@open-mercato/core 0.6.6-develop.6228.1.cf483c68b5 → 0.6.6-develop.6241.1.47c01ad4ed

package/dist/modules/customers/api/settings/address-format/route.js

@@ -5,9 +5,14 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 import { customerSettingsUpsertSchema } from "../../../data/validators.js";
 import { loadCustomerSettings } from "../../../commands/settings.js";
 import { withScopedPayload } from "../../utils.js";
+const SETTINGS_RESOURCE_KIND = "customers.settings";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["customers.settings.manage"] },
   PUT: { requireAuth: true, requireFeatures: ["customers.settings.manage"] }
@@ -59,15 +64,42 @@ async function GET(req) {
 }
 async function PUT(req) {
   try {
-    const { ctx, translate } = await resolveSettingsContext(req);
+    const { ctx, tenantId, organizationId, translate } = await resolveSettingsContext(req);
     const payload = await req.json().catch(() => ({}));
     const scoped = withScopedPayload(payload, ctx, translate);
     const input = customerSettingsUpsertSchema.parse(scoped);
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth.sub,
+      resourceKind: SETTINGS_RESOURCE_KIND,
+      resourceId: organizationId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = ctx.container.resolve("commandBus");
     const { result } = await commandBus.execute(
       "customers.settings.save",
       { input, ctx }
     );
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth.sub,
+        resourceKind: SETTINGS_RESOURCE_KIND,
+        resourceId: organizationId,
+        operation: "update",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     return NextResponse.json({
       addressFormat: result?.addressFormat ?? input.addressFormat
     });

package/dist/modules/customers/api/settings/address-format/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/settings/address-format/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { customerSettingsUpsertSchema, type CustomerSettingsUpsertInput } from '../../../data/validators'\nimport { loadCustomerSettings } from '../../../commands/settings'\nimport type { CustomerAddressFormat } from '../../../data/entities'\nimport { withScopedPayload } from '../../utils'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n}\n\ntype SettingsRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nasync function resolveSettingsContext(req: Request): Promise<SettingsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const em = (container.resolve('em') as EntityManager)\n  return {\n    ctx,\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n    em,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const { em, tenantId, organizationId } = await resolveSettingsContext(req)\n    const record = await loadCustomerSettings(em, { tenantId, organizationId })\n    return NextResponse.json({\n      addressFormat: record?.addressFormat ?? 'line_first',\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.settings.address-format.get failed', err)\n    return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to load settings') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const { ctx, translate } = await resolveSettingsContext(req)\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload, ctx, translate)\n    const input = customerSettingsUpsertSchema.parse(scoped)\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result } = await commandBus.execute<CustomerSettingsUpsertInput, { settingsId: string; addressFormat: CustomerAddressFormat }>(\n      'customers.settings.save',\n      { input, ctx },\n    )\n\n    return NextResponse.json({\n      addressFormat: result?.addressFormat ?? input.addressFormat,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.settings.address-format.put failed', err)\n    return NextResponse.json({ error: translate('customers.errors.save_failed', 'Failed to save settings') }, { status: 400 })\n  }\n}\n\nconst addressFormatResponseSchema = z.object({\n  addressFormat: z.string(),\n})\n\nconst addressFormatErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Customer address format settings',\n  methods: {\n    GET: {\n      summary: 'Retrieve address format',\n      description: 'Returns the current address formatting preference for the selected organization.',\n      responses: [\n        { status: 200, description: 'Current address format', schema: addressFormatResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: addressFormatErrorSchema },\n        { status: 400, description: 'Organization context missing', schema: addressFormatErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update address format',\n      description: 'Updates the address format preference for the selected organization.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: customerSettingsUpsertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated address format', schema: addressFormatResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: addressFormatErrorSchema },\n        { status: 400, description: 'Invalid payload or organization context', schema: addressFormatErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAGnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oCAAsE;AAC/E,SAAS,4BAA4B;AAErC,SAAS,yBAAyB;AAG3B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC3E;AAUA,eAAe,uBAAuB,KAA6C;AACjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,EACjI;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,SAAO;AAAA,IACL;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,UAAU,eAAe,IAAI,MAAM,uBAAuB,GAAG;AACzE,UAAM,SAAS,MAAM,qBAAqB,IAAI,EAAE,UAAU,eAAe,CAAC;AAC1E,WAAO,aAAa,KAAK;AAAA,MACvB,eAAe,QAAQ,iBAAiB;AAAA,IAC1C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,uBAAuB,GAAG;AAC3D,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,SAAS,KAAK,SAAS;AACxD,UAAM,QAAQ,6BAA6B,MAAM,MAAM;AAEvD,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,eAAe,QAAQ,iBAAiB,MAAM;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,eAAe,EAAE,OAAO;AAC1B,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,4BAA4B;AAAA,QAC1F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,yBAAyB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,yBAAyB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,4BAA4B;AAAA,QAC1F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,yBAAyB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,yBAAyB;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { customerSettingsUpsertSchema, type CustomerSettingsUpsertInput } from '../../../data/validators'\nimport { loadCustomerSettings } from '../../../commands/settings'\nimport type { CustomerAddressFormat } from '../../../data/entities'\nimport { withScopedPayload } from '../../utils'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nconst SETTINGS_RESOURCE_KIND = 'customers.settings'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n}\n\ntype SettingsRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nasync function resolveSettingsContext(req: Request): Promise<SettingsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const em = (container.resolve('em') as EntityManager)\n  return {\n    ctx,\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n    em,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const { em, tenantId, organizationId } = await resolveSettingsContext(req)\n    const record = await loadCustomerSettings(em, { tenantId, organizationId })\n    return NextResponse.json({\n      addressFormat: record?.addressFormat ?? 'line_first',\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.settings.address-format.get failed', err)\n    return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to load settings') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const { ctx, tenantId, organizationId, translate } = await resolveSettingsContext(req)\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload, ctx, translate)\n    const input = customerSettingsUpsertSchema.parse(scoped)\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId,\n      organizationId,\n      userId: ctx.auth!.sub,\n      resourceKind: SETTINGS_RESOURCE_KIND,\n      resourceId: organizationId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result } = await commandBus.execute<CustomerSettingsUpsertInput, { settingsId: string; addressFormat: CustomerAddressFormat }>(\n      'customers.settings.save',\n      { input, ctx },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId,\n        organizationId,\n        userId: ctx.auth!.sub,\n        resourceKind: SETTINGS_RESOURCE_KIND,\n        resourceId: organizationId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      addressFormat: result?.addressFormat ?? input.addressFormat,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.settings.address-format.put failed', err)\n    return NextResponse.json({ error: translate('customers.errors.save_failed', 'Failed to save settings') }, { status: 400 })\n  }\n}\n\nconst addressFormatResponseSchema = z.object({\n  addressFormat: z.string(),\n})\n\nconst addressFormatErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Customer address format settings',\n  methods: {\n    GET: {\n      summary: 'Retrieve address format',\n      description: 'Returns the current address formatting preference for the selected organization.',\n      responses: [\n        { status: 200, description: 'Current address format', schema: addressFormatResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: addressFormatErrorSchema },\n        { status: 400, description: 'Organization context missing', schema: addressFormatErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update address format',\n      description: 'Updates the address format preference for the selected organization.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: customerSettingsUpsertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated address format', schema: addressFormatResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: addressFormatErrorSchema },\n        { status: 400, description: 'Invalid payload or organization context', schema: addressFormatErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAGnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAsE;AAC/E,SAAS,4BAA4B;AAErC,SAAS,yBAAyB;AAGlC,MAAM,yBAAyB;AAExB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC3E;AAUA,eAAe,uBAAuB,KAA6C;AACjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,EACjI;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,SAAO;AAAA,IACL;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,UAAU,eAAe,IAAI,MAAM,uBAAuB,GAAG;AACzE,UAAM,SAAS,MAAM,qBAAqB,IAAI,EAAE,UAAU,eAAe,CAAC;AAC1E,WAAO,aAAa,KAAK;AAAA,MACvB,eAAe,QAAQ,iBAAiB;AAAA,IAC1C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,gBAAgB,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,SAAS,KAAK,SAAS;AACxD,UAAM,QAAQ,6BAA6B,MAAM,MAAM;AAEvD,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE;AAAA,MACA;AAAA,MACA,QAAQ,IAAI,KAAM;AAAA,MAClB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD;AAAA,QACA;AAAA,QACA,QAAQ,IAAI,KAAM;AAAA,QAClB,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,eAAe,QAAQ,iBAAiB,MAAM;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,gDAAgD,GAAG;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,eAAe,EAAE,OAAO;AAC1B,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,4BAA4B;AAAA,QAC1F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,yBAAyB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,yBAAyB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,4BAA4B;AAAA,QAC1F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,yBAAyB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,yBAAyB;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/tags/assign/route.js

@@ -8,6 +8,11 @@ import { tagAssignmentSchema } from "../../../data/validators.js";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { withScopedPayload } from "../../utils.js";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const TAG_ASSIGNMENT_RESOURCE_KIND = "customers.tagAssignment";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["customers.activities.manage"] }
 };
@@ -30,14 +35,46 @@ async function buildContext(req) {
 async function POST(req) {
   try {
     const { ctx, auth, translate } = await buildContext(req);
+    const tenantId = auth.tenantId;
+    const organizationId = ctx.selectedOrganizationId;
+    if (!tenantId || !organizationId) {
+      return NextResponse.json({ error: translate("customers.errors.context_required", "Organization and tenant context required") }, { status: 400 });
+    }
     const body = await req.json().catch(() => ({}));
