@open-mercato/core 0.6.6-develop.6229.1.ebe6706732 → 0.6.6-develop.6241.1.47c01ad4ed

package/dist/modules/entities/components/EncryptionManager.js

@@ -13,8 +13,10 @@ import {
 } from "@open-mercato/ui/primitives/select";
 import { LoadingMessage, ErrorMessage } from "@open-mercato/ui/backend/detail";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
-import { apiCall, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
 import { raiseCrudError } from "@open-mercato/ui/backend/utils/serverErrors";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
 import { useCustomFieldDefs } from "@open-mercato/ui/backend/utils/customFieldDefs";
 import { Plus, Save, Trash2 } from "lucide-react";
 import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/useOrganizationScope";
@@ -181,6 +183,7 @@ function EncryptionManager() {
     setHasUserEdited(false);
     lastMapSignatureRef.current = signature;
   }, [mapSignature, map, canonicalOptions, hasUserEdited]);
+  const { runMutation } = useGuardedMutation({ contextId: "entities.encryption-map" });
   const mutation = useMutation({
     mutationFn: async () => {
       const trimmed = fields.map((row) => ({
@@ -196,15 +199,25 @@ function EncryptionManager() {
       if (!trimmed.length) {
         throw new Error(t("entities.encryption.errors.noFields", "Add at least one field to encrypt"));
       }
-      const res = await apiCall("/api/entities/encryption", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ entityId: selectedEntityId, fields: trimmed, isActive })
+      const payload = { entityId: selectedEntityId, fields: trimmed, isActive };
+      return runMutation({
+        operation: async () => {
+          const res = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(map?.updatedAt ?? null),
+            () => apiCall("/api/entities/encryption", {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify(payload)
+            })
+          );
+          if (!res.ok) {
+            await raiseCrudError(res.response, t("entities.encryption.errors.save", "Failed to save encryption map"));
+          }
+          return true;
+        },
+        context: {},
+        mutationPayload: payload
       });
-      if (!res.ok) {
-        await raiseCrudError(res.response, t("entities.encryption.errors.save", "Failed to save encryption map"));
-      }
-      return true;
     },
     onSuccess: () => {
       flash(t("entities.encryption.flash.saved", "Encryption map saved"), "success");

package/dist/modules/entities/components/EncryptionManager.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/components/EncryptionManager.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useQuery, useMutation } from '@tanstack/react-query'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useCustomFieldDefs, type CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'\nimport { Plus, Save, Trash2 } from 'lucide-react'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { getEntityFields } from '#generated/entity-fields-registry'\n\ntype EntityOption = { entityId: string; label?: string; source?: string }\ntype FieldOption = { value: string; label: string }\n\ntype EncryptionFieldRow = {\n  id: string\n  field: string\n  hashField?: string | null\n}\n\ntype EncryptionMapResponse = {\n  entityId: string\n  fields?: Array<{ field: string; hashField?: string | null }>\n  isActive?: boolean\n}\n\ntype CanonicalOption = { value: string; label?: string }\n\nconst EMPTY_FIELD_DEFS: CustomFieldDefDto[] = []\n\nfunction normalizeToken(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')\n    .replace(/[^a-z0-9]/gi, '')\n    .toLowerCase()\n}\n\nfunction canonicalizeFieldName(raw: string, options: CanonicalOption[]): string {\n  const trimmed = typeof raw === 'string' ? raw.trim() : ''\n  if (!trimmed) return ''\n  const normalized = normalizeToken(trimmed)\n  for (const option of options) {\n    const optionValue = typeof option.value === 'string' ? option.value.trim() : ''\n    if (optionValue && normalizeToken(optionValue) === normalized) return optionValue\n    if (option.label && normalizeToken(option.label) === normalized) return optionValue\n  }\n  return trimmed\n}\n\nfunction normalizeFieldRows(raw: EncryptionMapResponse | undefined, options: CanonicalOption[]): EncryptionFieldRow[] {\n  const rows = Array.isArray(raw?.fields) ? raw!.fields : []\n  return rows.map((entry, idx) => ({\n    id: `${entry.field}-${idx}`,\n    field: canonicalizeFieldName(entry.field, options),\n    hashField: entry.hashField ? canonicalizeFieldName(entry.hashField, options) : null,\n  }))\n}\n\nfunction areFieldRowsEqual(a: EncryptionFieldRow[], b: EncryptionFieldRow[]): boolean {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  return a.every((row, idx) => {\n    const other = b[idx]\n    return !!other && row.id === other.id && row.field === other.field && (row.hashField ?? null) === (other.hashField ?? null)\n  })\n}\n\nfunction areFieldOptionsEqual(a: FieldOption[], b: FieldOption[]): boolean {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  return a.every((option, idx) => {\n    const other = b[idx]\n    return !!other && option.value === other.value && option.label === other.label\n  })\n}\n\nfunction buildRowId(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()\n  return `row-${Math.random().toString(36).slice(2)}`\n}\n\nexport function EncryptionManager() {\n  const t = useT()\n  const scopeVersion = useOrganizationScopeVersion()\n  const [selectedEntityId, setSelectedEntityId] = React.useState('')\n  const [fields, setFields] = React.useState<EncryptionFieldRow[]>([])\n  const [isActive, setIsActive] = React.useState(true)\n  const [baseFieldOptions, setBaseFieldOptions] = React.useState<FieldOption[]>([])\n  const [hasUserEdited, setHasUserEdited] = React.useState(false)\n  const { data: rawFieldDefs, isLoading: loadingFieldDefs } = useCustomFieldDefs(selectedEntityId ? [selectedEntityId] : [], {\n    enabled: !!selectedEntityId,\n  })\n  const fieldDefs = rawFieldDefs ?? EMPTY_FIELD_DEFS\n  const canonicalOptions = React.useMemo<CanonicalOption[]>(() => {\n    const options: CanonicalOption[] = []\n    for (const option of baseFieldOptions) {\n      if (!option.value) continue\n      if (options.some((opt) => opt.value === option.value)) continue\n      options.push(option)\n    }\n    for (const def of fieldDefs) {\n      const key = typeof def.key === 'string' ? def.key.trim() : ''\n      if (!key || options.some((opt) => opt.value === key)) continue\n      const label = typeof def.label === 'string' ? def.label : undefined\n      options.push({ value: key, label })\n    }\n    return options\n  }, [baseFieldOptions, fieldDefs])\n  const fieldOptions = React.useMemo(() => {\n    const entries = new Map<string, string>()\n    for (const option of baseFieldOptions) {\n      if (!option.value || entries.has(option.value)) continue\n      entries.set(option.value, option.label || option.value)\n    }\n    for (const def of fieldDefs) {\n      const key = typeof def.key === 'string' ? def.key.trim() : ''\n      if (!key || entries.has(key)) continue\n      const label = typeof def.label === 'string' && def.label.trim().length ? def.label : key\n      entries.set(key, label)\n    }\n    for (const row of fields) {\n      const main = row.field?.trim()\n      if (main && !entries.has(main)) entries.set(main, main)\n      const hash = row.hashField?.trim()\n      if (hash && !entries.has(hash)) entries.set(hash, hash)\n    }\n    return Array.from(entries.entries()).map(([value, label]) => ({ value, label }))\n  }, [baseFieldOptions, fieldDefs, fields])\n\n  const { data: entities, isLoading: loadingEntities, error: entitiesError } = useQuery<{ items: EntityOption[] }>({\n    queryKey: ['entities-list', scopeVersion],\n    queryFn: async () =>\n      readApiResultOrThrow('/api/entities/entities', undefined, {\n        errorMessage: t('entities.encryption.errors.loadEntities', 'Failed to load entities'),\n      }),\n  })\n\n  React.useEffect(() => {\n    if (!selectedEntityId && entities?.items?.length) {\n      const first = entities.items[0]\n      setSelectedEntityId(first.entityId)\n    }\n  }, [entities, selectedEntityId])\n\n  React.useEffect(() => {\n    if (!selectedEntityId) {\n      setBaseFieldOptions((prev) => (prev.length ? [] : prev))\n      return\n    }\n    const parts = selectedEntityId.split(':')\n    const entitySlug = parts[1]\n    if (!entitySlug) {\n      setBaseFieldOptions((prev) => (prev.length ? [] : prev))\n      return\n    }\n\n    // Use static registry instead of dynamic import for Turbopack compatibility\n    const mod = getEntityFields(entitySlug)\n    if (!mod) {\n      console.warn('[encryption] No fields found for entity', entitySlug)\n      setBaseFieldOptions((prev) => (prev.length ? [] : prev))\n      return\n    }\n\n    const options: FieldOption[] = []\n    for (const raw of Object.values(mod)) {\n      if (typeof raw !== 'string' || !raw.trim()) continue\n      const value = raw.trim()\n      if (options.some((opt) => opt.value === value)) continue\n      const label = value\n        .split('_')\n        .map((segment) => (segment ? `${segment[0].toUpperCase()}${segment.slice(1)}` : ''))\n        .join(' ')\n        .trim() || value\n      options.push({ value, label })\n    }\n    setBaseFieldOptions((prev) => (areFieldOptionsEqual(prev, options) ? prev : options))\n  }, [selectedEntityId])\n\n  const {\n    data: map,\n    isLoading: loadingMap,\n    isError: mapError,\n    refetch: refetchMap,\n  } = useQuery<EncryptionMapResponse>({\n    queryKey: ['encryption-map', selectedEntityId, scopeVersion],\n    enabled: !!selectedEntityId,\n    queryFn: async () =>\n      readApiResultOrThrow(`/api/entities/encryption?entityId=${encodeURIComponent(selectedEntityId)}`, undefined, {\n        errorMessage: t('entities.encryption.errors.loadMap', 'Failed to load encryption map'),\n      }),\n  })\n\n  const mapSignature = React.useMemo(() => JSON.stringify(map ?? null), [map])\n  const lastMapSignatureRef = React.useRef<string | null>(null)\n\n  React.useEffect(() => {\n    const signature = mapSignature\n    const isSameMap = signature === lastMapSignatureRef.current\n    if (isSameMap && hasUserEdited) return\n    if (!map) {\n      setFields((prev) => (prev.length ? [] : prev))\n      setIsActive((prev) => (prev === true ? prev : true))\n      setHasUserEdited(false)\n      lastMapSignatureRef.current = signature\n      return\n    }\n    const nextFields = normalizeFieldRows(map, canonicalOptions)\n    setFields((prev) => (areFieldRowsEqual(prev, nextFields) ? prev : nextFields))\n    const nextIsActive = map?.isActive !== false\n    setIsActive((prev) => (prev === nextIsActive ? prev : nextIsActive))\n    setHasUserEdited(false)\n    lastMapSignatureRef.current = signature\n  }, [mapSignature, map, canonicalOptions, hasUserEdited])\n\n  const mutation = useMutation({\n    mutationFn: async () => {\n      const trimmed = fields\n        .map((row) => ({\n          field: canonicalizeFieldName(row.field, canonicalOptions).trim(),\n          hashField: row.hashField ? canonicalizeFieldName(row.hashField, canonicalOptions).trim() : '',\n        }))\n        .filter((row) => row.field.length > 0)\n        .map((row) => ({\n          field: row.field,\n          hashField: row.hashField ? row.hashField : null,\n        }))\n      if (!selectedEntityId) {\n        throw new Error(t('entities.encryption.errors.selectEntity', 'Select an entity before saving'))\n      }\n      if (!trimmed.length) {\n        throw new Error(t('entities.encryption.errors.noFields', 'Add at least one field to encrypt'))\n      }\n      const res = await apiCall('/api/entities/encryption', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ entityId: selectedEntityId, fields: trimmed, isActive }),\n      })\n      if (!res.ok) {\n        await raiseCrudError(res.response, t('entities.encryption.errors.save', 'Failed to save encryption map'))\n      }\n      return true\n    },\n    onSuccess: () => {\n      flash(t('entities.encryption.flash.saved', 'Encryption map saved'), 'success')\n      void refetchMap()\n    },\n    onError: (err: any) => {\n      const message = err?.message || t('entities.encryption.errors.save', 'Failed to save encryption map')\n      flash(message, 'error')\n    },\n  })\n\n  const addField = () => {\n    setHasUserEdited(true)\n    setFields((prev) => [...prev, { id: buildRowId(), field: '', hashField: null }])\n  }\n\n  const updateField = (id: string, patch: Partial<EncryptionFieldRow>) => {\n    setHasUserEdited(true)\n    setFields((prev) => prev.map((row) => (row.id === id ? { ...row, ...patch } : row)))\n  }\n\n  const removeField = (id: string) => {\n    setHasUserEdited(true)\n    setFields((prev) => prev.filter((row) => row.id !