPayment(\n      parsed.data.transactionId,\n      parsed.data.amount,\n      parsed.data.reason,\n      { organizationId: auth.orgId as string, tenantId: auth.tenantId },\n    )\n    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: gatewayTransactionResourceKind,\n      resourceId: parsed.data.transactionId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return NextResponse.json(result)\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : 'Refund failed'\n    return NextResponse.json({ error: message }, { status: 502 })\n  }\n}\n\nexport const openApi = {\n  tags: [paymentGatewaysTag],\n  summary: 'Refund a captured payment',\n  methods: {\n    POST: {\n      summary: 'Refund payment',\n      tags: [paymentGatewaysTag],\n      responses: [\n        { status: 200, description: 'Payment refunded' },\n        { status: 422, description: 'Invalid payload' },\n        { status: 502, description: 'Gateway provider error' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAsB,GAAG;AAC/C,QAAM,SAAS,aAAa,UAAU,OAAO;AAC7C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,UAAU,UAAU,QAAQ,uBAAuB;AAEzD,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAAA,IAClE;AACA,UAAM,2CAA2C,YAAY,uBAAuB;AAAA,MAClF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,kBAAkB;AAAA,EACzB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,kBAAkB;AAAA,MACzB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,QAC9C,EAAE,QAAQ,KAAK,aAAa,yBAAyB;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/payment_gateways/api/sessions/route.js

@@ -4,6 +4,12 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { createSessionSchema } from "../../data/validators.js";
 import { paymentGatewaysTag } from "../openapi.js";
+import {
+  resolveUserFeatures,
+  runPaymentGatewayMutationGuardAfterSuccess,
+  runPaymentGatewayMutationGuards
+} from "../guards.js";
+const gatewayTransactionResourceKind = "payment_gateways.gateway_transaction";
 const metadata = {
   path: "/payment_gateways/sessions",
   POST: { requireAuth: true, requireFeatures: ["payment_gateways.manage"] }
@@ -19,6 +25,27 @@ async function POST(req) {
     return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 422 });
   }
   const container = await createRequestContainer();
+  const guardResult = await runPaymentGatewayMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: null,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data
+    },
+    resolveUserFeatures(auth)
+  );
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const service = container.resolve("paymentGatewayService");
   try {
     const { transaction, session } = await service.createPaymentSession({
@@ -37,6 +64,16 @@ async function POST(req) {
       tenantId: auth.tenantId
     });
     const redirectUrl = session.redirectUrl ?? (session.clientSession?.type === "redirect" ? session.clientSession.redirectUrl : null);
+    await runPaymentGatewayMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? "",
+      resourceKind: gatewayTransactionResourceKind,
+      resourceId: transaction.id,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return NextResponse.json({
       transactionId: transaction.id,
       sessionId: session.sessionId,