     const scoped = withScopedPayload(body, ctx, translate);
     const input = tagAssignmentSchema.parse(scoped);
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: auth.sub,
+      resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,
+      resourceId: input.entityId,
+      operation: "custom",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = ctx.container.resolve("commandBus");
     const { result, logEntry } = await commandBus.execute(
       "customers.tags.assign",
       { input, ctx }
     );
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,
+        resourceId: input.entityId,
+        operation: "custom",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const response = NextResponse.json({ id: result?.assignmentId ?? null }, { status: 201 });
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/dist/modules/customers/api/tags/assign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/tags/assign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { tagAssignmentSchema, type TagAssignmentInput } from '../../../data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { withScopedPayload } from '../../utils'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['customers.activities.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; auth: Awaited<ReturnType<typeof getAuthFromRequest>>; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, auth, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, auth, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(body, ctx, translate)\n    const input = tagAssignmentSchema.parse(scoped)\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<TagAssignmentInput, { assignmentId: string }>(\n    'customers.tags.assign',\n    { input, ctx },\n  )\n    const response = NextResponse.json({ id: result?.assignmentId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.tagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.tags.assign failed', err)\n    return NextResponse.json({ error: translate('customers.errors.assign_failed', 'Failed to assign tag') }, { status: 400 })\n  }\n}\n\nconst tagAssignmentResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n})\n\nconst tagAssignmentErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Assign customer tag',\n  methods: {\n    POST: {\n      summary: 'Assign tag to customer entity',\n      description: 'Links a tag to a customer entity within the validated tenant / organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: tagAssignmentSchema,\n      },\n      responses: [\n        { status: 201, description: 'Tag assigned to customer', schema: tagAssignmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation or assignment failed', schema: tagAssignmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: tagAssignmentErrorSchema },\n        { status: 403, description: 'Insufficient tenant/organization access', schema: tagAssignmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAAoD;AAC7D,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAG3B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACsJ;AACtJ,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,MAAM,UAAU;AAChC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,MAAM,UAAU,IAAI,MAAM,aAAa,GAAG;AACvD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,MAAM,KAAK,SAAS;AACrD,UAAM,QAAQ,oBAAoB,MAAM,MAAM;AAE9C,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC9C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACE,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1H;AACF;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,4BAA4B;AAAA,MAC9F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,yBAAyB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,yBAAyB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,yBAAyB;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { tagAssignmentSchema, type TagAssignmentInput } from '../../../data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { withScopedPayload } from '../../utils'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nconst TAG_ASSIGNMENT_RESOURCE_KIND = 'customers.tagAssignment'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['customers.activities.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; auth: Awaited<ReturnType<typeof getAuthFromRequest>>; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, auth, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, auth, translate } = await buildContext(req)\n    const tenantId = auth!.tenantId\n    const organizationId = ctx.selectedOrganizationId\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })\n    }\n    const body = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(body, ctx, translate)\n    const input = tagAssignmentSchema.parse(scoped)\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId,\n      organizationId,\n      userId: auth!.sub,\n      resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,\n      resourceId: input.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<TagAssignmentInput, { assignmentId: string }>(\n    'customers.tags.assign',\n    { input, ctx },\n  )\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId,\n        organizationId,\n        userId: auth!.sub,\n        resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,\n        resourceId: input.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const response = NextResponse.json({ id: result?.assignmentId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.tagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.tags.assign failed', err)\n    return NextResponse.json({ error: translate('customers.errors.assign_failed', 'Failed to assign tag') }, { status: 400 })\n  }\n}\n\nconst tagAssignmentResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n})\n\nconst tagAssignmentErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Assign customer tag',\n  methods: {\n    POST: {\n      summary: 'Assign tag to customer entity',\n      description: 'Links a tag to a customer entity within the validated tenant / organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: tagAssignmentSchema,\n      },\n      responses: [\n        { status: 201, description: 'Tag assigned to customer', schema: tagAssignmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation or assignment failed', schema: tagAssignmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: tagAssignmentErrorSchema },\n        { status: 403, description: 'Insufficient tenant/organization access', schema: tagAssignmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAAoD;AAC7D,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,MAAM,+BAA+B;AAE9B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACsJ;AACtJ,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,MAAM,UAAU;AAChC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,MAAM,UAAU,IAAI,MAAM,aAAa,GAAG;AACvD,UAAM,WAAW,KAAM;AACvB,UAAM,iBAAiB,IAAI;AAC3B,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,0CAA0C,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AACA,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,MAAM,KAAK,SAAS;AACrD,UAAM,QAAQ,oBAAoB,MAAM,MAAM;AAE9C,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE;AAAA,MACA;AAAA,MACA,QAAQ,KAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC9C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACE,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD;AAAA,QACA;AAAA,QACA,QAAQ,KAAM;AAAA,QACd,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1H;AACF;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,4BAA4B;AAAA,MAC9F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,yBAAyB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,yBAAyB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,yBAAyB;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/tags/unassign/route.js

@@ -8,6 +8,11 @@ import { tagAssignmentSchema } from "../../../data/validators.js";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { withScopedPayload } from "../../utils.js";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const TAG_ASSIGNMENT_RESOURCE_KIND = "customers.tagAssignment";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["customers.activities.manage"] }
 };
@@ -30,14 +35,46 @@ async function buildContext(req) {
 async function POST(req) {
   try {
     const { ctx, auth, translate } = await buildContext(req);
+    const tenantId = auth.tenantId;
+    const organizationId = ctx.selectedOrganizationId;
+    if (!tenantId || !organizationId) {
+      return NextResponse.json({ error: translate("customers.errors.context_required", "Organization and tenant context required") }, { status: 400 });
+    }
     const body = await req.json().catch(() => ({}));
     const scoped = withScopedPayload(body, ctx, translate);
     const input = tagAssignmentSchema.parse(scoped);
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: auth.sub,
+      resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,
+      resourceId: input.entityId,
+      operation: "custom",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
     const commandBus = ctx.container.resolve("commandBus");
     const { result, logEntry } = await commandBus.execute(
       "customers.tags.unassign",
       { input, ctx }
     );
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,
+        resourceId: input.entityId,
+        operation: "custom",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
     const response = NextResponse.json({ id: result?.assignmentId ?? null });
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/dist/modules/customers/api/tags/unassign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/tags/unassign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { tagAssignmentSchema, type TagAssignmentInput } from '../../../data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { withScopedPayload } from '../../utils'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['customers.activities.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; auth: Awaited<ReturnType<typeof getAuthFromRequest>>; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, auth, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, auth, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(body, ctx, translate)\n    const input = tagAssignmentSchema.parse(scoped)\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<TagAssignmentInput, { assignmentId: string | null }>(\n    'customers.tags.unassign',\n    { input, ctx },\n  )\n    const response = NextResponse.json({ id: result?.assignmentId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.tagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.tags.unassign failed', err)\n    return NextResponse.json({ error: translate('customers.errors.unassign_failed', 'Failed to unassign tag') }, { status: 400 })\n  }\n}\n\nconst tagUnassignResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n})\n\nconst tagUnassignErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Unassign customer tag',\n  methods: {\n    POST: {\n      summary: 'Remove tag from customer entity',\n      description: 'Detaches a tag from a customer entity within the validated tenant / organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: tagAssignmentSchema,\n      },\n      responses: [\n        { status: 200, description: 'Tag unassigned from customer', schema: tagUnassignResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation or unassignment failed', schema: tagUnassignErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: tagUnassignErrorSchema },\n        { status: 403, description: 'Insufficient tenant/organization access', schema: tagUnassignErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAAoD;AAC7D,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAG3B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACsJ;AACtJ,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,MAAM,UAAU;AAChC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,MAAM,UAAU,IAAI,MAAM,aAAa,GAAG;AACvD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,MAAM,KAAK,SAAS;AACrD,UAAM,QAAQ,oBAAoB,MAAM,MAAM;AAE9C,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC9C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACE,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,CAAC;AACvE,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,kCAAkC,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,oCAAoC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEA,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,0BAA0B;AAAA,MAChG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,uBAAuB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,uBAAuB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,uBAAuB;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { tagAssignmentSchema, type TagAssignmentInput } from '../../../data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { withScopedPayload } from '../../utils'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nconst TAG_ASSIGNMENT_RESOURCE_KIND = 'customers.tagAssignment'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['customers.activities.