== id))\n  }\n\n  const renderFields = () => {\n    if (loadingMap || loadingFieldDefs) {\n      return (\n        <LoadingMessage\n          label={t('entities.encryption.loading', 'Loading encryption map\u2026')}\n          className=\"border-0 bg-transparent p-4\"\n        />\n      )\n    }\n    if (mapError) {\n      return (\n        <ErrorMessage\n          label={t('entities.encryption.errors.loadMap', 'Failed to load encryption map')}\n          action={(\n            <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={() => void refetchMap()}>\n              {t('entities.encryption.actions.retry', 'Retry')}\n            </Button>\n          )}\n        />\n      )\n    }\n    if (!fields.length) {\n      return (\n        <div className=\"rounded border bg-background/80 p-4 text-sm text-muted-foreground\">\n          {t('entities.encryption.empty', 'No fields are encrypted yet. Add the first one below.')}\n        </div>\n      )\n    }\n    const withFallbackOption = (value?: string | null) => {\n      if (value && !fieldOptions.some((opt) => opt.value === value)) {\n        return [...fieldOptions, { value, label: value }]\n      }\n      return fieldOptions\n    }\n    return (\n      <div className=\"overflow-x-auto\">\n        <table className=\"w-full min-w-[720px] text-sm\">\n          <thead>\n            <tr className=\"text-xs uppercase tracking-wide text-muted-foreground\">\n              <th className=\"px-3 py-2 text-left\">\n                {t('entities.encryption.fields.field', 'Field name')}\n              </th>\n              <th className=\"px-3 py-2 text-left\">\n                {t('entities.encryption.fields.hash', 'Hash field (optional)')}\n              </th>\n              <th className=\"px-3 py-2 text-right\">\n                {t('entities.encryption.fields.actions', 'Actions')}\n              </th>\n            </tr>\n          </thead>\n          <tbody>\n            {fields.map((row) => {\n              const fieldOpts = withFallbackOption(row.field)\n              const hashOpts = withFallbackOption(row.hashField)\n              return (\n                <tr key={row.id} className=\"border-t\">\n                  <td className=\"px-3 py-2 align-top\">\n                    <Select\n                      value={row.field || undefined}\n                      onValueChange={(value) => updateField(row.id, { field: value ?? '' })}\n                    >\n                      <SelectTrigger>\n                        <SelectValue placeholder={t('entities.encryption.fields.selectField', 'Select field')} />\n                      </SelectTrigger>\n                      <SelectContent>\n                        {fieldOpts.map((option) => (\n                          <SelectItem key={option.value} value={option.value}>\n                            {option.label}\n                          </SelectItem>\n                        ))}\n                      </SelectContent>\n                    </Select>\n                  </td>\n                  <td className=\"px-3 py-2 align-top\">\n                    <Select\n                      value={row.hashField || undefined}\n                      onValueChange={(value) => updateField(row.id, { hashField: value || null })}\n                    >\n                      <SelectTrigger>\n                        <SelectValue placeholder={t('entities.encryption.fields.selectHash', 'Select hash field (optional)')} />\n                      </SelectTrigger>\n                      <SelectContent>\n                        {hashOpts.map((option) => (\n                          <SelectItem key={option.value} value={option.value}>\n                            {option.label}\n                          </SelectItem>\n                        ))}\n                      </SelectContent>\n                    </Select>\n                    <p className=\"mt-1 text-overline text-muted-foreground\">\n                      {t('entities.encryption.fields.hashHint', 'Use when lookups must stay deterministic (e.g., login by email).')}\n                    </p>\n                  </td>\n                  <td className=\"px-3 py-2 align-top text-right\">\n                    <Button\n                      type=\"button\"\n                      variant=\"ghost\"\n                      size=\"sm\"\n                      className=\"h-9 w-9 px-0\"\n                      aria-label={t('entities.encryption.actions.remove', 'Remove')}\n                      onClick={() => removeField(row.id)}\n                    >\n                      <Trash2 className=\"h-4 w-4\" />\n                    </Button>\n                  </td>\n                </tr>\n              )\n            })}\n          </tbody>\n        </table>\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-6\">\n      <div className=\"flex flex-col gap-3 rounded-lg border bg-card p-4 shadow-sm\">\n        <div className=\"space-y-2\">\n          <h2 className=\"text-xl font-semibold\">{t('entities.encryption.title', 'Encryption')}</h2>\n          <p className=\"text-sm text-muted-foreground\">\n            {t('entities.encryption.description', 'Manage which entity fields are encrypted with tenant keys and optional hash columns.')}\n          </p>\n        </div>\n        <div className=\"flex flex-col gap-4 sm:flex-row sm:items-end\">\n          <div className=\"flex-1 space-y-3\">\n            <div>\n              <label className=\"text-xs text-muted-foreground\">\n                {t('entities.encryption.selectEntity', 'Choose entity')}\n              </label>\n              <Select\n                value={selectedEntityId || undefined}\n                onValueChange={(value) => setSelectedEntityId(value ?? '')}\n                disabled={loadingEntities || !!entitiesError}\n              >\n                <SelectTrigger className=\"mt-1\">\n                  <SelectValue placeholder={t('entities.encryption.placeholder', 'Select an entity')} />\n                </SelectTrigger>\n                <SelectContent>\n                  {(entities?.items || []).map((item) => (\n                    <SelectItem key={item.entityId} value={item.entityId}>\n                      {item.label || item.entityId} {item.source === 'custom' ? `(${t('entities.encryption.source.custom', 'custom')})` : ''}\n                    </SelectItem>\n                  ))}\n                </SelectContent>\n              </Select>\n              {entitiesError ? (\n                <p className=\"mt-1 text-xs text-status-error-text\">\n                  {t('entities.encryption.errors.loadEntities', 'Failed to load entities')}\n                </p>\n              ) : (\n                <p className=\"mt-1 text-xs text-muted-foreground\">\n                  {t('entities.encryption.entityHint', 'Maps apply per tenant/organization. Use field names from your entities.')}\n                </p>\n              )}\n            </div>\n            <div className=\"inline-flex items-center gap-2 text-sm\">\n              <Checkbox\n                id=\"entities-encryption-active\"\n                checked={isActive}\n                onCheckedChange={(checked) => setIsActive(checked === true)}\n              />\n              <label htmlFor=\"entities-encryption-active\">\n                {t('entities.encryption.active', 'Encryption enabled for this entity')}\n              </label>\n            </div>\n          </div>\n        </div>\n        <div className=\"rounded-lg border bg-background/80 p-4\">\n          <div className=\"mb-3 flex items-center justify-between\">\n            <div>\n              <h3 className=\"text-sm font-medium\">{t('entities.encryption.fields.title', 'Encrypted fields')}</h3>\n              <p className=\"text-xs text-muted-foreground\">\n                {t('entities.encryption.fields.subtitle', 'List the attributes that should be encrypted with the tenant key.')}\n              </p>\n            </div>\n            <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={addField}>\n              <Plus className=\"mr-2 h-4 w-4\" />\n              {t('entities.encryption.actions.add', 'Add field')}\n            </Button>\n          </div>\n          {renderFields()}\n        </div>\n        <div className=\"flex justify-end\">\n          <Button\n            type=\"button\"\n            onClick={() => mutation.mutate()}\n            disabled={mutation.isPending || loadingEntities || !!entitiesError || !selectedEntityId}\n          >\n            <Save className=\"mr-2 h-4 w-4\" />\n            {mutation.isPending\n              ? t('entities.encryption.actions.saving', 'Saving\u2026')\n              : t('entities.encryption.actions.save', 'Save encryption map')}\n          </Button>\n        </div>\n      </div>\n    </div>\n  )\n}\n"],
-  "mappings": ";AA2RQ,cAmCI,YAnCJ;AAzRR,YAAY,WAAW;AACvB,SAAS,UAAU,mBAAmB;AACtC,SAAS,cAAc;AACvB,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,oBAAoB;AAC7C,SAAS,aAAa;AACtB,SAAS,SAAS,4BAA4B;AAC9C,SAAS,sBAAsB;AAC/B,SAAS,0BAAkD;AAC3D,SAAS,MAAM,MAAM,cAAc;AACnC,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,uBAAuB;AAmBhC,MAAM,mBAAwC,CAAC;AAE/C,SAAS,eAAe,OAAuB;AAC7C,SAAO,MACJ,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,eAAe,EAAE,EACzB,YAAY;AACjB;AAEA,SAAS,sBAAsB,KAAa,SAAoC;AAC9E,QAAM,UAAU,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACvD,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,eAAe,OAAO;AACzC,aAAW,UAAU,SAAS;AAC5B,UAAM,cAAc,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,KAAK,IAAI;AAC7E,QAAI,eAAe,eAAe,WAAW,MAAM,WAAY,QAAO;AACtE,QAAI,OAAO,SAAS,eAAe,OAAO,KAAK,MAAM,WAAY,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAwC,SAAkD;AACpH,QAAM,OAAO,MAAM,QAAQ,KAAK,MAAM,IAAI,IAAK,SAAS,CAAC;AACzD,SAAO,KAAK,IAAI,CAAC,OAAO,SAAS;AAAA,IAC/B,IAAI,GAAG,MAAM,KAAK,IAAI,GAAG;AAAA,IACzB,OAAO,sBAAsB,MAAM,OAAO,OAAO;AAAA,IACjD,WAAW,MAAM,YAAY,sBAAsB,MAAM,WAAW,OAAO,IAAI;AAAA,EACjF,EAAE;AACJ;AAEA,SAAS,kBAAkB,GAAyB,GAAkC;AACpF,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,EAAE,MAAM,CAAC,KAAK,QAAQ;AAC3B,UAAM,QAAQ,EAAE,GAAG;AACnB,WAAO,CAAC,CAAC,SAAS,IAAI,OAAO,MAAM,MAAM,IAAI,UAAU,MAAM,UAAU,IAAI,aAAa,WAAW,MAAM,aAAa;AAAA,EACxH,CAAC;AACH;AAEA,SAAS,qBAAqB,GAAkB,GAA2B;AACzE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,EAAE,MAAM,CAAC,QAAQ,QAAQ;AAC9B,UAAM,QAAQ,EAAE,GAAG;AACnB,WAAO,CAAC,CAAC,SAAS,OAAO,UAAU,MAAM,SAAS,OAAO,UAAU,MAAM;AAAA,EAC3E,CAAC;AACH;AAEA,SAAS,aAAqB;AAC5B,MAAI,OAAO,WAAW,eAAe,OAAO,WAAY,QAAO,OAAO,WAAW;AACjF,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD;AAEO,SAAS,oBAAoB;AAClC,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,4BAA4B;AACjD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,EAAE;AACjE,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAA+B,CAAC,CAAC;AACnE,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,IAAI;AACnD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,CAAC,CAAC;AAChF,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,EAAE,MAAM,cAAc,WAAW,iBAAiB,IAAI,mBAAmB,mBAAmB,CAAC,gBAAgB,IAAI,CAAC,GAAG;AAAA,IACzH,SAAS,CAAC,CAAC;AAAA,EACb,CAAC;AACD,QAAM,YAAY,gBAAgB;AAClC,QAAM,mBAAmB,MAAM,QAA2B,MAAM;AAC9D,UAAM,UAA6B,CAAC;AACpC,eAAW,UAAU,kBAAkB;AACrC,UAAI,CAAC,OAAO,MAAO;AACnB,UAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI,UAAU,OAAO,KAAK,EAAG;AACvD,cAAQ,KAAK,MAAM;AAAA,IACrB;AACA,eAAW,OAAO,WAAW;AAC3B,YAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI;AAC3D,UAAI,CAAC,OAAO,QAAQ,KAAK,CAAC,QAAQ,IAAI,UAAU,GAAG,EAAG;AACtD,YAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AAC1D,cAAQ,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACT,GAAG,CAAC,kBAAkB,SAAS,CAAC;AAChC,QAAM,eAAe,MAAM,QAAQ,MAAM;AACvC,UAAM,UAAU,oBAAI,IAAoB;AACxC,eAAW,UAAU,kBAAkB;AACrC,UAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,EAAG;AAChD,cAAQ,IAAI,OAAO,OAAO,OAAO,SAAS,OAAO,KAAK;AAAA,IACxD;AACA,eAAW,OAAO,WAAW;AAC3B,YAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI;AAC3D,UAAI,CAAC,OAAO,QAAQ,IAAI,GAAG,EAAG;AAC9B,YAAM,QAAQ,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACrF,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AACA,eAAW,OAAO,QAAQ;AACxB,YAAM,OAAO,IAAI,OAAO,KAAK;AAC7B,UAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAG,SAAQ,IAAI,MAAM,IAAI;AACtD,YAAM,OAAO,IAAI,WAAW,KAAK;AACjC,UAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAG,SAAQ,IAAI,MAAM,IAAI;AAAA,IACxD;AACA,WAAO,MAAM,KAAK,QAAQ,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,OAAO,MAAM,EAAE;AAAA,EACjF,GAAG,CAAC,kBAAkB,WAAW,MAAM,CAAC;AAExC,QAAM,EAAE,MAAM,UAAU,WAAW,iBAAiB,OAAO,cAAc,IAAI,SAAoC;AAAA,IAC/G,UAAU,CAAC,iBAAiB,YAAY;AAAA,IACxC,SAAS,YACP,qBAAqB,0BAA0B,QAAW;AAAA,MACxD,cAAc,EAAE,2CAA2C,yBAAyB;AAAA,IACtF,CAAC;AAAA,EACL,CAAC;AAED,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,oBAAoB,UAAU,OAAO,QAAQ;AAChD,YAAM,QAAQ,SAAS,MAAM,CAAC;AAC9B,0BAAoB,MAAM,QAAQ;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,UAAU,gBAAgB,CAAC;AAE/B,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,kBAAkB;AACrB,0BAAoB,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AACvD;AAAA,IACF;AACA,UAAM,QAAQ,iBAAiB,MAAM,GAAG;AACxC,UAAM,aAAa,MAAM,CAAC;AAC1B,QAAI,CAAC,YAAY;AACf,0BAAoB,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AACvD;AAAA,IACF;AAGA,UAAM,MAAM,gBAAgB,UAAU;AACtC,QAAI,CAAC,KAAK;AACR,cAAQ,KAAK,2CAA2C,UAAU;AAClE,0BAAoB,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AACvD;AAAA,IACF;AAEA,UAAM,UAAyB,CAAC;AAChC,eAAW,OAAO,OAAO,OAAO,GAAG,GAAG;AACpC,UAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,EAAG;AAC5C,YAAM,QAAQ,IAAI,KAAK;AACvB,UAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI,UAAU,KAAK,EAAG;AAChD,YAAM,QAAQ,MACX,MAAM,GAAG,EACT,IAAI,CAAC,YAAa,UAAU,GAAG,QAAQ,CAAC,EAAE,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAAK,EAAG,EAClF,KAAK,GAAG,EACR,KAAK,KAAK;AACb,cAAQ,KAAK,EAAE,OAAO,MAAM,CAAC;AAAA,IAC/B;AACA,wBAAoB,CAAC,SAAU,qBAAqB,MAAM,OAAO,IAAI,OAAO,OAAQ;AAAA,EACtF,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,EACX,IAAI,SAAgC;AAAA,IAClC,UAAU,CAAC,kBAAkB,kBAAkB,YAAY;AAAA,IAC3D,SAAS,CAAC,CAAC;AAAA,IACX,SAAS,YACP,qBAAqB,qCAAqC,mBAAmB,gBAAgB,CAAC,IAAI,QAAW;AAAA,MAC3G,cAAc,EAAE,sCAAsC,+BAA+B;AAAA,IACvF,CAAC;AAAA,EACL,CAAC;AAED,QAAM,eAAe,MAAM,QAAQ,MAAM,KAAK,UAAU,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC;AAC3E,QAAM,sBAAsB,MAAM,OAAsB,IAAI;AAE5D,QAAM,UAAU,MAAM;AACpB,UAAM,YAAY;AAClB,UAAM,YAAY,cAAc,oBAAoB;AACpD,QAAI,aAAa,cAAe;AAChC,QAAI,CAAC,KAAK;AACR,gBAAU,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AAC7C,kBAAY,CAAC,SAAU,SAAS,OAAO,OAAO,IAAK;AACnD,uBAAiB,KAAK;AACtB,0BAAoB,UAAU;AAC9B;AAAA,IACF;AACA,UAAM,aAAa,mBAAmB,KAAK,gBAAgB;AAC3D,cAAU,CAAC,SAAU,kBAAkB,MAAM,UAAU,IAAI,OAAO,UAAW;AAC7E,UAAM,eAAe,KAAK,aAAa;AACvC,gBAAY,CAAC,SAAU,SAAS,eAAe,OAAO,YAAa;AACnE,qBAAiB,KAAK;AACtB,wBAAoB,UAAU;AAAA,EAChC,GAAG,CAAC,cAAc,KAAK,kBAAkB,aAAa,CAAC;AAEvD,QAAM,WAAW,YAAY;AAAA,IAC3B,YAAY,YAAY;AACtB,YAAM,UAAU,OACb,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,sBAAsB,IAAI,OAAO,gBAAgB,EAAE,KAAK;AAAA,QAC/D,WAAW,IAAI,YAAY,sBAAsB,IAAI,WAAW,gBAAgB,EAAE,KAAK,IAAI;AAAA,MAC7F,EAAE,EACD,OAAO,CAAC,QAAQ,IAAI,MAAM,SAAS,CAAC,EACpC,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,IAAI;AAAA,QACX,WAAW,IAAI,YAAY,IAAI,YAAY;AAAA,MAC7C,EAAE;AACJ,UAAI,CAAC,kBAAkB;AACrB,cAAM,IAAI,MAAM,EAAE,2CAA2C,gCAAgC,CAAC;AAAA,MAChG;AACA,UAAI,CAAC,QAAQ,QAAQ;AACnB,cAAM,IAAI,MAAM,EAAE,uCAAuC,mCAAmC,CAAC;AAAA,MAC/F;AACA,YAAM,MAAM,MAAM,QAAQ,4BAA4B;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,kBAAkB,QAAQ,SAAS,SAAS,CAAC;AAAA,MAChF,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,eAAe,IAAI,UAAU,EAAE,mCAAmC,+BAA+B,CAAC;AAAA,MAC1G;AACA,aAAO;AAAA,IACT;AAAA,IACA,WAAW,MAAM;AACf,YAAM,EAAE,mCAAmC,sBAAsB,GAAG,SAAS;AAC7E,WAAK,WAAW;AAAA,IAClB;AAAA,IACA,SAAS,CAAC,QAAa;AACrB,YAAM,UAAU,KAAK,WAAW,EAAE,mCAAmC,+BAA+B;AACpG,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,CAAC;AAED,QAAM,WAAW,MAAM;AACrB,qBAAiB,IAAI;AACrB,cAAU,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,IAAI,WAAW,GAAG,OAAO,IAAI,WAAW,KAAK,CAAC,CAAC;AAAA,EACjF;AAEA,QAAM,cAAc,CAAC,IAAY,UAAuC;AACtE,qBAAiB,IAAI;AACrB,cAAU,CAAC,SAAS,KAAK,IAAI,CAAC,QAAS,IAAI,OAAO,KAAK,EAAE,GAAG,KAAK,GAAG,MAAM,IAAI,GAAI,CAAC;AAAA,EACrF;AAEA,QAAM,cAAc,CAAC,OAAe;AAClC,qBAAiB,IAAI;AACrB,cAAU,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;AAAA,EACzD;AAEA,QAAM,eAAe,MAAM;AACzB,QAAI,cAAc,kBAAkB;AAClC,aACE;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,+BAA+B,8BAAyB;AAAA,UACjE,WAAU;AAAA;AAAA,MACZ;AAAA,IAEJ;AACA,QAAI,UAAU;AACZ,aACE;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,sCAAsC,+BAA+B;AAAA,UAC9E,QACE,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,MAAM,KAAK,WAAW,GAC9E,YAAE,qCAAqC,OAAO,GACjD;AAAA;AAAA,MAEJ;AAAA,IAEJ;AACA,QAAI,CAAC,OAAO,QAAQ;AAClB,aACE,oBAAC,SAAI,WAAU,qEACZ,YAAE,6BAA6B,uDAAuD,GACzF;AAAA,IAEJ;AACA,UAAM,qBAAqB,CAAC,UAA0B;AACpD,UAAI,SAAS,CAAC,aAAa,KAAK,CAAC,QAAQ,IAAI,UAAU,KAAK,GAAG;AAC7D,eAAO,CAAC,GAAG,cAAc,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AACA,WACE,oBAAC,SAAI,WAAU,mBACb,+BAAC,WAAM,WAAU,gCACf;AAAA,0BAAC,WACC,+BAAC,QAAG,WAAU,yDACZ;AAAA,4BAAC,QAAG,WAAU,uBACX,YAAE,oCAAoC,YAAY,GACrD;AAAA,QACA,oBAAC,QAAG,WAAU,uBACX,YAAE,mCAAmC,uBAAuB,GAC/D;AAAA,QACA,oBAAC,QAAG,WAAU,wBACX,YAAE,sCAAsC,SAAS,GACpD;AAAA,SACF,GACF;AAAA,MACA,oBAAC,WACE,iBAAO,IAAI,CAAC,QAAQ;AACnB,cAAM,YAAY,mBAAmB,IAAI,KAAK;AAC9C,cAAM,WAAW,mBAAmB,IAAI,SAAS;AACjD,eACE,qBAAC,QAAgB,WAAU,YACzB;AAAA,8BAAC,QAAG,WAAU,uBACZ;AAAA,YAAC;AAAA;AAAA,cACC,OAAO,IAAI,SAAS;AAAA,cACpB,eAAe,CAAC,UAAU,YAAY,IAAI,IAAI,EAAE,OAAO,SAAS,GAAG,CAAC;AAAA,cAEpE;AAAA,oCAAC,iBACC,8BAAC,eAAY,aAAa,EAAE,0CAA0C,cAAc,GAAG,GACzF;AAAA,gBACA,oBAAC,iBACE,oBAAU,IAAI,CAAC,WACd,oBAAC,cAA8B,OAAO,OAAO,OAC1C,iBAAO,SADO,OAAO,KAExB,CACD,GACH;AAAA;AAAA;AAAA,UACF,GACF;AAAA,UACA,qBAAC,QAAG,WAAU,uBACZ;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAO,IAAI,aAAa;AAAA,gBACxB,eAAe,CAAC,UAAU,YAAY,IAAI,IAAI,EAAE,WAAW,SAAS,KAAK,CAAC;AAAA,gBAE1E;AAAA,sCAAC,iBACC,8BAAC,eAAY,aAAa,EAAE,yCAAyC,8BAA8B,GAAG,GACxG;AAAA,kBACA,oBAAC,iBACE,mBAAS,IAAI,CAAC,WACb,oBAAC,cAA8B,OAAO,OAAO,OAC1C,iBAAO,SADO,OAAO,KAExB,CACD,GACH;AAAA;AAAA;AAAA,YACF;AAAA,YACA,oBAAC,OAAE,WAAU,4CACV,YAAE,uCAAuC,kEAAkE,GAC9G;AAAA,aACF;AAAA,UACA,oBAAC,QAAG,WAAU,kCACZ;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,cAAY,EAAE,sCAAsC,QAAQ;AAAA,cAC5D,SAAS,MAAM,YAAY,IAAI,EAAE;AAAA,cAEjC,8BAAC,UAAO,WAAU,WAAU;AAAA;AAAA,UAC9B,GACF;AAAA,aAjDO,IAAI,EAkDb;AAAA,MAEJ,CAAC,GACH;AAAA,OACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAU,aACb,+BAAC,SAAI,WAAU,+DACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,QAAG,WAAU,yBAAyB,YAAE,6BAA6B,YAAY,GAAE;AAAA,MACpF,oBAAC,OAAE,WAAU,iCACV,YAAE,mCAAmC,sFAAsF,GAC9H;AAAA,OACF;AAAA,IACA,oBAAC,SAAI,WAAU,gDACb,+BAAC,SAAI,WAAU,oBACb;AAAA,2BAAC,SACC;AAAA,4BAAC,WAAM,WAAU,iCACd,YAAE,oCAAoC,eAAe,GACxD;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,oBAAoB;AAAA,YAC3B,eAAe,CAAC,UAAU,oBAAoB,SAAS,EAAE;AAAA,YACzD,UAAU,mBAAmB,CAAC,CAAC;AAAA,YAE/B;AAAA,kCAAC,iBAAc,WAAU,QACvB,8BAAC,eAAY,aAAa,EAAE,mCAAmC,kBAAkB,GAAG,GACtF;AAAA,cACA,oBAAC,iBACG,qBAAU,SAAS,CAAC,GAAG,IAAI,CAAC,SAC5B,qBAAC,cAA+B,OAAO,KAAK,UACzC;AAAA,qBAAK,SAAS,KAAK;AAAA,gBAAS;AAAA,gBAAE,KAAK,WAAW,WAAW,IAAI,EAAE,qCAAqC,QAAQ,CAAC,MAAM;AAAA,mBADrG,KAAK,QAEtB,CACD,GACH;AAAA;AAAA;AAAA,QACF;AAAA,QACC,gBACC,oBAAC,OAAE,WAAU,uCACV,YAAE,2CAA2C,yBAAyB,GACzE,IAEA,oBAAC,OAAE,WAAU,sCACV,YAAE,kCAAkC,yEAAyE,GAChH;AAAA,SAEJ;AAAA,MACA,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,SAAS;AAAA,YACT,iBAAiB,CAAC,YAAY,YAAY,YAAY,IAAI;AAAA;AAAA,QAC5D;AAAA,QACA,oBAAC,WAAM,SAAQ,8BACZ,YAAE,8BAA8B,oCAAoC,GACvE;AAAA,SACF;AAAA,OACF,GACF;AAAA,IACA,qBAAC,SAAI,WAAU,0CACb;AAAA,2BAAC,SAAI,WAAU,0CACb;AAAA,6BAAC,SACC;AAAA,8BAAC,QAAG,WAAU,uBAAuB,YAAE,oCAAoC,kBAAkB,GAAE;AAAA,UAC/F,oBAAC,OAAE,WAAU,iCACV,YAAE,uCAAuC,mEAAmE,GAC/G;AAAA,WACF;AAAA,QACA,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,UACzD;AAAA,8BAAC,QAAK,WAAU,gBAAe;AAAA,UAC9B,EAAE,mCAAmC,WAAW;AAAA,WACnD;AAAA,SACF;AAAA,MACC,aAAa;AAAA,OAChB;AAAA,IACA,oBAAC,SAAI,WAAU,oBACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAS,MAAM,SAAS,OAAO;AAAA,QAC/B,UAAU,SAAS,aAAa,mBAAmB,CAAC,CAAC,iBAAiB,CAAC;AAAA,QAEvE;AAAA,8BAAC,QAAK,WAAU,gBAAe;AAAA,UAC9B,SAAS,YACN,EAAE,sCAAsC,cAAS,IACjD,EAAE,oCAAoC,qBAAqB;AAAA;AAAA;AAAA,IACjE,GACF;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useQuery, useMutation } from '@tanstack/react-query'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { useCustomFieldDefs, type CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'\nimport { Plus, Save, Trash2 } from 'lucide-react'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { getEntityFields } from '#generated/entity-fields-registry'\n\ntype EntityOption = { entityId: string; label?: string; source?: string }\ntype FieldOption = { value: string; label: string }\n\ntype EncryptionFieldRow = {\n  id: string\n  field: string\n  hashField?: string | null\n}\n\ntype EncryptionMapResponse = {\n  entityId: string\n  fields?: Array<{ field: string; hashField?: string | null }>\n  isActive?: boolean\n  updatedAt?: string | null\n}\n\ntype CanonicalOption = { value: string; label?: string }\n\nconst EMPTY_FIELD_DEFS: CustomFieldDefDto[] = []\n\nfunction normalizeToken(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')\n    .replace(/[^a-z0-9]/gi, '')\n    .toLowerCase()\n}\n\nfunction canonicalizeFieldName(raw: string, options: CanonicalOption[]): string {\n  const trimmed = typeof raw === 'string' ? raw.trim() : ''\n  if (!trimmed) return ''\n  const normalized = normalizeToken(trimmed)\n  for (const option of options) {\n    const optionValue = typeof option.value === 'string' ? option.value.trim() : ''\n    if (optionValue && normalizeToken(optionValue) === normalized) return optionValue\n    if (option.label && normalizeToken(option.label) === normalized) return optionValue\n  }\n  return trimmed\n}\n\nfunction normalizeFieldRows(raw: EncryptionMapResponse | undefined, options: CanonicalOption[]): EncryptionFieldRow[] {\n  const rows = Array.isArray(raw?.fields) ? raw!.fields : []\n  return rows.map((entry, idx) => ({\n    id: `${entry.field}-${idx}`,\n    field: canonicalizeFieldName(entry.field, options),\n    hashField: entry.hashField ? canonicalizeFieldName(entry.hashField, options) : null,\n  }))\n}\n\nfunction areFieldRowsEqual(a: EncryptionFieldRow[], b: EncryptionFieldRow[]): boolean {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  return a.every((row, idx) => {\n    const other = b[idx]\n    return !!other && row.id === other.id && row.field === other.field && (row.hashField ?? null) === (other.hashField ?? null)\n  })\n}\n\nfunction areFieldOptionsEqual(a: FieldOption[], b: FieldOption[]): boolean {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  return a.every((option, idx) => {\n    const other = b[idx]\n    return !!other && option.value === other.value && option.label === other.label\n  })\n}\n\nfunction buildRowId(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()\n  return `row-${Math.random().toString(36).slice(2)}`\n}\n\nexport function EncryptionManager() {\n  const t = useT()\n  const scopeVersion = useOrganizationScopeVersion()\n  const [selectedEntityId, setSelectedEntityId] = React.useState('')\n  const [fields, setFields] = React.useState<EncryptionFieldRow[]>([])\n  const [isActive, setIsActive] = React.useState(true)\n  const [baseFieldOptions, setBaseFieldOptions] = React.useState<FieldOption[]>([])\n  const [hasUserEdited, setHasUserEdited] = React.useState(false)\n  const { data: rawFieldDefs, isLoading: loadingFieldDefs } = useCustomFieldDefs(selectedEntityId ? [selectedEntityId] : [], {\n    enabled: !!selectedEntityId,\n  })\n  const fieldDefs = rawFieldDefs ?? EMPTY_FIELD_DEFS\n  const canonicalOptions = React.useMemo<CanonicalOption[]>(() => {\n    const options: CanonicalOption[] = []\n    for (const option of baseFieldOptions) {\n      if (!option.value) continue\n      if (options.some((opt) => opt.value === option.value)) continue\n      options.push(option)\n    }\n    for (const def of fieldDefs) {\n      const key = typeof def.key === 'string' ? def.key.trim() : ''\n      if (!key || options.some((opt) => opt.value === key)) continue\n      const label = typeof def.label === 'string' ? def.label : undefined\n      options.push({ value: key, label })\n    }\n    return options\n  }, [baseFieldOptions, fieldDefs])\n  const fieldOptions = React.useMemo(() => {\n    const entries = new Map<string, string>()\n    for (const option of baseFieldOptions) {\n      if (!option.value || entries.has(option.value)) continue\n      entries.set(option.value, option.label || option.value)\n    }\n    for (const def of fieldDefs) {\n      const key = typeof def.key === 'string' ? def.key.trim() : ''\n      if (!key || entries.has(key)) continue\n      const label = typeof def.label === 'string' && def.label.trim().length ? def.label : key\n      entries.set(key, label)\n    }\n    for (const row of fields) {\n      const main = row.field?.trim()\n      if (main && !entries.has(main)) entries.set(main, main)\n      const hash = row.hashField?.trim()\n      if (hash && !entries.has(hash)) entries.set(hash, hash)\n    }\n    return Array.from(entries.entries()).map(([value, label]) => ({ value, label }))\n  }, [baseFieldOptions, fieldDefs, fields])\n\n  const { data: entities, isLoading: loadingEntities, error: entitiesError } = useQuery<{ items: EntityOption[] }>({\n    queryKey: ['entities-list', scopeVersion],\n    queryFn: async () =>\n      readApiResultOrThrow('/api/entities/entities', undefined, {\n        errorMessage: t('entities.encryption.errors.loadEntities', 'Failed to load entities'),\n      }),\n  })\n\n  React.useEffect(() => {\n    if (!selectedEntityId && entities?.items?.length) {\n      const first = entities.items[0]\n      setSelectedEntityId(first.entityId)\n    }\n  }, [entities, selectedEntityId])\n\n  React.useEffect(() => {\n    if (!selectedEntityId) {\n      setBaseFieldOptions((prev) => (prev.length ? [] : prev))\n      return\n    }\n    const parts = selectedEntityId.split(':')\n    const entitySlug = parts[1]\n    if (!entitySlug) {\n      setBaseFieldOptions((prev) => (prev.length ? [] : prev))\n      return\n    }\n\n    // Use static registry instead of dynamic import for Turbopack compatibility\n    const mod = getEntityFields(entitySlug)\n    if (!mod) {\n      console.warn('[encryption] No fields found for entity', entitySlug)\n      setBaseFieldOptions((prev) => (prev.length ? [] : prev))\n      return\n    }\n\n    const options: FieldOption[] = []\n    for (const raw of Object.values(mod)) {\n      if (typeof raw !