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; auth: Awaited<ReturnType<typeof getAuthFromRequest>>; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, auth, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, auth, translate } = await buildContext(req)\n    const tenantId = auth!.tenantId\n    const organizationId = ctx.selectedOrganizationId\n    if (!tenantId || !organizationId) {\n      return NextResponse.json({ error: translate('customers.errors.context_required', 'Organization and tenant context required') }, { status: 400 })\n    }\n    const body = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(body, ctx, translate)\n    const input = tagAssignmentSchema.parse(scoped)\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId,\n      organizationId,\n      userId: auth!.sub,\n      resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,\n      resourceId: input.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<TagAssignmentInput, { assignmentId: string | null }>(\n    'customers.tags.unassign',\n    { input, ctx },\n  )\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId,\n        organizationId,\n        userId: auth!.sub,\n        resourceKind: TAG_ASSIGNMENT_RESOURCE_KIND,\n        resourceId: input.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const response = NextResponse.json({ id: result?.assignmentId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.tagAssignment',\n          resourceId: logEntry.resourceId ?? result?.assignmentId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    console.error('customers.tags.unassign failed', err)\n    return NextResponse.json({ error: translate('customers.errors.unassign_failed', 'Failed to unassign tag') }, { status: 400 })\n  }\n}\n\nconst tagUnassignResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n})\n\nconst tagUnassignErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Unassign customer tag',\n  methods: {\n    POST: {\n      summary: 'Remove tag from customer entity',\n      description: 'Detaches a tag from a customer entity within the validated tenant / organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: tagAssignmentSchema,\n      },\n      responses: [\n        { status: 200, description: 'Tag unassigned from customer', schema: tagUnassignResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation or unassignment failed', schema: tagUnassignErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: tagUnassignErrorSchema },\n        { status: 403, description: 'Insufficient tenant/organization access', schema: tagUnassignErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAAoD;AAC7D,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,MAAM,+BAA+B;AAE9B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACsJ;AACtJ,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAC7G,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,MAAM,UAAU;AAChC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,MAAM,UAAU,IAAI,MAAM,aAAa,GAAG;AACvD,UAAM,WAAW,KAAM;AACvB,UAAM,iBAAiB,IAAI;AAC3B,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,0CAA0C,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AACA,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,MAAM,KAAK,SAAS;AACrD,UAAM,QAAQ,oBAAoB,MAAM,MAAM;AAE9C,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE;AAAA,MACA;AAAA,MACA,QAAQ,KAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC9C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACE,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD;AAAA,QACA;AAAA,QACA,QAAQ,KAAM;AAAA,QACd,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,KAAK,CAAC;AACvE,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,gBAAgB;AAAA,UAC3D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAQ,MAAM,kCAAkC,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,oCAAoC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEA,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,0BAA0B;AAAA,MAChG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,uBAAuB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,uBAAuB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,uBAAuB;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/api/encryption.js

@@ -4,6 +4,13 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { EncryptionMap } from "@open-mercato/core/modules/entities/data/entities";
 import { upsertEncryptionMapSchema } from "@open-mercato/core/modules/entities/data/validators";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const ENCRYPTION_MAP_RESOURCE_KIND = "entities.encryption_map";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["entities.definitions.manage"] },
   POST: { requireAuth: true, requireFeatures: ["entities.definitions.manage"] }
@@ -14,6 +21,15 @@ function resolveScope(auth) {
     organizationId: auth.orgId ?? null
   };
 }
+function toIsoOrNull(value) {
+  if (value == null) return null;
+  if (value instanceof Date) {
+    const ms = value.getTime();
+    return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+  }
+  const trimmed = String(value).trim();
+  return trimmed.length ? trimmed : null;
+}
 async function GET(req) {
   const url = new URL(req.url);
   const entityId = url.searchParams.get("entityId") || "";
@@ -21,8 +37,8 @@ async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth?.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { tenantId, organizationId } = resolveScope(auth);
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em");
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
   const repo = em.getRepository(EncryptionMap);
   const candidates = [
     { entityId, tenantId, organizationId },
@@ -42,47 +58,99 @@ async function GET(req) {
     tenantId,
     organizationId,
     fields: record?.fieldsJson ?? [],