== 'string' || !raw.trim()) continue\n      const value = raw.trim()\n      if (options.some((opt) => opt.value === value)) continue\n      const label = value\n        .split('_')\n        .map((segment) => (segment ? `${segment[0].toUpperCase()}${segment.slice(1)}` : ''))\n        .join(' ')\n        .trim() || value\n      options.push({ value, label })\n    }\n    setBaseFieldOptions((prev) => (areFieldOptionsEqual(prev, options) ? prev : options))\n  }, [selectedEntityId])\n\n  const {\n    data: map,\n    isLoading: loadingMap,\n    isError: mapError,\n    refetch: refetchMap,\n  } = useQuery<EncryptionMapResponse>({\n    queryKey: ['encryption-map', selectedEntityId, scopeVersion],\n    enabled: !!selectedEntityId,\n    queryFn: async () =>\n      readApiResultOrThrow(`/api/entities/encryption?entityId=${encodeURIComponent(selectedEntityId)}`, undefined, {\n        errorMessage: t('entities.encryption.errors.loadMap', 'Failed to load encryption map'),\n      }),\n  })\n\n  const mapSignature = React.useMemo(() => JSON.stringify(map ?? null), [map])\n  const lastMapSignatureRef = React.useRef<string | null>(null)\n\n  React.useEffect(() => {\n    const signature = mapSignature\n    const isSameMap = signature === lastMapSignatureRef.current\n    if (isSameMap && hasUserEdited) return\n    if (!map) {\n      setFields((prev) => (prev.length ? [] : prev))\n      setIsActive((prev) => (prev === true ? prev : true))\n      setHasUserEdited(false)\n      lastMapSignatureRef.current = signature\n      return\n    }\n    const nextFields = normalizeFieldRows(map, canonicalOptions)\n    setFields((prev) => (areFieldRowsEqual(prev, nextFields) ? prev : nextFields))\n    const nextIsActive = map?.isActive !== false\n    setIsActive((prev) => (prev === nextIsActive ? prev : nextIsActive))\n    setHasUserEdited(false)\n    lastMapSignatureRef.current = signature\n  }, [mapSignature, map, canonicalOptions, hasUserEdited])\n\n  const { runMutation } = useGuardedMutation({ contextId: 'entities.encryption-map' })\n\n  const mutation = useMutation({\n    mutationFn: async () => {\n      const trimmed = fields\n        .map((row) => ({\n          field: canonicalizeFieldName(row.field, canonicalOptions).trim(),\n          hashField: row.hashField ? canonicalizeFieldName(row.hashField, canonicalOptions).trim() : '',\n        }))\n        .filter((row) => row.field.length > 0)\n        .map((row) => ({\n          field: row.field,\n          hashField: row.hashField ? row.hashField : null,\n        }))\n      if (!selectedEntityId) {\n        throw new Error(t('entities.encryption.errors.selectEntity', 'Select an entity before saving'))\n      }\n      if (!trimmed.length) {\n        throw new Error(t('entities.encryption.errors.noFields', 'Add at least one field to encrypt'))\n      }\n      const payload = { entityId: selectedEntityId, fields: trimmed, isActive }\n      // Route the write through the guarded mutation helper so global injection\n      // modules (mutation guard, record-lock conflict handling) can run, and send\n      // the loaded map's version so a stale tab cannot silently overwrite a newer\n      // encryption configuration (the server rejects mismatches with a 409).\n      return runMutation({\n        operation: async () => {\n          const res = await withScopedApiRequestHeaders(\n            buildOptimisticLockHeader(map?.updatedAt ?? null),\n            () => apiCall('/api/entities/encryption', {\n              method: 'POST',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify(payload),\n            }),\n          )\n          if (!res.ok) {\n            await raiseCrudError(res.response, t('entities.encryption.errors.save', 'Failed to save encryption map'))\n          }\n          return true\n        },\n        context: {},\n        mutationPayload: payload,\n      })\n    },\n    onSuccess: () => {\n      flash(t('entities.encryption.flash.saved', 'Encryption map saved'), 'success')\n      void refetchMap()\n    },\n    onError: (err: any) => {\n      const message = err?.message || t('entities.encryption.errors.save', 'Failed to save encryption map')\n      flash(message, 'error')\n    },\n  })\n\n  const addField = () => {\n    setHasUserEdited(true)\n    setFields((prev) => [...prev, { id: buildRowId(), field: '', hashField: null }])\n  }\n\n  const updateField = (id: string, patch: Partial<EncryptionFieldRow>) => {\n    setHasUserEdited(true)\n    setFields((prev) => prev.map((row) => (row.id === id ? { ...row, ...patch } : row)))\n  }\n\n  const removeField = (id: string) => {\n    setHasUserEdited(true)\n    setFields((prev) => prev.filter((row) => row.id !== id))\n  }\n\n  const renderFields = () => {\n    if (loadingMap || loadingFieldDefs) {\n      return (\n        <LoadingMessage\n          label={t('entities.encryption.loading', 'Loading encryption map\u2026')}\n          className=\"border-0 bg-transparent p-4\"\n        />\n      )\n    }\n    if (mapError) {\n      return (\n        <ErrorMessage\n          label={t('entities.encryption.errors.loadMap', 'Failed to load encryption map')}\n          action={(\n            <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={() => void refetchMap()}>\n              {t('entities.encryption.actions.retry', 'Retry')}\n            </Button>\n          )}\n        />\n      )\n    }\n    if (!fields.length) {\n      return (\n        <div className=\"rounded border bg-background/80 p-4 text-sm text-muted-foreground\">\n          {t('entities.encryption.empty', 'No fields are encrypted yet. Add the first one below.')}\n        </div>\n      )\n    }\n    const withFallbackOption = (value?: string | null) => {\n      if (value && !fieldOptions.some((opt) => opt.value === value)) {\n        return [...fieldOptions, { value, label: value }]\n      }\n      return fieldOptions\n    }\n    return (\n      <div className=\"overflow-x-auto\">\n        <table className=\"w-full min-w-[720px] text-sm\">\n          <thead>\n            <tr className=\"text-xs uppercase tracking-wide text-muted-foreground\">\n              <th className=\"px-3 py-2 text-left\">\n                {t('entities.encryption.fields.field', 'Field name')}\n              </th>\n              <th className=\"px-3 py-2 text-left\">\n                {t('entities.encryption.fields.hash', 'Hash field (optional)')}\n              </th>\n              <th className=\"px-3 py-2 text-right\">\n                {t('entities.encryption.fields.actions', 'Actions')}\n              </th>\n            </tr>\n          </thead>\n          <tbody>\n            {fields.map((row) => {\n              const fieldOpts = withFallbackOption(row.field)\n              const hashOpts = withFallbackOption(row.hashField)\n              return (\n                <tr key={row.id} className=\"border-t\">\n                  <td className=\"px-3 py-2 align-top\">\n                    <Select\n                      value={row.field || undefined}\n                      onValueChange={(value) => updateField(row.id, { field: value ?? '' })}\n                    >\n                      <SelectTrigger>\n                        <SelectValue placeholder={t('entities.encryption.fields.selectField', 'Select field')} />\n                      </SelectTrigger>\n                      <SelectContent>\n                        {fieldOpts.map((option) => (\n                          <SelectItem key={option.value} value={option.value}>\n                            {option.label}\n                          </SelectItem>\n                        ))}\n                      </SelectContent>\n                    </Select>\n                  </td>\n                  <td className=\"px-3 py-2 align-top\">\n                    <Select\n                      value={row.hashField || undefined}\n                      onValueChange={(value) => updateField(row.id, { hashField: value || null })}\n                    >\n                      <SelectTrigger>\n                        <SelectValue placeholder={t('entities.encryption.fields.selectHash', 'Select hash field (optional)')} />\n                      </SelectTrigger>\n                      <SelectContent>\n                        {hashOpts.map((option) => (\n                          <SelectItem key={option.value} value={option.value}>\n                            {option.label}\n                          </SelectItem>\n                        ))}\n                      </SelectContent>\n                    </Select>\n                    <p className=\"mt-1 text-overline text-muted-foreground\">\n                      {t('entities.encryption.fields.hashHint', 'Use when lookups must stay deterministic (e.g., login by email).')}\n                    </p>\n                  </td>\n                  <td className=\"px-3 py-2 align-top text-right\">\n                    <Button\n                      type=\"button\"\n                      variant=\"ghost\"\n                      size=\"sm\"\n                      className=\"h-9 w-9 px-0\"\n                      aria-label={t('entities.encryption.actions.remove', 'Remove')}\n                      onClick={() => removeField(row.id)}\n                    >\n                      <Trash2 className=\"h-4 w-4\" />\n                    </Button>\n                  </td>\n                </tr>\n              )\n            })}\n          </tbody>\n        </table>\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-6\">\n      <div className=\"flex flex-col gap-3 rounded-lg border bg-card p-4 shadow-sm\">\n        <div className=\"space-y-2\">\n          <h2 className=\"text-xl font-semibold\">{t('entities.encryption.title', 'Encryption')}</h2>\n          <p className=\"text-sm text-muted-foreground\">\n            {t('entities.encryption.description', 'Manage which entity fields are encrypted with tenant keys and optional hash columns.')}\n          </p>\n        </div>\n        <div className=\"flex flex-col gap-4 sm:flex-row sm:items-end\">\n          <div className=\"flex-1 space-y-3\">\n            <div>\n              <label className=\"text-xs text-muted-foreground\">\n                {t('entities.encryption.selectEntity', 'Choose entity')}\n              </label>\n              <Select\n                value={selectedEntityId || undefined}\n                onValueChange={(value) => setSelectedEntityId(value ?? '')}\n                disabled={loadingEntities || !!entitiesError}\n              >\n                <SelectTrigger className=\"mt-1\">\n                  <SelectValue placeholder={t('entities.encryption.placeholder', 'Select an entity')} />\n                </SelectTrigger>\n                <SelectContent>\n                  {(entities?.items || []).map((item) => (\n                    <SelectItem key={item.entityId} value={item.entityId}>\n                      {item.label || item.entityId} {item.source === 'custom' ? `(${t('entities.encryption.source.custom', 'custom')})` : ''}\n                    </SelectItem>\n                  ))}\n                </SelectContent>\n              </Select>\n              {entitiesError ? (\n                <p className=\"mt-1 text-xs text-status-error-text\">\n                  {t('entities.encryption.errors.loadEntities', 'Failed to load entities')}\n                </p>\n              ) : (\n                <p className=\"mt-1 text-xs text-muted-foreground\">\n                  {t('entities.encryption.entityHint', 'Maps apply per tenant/organization. Use field names from your entities.')}\n                </p>\n              )}\n            </div>\n            <div className=\"inline-flex items-center gap-2 text-sm\">\n              <Checkbox\n                id=\"entities-encryption-active\"\n                checked={isActive}\n                onCheckedChange={(checked) => setIsActive(checked === true)}\n              />\n              <label htmlFor=\"entities-encryption-active\">\n                {t('entities.encryption.active', 'Encryption enabled for this entity')}\n              </label>\n            </div>\n          </div>\n        </div>\n        <div className=\"rounded-lg border bg-background/80 p-4\">\n          <div className=\"mb-3 flex items-center justify-between\">\n            <div>\n              <h3 className=\"text-sm font-medium\">{t('entities.encryption.fields.title', 'Encrypted fields')}</h3>\n              <p className=\"text-xs text-muted-foreground\">\n                {t('entities.encryption.fields.subtitle', 'List the attributes that should be encrypted with the tenant key.')}\n              </p>\n            </div>\n            <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={addField}>\n              <Plus className=\"mr-2 h-4 w-4\" />\n              {t('entities.encryption.actions.add', 'Add field')}\n            </Button>\n          </div>\n          {renderFields()}\n        </div>\n        <div className=\"flex justify-end\">\n          <Button\n            type=\"button\"\n            onClick={() => mutation.mutate()}\n            disabled={mutation.isPending || loadingEntities || !!entitiesError || !selectedEntityId}\n          >\n            <Save className=\"mr-2 h-4 w-4\" />\n            {mutation.isPending\n              ? t('entities.encryption.actions.saving', 'Saving\u2026')\n              : t('entities.encryption.actions.save', 'Save encryption map')}\n          </Button>\n        </div>\n      </div>\n    </div>\n  )\n}\n"],