-    isActive: record?.isActive ?? true
+    isActive: record?.isActive ?? true,
+    updatedAt: toIsoOrNull(record?.updatedAt)
   });
 }
 async function POST(req) {
-  const body = await req.json().catch(() => ({}));
-  const parsed = upsertEncryptionMapSchema.safeParse(body);
-  if (!parsed.success) {
-    return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
-  }
-  const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  const scope = resolveScope(auth);
-  const payload = parsed.data;
-  const tenantId = scope.tenantId;
-  const organizationId = scope.organizationId;
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em");
-  const repo = em.getRepository(EncryptionMap);
-  const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null });
-  if (existing) {
-    existing.fieldsJson = payload.fields;
-    existing.isActive = payload.isActive ?? true;
-    existing.updatedAt = /* @__PURE__ */ new Date();
-    await em.persist(existing).flush();
-  } else {
-    const map = repo.create({
-      entityId: payload.entityId,
+  try {
+    const body = await req.json().catch(() => ({}));
+    const parsed = upsertEncryptionMapSchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
+    }
+    const auth = await getAuthFromRequest(req);
+    if (!auth?.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const scope = resolveScope(auth);
+    const payload = parsed.data;
+    const tenantId = auth.tenantId;
+    const organizationId = scope.organizationId;
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const repo = em.getRepository(EncryptionMap);
+    const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null });
+    if (existing) {
+      enforceCommandOptimisticLock({
+        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
+        resourceId: existing.id,
+        current: existing.updatedAt,
+        request: req
+      });
+    }
+    const guardResult = await validateCrudMutationGuard(container, {
       tenantId,
       organizationId,
-      fieldsJson: payload.fields,
-      isActive: payload.isActive ?? true
+      userId: auth.sub,
+      resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
+      resourceId: existing?.id ?? payload.entityId,
+      operation: existing ? "update" : "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload
     });
-    await em.persist(map).flush();
-  }
-  try {
-    const svc = resolve("tenantEncryptionService");
-    await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId);
-  } catch {
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
+    let saved;
+    if (existing) {
+      existing.fieldsJson = payload.fields;
+      existing.isActive = payload.isActive ?? true;
+      existing.updatedAt = /* @__PURE__ */ new Date();
+      await em.persist(existing).flush();
+      saved = existing;
+    } else {
+      const map = repo.create({
+        entityId: payload.entityId,
+        tenantId,
+        organizationId,
+        fieldsJson: payload.fields,
+        isActive: payload.isActive ?? true
+      });
+      await em.persist(map).flush();
+      saved = map;
+    }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
+        resourceId: saved?.id ?? payload.entityId,
+        operation: existing ? "update" : "create",
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
+    try {
+      const svc = container.resolve("tenantEncryptionService");
+      await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId);
+    } catch {
+    }
+    return NextResponse.json({ ok: true, updatedAt: toIsoOrNull(saved?.updatedAt) });
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    throw err;
   }
-  return NextResponse.json({ ok: true });
 }
+const conflictResponseSchema = z.object({
+  error: z.string(),
+  code: z.string(),
+  currentUpdatedAt: z.string(),
+  expectedUpdatedAt: z.string()
+});
 const openApi = {
   tag: "Entities",
   summary: "Manage encryption maps",
@@ -91,13 +159,16 @@ const openApi = {
       summary: "Fetch encryption map",
       description: "Returns the encrypted field map for the current tenant/organization scope.",
       query: z.object({ entityId: z.string() }),
-      responses: [{ status: 200, description: "Map", schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional() }) }]
+      responses: [{ status: 200, description: "Map", schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional(), updatedAt: z.string().nullable().optional() }) }]
     },
     POST: {
       summary: "Upsert encryption map",
-      description: "Creates or updates the encryption map for the current tenant/organization scope.",
+      description: "Creates or updates the encryption map for the current tenant/organization scope. Enforces optimistic locking when the caller sends the expected version header.",
       requestBody: { contentType: "application/json", schema: upsertEncryptionMapSchema },
-      responses: [{ status: 200, description: "Saved", schema: z.object({ ok: z.boolean() }) }]
+      responses: [
+        { status: 200, description: "Saved", schema: z.object({ ok: z.boolean(), updatedAt: z.string().nullable().optional() }) },
+        { status: 409, description: "Optimistic-lock conflict (stale write)", schema: conflictResponseSchema }
+      ]
     }
   }
 };

package/dist/modules/entities/api/encryption.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/encryption.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { upsertEncryptionMapSchema } from '@open-mercato/core/modules/entities/data/validators'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nfunction resolveScope(auth: { tenantId?: string | null; orgId?: string | null }) {\n  return {\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const { tenantId, organizationId } = resolveScope(auth)\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n  const repo = em.getRepository(EncryptionMap)\n  // Prefer tenant+org, then tenant-global, then global\n  const candidates = [\n    { entityId, tenantId, organizationId },\n    { entityId, tenantId, organizationId: null },\n    { entityId, tenantId: null, organizationId: null },\n  ]\n  let record: any = null\n  for (const where of candidates) {\n    // eslint-disable-next-line no-await-in-loop\n    const found = await repo.findOne({ ...where, deletedAt: null })\n    if (found) {\n      record = found\n      break\n    }\n  }\n\n  return NextResponse.json({\n    entityId,\n    tenantId,\n    organizationId,\n    fields: record?.fieldsJson ?? [],\n    isActive: record?.isActive ?? true,\n  })\n}\n\nexport async function POST(req: Request) {\n  const body = await req.json().catch(() => ({}))\n  const parsed = upsertEncryptionMapSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const scope = resolveScope(auth)\n  const payload = parsed.data\n  const tenantId = scope.tenantId\n  const organizationId = scope.organizationId\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n  const repo = em.getRepository(EncryptionMap)\n  const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null })\n  if (existing) {\n    existing.fieldsJson = payload.fields\n    existing.isActive = payload.isActive ?? true\n    existing.updatedAt = new Date()\n    await em.persist(existing).flush()\n  } else {\n    const map = repo.create({\n      entityId: payload.entityId,\n      tenantId,\n      organizationId,\n      fieldsJson: payload.fields,\n      isActive: payload.isActive ?? true,\n    })\n    await em.persist(map).flush()\n  }\n\n  try {\n    const svc = resolve('tenantEncryptionService') as { invalidateMap?: (e: string, t: string | null, o: string | null) => Promise<void> }\n    await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId)\n  } catch {\n    // best-effort cache bust\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage encryption maps',\n  methods: {\n    GET: {\n      summary: 'Fetch encryption map',\n      description: 'Returns the encrypted field map for the current tenant/organization scope.',\n      query: z.object({ entityId: z.string() }),\n      responses: [{ status: 200, description: 'Map', schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional() }) }],\n    },\n    POST: {\n      summary: 'Upsert encryption map',\n      description: 'Creates or updates the encryption map for the current tenant/organization scope.',\n      requestBody: { contentType: 'application/json', schema: upsertEncryptionMapSchema },\n      responses: [{ status: 200, description: 'Saved', schema: z.object({ ok: z.boolean() }) }],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,qBAAqB;AAC9B,SAAS,iCAAiC;AAGnC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,SAAS,aAAa,MAA2D;AAC/E,SAAO;AAAA,IACL,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,EAAE,UAAU,eAAe,IAAI,aAAa,IAAI;AAEtD,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,GAAG,cAAc,aAAa;AAE3C,QAAM,aAAa;AAAA,IACjB,EAAE,UAAU,UAAU,eAAe;AAAA,IACrC,EAAE,UAAU,UAAU,gBAAgB,KAAK;AAAA,IAC3C,EAAE,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACnD;AACA,MAAI,SAAc;AAClB,aAAW,SAAS,YAAY;AAE9B,UAAM,QAAQ,MAAM,KAAK,QAAQ,EAAE,GAAG,OAAO,WAAW,KAAK,CAAC;AAC9D,QAAI,OAAO;AACT,eAAS;AACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ,cAAc,CAAC;AAAA,IAC/B,UAAU,QAAQ,YAAY;AAAA,EAChC,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,QAAQ,aAAa,IAAI;AAC/B,QAAM,UAAU,OAAO;AACvB,QAAM,WAAW,MAAM;AACvB,QAAM,iBAAiB,MAAM;AAE7B,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,GAAG,cAAc,aAAa;AAC3C,QAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,UAAU,QAAQ,UAAU,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAC7G,MAAI,UAAU;AACZ,aAAS,aAAa,QAAQ;AAC9B,aAAS,WAAW,QAAQ,YAAY;AACxC,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AAAA,EACnC,OAAO;AACL,UAAM,MAAM,KAAK,OAAO;AAAA,MACtB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,UAAU,QAAQ,YAAY;AAAA,IAChC,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAAA,EAC9B;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ,yBAAyB;AAC7C,UAAM,KAAK,gBAAgB,QAAQ,UAAU,UAAU,cAAc;AAAA,EACvE,QAAQ;AAAA,EAER;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAAA,MACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,OAAO,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAAA,IAC9N;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAAA,IAC1F;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\nimport { upsertEncryptionMapSchema } from '@open-mercato/core/modules/entities/data/validators'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nconst ENCRYPTION_MAP_RESOURCE_KIND = 'entities.encryption_map'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nfunction resolveScope(auth: { tenantId?: string | null; orgId?: string | null }) {\n  return {\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n}\n\nfunction toIsoOrNull(value: Date | string | null | undefined): string | null {\n  if (value == null) return null\n  if (value instanceof Date) {\n    const ms = value.getTime()\n    return Number.isFinite(ms) ? new Date(ms).toISOString() : null\n  }\n  const trimmed = String(value).trim()\n  return trimmed.length ? trimmed : null\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const { tenantId, organizationId } = resolveScope(auth)\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const repo = em.getRepository(EncryptionMap)\n  // Prefer tenant+org, then tenant-global, then global\n  const candidates = [\n    { entityId, tenantId, organizationId },\n    { entityId, tenantId, organizationId: null },\n    { entityId, tenantId: null, organizationId: null },\n  ]\n  let record: any = null\n  for (const where of candidates) {\n    // eslint-disable-next-line no-await-in-loop\n    const found = await repo.findOne({ ...where, deletedAt: null })\n    if (found) {\n      record = found\n      break\n    }\n  }\n\n  return NextResponse.json({\n    entityId,\n    tenantId,\n    organizationId,\n    fields: record?.fieldsJson ?? [],\n    isActive: record?.isActive ?? true,\n    updatedAt: toIsoOrNull(record?.updatedAt),\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = upsertEncryptionMapSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n    }\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const scope = resolveScope(auth)\n    const payload = parsed.data\n    const tenantId: string = auth.tenantId\n    const organizationId = scope.organizationId\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as any\n    const repo = em.getRepository(EncryptionMap)\n    const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null })\n\n    // Reject stale writes: a save started from an older tab must not silently\n    // overwrite a newer encryption configuration. No-op when the client did not\n    // send the expected-version header (strictly additive).