+  "mappings": ";AA8SQ,cAmCI,YAnCJ;AA5SR,YAAY,WAAW;AACvB,SAAS,UAAU,mBAAmB;AACtC,SAAS,cAAc;AACvB,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,oBAAoB;AAC7C,SAAS,aAAa;AACtB,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B;AACnC,SAAS,iCAAiC;AAC1C,SAAS,0BAAkD;AAC3D,SAAS,MAAM,MAAM,cAAc;AACnC,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,uBAAuB;AAoBhC,MAAM,mBAAwC,CAAC;AAE/C,SAAS,eAAe,OAAuB;AAC7C,SAAO,MACJ,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,eAAe,EAAE,EACzB,YAAY;AACjB;AAEA,SAAS,sBAAsB,KAAa,SAAoC;AAC9E,QAAM,UAAU,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACvD,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,eAAe,OAAO;AACzC,aAAW,UAAU,SAAS;AAC5B,UAAM,cAAc,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,KAAK,IAAI;AAC7E,QAAI,eAAe,eAAe,WAAW,MAAM,WAAY,QAAO;AACtE,QAAI,OAAO,SAAS,eAAe,OAAO,KAAK,MAAM,WAAY,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAwC,SAAkD;AACpH,QAAM,OAAO,MAAM,QAAQ,KAAK,MAAM,IAAI,IAAK,SAAS,CAAC;AACzD,SAAO,KAAK,IAAI,CAAC,OAAO,SAAS;AAAA,IAC/B,IAAI,GAAG,MAAM,KAAK,IAAI,GAAG;AAAA,IACzB,OAAO,sBAAsB,MAAM,OAAO,OAAO;AAAA,IACjD,WAAW,MAAM,YAAY,sBAAsB,MAAM,WAAW,OAAO,IAAI;AAAA,EACjF,EAAE;AACJ;AAEA,SAAS,kBAAkB,GAAyB,GAAkC;AACpF,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,EAAE,MAAM,CAAC,KAAK,QAAQ;AAC3B,UAAM,QAAQ,EAAE,GAAG;AACnB,WAAO,CAAC,CAAC,SAAS,IAAI,OAAO,MAAM,MAAM,IAAI,UAAU,MAAM,UAAU,IAAI,aAAa,WAAW,MAAM,aAAa;AAAA,EACxH,CAAC;AACH;AAEA,SAAS,qBAAqB,GAAkB,GAA2B;AACzE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,EAAE,MAAM,CAAC,QAAQ,QAAQ;AAC9B,UAAM,QAAQ,EAAE,GAAG;AACnB,WAAO,CAAC,CAAC,SAAS,OAAO,UAAU,MAAM,SAAS,OAAO,UAAU,MAAM;AAAA,EAC3E,CAAC;AACH;AAEA,SAAS,aAAqB;AAC5B,MAAI,OAAO,WAAW,eAAe,OAAO,WAAY,QAAO,OAAO,WAAW;AACjF,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD;AAEO,SAAS,oBAAoB;AAClC,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,4BAA4B;AACjD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,EAAE;AACjE,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAA+B,CAAC,CAAC;AACnE,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,IAAI;AACnD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,CAAC,CAAC;AAChF,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,EAAE,MAAM,cAAc,WAAW,iBAAiB,IAAI,mBAAmB,mBAAmB,CAAC,gBAAgB,IAAI,CAAC,GAAG;AAAA,IACzH,SAAS,CAAC,CAAC;AAAA,EACb,CAAC;AACD,QAAM,YAAY,gBAAgB;AAClC,QAAM,mBAAmB,MAAM,QAA2B,MAAM;AAC9D,UAAM,UAA6B,CAAC;AACpC,eAAW,UAAU,kBAAkB;AACrC,UAAI,CAAC,OAAO,MAAO;AACnB,UAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI,UAAU,OAAO,KAAK,EAAG;AACvD,cAAQ,KAAK,MAAM;AAAA,IACrB;AACA,eAAW,OAAO,WAAW;AAC3B,YAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI;AAC3D,UAAI,CAAC,OAAO,QAAQ,KAAK,CAAC,QAAQ,IAAI,UAAU,GAAG,EAAG;AACtD,YAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AAC1D,cAAQ,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACT,GAAG,CAAC,kBAAkB,SAAS,CAAC;AAChC,QAAM,eAAe,MAAM,QAAQ,MAAM;AACvC,UAAM,UAAU,oBAAI,IAAoB;AACxC,eAAW,UAAU,kBAAkB;AACrC,UAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,EAAG;AAChD,cAAQ,IAAI,OAAO,OAAO,OAAO,SAAS,OAAO,KAAK;AAAA,IACxD;AACA,eAAW,OAAO,WAAW;AAC3B,YAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI;AAC3D,UAAI,CAAC,OAAO,QAAQ,IAAI,GAAG,EAAG;AAC9B,YAAM,QAAQ,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACrF,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AACA,eAAW,OAAO,QAAQ;AACxB,YAAM,OAAO,IAAI,OAAO,KAAK;AAC7B,UAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAG,SAAQ,IAAI,MAAM,IAAI;AACtD,YAAM,OAAO,IAAI,WAAW,KAAK;AACjC,UAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAG,SAAQ,IAAI,MAAM,IAAI;AAAA,IACxD;AACA,WAAO,MAAM,KAAK,QAAQ,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,OAAO,MAAM,EAAE;AAAA,EACjF,GAAG,CAAC,kBAAkB,WAAW,MAAM,CAAC;AAExC,QAAM,EAAE,MAAM,UAAU,WAAW,iBAAiB,OAAO,cAAc,IAAI,SAAoC;AAAA,IAC/G,UAAU,CAAC,iBAAiB,YAAY;AAAA,IACxC,SAAS,YACP,qBAAqB,0BAA0B,QAAW;AAAA,MACxD,cAAc,EAAE,2CAA2C,yBAAyB;AAAA,IACtF,CAAC;AAAA,EACL,CAAC;AAED,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,oBAAoB,UAAU,OAAO,QAAQ;AAChD,YAAM,QAAQ,SAAS,MAAM,CAAC;AAC9B,0BAAoB,MAAM,QAAQ;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,UAAU,gBAAgB,CAAC;AAE/B,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,kBAAkB;AACrB,0BAAoB,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AACvD;AAAA,IACF;AACA,UAAM,QAAQ,iBAAiB,MAAM,GAAG;AACxC,UAAM,aAAa,MAAM,CAAC;AAC1B,QAAI,CAAC,YAAY;AACf,0BAAoB,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AACvD;AAAA,IACF;AAGA,UAAM,MAAM,gBAAgB,UAAU;AACtC,QAAI,CAAC,KAAK;AACR,cAAQ,KAAK,2CAA2C,UAAU;AAClE,0BAAoB,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AACvD;AAAA,IACF;AAEA,UAAM,UAAyB,CAAC;AAChC,eAAW,OAAO,OAAO,OAAO,GAAG,GAAG;AACpC,UAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,EAAG;AAC5C,YAAM,QAAQ,IAAI,KAAK;AACvB,UAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI,UAAU,KAAK,EAAG;AAChD,YAAM,QAAQ,MACX,MAAM,GAAG,EACT,IAAI,CAAC,YAAa,UAAU,GAAG,QAAQ,CAAC,EAAE,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAAK,EAAG,EAClF,KAAK,GAAG,EACR,KAAK,KAAK;AACb,cAAQ,KAAK,EAAE,OAAO,MAAM,CAAC;AAAA,IAC/B;AACA,wBAAoB,CAAC,SAAU,qBAAqB,MAAM,OAAO,IAAI,OAAO,OAAQ;AAAA,EACtF,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,SAAS;AAAA,EACX,IAAI,SAAgC;AAAA,IAClC,UAAU,CAAC,kBAAkB,kBAAkB,YAAY;AAAA,IAC3D,SAAS,CAAC,CAAC;AAAA,IACX,SAAS,YACP,qBAAqB,qCAAqC,mBAAmB,gBAAgB,CAAC,IAAI,QAAW;AAAA,MAC3G,cAAc,EAAE,sCAAsC,+BAA+B;AAAA,IACvF,CAAC;AAAA,EACL,CAAC;AAED,QAAM,eAAe,MAAM,QAAQ,MAAM,KAAK,UAAU,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC;AAC3E,QAAM,sBAAsB,MAAM,OAAsB,IAAI;AAE5D,QAAM,UAAU,MAAM;AACpB,UAAM,YAAY;AAClB,UAAM,YAAY,cAAc,oBAAoB;AACpD,QAAI,aAAa,cAAe;AAChC,QAAI,CAAC,KAAK;AACR,gBAAU,CAAC,SAAU,KAAK,SAAS,CAAC,IAAI,IAAK;AAC7C,kBAAY,CAAC,SAAU,SAAS,OAAO,OAAO,IAAK;AACnD,uBAAiB,KAAK;AACtB,0BAAoB,UAAU;AAC9B;AAAA,IACF;AACA,UAAM,aAAa,mBAAmB,KAAK,gBAAgB;AAC3D,cAAU,CAAC,SAAU,kBAAkB,MAAM,UAAU,IAAI,OAAO,UAAW;AAC7E,UAAM,eAAe,KAAK,aAAa;AACvC,gBAAY,CAAC,SAAU,SAAS,eAAe,OAAO,YAAa;AACnE,qBAAiB,KAAK;AACtB,wBAAoB,UAAU;AAAA,EAChC,GAAG,CAAC,cAAc,KAAK,kBAAkB,aAAa,CAAC;AAEvD,QAAM,EAAE,YAAY,IAAI,mBAAmB,EAAE,WAAW,0BAA0B,CAAC;AAEnF,QAAM,WAAW,YAAY;AAAA,IAC3B,YAAY,YAAY;AACtB,YAAM,UAAU,OACb,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,sBAAsB,IAAI,OAAO,gBAAgB,EAAE,KAAK;AAAA,QAC/D,WAAW,IAAI,YAAY,sBAAsB,IAAI,WAAW,gBAAgB,EAAE,KAAK,IAAI;AAAA,MAC7F,EAAE,EACD,OAAO,CAAC,QAAQ,IAAI,MAAM,SAAS,CAAC,EACpC,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,IAAI;AAAA,QACX,WAAW,IAAI,YAAY,IAAI,YAAY;AAAA,MAC7C,EAAE;AACJ,UAAI,CAAC,kBAAkB;AACrB,cAAM,IAAI,MAAM,EAAE,2CAA2C,gCAAgC,CAAC;AAAA,MAChG;AACA,UAAI,CAAC,QAAQ,QAAQ;AACnB,cAAM,IAAI,MAAM,EAAE,uCAAuC,mCAAmC,CAAC;AAAA,MAC/F;AACA,YAAM,UAAU,EAAE,UAAU,kBAAkB,QAAQ,SAAS,SAAS;AAKxE,aAAO,YAAY;AAAA,QACjB,WAAW,YAAY;AACrB,gBAAM,MAAM,MAAM;AAAA,YAChB,0BAA0B,KAAK,aAAa,IAAI;AAAA,YAChD,MAAM,QAAQ,4BAA4B;AAAA,cACxC,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,YAC9B,CAAC;AAAA,UACH;AACA,cAAI,CAAC,IAAI,IAAI;AACX,kBAAM,eAAe,IAAI,UAAU,EAAE,mCAAmC,+BAA+B,CAAC;AAAA,UAC1G;AACA,iBAAO;AAAA,QACT;AAAA,QACA,SAAS,CAAC;AAAA,QACV,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,IACA,WAAW,MAAM;AACf,YAAM,EAAE,mCAAmC,sBAAsB,GAAG,SAAS;AAC7E,WAAK,WAAW;AAAA,IAClB;AAAA,IACA,SAAS,CAAC,QAAa;AACrB,YAAM,UAAU,KAAK,WAAW,EAAE,mCAAmC,+BAA+B;AACpG,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,CAAC;AAED,QAAM,WAAW,MAAM;AACrB,qBAAiB,IAAI;AACrB,cAAU,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,IAAI,WAAW,GAAG,OAAO,IAAI,WAAW,KAAK,CAAC,CAAC;AAAA,EACjF;AAEA,QAAM,cAAc,CAAC,IAAY,UAAuC;AACtE,qBAAiB,IAAI;AACrB,cAAU,CAAC,SAAS,KAAK,IAAI,CAAC,QAAS,IAAI,OAAO,KAAK,EAAE,GAAG,KAAK,GAAG,MAAM,IAAI,GAAI,CAAC;AAAA,EACrF;AAEA,QAAM,cAAc,CAAC,OAAe;AAClC,qBAAiB,IAAI;AACrB,cAAU,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;AAAA,EACzD;AAEA,QAAM,eAAe,MAAM;AACzB,QAAI,cAAc,kBAAkB;AAClC,aACE;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,+BAA+B,8BAAyB;AAAA,UACjE,WAAU;AAAA;AAAA,MACZ;AAAA,IAEJ;AACA,QAAI,UAAU;AACZ,aACE;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,sCAAsC,+BAA+B;AAAA,UAC9E,QACE,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,MAAM,KAAK,WAAW,GAC9E,YAAE,qCAAqC,OAAO,GACjD;AAAA;AAAA,MAEJ;AAAA,IAEJ;AACA,QAAI,CAAC,OAAO,QAAQ;AAClB,aACE,oBAAC,SAAI,WAAU,qEACZ,YAAE,6BAA6B,uDAAuD,GACzF;AAAA,IAEJ;AACA,UAAM,qBAAqB,CAAC,UAA0B;AACpD,UAAI,SAAS,CAAC,aAAa,KAAK,CAAC,QAAQ,IAAI,UAAU,KAAK,GAAG;AAC7D,eAAO,CAAC,GAAG,cAAc,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AACA,WACE,oBAAC,SAAI,WAAU,mBACb,+BAAC,WAAM,WAAU,gCACf;AAAA,0BAAC,WACC,+BAAC,QAAG,WAAU,yDACZ;AAAA,4BAAC,QAAG,WAAU,uBACX,YAAE,oCAAoC,YAAY,GACrD;AAAA,QACA,oBAAC,QAAG,WAAU,uBACX,YAAE,mCAAmC,uBAAuB,GAC/D;AAAA,QACA,oBAAC,QAAG,WAAU,wBACX,YAAE,sCAAsC,SAAS,GACpD;AAAA,SACF,GACF;AAAA,MACA,oBAAC,WACE,iBAAO,IAAI,CAAC,QAAQ;AACnB,cAAM,YAAY,mBAAmB,IAAI,KAAK;AAC9C,cAAM,WAAW,mBAAmB,IAAI,SAAS;AACjD,eACE,qBAAC,QAAgB,WAAU,YACzB;AAAA,8BAAC,QAAG,WAAU,uBACZ;AAAA,YAAC;AAAA;AAAA,cACC,OAAO,IAAI,SAAS;AAAA,cACpB,eAAe,CAAC,UAAU,YAAY,IAAI,IAAI,EAAE,OAAO,SAAS,GAAG,CAAC;AAAA,cAEpE;AAAA,oCAAC,iBACC,8BAAC,eAAY,aAAa,EAAE,0CAA0C,cAAc,GAAG,GACzF;AAAA,gBACA,oBAAC,iBACE,oBAAU,IAAI,CAAC,WACd,oBAAC,cAA8B,OAAO,OAAO,OAC1C,iBAAO,SADO,OAAO,KAExB,CACD,GACH;AAAA;AAAA;AAAA,UACF,GACF;AAAA,UACA,qBAAC,QAAG,WAAU,uBACZ;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAO,IAAI,aAAa;AAAA,gBACxB,eAAe,CAAC,UAAU,YAAY,IAAI,IAAI,EAAE,WAAW,SAAS,KAAK,CAAC;AAAA,gBAE1E;AAAA,sCAAC,iBACC,8BAAC,eAAY,aAAa,EAAE,yCAAyC,8BAA8B,GAAG,GACxG;AAAA,kBACA,oBAAC,iBACE,mBAAS,IAAI,CAAC,WACb,oBAAC,cAA8B,OAAO,OAAO,OAC1C,iBAAO,SADO,OAAO,KAExB,CACD,GACH;AAAA;AAAA;AAAA,YACF;AAAA,YACA,oBAAC,OAAE,WAAU,4CACV,YAAE,uCAAuC,kEAAkE,GAC9G;AAAA,aACF;AAAA,UACA,oBAAC,QAAG,WAAU,kCACZ;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,WAAU;AAAA,cACV,cAAY,EAAE,sCAAsC,QAAQ;AAAA,cAC5D,SAAS,MAAM,YAAY,IAAI,EAAE;AAAA,cAEjC,8BAAC,UAAO,WAAU,WAAU;AAAA;AAAA,UAC9B,GACF;AAAA,aAjDO,IAAI,EAkDb;AAAA,MAEJ,CAAC,GACH;AAAA,OACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,SAAI,WAAU,aACb,+BAAC,SAAI,WAAU,+DACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,QAAG,WAAU,yBAAyB,YAAE,6BAA6B,YAAY,GAAE;AAAA,MACpF,oBAAC,OAAE,WAAU,iCACV,YAAE,mCAAmC,sFAAsF,GAC9H;AAAA,OACF;AAAA,IACA,oBAAC,SAAI,WAAU,gDACb,+BAAC,SAAI,WAAU,oBACb;AAAA,2BAAC,SACC;AAAA,4BAAC,WAAM,WAAU,iCACd,YAAE,oCAAoC,eAAe,GACxD;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,oBAAoB;AAAA,YAC3B,eAAe,CAAC,UAAU,oBAAoB,SAAS,EAAE;AAAA,YACzD,UAAU,mBAAmB,CAAC,CAAC;AAAA,YAE/B;AAAA,kCAAC,iBAAc,WAAU,QACvB,8BAAC,eAAY,aAAa,EAAE,mCAAmC,kBAAkB,GAAG,GACtF;AAAA,cACA,oBAAC,iBACG,qBAAU,SAAS,CAAC,GAAG,IAAI,CAAC,SAC5B,qBAAC,cAA+B,OAAO,KAAK,UACzC;AAAA,qBAAK,SAAS,KAAK;AAAA,gBAAS;AAAA,gBAAE,KAAK,WAAW,WAAW,IAAI,EAAE,qCAAqC,QAAQ,CAAC,MAAM;AAAA,mBADrG,KAAK,QAEtB,CACD,GACH;AAAA;AAAA;AAAA,QACF;AAAA,QACC,gBACC,oBAAC,OAAE,WAAU,uCACV,YAAE,2CAA2C,yBAAyB,GACzE,IAEA,oBAAC,OAAE,WAAU,sCACV,YAAE,kCAAkC,yEAAyE,GAChH;AAAA,SAEJ;AAAA,MACA,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,SAAS;AAAA,YACT,iBAAiB,CAAC,YAAY,YAAY,YAAY,IAAI;AAAA;AAAA,QAC5D;AAAA,QACA,oBAAC,WAAM,SAAQ,8BACZ,YAAE,8BAA8B,oCAAoC,GACvE;AAAA,SACF;AAAA,OACF,GACF;AAAA,IACA,qBAAC,SAAI,WAAU,0CACb;AAAA,2BAAC,SAAI,WAAU,0CACb;AAAA,6BAAC,SACC;AAAA,8BAAC,QAAG,WAAU,uBAAuB,YAAE,oCAAoC,kBAAkB,GAAE;AAAA,UAC/F,oBAAC,OAAE,WAAU,iCACV,YAAE,uCAAuC,mEAAmE,GAC/G;AAAA,WACF;AAAA,QACA,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,UACzD;AAAA,8BAAC,QAAK,WAAU,gBAAe;AAAA,UAC9B,EAAE,mCAAmC,WAAW;AAAA,WACnD;AAAA,SACF;AAAA,MACC,aAAa;AAAA,OAChB;AAAA,IACA,oBAAC,SAAI,WAAU,oBACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAS,MAAM,SAAS,OAAO;AAAA,QAC/B,UAAU,SAAS,aAAa,mBAAmB,CAAC,CAAC,iBAAiB,CAAC;AAAA,QAEvE;AAAA,8BAAC,QAAK,WAAU,gBAAe;AAAA,UAC9B,SAAS,YACN,EAAE,sCAAsC,cAAS,IACjD,EAAE,oCAAoC,qBAAqB;AAAA;AAAA;AAAA,IACjE,GACF;AAAA,KACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/integrations/api/[id]/credentials/route.js

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getIntegration } from "@open-mercato/shared/modules/integrations/types";
+import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { emitIntegrationsEvent } from "../../../events.js";
 import { saveCredentialsSchema } from "../../../data/validators.js";
 import {
@@ -48,8 +50,10 @@ async function GET(req, ctx) {
   const credentialsService = container.resolve("integrationCredentialsService");
   const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
   let values;
+  let updatedAt;
   try {
     values = await credentialsService.resolve(integration.id, scope);
+    updatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope);
   } catch (error) {
     if (isCredentialsEncryptionUnavailableError(error)) {
       return NextResponse.json({ error: "Integration credentials encryption is unavailable" }, { status: 503 });
@@ -59,7 +63,8 @@ async function GET(req, ctx) {
   return NextResponse.json({
     integrationId: integration.id,
     schema: credentialsService.getSchema(integration.id),
-    credentials: values ?? {}
+    credentials: values ?? {},
+    updatedAt: updatedAt?.toISOString() ?? null
   });
 }
 async function PUT(req, ctx) {
@@ -111,6 +116,23 @@ async function PUT(req, ctx) {
   }
   const credentialsService = container.resolve("integrationCredentialsService");
   const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  try {
+    const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope);
+    enforceCommandOptimisticLock({
+      resourceKind: "integrations.integration",
+      resourceId: integration.id,
+      current: currentUpdatedAt,
+      request: req
+    });
+  } catch (error) {
+    if (isCrudHttpError(error)) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    if (isCredentialsEncryptionUnavailableError(error)) {
+      return NextResponse.json({ error: "Integration credentials encryption is unavailable" }, { status: 503 });
+    }
+    throw error;
+  }
   const credentialFieldErrors = collectCredentialUrlValidationErrors(
     credentialsService.getSchema(integration.id),
     payloadData.credentials

package/dist/modules/integrations/api/[id]/credentials/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/integrations/api/%5Bid%5D/credentials/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { saveCredentialsSchema } from '../../../data/validators'\nimport {\n  isCredentialsEncryptionUnavailableError,\n  type CredentialsService,\n} from '../../../lib/credentials-service'\nimport { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get or save integration credentials',\n}\n\nfunction resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }): Promise<{ id?: string } | undefined> | { id?: string } | undefined {\n  if (!ctx.params) return undefined\n  if (typeof (ctx.params as Promise<unknown>).then === 'function') {\n    return ctx.params as Promise<{ id?: string }>\n  }\n  return ctx.params as { id?: string }\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  let values: Record<string, unknown> | null\n  try {\n    values = await credentialsService.resolve(integration.id, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  return NextResponse.json({\n    integrationId: integration.id,\n    schema: credentialsService.getSchema(integration.id),\n    credentials: values ?? {},\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = saveCredentialsSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid credentials payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = saveCredentialsSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid credentials payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const credentialFieldErrors = collectCredentialUrlValidationErrors(\n    credentialsService.getSchema(integration.id),\n    payloadData.credentials,\n  )\n  if (Object.keys(credentialFieldErrors).length > 0) {\n    return NextResponse.json(\n      { error: 'Invalid credentials payload', details: { fieldErrors: credentialFieldErrors } },\n      { status: 422 },\n    )\n  }\n\n  try {\n    await credentialsService.save(integration.id, payloadData.credentials, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  await emitIntegrationsEvent('integrations.credentials.updated', {\n    integrationId: integration.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({ ok: true })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,SAAS,cAAc,KAAkI;AACvJ,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,OAAQ,IAAI,OAA4B,SAAS,YAAY;AAC/D,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AAAA,EACjE,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,eAAe,YAAY;AAAA,IAC3B,QAAQ,mBAAmB,UAAU,YAAY,EAAE;AAAA,IACnD,aAAa,UAAU,CAAC;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,sBAAsB,UAAU,OAAO;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,sBAAsB,UAAU,aAAa;AAC9D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7I;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,wBAAwB;AAAA,IAC5B,mBAAmB,UAAU,YAAY,EAAE;AAAA,IAC3C,YAAY;AAAA,EACd;AACA,MAAI,OAAO,KAAK,qBAAqB,EAAE,SAAS,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,+BAA+B,SAAS,EAAE,aAAa,sBAAsB,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,mBAAmB,KAAK,YAAY,IAAI,YAAY,aAAa,KAAK;AAAA,EAC9E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,sBAAsB,oCAAoC;AAAA,IAC9D,eAAe,YAAY;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { saveCredentialsSchema } from '../../../data/validators'\nimport {\n  isCredentialsEncryptionUnavailableError,\n  type CredentialsService,\n} from '../../../lib/credentials-service'\nimport { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get or save integration credentials',\n}\n\nfunction resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }): Promise<{ id?: string } | undefined> | { id?: string } | undefined {\n  if (!ctx.params) return undefined\n  if (typeof (ctx.params as Promise<unknown>).then === 'function') {\n    return ctx.params as Promise<{ id?: string }>\n  }\n  return ctx.params as { id?: string }\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  let values: Record<string, unknown> | null\n  let updatedAt: Date | null\n  try {\n    values = await credentialsService.resolve(integration.id, scope)\n    updatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  return NextResponse.json({\n    integrationId: integration.id,\n    schema: credentialsService.getSchema(integration.id),\n    credentials: values ?? {},\n    updatedAt: updatedAt?.toISOString() ?? null,\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = saveCredentialsSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid credentials payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = saveCredentialsSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid credentials payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  try {\n    const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: currentUpdatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const credentialFieldErrors = collectCredentialUrlValidationErrors(\n    credentialsService.getSchema(integration.id),\n    payloadData.credentials,\n  )\n  if (Object.keys(credentialFieldErrors).length > 0) {\n    return NextResponse.json(\n      { error: 'Invalid credentials payload', details: { fieldErrors: credentialFieldErrors } },\n      { status: 422 },\n    )\n  }\n\n  try {\n    await credentialsService.save(integration.id, payloadData.credentials, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  await emitIntegrationsEvent('integrations.credentials.updated', {\n    integrationId: integration.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({ ok: true })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,SAAS,cAAc,KAAkI;AACvJ,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,OAAQ,IAAI,OAA4B,SAAS,YAAY;AAC/D,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AAC/D,gBAAY,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AAAA,EAC7E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,eAAe,YAAY;AAAA,IAC3B,QAAQ,mBAAmB,UAAU,YAAY,EAAE;AAAA,IACnD,aAAa,UAAU,CAAC;AAAA,IACxB,WAAW,WAAW,YAAY,KAAK;AAAA,EACzC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,sBAAsB,UAAU,OAAO;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,sBAAsB,UAAU,aAAa;AAC9D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7I;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,MAAI;AACF,UAAM,mBAAmB,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AACxF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,wBAAwB;AAAA,IAC5B,mBAAmB,UAAU,YAAY,EAAE;AAAA,IAC3C,YAAY;AAAA,EACd;AACA,MAAI,OAAO,KAAK,qBAAqB,EAAE,SAAS,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,+BAA+B,SAAS,EAAE,aAAa,sBAAsB,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,mBAAmB,KAAK,YAAY,IAAI,YAAY,aAAa,KAAK;AAAA,EAC9E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,sBAAsB,oCAAoC;AAAA,IAC9D,eAAe,YAAY;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
   "names": []
 }

package/dist/modules/integrations/api/[id]/route.js

@@ -46,11 +46,15 @@ async function GET(req, ctx) {
   const stateService = container.resolve("integrationStateService");
   const logService = container.resolve("integrationLogService");
   const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
-  const [credentials, state, analyticsMap] = await Promise.all([
+  const [credentials, credentialsUpdatedAt, state, analyticsMap] = await Promise.all([
     credentialsService.resolve(integration.id, scope).catch((err) => {
       if (err instanceof CredentialsEncryptionUnavailableError) return null;
       throw err;
     }),
+    credentialsService.resolveUpdatedAt(integration.id, scope).catch((err) => {
+      if (err instanceof CredentialsEncryptionUnavailableError) return null;
+      throw err;
+    }),
     stateService.resolveState(integration.id, scope),
     logService.aggregateAnalytics([integration.id], scope, 30)
   ]);
@@ -84,7 +88,8 @@ async function GET(req, ctx) {
           lastHealthStatus: resolvedState.lastHealthStatus,
           lastHealthCheckedAt: resolvedState.lastHealthCheckedAt?.toISOString() ?? null,
           lastHealthLatencyMs: resolvedState.lastHealthLatencyMs,
-          enabledAt: resolvedState.enabledAt?.toISOString() ?? null
+          enabledAt: resolvedState.enabledAt?.toISOString() ?? null,
+          updatedAt: resolvedState.updatedAt?.toISOString() ?? null
         }
       };
     })
@@ -112,9 +117,11 @@ async function GET(req, ctx) {
         lastHealthStatus: state.lastHealthStatus,
         lastHealthCheckedAt: state.lastHealthCheckedAt?.toISOString() ?? null,
         lastHealthLatencyMs: state.lastHealthLatencyMs,
-        enabledAt: state.enabledAt?.toISOString() ?? null
+        enabledAt: state.enabledAt?.toISOString() ?? null,
+        updatedAt: state.updatedAt?.toISOString() ?? null
       },
       hasCredentials,
+      credentialsUpdatedAt: credentialsUpdatedAt?.toISOString() ?? null,
       healthStatus,
       analytics
     }

package/dist/modules/integrations/api/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/integrations/api/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getBundle, getBundleIntegrations, getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { CredentialsEncryptionUnavailableError, type CredentialsService } from '../../lib/credentials-service'\nimport type { IntegrationStateService } from '../../lib/state-service'\nimport type { IntegrationLogService } from '../../lib/log-service'\nimport { deriveIntegrationHealthStatus, getEffectiveHealthCheckConfig } from '../../lib/health-service'\nimport {\n  finalizeIntegrationsReadResponse,\n  integrationApiRoutePaths,\n  runIntegrationsReadBeforeInterceptors,\n} from '../umes-read'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.view'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get integration detail',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const beforeInterceptors = await runIntegrationsReadBeforeInterceptors({\n    routePath: integrationApiRoutePaths.detail,\n    request: req,\n    auth,\n    container,\n  })\n  if (!beforeInterceptors.ok) {\n    return NextResponse.json(beforeInterceptors.body, { status: beforeInterceptors.statusCode })\n  }\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const logService = container.resolve('integrationLogService') as IntegrationLogService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const [credentials, state, analyticsMap] = await Promise.all([\n    credentialsService.resolve(integration.id, scope).catch((err) => {\n      if (err instanceof CredentialsEncryptionUnavailableError) return null\n      throw err\n    }),\n    stateService.resolveState(integration.id, scope),\n    logService.aggregateAnalytics([integration.id], scope, 30),\n  ])\n\n  const hasCredentials = credentials != null && Object.keys(credentials).length > 0\n  const healthConfig = getEffectiveHealthCheckConfig(integration.id)\n  const hasHealthCheck = Boolean(healthConfig?.service)\n  const healthStatus = deriveIntegrationHealthStatus({\n    hasHealthCheck,\n    hasCredentials,\n    lastHealthStatus: state.lastHealthStatus,\n    lastHealthCheckedAt: state.lastHealthCheckedAt,\n  })\n\n  const analytics = analyticsMap.get(integration.id) ?? {\n    lastActivityAt: null,\n    totalCount: 0,\n    errorCount: 0,\n    errorRate: 0,\n    dailyCounts: Array.from({ length: 30 }, () => 0),\n  }\n\n  const bundle = integration.bundleId ? getBundle(integration.bundleId) : undefined\n  const bundleIntegrations = integration.bundleId\n    ? await Promise.all(\n      getBundleIntegrations(integration.bundleId).map(async (item) => {\n        const resolvedState = await stateService.resolveState(item.id, scope)\n        return {\n          ...item,\n          isEnabled: resolvedState.isEnabled,\n          state: {\n            isEnabled: resolvedState.isEnabled,\n            apiVersion: resolvedState.apiVersion,\n            reauthRequired: resolvedState.reauthRequired,\n            lastHealthStatus: resolvedState.lastHealthStatus,\n            lastHealthCheckedAt: resolvedState.lastHealthCheckedAt?.toISOString() ?? null,\n            lastHealthLatencyMs: resolvedState.lastHealthLatencyMs,\n            enabledAt: resolvedState.enabledAt?.toISOString() ?? null,\n          },\n        }\n      }),\n    )\n    : []\n\n  return finalizeIntegrationsReadResponse({\n    routePath: integrationApiRoutePaths.detail,\n    request: req,\n    auth,\n    container,\n    interceptorRequest: beforeInterceptors.request,\n    beforeMetadata: beforeInterceptors.metadataByInterceptor,\n    enrich: {\n      targetEntity: 'integrations.integration',\n      recordKeys: ['integration'],\n      listKeys: ['bundleIntegrations'],\n    },\n    body: {\n      integration,\n      bundle,\n      bundleIntegrations,\n      state: {\n        isEnabled: state.isEnabled,\n        apiVersion: state.apiVersion,\n        reauthRequired: state.reauthRequired,\n        lastHealthStatus: state.lastHealthStatus,\n        lastHealthCheckedAt: state.lastHealthCheckedAt?.toISOString() ?? null,\n        lastHealthLatencyMs: state.lastHealthLatencyMs,\n        enabledAt: state.enabledAt?.toISOString() ?? null,\n      },\n      hasCredentials,\n      healthStatus,\n      analytics,\n    },\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,WAAW,uBAAuB,sBAAsB;AACjE,SAAS,6CAAsE;AAG/E,SAAS,+BAA+B,qCAAqC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACnE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,MAAM,sCAAsC;AAAA,IACrE,WAAW,yBAAyB;AAAA,IACpC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,CAAC,mBAAmB,IAAI;AAC1B,WAAO,aAAa,KAAK,mBAAmB,MAAM,EAAE,QAAQ,mBAAmB,WAAW,CAAC;AAAA,EAC7F;AACA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,aAAa,UAAU,QAAQ,uBAAuB;AAC5D,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,CAAC,aAAa,OAAO,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC3D,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,CAAC,QAAQ;AAC/D,UAAI,eAAe,sCAAuC,QAAO;AACjE,YAAM;AAAA,IACR,CAAC;AAAA,IACD,aAAa,aAAa,YAAY,IAAI,KAAK;AAAA,IAC/C,WAAW,mBAAmB,CAAC,YAAY,EAAE,GAAG,OAAO,EAAE;AAAA,EAC3D,CAAC;AAED,QAAM,iBAAiB,eAAe,QAAQ,OAAO,KAAK,WAAW,EAAE,SAAS;AAChF,QAAM,eAAe,8BAA8B,YAAY,EAAE;AACjE,QAAM,iBAAiB,QAAQ,cAAc,OAAO;AACpD,QAAM,eAAe,8BAA8B;AAAA,IACjD;AAAA,IACA;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,qBAAqB,MAAM;AAAA,EAC7B,CAAC;AAED,QAAM,YAAY,aAAa,IAAI,YAAY,EAAE,KAAK;AAAA,IACpD,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,aAAa,MAAM,KAAK,EAAE,QAAQ,GAAG,GAAG,MAAM,CAAC;AAAA,EACjD;AAEA,QAAM,SAAS,YAAY,WAAW,UAAU,YAAY,QAAQ,IAAI;AACxE,QAAM,qBAAqB,YAAY,WACnC,MAAM,QAAQ;AAAA,IACd,sBAAsB,YAAY,QAAQ,EAAE,IAAI,OAAO,SAAS;AAC9D,YAAM,gBAAgB,MAAM,aAAa,aAAa,KAAK,IAAI,KAAK;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,cAAc;AAAA,QACzB,OAAO;AAAA,UACL,WAAW,cAAc;AAAA,UACzB,YAAY,cAAc;AAAA,UAC1B,gBAAgB,cAAc;AAAA,UAC9B,kBAAkB,cAAc;AAAA,UAChC,qBAAqB,cAAc,qBAAqB,YAAY,KAAK;AAAA,UACzE,qBAAqB,cAAc;AAAA,UACnC,WAAW,cAAc,WAAW,YAAY,KAAK;AAAA,QACvD;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,IACE,CAAC;AAEL,SAAO,iCAAiC;AAAA,IACtC,WAAW,yBAAyB;AAAA,IACpC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,oBAAoB,mBAAmB;AAAA,IACvC,gBAAgB,mBAAmB;AAAA,IACnC,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,YAAY,CAAC,aAAa;AAAA,MAC1B,UAAU,CAAC,oBAAoB;AAAA,IACjC;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,gBAAgB,MAAM;AAAA,QACtB,kBAAkB,MAAM;AAAA,QACxB,qBAAqB,MAAM,qBAAqB,YAAY,KAAK;AAAA,QACjE,qBAAqB,MAAM;AAAA,QAC3B,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getBundle, getBundleIntegrations, getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { CredentialsEncryptionUnavailableError, type CredentialsService } from '../../lib/credentials-service'\nimport type { IntegrationStateService } from '../../lib/state-service'\nimport type { IntegrationLogService } from '../../lib/log-service'\nimport { deriveIntegrationHealthStatus, getEffectiveHealthCheckConfig } from '../../lib/health-service'\nimport {\n  finalizeIntegrationsReadResponse,\n  integrationApiRoutePaths,\n  runIntegrationsReadBeforeInterceptors,\n} from '../umes-read'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.view'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get integration detail',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const beforeInterceptors = await runIntegrationsReadBeforeInterceptors({\n    routePath: integrationApiRoutePaths.detail,\n    request: req,\n    auth,\n    container,\n  })\n  if (!beforeInterceptors.ok) {\n    return NextResponse.json(beforeInterceptors.body, { status: beforeInterceptors.statusCode })\n  }\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const logService = container.resolve('integrationLogService') as IntegrationLogService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const [credentials, credentialsUpdatedAt, state, analyticsMap] = await Promise.all([\n    credentialsService.resolve(integration.id, scope).catch((err) => {\n      if (err instanceof CredentialsEncryptionUnavailableError) return null\n      throw err\n    }),\n    credentialsService.resolveUpdatedAt(integration.id, scope).catch((err) => {\n      if (err instanceof CredentialsEncryptionUnavailableError) return null\n      throw err\n    }),\n    stateService.resolveState(integration.id, scope),\n    logService.aggregateAnalytics([integration.id], scope, 30),\n  ])\n\n  const hasCredentials = credentials != null && Object.keys(credentials).length > 0\n  const healthConfig = getEffectiveHealthCheckConfig(integration.id)\n  const hasHealthCheck = Boolean(healthConfig?.service)\n  const healthStatus = deriveIntegrationHealthStatus({\n    hasHealthCheck,\n    hasCredentials,\n    lastHealthStatus: state.lastHealthStatus,\n    lastHealthCheckedAt: state.lastHealthCheckedAt,\n  })\n\n  const analytics = analyticsMap.get(integration.id) ?? {\n    lastActivityAt: null,\n    totalCount: 0,\n    errorCount: 0,\n    errorRate: 0,\n    dailyCounts: Array.from({ length: 30 }, () => 0),\n  }\n\n  const bundle = integration.bundleId ? getBundle(integration.bundleId) : undefined\n  const bundleIntegrations = integration.bundleId\n    ? await Promise.all(\n      getBundleIntegrations(integration.bundleId).map(async (item) => {\n        const resolvedState = await stateService.resolveState(item.id, scope)\n        return {\n          ...item,\n          isEnabled: resolvedState.isEnabled,\n          state: {\n            isEnabled: resolvedState.isEnabled,\n            apiVersion: resolvedState.apiVersion,\n            reauthRequired: resolvedState.reauthRequired,\n            lastHealthStatus: resolvedState.lastHealthStatus,\n            lastHealthCheckedAt: resolvedState.lastHealthCheckedAt?.toISOString() ?? null,\n            lastHealthLatencyMs: resolvedState.lastHealthLatencyMs,\n            enabledAt: resolvedState.enabledAt?.toISOString() ?? null,\n            updatedAt: resolvedState.updatedAt?.toISOString() ?? null,\n          },\n        }\n      }),\n    )\n    : []\n\n  return finalizeIntegrationsReadResponse({\n    routePath: integrationApiRoutePaths.detail,\n    request: req,\n    auth,\n    container,\n    interceptorRequest: beforeInterceptors.request,\n    beforeMetadata: beforeInterceptors.metadataByInterceptor,\n    enrich: {\n      targetEntity: 'integrations.integration',\n      recordKeys: ['integration'],\n      listKeys: ['bundleIntegrations'],\n    },\n    body: {\n      integration,\n      bundle,\n      bundleIntegrations,\n      state: {\n        isEnabled: state.isEnabled,\n        apiVersion: state.apiVersion,\n        reauthRequired: state.reauthRequired,\n        lastHealthStatus: state.lastHealthStatus,\n        lastHealthCheckedAt: state.lastHealthCheckedAt?.toISOString() ?? null,\n        lastHealthLatencyMs: state.lastHealthLatencyMs,\n        enabledAt: state.enabledAt?.toISOString() ?? null,\n        updatedAt: state.updatedAt?.toISOString() ?? null,\n      },\n      hasCredentials,\n      credentialsUpdatedAt: credentialsUpdatedAt?.toISOString() ?? null,\n      healthStatus,\n      analytics,\n    },\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,WAAW,uBAAuB,sBAAsB;AACjE,SAAS,6CAAsE;AAG/E,SAAS,+BAA+B,qCAAqC;AAC7E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACnE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,MAAM,sCAAsC;AAAA,IACrE,WAAW,yBAAyB;AAAA,IACpC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,CAAC,mBAAmB,IAAI;AAC1B,WAAO,aAAa,KAAK,mBAAmB,MAAM,EAAE,QAAQ,mBAAmB,WAAW,CAAC;AAAA,EAC7F;AACA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,aAAa,UAAU,QAAQ,uBAAuB;AAC5D,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,CAAC,aAAa,sBAAsB,OAAO,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjF,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,CAAC,QAAQ;AAC/D,UAAI,eAAe,sCAAuC,QAAO;AACjE,YAAM;AAAA,IACR,CAAC;AAAA,IACD,mBAAmB,iBAAiB,YAAY,IAAI,KAAK,EAAE,MAAM,CAAC,QAAQ;AACxE,UAAI,eAAe,sCAAuC,QAAO;AACjE,YAAM;AAAA,IACR,CAAC;AAAA,IACD,aAAa,aAAa,YAAY,IAAI,KAAK;AAAA,IAC/C,WAAW,mBAAmB,CAAC,YAAY,EAAE,GAAG,OAAO,EAAE;AAAA,EAC3D,CAAC;AAED,QAAM,iBAAiB,eAAe,QAAQ,OAAO,KAAK,WAAW,EAAE,SAAS;AAChF,QAAM,eAAe,8BAA8B,YAAY,EAAE;AACjE,QAAM,iBAAiB,QAAQ,cAAc,OAAO;AACpD,QAAM,eAAe,8BAA8B;AAAA,IACjD;AAAA,IACA;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,qBAAqB,MAAM;AAAA,EAC7B,CAAC;AAED,QAAM,YAAY,aAAa,IAAI,YAAY,EAAE,KAAK;AAAA,IACpD,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,aAAa,MAAM,KAAK,EAAE,QAAQ,GAAG,GAAG,MAAM,CAAC;AAAA,EACjD;AAEA,QAAM,SAAS,YAAY,WAAW,UAAU,YAAY,QAAQ,IAAI;AACxE,QAAM,qBAAqB,YAAY,WACnC,MAAM,QAAQ;AAAA,IACd,sBAAsB,YAAY,QAAQ,EAAE,IAAI,OAAO,SAAS;AAC9D,YAAM,gBAAgB,MAAM,aAAa,aAAa,KAAK,IAAI,KAAK;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,cAAc;AAAA,QACzB,OAAO;AAAA,UACL,WAAW,cAAc;AAAA,UACzB,YAAY,cAAc;AAAA,UAC1B,gBAAgB,cAAc;AAAA,UAC9B,kBAAkB,cAAc;AAAA,UAChC,qBAAqB,cAAc,qBAAqB,YAAY,KAAK;AAAA,UACzE,qBAAqB,cAAc;AAAA,UACnC,WAAW,cAAc,WAAW,YAAY,KAAK;AAAA,UACrD,WAAW,cAAc,WAAW,YAAY,KAAK;AAAA,QACvD;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,IACE,CAAC;AAEL,SAAO,iCAAiC;AAAA,IACtC,WAAW,yBAAyB;AAAA,IACpC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,oBAAoB,mBAAmB;AAAA,IACvC,gBAAgB,mBAAmB;AAAA,IACnC,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,YAAY,CAAC,aAAa;AAAA,MAC1B,UAAU,CAAC,oBAAoB;AAAA,IACjC;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,gBAAgB,MAAM;AAAA,QACtB,kBAAkB,MAAM;AAAA,QACxB,qBAAqB,MAAM,qBAAqB,YAAY,KAAK;AAAA,QACjE,qBAAqB,MAAM;AAAA,QAC3B,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,QAC7C,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,sBAAsB,sBAAsB,YAAY,KAAK;AAAA,MAC7D;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/modules/integrations/api/[id]/state/route.js

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getIntegration } from "@open-mercato/shared/modules/integrations/types";
+import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { emitIntegrationsEvent } from "../../../events.js";
 import { updateStateSchema } from "../../../data/validators.js";
 import {
@@ -66,16 +68,28 @@ async function PUT(req, ctx) {
     payloadData = reparsed.data;
   }
   const stateService = container.resolve("integrationStateService");
+  const stateScope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  try {
+    const current = await stateService.resolveState(integration.id, stateScope);
+    enforceCommandOptimisticLock({
+      resourceKind: "integrations.integration",
+      resourceId: integration.id,
+      current: current.updatedAt,
+      request: req
+    });
+  } catch (error) {
+    if (isCrudHttpError(error)) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    throw error;
+  }
   const state = await stateService.upsert(
     integration.id,
     {
       isEnabled: payloadData.isEnabled,
       reauthRequired: payloadData.reauthRequired
     },
-    {
-      organizationId: auth.orgId,
-      tenantId: auth.tenantId
-    }
+    stateScope
   );
   await emitIntegrationsEvent("integrations.state.updated", {
     integrationId: integration.id,
@@ -98,7 +112,8 @@ async function PUT(req, ctx) {
   return NextResponse.json({
     isEnabled: state.isEnabled,
     reauthRequired: state.reauthRequired,
-    apiVersion: state.apiVersion ?? null
+    apiVersion: state.apiVersion ?? null,
+    updatedAt: state.updatedAt?.toISOString() ?? null
   });
 }
 export {

package/dist/modules/integrations/api/[id]/state/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/integrations/api/%5Bid%5D/state/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { updateStateSchema } from '../../../data/validators'\nimport type { IntegrationStateService } from '../../../lib/state-service'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['integrations.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Update integration state',\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = updateStateSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid state payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = updateStateSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid state payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n\n  const state = await stateService.upsert(\n    integration.id,\n    {\n      isEnabled: payloadData.isEnabled,\n      reauthRequired: payloadData.reauthRequired,\n    },\n    {\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    },\n  )\n\n  await emitIntegrationsEvent('integrations.state.updated', {\n    integrationId: integration.id,\n    isEnabled: state.isEnabled,\n    reauthRequired: state.reauthRequired,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({\n    isEnabled: state.isEnabled,\n    reauthRequired: state.reauthRequired,\n    apiVersion: state.apiVersion ?? null,\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACrE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,kBAAkB,UAAU,OAAO;AACtD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,kBAAkB,UAAU,aAAa;AAC1D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvI;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAEhE,QAAM,QAAQ,MAAM,aAAa;AAAA,IAC/B,YAAY;AAAA,IACZ;AAAA,MACE,WAAW,YAAY;AAAA,MACvB,gBAAgB,YAAY;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,sBAAsB,8BAA8B;AAAA,IACxD,eAAe,YAAY;AAAA,IAC3B,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,IACtB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK;AAAA,IACvB,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,IACtB,YAAY,MAAM,cAAc;AAAA,EAClC,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { updateStateSchema } from '../../../data/validators'\nimport type { IntegrationStateService } from '../../../lib/state-service'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['integrations.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Update integration state',\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = updateStateSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid state payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = updateStateSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid state payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const stateScope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  try {\n    const current = await stateService.resolveState(integration.id, stateScope)\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: current.updatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    throw error\n  }\n\n  const state = await stateService.upsert(\n    integration.id,\n    {\n      isEnabled: payloadData.isEnabled,\n      reauthRequired: payloadData.reauthRequired,\n    },\n    stateScope,\n  )\n\n  await emitIntegrationsEvent('integrations.state.updated', {\n    integrationId: integration.id,\n    isEnabled: state.isEnabled,\n    reauthRequired: state.reauthRequired,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({\n    isEnabled: state.isEnabled,\n    reauthRequired: state.reauthRequired,\n    apiVersion: state.apiVersion ?? null,\n    updatedAt: state.updatedAt?.toISOString() ?? null,\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACrE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,kBAAkB,UAAU,OAAO;AACtD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,kBAAkB,UAAU,aAAa;AAC1D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvI;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,aAAa,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAEnF,MAAI;AACF,UAAM,UAAU,MAAM,aAAa,aAAa,YAAY,IAAI,UAAU;AAC1E,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS,QAAQ;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM;AAAA,EACR;AAEA,QAAM,QAAQ,MAAM,aAAa;AAAA,IAC/B,YAAY;AAAA,IACZ;AAAA,MACE,WAAW,YAAY;AAAA,MACvB,gBAAgB,YAAY;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AAEA,QAAM,sBAAsB,8BAA8B;AAAA,IACxD,eAAe,YAAY;AAAA,IAC3B,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,IACtB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK;AAAA,IACvB,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,IACtB,YAAY,MAAM,cAAc;AAAA,IAChC,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,EAC/C,CAAC;AACH;",
   "names": []
 }

package/dist/modules/integrations/api/[id]/version/route.js

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getIntegration } from "@open-mercato/shared/modules/integrations/types";
+import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { emitIntegrationsEvent } from "../../../events.js";
 import { updateVersionSchema } from "../../../data/validators.js";
 import { resolveDefaultApiVersion } from "../../../lib/registry-service.js";
@@ -84,7 +86,21 @@ async function PUT(req, ctx) {
   }
   const stateService = container.resolve("integrationStateService");
   const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
-  const before = await stateService.resolveApiVersion(integration.id, scope);
+  const currentState = await stateService.resolveState(integration.id, scope);
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: "integrations.integration",
+      resourceId: integration.id,
+      current: currentState.updatedAt,
+      request: req
+    });
+  } catch (error) {
+    if (isCrudHttpError(error)) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    throw error;
+  }
+  const before = currentState.apiVersion;
   await stateService.upsert(integration.id, { apiVersion: payloadData.apiVersion }, scope);
   await emitIntegrationsEvent("integrations.version.changed", {
     integrationId: integration.id,

package/dist/modules/integrations/api/[id]/version/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/integrations/api/%5Bid%5D/version/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { updateVersionSchema } from '../../../data/validators'\nimport type { IntegrationStateService } from '../../../lib/state-service'\nimport { resolveDefaultApiVersion } from '../../../lib/registry-service'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['integrations.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Change integration API version',\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = updateVersionSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const requestedVersion = parsedBody.data.apiVersion\n  const availableVersions = integration.apiVersions ?? []\n  if (availableVersions.length === 0) {\n    return NextResponse.json({ error: 'This integration is not versioned' }, { status: 422 })\n  }\n\n  const exists = availableVersions.some((version) => version.id === requestedVersion)\n  if (!exists) {\n    return NextResponse.json({ error: 'Unknown integration version' }, { status: 422 })\n  }\n\n  const defaultVersion = resolveDefaultApiVersion(availableVersions)\n  if (!defaultVersion) {\n    return NextResponse.json({ error: 'Integration version configuration is invalid' }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = updateVersionSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n  if (!availableVersions.some((version) => version.id === payloadData.apiVersion)) {\n    return NextResponse.json({ error: 'Unknown integration version' }, { status: 422 })\n  }\n\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const before = await stateService.resolveApiVersion(integration.id, scope)\n  await stateService.upsert(integration.id, { apiVersion: payloadData.apiVersion }, scope)\n\n  await emitIntegrationsEvent('integrations.version.changed', {\n    integrationId: integration.id,\n    previousVersion: before ?? defaultVersion,\n    apiVersion: payloadData.apiVersion,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n\n  return NextResponse.json({\n    apiVersion: payloadData.apiVersion,\n    previousVersion: before ?? defaultVersion,\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAEpC,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACrE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,oBAAoB,UAAU,OAAO;AACxD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,mBAAmB,WAAW,KAAK;AACzC,QAAM,oBAAoB,YAAY,eAAe,CAAC;AACtD,MAAI,kBAAkB,WAAW,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,kBAAkB,KAAK,CAAC,YAAY,QAAQ,OAAO,gBAAgB;AAClF,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,QAAM,iBAAiB,yBAAyB,iBAAiB;AACjE,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC9B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,oBAAoB,UAAU,aAAa;AAC5D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjI;AACA,kBAAc,SAAS;AAAA,EACzB;AACA,MAAI,CAAC,kBAAkB,KAAK,CAAC,YAAY,QAAQ,OAAO,YAAY,UAAU,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,SAAS,MAAM,aAAa,kBAAkB,YAAY,IAAI,KAAK;AACzE,QAAM,aAAa,OAAO,YAAY,IAAI,EAAE,YAAY,YAAY,WAAW,GAAG,KAAK;AAEvF,QAAM,sBAAsB,gCAAgC;AAAA,IAC1D,eAAe,YAAY;AAAA,IAC3B,iBAAiB,UAAU;AAAA,IAC3B,YAAY,YAAY;AAAA,IACxB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC/E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,YAAY,YAAY;AAAA,IACxB,iBAAiB,UAAU;AAAA,EAC7B,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { updateVersionSchema } from '../../../data/validators'\nimport type { IntegrationStateService } from '../../../lib/state-service'\nimport { resolveDefaultApiVersion } from '../../../lib/registry-service'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['integrations.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Change integration API version',\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = updateVersionSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const requestedVersion = parsedBody.data.apiVersion\n  const availableVersions = integration.apiVersions ?? []\n  if (availableVersions.length === 0) {\n    return NextResponse.json({ error: 'This integration is not versioned' }, { status: 422 })\n  }\n\n  const exists = availableVersions.some((version) => version.id === requestedVersion)\n  if (!exists) {\n    return NextResponse.json({ error: 'Unknown integration version' }, { status: 422 })\n  }\n\n  const defaultVersion = resolveDefaultApiVersion(availableVersions)\n  if (!defaultVersion) {\n    return NextResponse.json({ error: 'Integration version configuration is invalid' }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = updateVersionSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n  if (!availableVersions.some((version) => version.id === payloadData.apiVersion)) {\n    return NextResponse.json({ error: 'Unknown integration version' }, { status: 422 })\n  }\n\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const currentState = await stateService.resolveState(integration.id, scope)\n  try {\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: currentState.updatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    throw error\n  }\n\n  const before = currentState.apiVersion\n  await stateService.upsert(integration.id, { apiVersion: payloadData.apiVersion }, scope)\n\n  await emitIntegrationsEvent('integrations.version.changed', {\n    integrationId: integration.id,\n    previousVersion: before ?? defaultVersion,\n    apiVersion: payloadData.apiVersion,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n\n  return NextResponse.json({\n    apiVersion: payloadData.apiVersion,\n    previousVersion: before ?? defaultVersion,\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAEpC,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACrE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,oBAAoB,UAAU,OAAO;AACxD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,mBAAmB,WAAW,KAAK;AACzC,QAAM,oBAAoB,YAAY,eAAe,CAAC;AACtD,MAAI,kBAAkB,WAAW,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,kBAAkB,KAAK,CAAC,YAAY,QAAQ,OAAO,gBAAgB;AAClF,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,QAAM,iBAAiB,yBAAyB,iBAAiB;AACjE,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC9B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,oBAAoB,UAAU,aAAa;AAC5D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,yCAAyC,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjI;AACA,kBAAc,SAAS;AAAA,EACzB;AACA,MAAI,CAAC,kBAAkB,KAAK,CAAC,YAAY,QAAQ,OAAO,YAAY,UAAU,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,eAAe,MAAM,aAAa,aAAa,YAAY,IAAI,KAAK;AAC1E,MAAI;AACF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS,aAAa;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM;AAAA,EACR;AAEA,QAAM,SAAS,aAAa;AAC5B,QAAM,aAAa,OAAO,YAAY,IAAI,EAAE,YAAY,YAAY,WAAW,GAAG,KAAK;AAEvF,QAAM,sBAAsB,gCAAgC;AAAA,IAC1D,eAAe,YAAY;AAAA,IAC3B,iBAAiB,UAAU;AAAA,IAC3B,YAAY,YAAY;AAAA,IACxB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC/E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,YAAY,YAAY;AAAA,IACxB,iBAAiB,UAAU;AAAA,EAC7B,CAAC;AACH;",
   "names": []
 }