\n    if (existing) {\n      enforceCommandOptimisticLock({\n        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,\n        resourceId: existing.id,\n        current: existing.updatedAt,\n        request: req,\n      })\n    }\n\n    // Mutation-guard contract for custom write routes. The resource is the\n    // encryption map for this entity scoped to the tenant/organization.\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId,\n      organizationId,\n      userId: auth.sub,\n      resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,\n      resourceId: existing?.id ?? payload.entityId,\n      operation: existing ? 'update' : 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    let saved: any\n    if (existing) {\n      existing.fieldsJson = payload.fields\n      existing.isActive = payload.isActive ?? true\n      existing.updatedAt = new Date()\n      await em.persist(existing).flush()\n      saved = existing\n    } else {\n      const map = repo.create({\n        entityId: payload.entityId,\n        tenantId,\n        organizationId,\n        fieldsJson: payload.fields,\n        isActive: payload.isActive ?? true,\n      })\n      await em.persist(map).flush()\n      saved = map\n    }\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId,\n        organizationId,\n        userId: auth.sub,\n        resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,\n        resourceId: saved?.id ?? payload.entityId,\n        operation: existing ? 'update' : 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    try {\n      const svc = container.resolve('tenantEncryptionService') as { invalidateMap?: (e: string, t: string | null, o: string | null) => Promise<void> }\n      await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId)\n    } catch {\n      // best-effort cache bust\n    }\n\n    return NextResponse.json({ ok: true, updatedAt: toIsoOrNull(saved?.updatedAt) })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n}\n\nconst conflictResponseSchema = z.object({\n  error: z.string(),\n  code: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage encryption maps',\n  methods: {\n    GET: {\n      summary: 'Fetch encryption map',\n      description: 'Returns the encrypted field map for the current tenant/organization scope.',\n      query: z.object({ entityId: z.string() }),\n      responses: [{ status: 200, description: 'Map', schema: z.object({ entityId: z.string(), fields: z.array(z.object({ field: z.string(), hashField: z.string().nullable().optional() })), isActive: z.boolean().optional(), updatedAt: z.string().nullable().optional() }) }],\n    },\n    POST: {\n      summary: 'Upsert encryption map',\n      description: 'Creates or updates the encryption map for the current tenant/organization scope. Enforces optimistic locking when the caller sends the expected version header.',\n      requestBody: { contentType: 'application/json', schema: upsertEncryptionMapSchema },\n      responses: [\n        { status: 200, description: 'Saved', schema: z.object({ ok: z.boolean(), updatedAt: z.string().nullable().optional() }) },\n        { status: 409, description: 'Optimistic-lock conflict (stale write)', schema: conflictResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,qBAAqB;AAC9B,SAAS,iCAAiC;AAC1C,SAAwB,uBAAuB;AAC/C,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,MAAM,+BAA+B;AAE9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,SAAS,aAAa,MAA2D;AAC/E,SAAO;AAAA,IACL,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AACF;AAEA,SAAS,YAAY,OAAwD;AAC3E,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,MAAM;AACzB,UAAM,KAAK,MAAM,QAAQ;AACzB,WAAO,OAAO,SAAS,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,YAAY,IAAI;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,EAAE,KAAK;AACnC,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,EAAE,UAAU,eAAe,IAAI,aAAa,IAAI;AAEtD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,GAAG,cAAc,aAAa;AAE3C,QAAM,aAAa;AAAA,IACjB,EAAE,UAAU,UAAU,eAAe;AAAA,IACrC,EAAE,UAAU,UAAU,gBAAgB,KAAK;AAAA,IAC3C,EAAE,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACnD;AACA,MAAI,SAAc;AAClB,aAAW,SAAS,YAAY;AAE9B,UAAM,QAAQ,MAAM,KAAK,QAAQ,EAAE,GAAG,OAAO,WAAW,KAAK,CAAC;AAC9D,QAAI,OAAO;AACT,eAAS;AACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ,cAAc,CAAC;AAAA,IAC/B,UAAU,QAAQ,YAAY;AAAA,IAC9B,WAAW,YAAY,QAAQ,SAAS;AAAA,EAC1C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AACA,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,UAAM,QAAQ,aAAa,IAAI;AAC/B,UAAM,UAAU,OAAO;AACvB,UAAM,WAAmB,KAAK;AAC9B,UAAM,iBAAiB,MAAM;AAE7B,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,GAAG,cAAc,aAAa;AAC3C,UAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,UAAU,QAAQ,UAAU,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAK7G,QAAI,UAAU;AACZ,mCAA6B;AAAA,QAC3B,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,SAAS,SAAS;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAIA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,UAAU,MAAM,QAAQ;AAAA,MACpC,WAAW,WAAW,WAAW;AAAA,MACjC,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI;AACJ,QAAI,UAAU;AACZ,eAAS,aAAa,QAAQ;AAC9B,eAAS,WAAW,QAAQ,YAAY;AACxC,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AACjC,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,MAAM,KAAK,OAAO;AAAA,QACtB,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ,YAAY;AAAA,MAChC,CAAC;AACD,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,cAAQ;AAAA,IACV;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,OAAO,MAAM,QAAQ;AAAA,QACjC,WAAW,WAAW,WAAW;AAAA,QACjC,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,MAAM,UAAU,QAAQ,yBAAyB;AACvD,YAAM,KAAK,gBAAgB,QAAQ,UAAU,UAAU,cAAc;AAAA,IACvE,QAAQ;AAAA,IAER;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,YAAY,OAAO,SAAS,EAAE,CAAC;AAAA,EACjF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAAA,MACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,OAAO,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,SAAS,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAAA,IAC3Q;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACxH,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,uBAAuB;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }