@open-mercato/core 0.6.6-develop.6472.1.1673e7e66b → 0.6.6-develop.6480.1.309f47ca1c

package/dist/modules/sales/commands/notes.js

@@ -84,7 +84,13 @@ async function requireContext(em, contextType, contextId, organizationId, tenant
     };
   }
   const repo = contextType === "invoice" ? SalesInvoice : SalesCreditMemo;
-  const entity = await em.findOne(repo, { id: contextId });
+  const entity = await findOneWithDecryption(
+    em,
+    repo,
+    { id: contextId },
+    {},
+    { tenantId, organizationId }
+  );
   if (!entity) {
     throw new CrudHttpError(404, { error: "sales.notes.context_not_found" });
   }
@@ -98,11 +104,11 @@ async function requireContext(em, contextType, contextId, organizationId, tenant
     quote: null
   };
 }
-function resolveAuthor(inputAuthor, authSub) {
-  if (inputAuthor) return inputAuthor;
-  if (!authSub) return null;
+function resolveAuthor(authSub) {
+  const sub = authSub?.trim();
+  if (!sub) return null;
   const uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/;
-  return uuidRegex.test(authSub) ? authSub : null;
+  return uuidRegex.test(sub) ? sub : null;
 }
 const createNoteCommand = {
   id: "sales.notes.create",
@@ -112,7 +118,7 @@ const createNoteCommand = {
     ensureOrganizationScope(ctx, parsed.organizationId);
     const em = ctx.container.resolve("em").fork();
     const context = await requireContext(em, parsed.contextType, parsed.contextId, parsed.organizationId, parsed.tenantId);
-    const authorUserId = resolveAuthor(parsed.authorUserId, ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null);
+    const authorUserId = resolveAuthor(ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null);
     const note = em.create(SalesNote, {
       organizationId: parsed.organizationId,
       tenantId: parsed.tenantId,
@@ -230,7 +236,9 @@ const updateNoteCommand = {
     ensureTenantScope(ctx, note.tenantId);
     ensureOrganizationScope(ctx, note.organizationId);
     if (parsed.body !== void 0) note.body = parsed.body;
-    if (parsed.authorUserId !== void 0) note.authorUserId = parsed.authorUserId ?? null;
+    if (parsed.authorUserId !== void 0) {
+      note.authorUserId = resolveAuthor(ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null);
+    }
     if (parsed.appearanceIcon !== void 0) note.appearanceIcon = parsed.appearanceIcon ?? null;
     if (parsed.appearanceColor !== void 0) note.appearanceColor = parsed.appearanceColor ?? null;
     note.updatedAt = /* @__PURE__ */ new Date();

package/dist/modules/sales/commands/notes.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/sales/commands/notes.ts"],
-  "sourcesContent": ["import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'\nimport {\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  SalesNote,\n  SalesOrder,\n  SalesQuote,\n  SalesInvoice,\n  SalesCreditMemo,\n  type SalesDocumentKind,\n} from '../data/entities'\nimport {\n  noteCreateSchema,\n  noteUpdateSchema,\n  type NoteCreateInput,\n  type NoteUpdateInput,\n} from '../data/validators'\nimport { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ensureOrganizationScope, ensureSameScope, ensureTenantScope, extractUndoPayload } from './shared'\n\ntype NoteSnapshot = {\n  id: string\n  organizationId: string\n  tenantId: string\n  contextType: SalesDocumentKind\n  contextId: string\n  orderId: string | null\n  quoteId: string | null\n  body: string\n  authorUserId: string | null\n  appearanceIcon: string | null\n  appearanceColor: string | null\n}\n\ntype NoteUndoPayload = {\n  before?: NoteSnapshot | null\n  after?: NoteSnapshot | null\n}\n\nconst noteCrudIndexer = {\n  entityType: E.sales.sales_note,\n}\n\nconst noteCrudEvents: CrudEventsConfig = {\n  module: 'sales',\n  entity: 'note',\n  persistent: true,\n  buildPayload: (ctx) => ({\n    id: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nasync function loadNoteSnapshot(em: EntityManager, id: string): Promise<NoteSnapshot | null> {\n  const note = await findOneWithDecryption(em, SalesNote, { id }, {})\n  if (!note) return null\n  return {\n    id: note.id,\n    organizationId: note.organizationId,\n    tenantId: note.tenantId,\n    contextType: note.contextType,\n    contextId: note.contextId,\n    orderId: note.order ? (typeof note.order === 'string' ? note.order : note.order.id) : null,\n    quoteId: note.quote ? (typeof note.quote === 'string' ? note.quote : note.quote.id) : null,\n    body: note.body,\n    authorUserId: note.authorUserId ?? null,\n    appearanceIcon: note.appearanceIcon ?? null,\n    appearanceColor: note.appearanceColor ?? null,\n  }\n}\n\nasync function requireContext(\n  em: EntityManager,\n  contextType: SalesDocumentKind,\n  contextId: string,\n  organizationId?: string,\n  tenantId?: string\n): Promise<{\n  organizationId: string\n  tenantId: string\n  order?: SalesOrder | null\n  quote?: SalesQuote | null\n}> {\n  if (contextType === 'order') {\n    const order = await findOneWithDecryption(em, SalesOrder, { id: contextId }, {}, { tenantId, organizationId })\n    if (!order) {\n      throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n    }\n    if (organizationId && tenantId) {\n      ensureSameScope(order, organizationId, tenantId)\n    }\n    return {\n      organizationId: order.organizationId,\n      tenantId: order.tenantId,\n      order,\n      quote: null,\n    }\n  }\n  if (contextType === 'quote') {\n    const quote = await findOneWithDecryption(em, SalesQuote, { id: contextId }, {}, { tenantId, organizationId })\n    if (!quote) {\n      throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n    }\n    if (organizationId && tenantId) {\n      ensureSameScope(quote, organizationId, tenantId)\n    }\n    return {\n      organizationId: quote.organizationId,\n      tenantId: quote.tenantId,\n      order: null,\n      quote,\n    }\n  }\n  const repo = contextType === 'invoice' ? SalesInvoice : SalesCreditMemo\n  const entity = await em.findOne(repo as any, { id: contextId }) as (SalesInvoice | SalesCreditMemo) | null\n  if (!entity) {\n    throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n  }\n  if (organizationId && tenantId) {\n    ensureSameScope(entity, organizationId, tenantId)\n  }\n  return {\n    organizationId: entity.organizationId,\n    tenantId: entity.tenantId,\n    order: null,\n    quote: null,\n  }\n}\n\nfunction resolveAuthor(inputAuthor: string | undefined, authSub: string | null): string | null {\n  if (inputAuthor) return inputAuthor\n  if (!authSub) return null\n  const uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n  return uuidRegex.test(authSub) ? authSub : null\n}\n\nconst createNoteCommand: CommandHandler<NoteCreateInput, { noteId: string; authorUserId: string | null }> = {\n  id: 'sales.notes.create',\n  async execute(rawInput, ctx) {\n    const parsed = noteCreateSchema.parse(rawInput ?? {})\n    ensureTenantScope(ctx, parsed.tenantId)\n    ensureOrganizationScope(ctx, parsed.organizationId)\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const context = await requireContext(em, parsed.contextType, parsed.contextId, parsed.organizationId, parsed.tenantId)\n    const authorUserId = resolveAuthor(parsed.authorUserId, ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null)\n\n    const note = em.create(SalesNote, {\n      organizationId: parsed.organizationId,\n      tenantId: parsed.tenantId,\n      contextType: parsed.contextType,\n      contextId: parsed.contextId,\n      order: context.order ?? null,\n      quote: context.quote ?? null,\n      authorUserId,\n      appearanceIcon: parsed.appearanceIcon ?? null,\n      appearanceColor: parsed.appearanceColor ?? null,\n      body: parsed.body,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    em.persist(note)\n    await em.flush()\n\n    const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: note,\n      identifiers: {\n        id: note.id,\n        organizationId: note.organizationId,\n        tenantId: note.tenantId,\n      },\n      indexer: noteCrudIndexer,\n      events: noteCrudEvents,\n    })\n\n    return { noteId: note.id, authorUserId: note.authorUserId ?? null }\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    return loadNoteSnapshot(em, result.noteId)\n  },\n  buildLog: async ({ result, snapshots }) => {\n    const { translate } = await resolveTranslations()\n    const snapshot = snapshots.after as NoteSnapshot | undefined\n    return {\n      actionLabel: translate('sales.audit.notes.create', 'Create note'),\n      resourceKind: 'sales.note',\n      resourceId: result.noteId,\n      parentResourceKind: snapshot?.contextType ? `sales.${snapshot.contextType}` : null,\n      parentResourceId: snapshot?.contextId ?? null,\n      tenantId: snapshot?.tenantId ?? null,\n      organizationId: snapshot?.organizationId ?? null,\n      snapshotAfter: snapshot ?? null,\n      payload: {\n        undo: {\n          after: snapshot ?? null,\n        } satisfies NoteUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const noteId = logEntry?.resourceId ?? null\n    if (!noteId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const existing = await findOneWithDecryption(em, SalesNote, { id: noteId }, {})\n    if (existing) {\n      em.remove(existing)\n      await em.flush()\n    }\n  },\n  redo: makeCreateRedo<SalesNote, NoteSnapshot, NoteCreateInput, { noteId: string; authorUserId: string | null }>({\n    entityClass: SalesNote,\n    indexer: noteCrudIndexer,\n    events: noteCrudEvents,\n    findRow: ({ em, id, snapshot }) =>\n      findOneWithDecryption(\n        em,\n        SalesNote,\n        { id },\n        undefined,\n        { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId },\n      ),\n    seedFromSnapshot: (snapshot) => ({\n      id: snapshot.id,\n      organizationId: snapshot.organizationId,\n      tenantId: snapshot.tenantId,\n      contextType: snapshot.contextType,\n      contextId: snapshot.contextId,\n      body: snapshot.body,\n      authorUserId: snapshot.authorUserId,\n      appearanceIcon: snapshot.appearanceIcon,\n      appearanceColor: snapshot.appearanceColor,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    }),\n    beforeRestore: async ({ em, snapshot }) => {\n      const context = await requireContext(em, snapshot.contextType, snapshot.contextId).catch(() => null)\n      if (!context) {\n        throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n      }\n      return {\n        order: snapshot.orderId ? context.order ?? null : null,\n        quote: snapshot.quoteId ? context.quote ?? null : null,\n      }\n    },\n    buildResult: (entity) => ({ noteId: entity.id, authorUserId: entity.authorUserId ?? null }),\n  }),\n}\n\nconst updateNoteCommand: CommandHandler<NoteUpdateInput, { noteId: string }> = {\n  id: 'sales.notes.update',\n  async prepare(rawInput, ctx) {\n    const parsed = noteUpdateSchema.parse(rawInput ?? {})\n    const em = ctx.container.resolve('em') as EntityManager\n    const snapshot = await loadNoteSnapshot(em, parsed.id)\n    return snapshot ? { before: snapshot } : {}\n  },\n  async execute(rawInput, ctx) {\n    const parsed = noteUpdateSchema.parse(rawInput ?? {})\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const note = await findOneWithDecryption(em, SalesNote, { id: parsed.id }, {})\n    if (!note) throw new CrudHttpError(404, { error: 'sales.notes.not_found' })\n    ensureTenantScope(ctx, note.tenantId)\n    ensureOrganizationScope(ctx, note.organizationId)\n\n    if (parsed.body !== undefined) note.body = parsed.body\n    if (parsed.authorUserId !== undefined) note.authorUserId = parsed.authorUserId ?? null\n    if (parsed.appearanceIcon !== undefined) note.appearanceIcon = parsed.appearanceIcon ?? null\n    if (parsed.appearanceColor !== undefined) note.appearanceColor = parsed.appearanceColor ?? null\n    note.updatedAt = new Date()\n\n    await em.flush()\n\n    const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'updated',\n      entity: note,\n      identifiers: {\n        id: note.id,\n        organizationId: note.organizationId,\n        tenantId: note.tenantId,\n      },\n      indexer: noteCrudIndexer,\n      events: noteCrudEvents,\n    })\n\n    return { noteId: note.id }\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    return await loadNoteSnapshot(em, result.noteId)\n  },\n  buildLog: async ({ snapshots }) => {\n    const { translate } = await resolveTranslations()\n    const before = snapshots.before as NoteSnapshot | undefined\n    if (!before) return null\n    const after = snapshots.after as NoteSnapshot | undefined\n    const changes =\n      after && before\n        ? buildChanges(\n            before as unknown as Record<string, unknown>,\n            after as unknown as Record<string, unknown>,\n            ['body', 'authorUserId', 'appearanceIcon', 'appearanceColor']\n          )\n        : {}\n    return {\n      actionLabel: translate('sales.audit.notes.update', 'Update note'),\n      resourceKind: 'sales.note',\n      resourceId: before.id,\n      parentResourceKind: before.contextType ? `sales.${before.contextType}` : null,\n      parentResourceId: before.contextId ?? null,\n      tenantId: before.tenantId,\n      organizationId: before.organizationId,\n      snapshotBefore: before,\n      snapshotAfter: after ?? null,\n      changes,\n      payload: {\n        undo: {\n          before,\n          after: after ?? null,\n        } satisfies NoteUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<NoteUndoPayload>(logEntry)\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const context = await requireContext(em, before.contextType, before.contextId).catch(() => null)\n    if (!context) return\n    let note = await findOneWithDecryption(em, SalesNote, { id: before.id }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })\n    if (!note) {\n      note = em.create(SalesNote, {\n        id: before.id,\n        organizationId: before.organizationId,\n        tenantId: before.tenantId,\n        contextType: before.contextType,\n        contextId: before.contextId,\n        order: before.orderId ? context.order ?? null : null,\n        quote: before.quoteId ? context.quote ?? null : null,\n        body: before.body,\n        authorUserId: before.authorUserId,\n        appearanceIcon: before.appearanceIcon,\n        appearanceColor: before.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(note)\n    }\n    note.organizationId = before.organizationId\n    note.tenantId = before.tenantId\n    note.contextType = before.contextType\n    note.contextId = before.contextId\n    note.order = before.orderId ? context.order ?? null : null\n    note.quote = before.quoteId ? context.quote ?? null : null\n    note.body = before.body\n    note.authorUserId = before.authorUserId\n    note.appearanceIcon = before.appearanceIcon\n    note.appearanceColor = before.appearanceColor\n    note.updatedAt = new Date()\n    await em.flush()\n\n    const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n    await emitCrudUndoSideEffects({\n      dataEngine,\n      action: 'updated',\n      entity: note,\n      identifiers: {\n        id: note.id,\n        organizationId: note.organizationId,\n        tenantId: note.tenantId,\n      },\n      indexer: noteCrudIndexer,\n      events: noteCrudEvents,\n    })\n  },\n}\n\nconst deleteNoteCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, { noteId: string }> =\n  {\n    id: 'sales.notes.delete',\n    async prepare(input, ctx) {\n      const id = requireId(input, 'Note id required')\n      const em = ctx.container.resolve('em') as EntityManager\n      const snapshot = await loadNoteSnapshot(em, id)\n      return snapshot ? { before: snapshot } : {}\n    },\n    async execute(input, ctx) {\n      const id = requireId(input, 'Note id required')\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const note = await findOneWithDecryption(em, SalesNote, { id }, {})\n      if (!note) throw new CrudHttpError(404, { error: 'sales.notes.not_found' })\n      ensureTenantScope(ctx, note.tenantId)\n      ensureOrganizationScope(ctx, note.organizationId)\n      em.remove(note)\n      await em.flush()\n\n      const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n      await emitCrudSideEffects({\n        dataEngine,\n        action: 'deleted',\n        entity: note,\n        identifiers: {\n          id: note.id,\n          organizationId: note.organizationId,\n          tenantId: note.tenantId,\n        },\n        indexer: noteCrudIndexer,\n        events: noteCrudEvents,\n      })\n      return { noteId: note.id }\n    },\n    buildLog: async ({ snapshots }) => {\n      const before = snapshots.before as NoteSnapshot | undefined\n      if (!before) return null\n      const { translate } = await resolveTranslations()\n      return {\n        actionLabel: translate('sales.audit.notes.delete', 'Delete note'),\n        resourceKind: 'sales.note',\n        resourceId: before.id,\n        parentResourceKind: before.contextType ? `sales.${before.contextType}` : null,\n        parentResourceId: before.contextId ?? null,\n        tenantId: before.tenantId,\n        organizationId: before.organizationId,\n        snapshotBefore: before,\n        payload: {\n          undo: {\n            before,\n          } satisfies NoteUndoPayload,\n        },\n      }\n    },\n    undo: async ({ logEntry, ctx }) => {\n      const payload = extractUndoPayload<NoteUndoPayload>(logEntry)\n      const before = payload?.before\n      if (!before) return\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const context = await requireContext(em, before.contextType, before.contextId).catch(() => null)\n      if (!context) return\n    let note = await findOneWithDecryption(em, SalesNote, { id: before.id }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })\n    if (!note) {\n      note = em.create(SalesNote, {\n        id: before.id,\n        organizationId: before.organizationId,\n        tenantId: before.tenantId,\n        contextType: before.contextType,\n        contextId: before.contextId,\n        order: before.orderId ? context.order ?? null : null,\n        quote: before.quoteId ? context.quote ?? null : null,\n        body: before.body,\n        authorUserId: before.authorUserId,\n        appearanceIcon: before.appearanceIcon,\n        appearanceColor: before.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(note)\n    }\n      note.organizationId = before.organizationId\n      note.tenantId = before.tenantId\n      note.contextType = before.contextType\n      note.contextId = before.contextId\n      note.order = before.orderId ? context.order ?? null : null\n      note.quote = before.quoteId ? context.quote ?? null : null\n      note.body = before.body\n      note.authorUserId = before.authorUserId\n      note.appearanceIcon = before.appearanceIcon\n      note.appearanceColor = before.appearanceColor\n      note.updatedAt = new Date()\n      await em.flush()\n\n      const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n      await emitCrudUndoSideEffects({\n        dataEngine,\n        action: 'created',\n        entity: note,\n        identifiers: {\n          id: note.id,\n          organizationId: note.organizationId,\n          tenantId: note.tenantId,\n        },\n        indexer: noteCrudIndexer,\n        events: noteCrudEvents,\n      })\n    },\n  }\n\nregisterCommand(createNoteCommand)\nregisterCommand(updateNoteCommand)\nregisterCommand(deleteNoteCommand)\n"],
-  "mappings": "AAAA,SAAS,uBAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,yBAAyB,iBAAiB,mBAAmB,0BAA0B;AAqBhG,MAAM,kBAAkB;AAAA,EACtB,YAAY,EAAE,MAAM;AACtB;AAEA,MAAM,iBAAmC;AAAA,EACvC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc,CAAC,SAAS;AAAA,IACtB,IAAI,IAAI,YAAY;AAAA,IACpB,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEA,eAAe,iBAAiB,IAAmB,IAA0C;AAC3F,QAAM,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC;AAClE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,SAAS,KAAK,QAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,KAAM;AAAA,IACtF,SAAS,KAAK,QAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,KAAM;AAAA,IACtF,MAAM,KAAK;AAAA,IACX,cAAc,KAAK,gBAAgB;AAAA,IACnC,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,iBAAiB,KAAK,mBAAmB;AAAA,EAC3C;AACF;AAEA,eAAe,eACb,IACA,aACA,WACA,gBACA,UAMC;AACD,MAAI,gBAAgB,SAAS;AAC3B,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,eAAe,CAAC;AAC7G,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,IACzE;AACA,QAAI,kBAAkB,UAAU;AAC9B,sBAAgB,OAAO,gBAAgB,QAAQ;AAAA,IACjD;AACA,WAAO;AAAA,MACL,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,gBAAgB,SAAS;AAC3B,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,eAAe,CAAC;AAC7G,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,IACzE;AACA,QAAI,kBAAkB,UAAU;AAC9B,sBAAgB,OAAO,gBAAgB,QAAQ;AAAA,IACjD;AACA,WAAO;AAAA,MACL,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,gBAAgB,YAAY,eAAe;AACxD,QAAM,SAAS,MAAM,GAAG,QAAQ,MAAa,EAAE,IAAI,UAAU,CAAC;AAC9D,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,EACzE;AACA,MAAI,kBAAkB,UAAU;AAC9B,oBAAgB,QAAQ,gBAAgB,QAAQ;AAAA,EAClD;AACA,SAAO;AAAA,IACL,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,aAAiC,SAAuC;AAC7F,MAAI,YAAa,QAAO;AACxB,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,YAAY;AAClB,SAAO,UAAU,KAAK,OAAO,IAAI,UAAU;AAC7C;AAEA,MAAM,oBAAsG;AAAA,EAC1G,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,iBAAiB,MAAM,YAAY,CAAC,CAAC;AACpD,sBAAkB,KAAK,OAAO,QAAQ;AACtC,4BAAwB,KAAK,OAAO,cAAc;AAClD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM,eAAe,IAAI,OAAO,aAAa,OAAO,WAAW,OAAO,gBAAgB,OAAO,QAAQ;AACrH,UAAM,eAAe,cAAc,OAAO,cAAc,IAAI,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI;AAEzG,UAAM,OAAO,GAAG,OAAO,WAAW;AAAA,MAChC,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,OAAO,QAAQ,SAAS;AAAA,MACxB,OAAO,QAAQ,SAAS;AAAA,MACxB;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,MAAM,OAAO;AAAA,MACb,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,IAAI;AACf,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,EAAE,QAAQ,KAAK,IAAI,cAAc,KAAK,gBAAgB,KAAK;AAAA,EACpE;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,WAAO,iBAAiB,IAAI,OAAO,MAAM;AAAA,EAC3C;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,UAAU,MAAM;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,WAAW,UAAU;AAC3B,WAAO;AAAA,MACL,aAAa,UAAU,4BAA4B,aAAa;AAAA,MAChE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB,UAAU,cAAc,SAAS,SAAS,WAAW,KAAK;AAAA,MAC9E,kBAAkB,UAAU,aAAa;AAAA,MACzC,UAAU,UAAU,YAAY;AAAA,MAChC,gBAAgB,UAAU,kBAAkB;AAAA,MAC5C,eAAe,YAAY;AAAA,MAC3B,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,YAAY;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,SAAS,UAAU,cAAc;AACvC,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC;AAC9E,QAAI,UAAU;AACZ,SAAG,OAAO,QAAQ;AAClB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AAAA,EACA,MAAM,eAA0G;AAAA,IAC9G,aAAa;AAAA,IACb,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,SAAS,CAAC,EAAE,IAAI,IAAI,SAAS,MAC3B;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,GAAG;AAAA,MACL;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,SAAS,eAAe;AAAA,IACzE;AAAA,IACF,kBAAkB,CAAC,cAAc;AAAA,MAC/B,IAAI,SAAS;AAAA,MACb,gBAAgB,SAAS;AAAA,MACzB,UAAU,SAAS;AAAA,MACnB,aAAa,SAAS;AAAA,MACtB,WAAW,SAAS;AAAA,MACpB,MAAM,SAAS;AAAA,MACf,cAAc,SAAS;AAAA,MACvB,gBAAgB,SAAS;AAAA,MACzB,iBAAiB,SAAS;AAAA,MAC1B,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB;AAAA,IACA,eAAe,OAAO,EAAE,IAAI,SAAS,MAAM;AACzC,YAAM,UAAU,MAAM,eAAe,IAAI,SAAS,aAAa,SAAS,SAAS,EAAE,MAAM,MAAM,IAAI;AACnG,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,MACzE;AACA,aAAO;AAAA,QACL,OAAO,SAAS,UAAU,QAAQ,SAAS,OAAO;AAAA,QAClD,OAAO,SAAS,UAAU,QAAQ,SAAS,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,IACA,aAAa,CAAC,YAAY,EAAE,QAAQ,OAAO,IAAI,cAAc,OAAO,gBAAgB,KAAK;AAAA,EAC3F,CAAC;AACH;AAEA,MAAM,oBAAyE;AAAA,EAC7E,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,iBAAiB,MAAM,YAAY,CAAC,CAAC;AACpD,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,WAAW,MAAM,iBAAiB,IAAI,OAAO,EAAE;AACrD,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,iBAAiB,MAAM,YAAY,CAAC,CAAC;AACpD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC;AAC7E,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAC1E,sBAAkB,KAAK,KAAK,QAAQ;AACpC,4BAAwB,KAAK,KAAK,cAAc;AAEhD,QAAI,OAAO,SAAS,OAAW,MAAK,OAAO,OAAO;AAClD,QAAI,OAAO,iBAAiB,OAAW,MAAK,eAAe,OAAO,gBAAgB;AAClF,QAAI,OAAO,mBAAmB,OAAW,MAAK,iBAAiB,OAAO,kBAAkB;AACxF,QAAI,OAAO,oBAAoB,OAAW,MAAK,kBAAkB,OAAO,mBAAmB;AAC3F,SAAK,YAAY,oBAAI,KAAK;AAE1B,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,EAAE,QAAQ,KAAK,GAAG;AAAA,EAC3B;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,WAAO,MAAM,iBAAiB,IAAI,OAAO,MAAM;AAAA,EACjD;AAAA,EACA,UAAU,OAAO,EAAE,UAAU,MAAM;AACjC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,QAAQ,UAAU;AACxB,UAAM,UACJ,SAAS,SACL;AAAA,MACE;AAAA,MACA;AAAA,MACA,CAAC,QAAQ,gBAAgB,kBAAkB,iBAAiB;AAAA,IAC9D,IACA,CAAC;AACP,WAAO;AAAA,MACL,aAAa,UAAU,4BAA4B,aAAa;AAAA,MAChE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB,OAAO,cAAc,SAAS,OAAO,WAAW,KAAK;AAAA,MACzE,kBAAkB,OAAO,aAAa;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,gBAAgB;AAAA,MAChB,eAAe,SAAS;AAAA,MACxB;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,UACA,OAAO,SAAS;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAoC,QAAQ;AAC5D,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM,eAAe,IAAI,OAAO,aAAa,OAAO,SAAS,EAAE,MAAM,MAAM,IAAI;AAC/F,QAAI,CAAC,QAAS;AACd,QAAI,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe,CAAC;AACjJ,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,WAAW;AAAA,QAC1B,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,MAAM,OAAO;AAAA,QACb,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,iBAAiB,OAAO;AAAA,QACxB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,IAAI;AAAA,IACjB;AACA,SAAK,iBAAiB,OAAO;AAC7B,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,OAAO;AAC1B,SAAK,YAAY,OAAO;AACxB,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,OAAO,OAAO;AACnB,SAAK,eAAe,OAAO;AAC3B,SAAK,iBAAiB,OAAO;AAC7B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,oBAAI,KAAK;AAC1B,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,wBAAwB;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;AAEA,MAAM,oBACJ;AAAA,EACE,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,WAAW,MAAM,iBAAiB,IAAI,EAAE;AAC9C,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC;AAClE,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAC1E,sBAAkB,KAAK,KAAK,QAAQ;AACpC,4BAAwB,KAAK,KAAK,cAAc;AAChD,OAAG,OAAO,IAAI;AACd,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,EAAE,QAAQ,KAAK,GAAG;AAAA,EAC3B;AAAA,EACA,UAAU,OAAO,EAAE,UAAU,MAAM;AACjC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,aAAa,UAAU,4BAA4B,aAAa;AAAA,MAChE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB,OAAO,cAAc,SAAS,OAAO,WAAW,KAAK;AAAA,MACzE,kBAAkB,OAAO,aAAa;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,gBAAgB;AAAA,MAChB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAoC,QAAQ;AAC5D,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM,eAAe,IAAI,OAAO,aAAa,OAAO,SAAS,EAAE,MAAM,MAAM,IAAI;AAC/F,QAAI,CAAC,QAAS;AAChB,QAAI,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe,CAAC;AACjJ,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,WAAW;AAAA,QAC1B,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,MAAM,OAAO;AAAA,QACb,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,iBAAiB,OAAO;AAAA,QACxB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,IAAI;AAAA,IACjB;AACE,SAAK,iBAAiB,OAAO;AAC7B,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,OAAO;AAC1B,SAAK,YAAY,OAAO;AACxB,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,OAAO,OAAO;AACnB,SAAK,eAAe,OAAO;AAC3B,SAAK,iBAAiB,OAAO;AAC7B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,oBAAI,KAAK;AAC1B,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,wBAAwB;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;AAEF,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;",
+  "sourcesContent": ["import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'\nimport {\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  SalesNote,\n  SalesOrder,\n  SalesQuote,\n  SalesInvoice,\n  SalesCreditMemo,\n  type SalesDocumentKind,\n} from '../data/entities'\nimport {\n  noteCreateSchema,\n  noteUpdateSchema,\n  type NoteCreateInput,\n  type NoteUpdateInput,\n} from '../data/validators'\nimport { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ensureOrganizationScope, ensureSameScope, ensureTenantScope, extractUndoPayload } from './shared'\n\ntype NoteSnapshot = {\n  id: string\n  organizationId: string\n  tenantId: string\n  contextType: SalesDocumentKind\n  contextId: string\n  orderId: string | null\n  quoteId: string | null\n  body: string\n  authorUserId: string | null\n  appearanceIcon: string | null\n  appearanceColor: string | null\n}\n\ntype NoteUndoPayload = {\n  before?: NoteSnapshot | null\n  after?: NoteSnapshot | null\n}\n\nconst noteCrudIndexer = {\n  entityType: E.sales.sales_note,\n}\n\nconst noteCrudEvents: CrudEventsConfig = {\n  module: 'sales',\n  entity: 'note',\n  persistent: true,\n  buildPayload: (ctx) => ({\n    id: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nasync function loadNoteSnapshot(em: EntityManager, id: string): Promise<NoteSnapshot | null> {\n  const note = await findOneWithDecryption(em, SalesNote, { id }, {})\n  if (!note) return null\n  return {\n    id: note.id,\n    organizationId: note.organizationId,\n    tenantId: note.tenantId,\n    contextType: note.contextType,\n    contextId: note.contextId,\n    orderId: note.order ? (typeof note.order === 'string' ? note.order : note.order.id) : null,\n    quoteId: note.quote ? (typeof note.quote === 'string' ? note.quote : note.quote.id) : null,\n    body: note.body,\n    authorUserId: note.authorUserId ?? null,\n    appearanceIcon: note.appearanceIcon ?? null,\n    appearanceColor: note.appearanceColor ?? null,\n  }\n}\n\nasync function requireContext(\n  em: EntityManager,\n  contextType: SalesDocumentKind,\n  contextId: string,\n  organizationId?: string,\n  tenantId?: string\n): Promise<{\n  organizationId: string\n  tenantId: string\n  order?: SalesOrder | null\n  quote?: SalesQuote | null\n}> {\n  if (contextType === 'order') {\n    const order = await findOneWithDecryption(em, SalesOrder, { id: contextId }, {}, { tenantId, organizationId })\n    if (!order) {\n      throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n    }\n    if (organizationId && tenantId) {\n      ensureSameScope(order, organizationId, tenantId)\n    }\n    return {\n      organizationId: order.organizationId,\n      tenantId: order.tenantId,\n      order,\n      quote: null,\n    }\n  }\n  if (contextType === 'quote') {\n    const quote = await findOneWithDecryption(em, SalesQuote, { id: contextId }, {}, { tenantId, organizationId })\n    if (!quote) {\n      throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n    }\n    if (organizationId && tenantId) {\n      ensureSameScope(quote, organizationId, tenantId)\n    }\n    return {\n      organizationId: quote.organizationId,\n      tenantId: quote.tenantId,\n      order: null,\n      quote,\n    }\n  }\n  const repo = contextType === 'invoice' ? SalesInvoice : SalesCreditMemo\n  const entity = await findOneWithDecryption(\n    em,\n    repo as any,\n    { id: contextId },\n    {},\n    { tenantId, organizationId },\n  ) as (SalesInvoice | SalesCreditMemo) | null\n  if (!entity) {\n    throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n  }\n  if (organizationId && tenantId) {\n    ensureSameScope(entity, organizationId, tenantId)\n  }\n  return {\n    organizationId: entity.organizationId,\n    tenantId: entity.tenantId,\n    order: null,\n    quote: null,\n  }\n}\n\nfunction resolveAuthor(authSub: string | null): string | null {\n  const sub = authSub?.trim()\n  if (!sub) return null\n  const uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n  return uuidRegex.test(sub) ? sub : null\n}\n\nconst createNoteCommand: CommandHandler<NoteCreateInput, { noteId: string; authorUserId: string | null }> = {\n  id: 'sales.notes.create',\n  async execute(rawInput, ctx) {\n    const parsed = noteCreateSchema.parse(rawInput ?? {})\n    ensureTenantScope(ctx, parsed.tenantId)\n    ensureOrganizationScope(ctx, parsed.organizationId)\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const context = await requireContext(em, parsed.contextType, parsed.contextId, parsed.organizationId, parsed.tenantId)\n    const authorUserId = resolveAuthor(ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null)\n\n    const note = em.create(SalesNote, {\n      organizationId: parsed.organizationId,\n      tenantId: parsed.tenantId,\n      contextType: parsed.contextType,\n      contextId: parsed.contextId,\n      order: context.order ?? null,\n      quote: context.quote ?? null,\n      authorUserId,\n      appearanceIcon: parsed.appearanceIcon ?? null,\n      appearanceColor: parsed.appearanceColor ?? null,\n      body: parsed.body,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    em.persist(note)\n    await em.flush()\n\n    const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: note,\n      identifiers: {\n        id: note.id,\n        organizationId: note.organizationId,\n        tenantId: note.tenantId,\n      },\n      indexer: noteCrudIndexer,\n      events: noteCrudEvents,\n    })\n\n    return { noteId: note.id, authorUserId: note.authorUserId ?? null }\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    return loadNoteSnapshot(em, result.noteId)\n  },\n  buildLog: async ({ result, snapshots }) => {\n    const { translate } = await resolveTranslations()\n    const snapshot = snapshots.after as NoteSnapshot | undefined\n    return {\n      actionLabel: translate('sales.audit.notes.create', 'Create note'),\n      resourceKind: 'sales.note',\n      resourceId: result.noteId,\n      parentResourceKind: snapshot?.contextType ? `sales.${snapshot.contextType}` : null,\n      parentResourceId: snapshot?.contextId ?? null,\n      tenantId: snapshot?.tenantId ?? null,\n      organizationId: snapshot?.organizationId ?? null,\n      snapshotAfter: snapshot ?? null,\n      payload: {\n        undo: {\n          after: snapshot ?? null,\n        } satisfies NoteUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const noteId = logEntry?.resourceId ?? null\n    if (!noteId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const existing = await findOneWithDecryption(em, SalesNote, { id: noteId }, {})\n    if (existing) {\n      em.remove(existing)\n      await em.flush()\n    }\n  },\n  redo: makeCreateRedo<SalesNote, NoteSnapshot, NoteCreateInput, { noteId: string; authorUserId: string | null }>({\n    entityClass: SalesNote,\n    indexer: noteCrudIndexer,\n    events: noteCrudEvents,\n    findRow: ({ em, id, snapshot }) =>\n      findOneWithDecryption(\n        em,\n        SalesNote,\n        { id },\n        undefined,\n        { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId },\n      ),\n    seedFromSnapshot: (snapshot) => ({\n      id: snapshot.id,\n      organizationId: snapshot.organizationId,\n      tenantId: snapshot.tenantId,\n      contextType: snapshot.contextType,\n      contextId: snapshot.contextId,\n      body: snapshot.body,\n      authorUserId: snapshot.authorUserId,\n      appearanceIcon: snapshot.appearanceIcon,\n      appearanceColor: snapshot.appearanceColor,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    }),\n    beforeRestore: async ({ em, snapshot }) => {\n      const context = await requireContext(em, snapshot.contextType, snapshot.contextId).catch(() => null)\n      if (!context) {\n        throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })\n      }\n      return {\n        order: snapshot.orderId ? context.order ?? null : null,\n        quote: snapshot.quoteId ? context.quote ?? null : null,\n      }\n    },\n    buildResult: (entity) => ({ noteId: entity.id, authorUserId: entity.authorUserId ?? null }),\n  }),\n}\n\nconst updateNoteCommand: CommandHandler<NoteUpdateInput, { noteId: string }> = {\n  id: 'sales.notes.update',\n  async prepare(rawInput, ctx) {\n    const parsed = noteUpdateSchema.parse(rawInput ?? {})\n    const em = ctx.container.resolve('em') as EntityManager\n    const snapshot = await loadNoteSnapshot(em, parsed.id)\n    return snapshot ? { before: snapshot } : {}\n  },\n  async execute(rawInput, ctx) {\n    const parsed = noteUpdateSchema.parse(rawInput ?? {})\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const note = await findOneWithDecryption(em, SalesNote, { id: parsed.id }, {})\n    if (!note) throw new CrudHttpError(404, { error: 'sales.notes.not_found' })\n    ensureTenantScope(ctx, note.tenantId)\n    ensureOrganizationScope(ctx, note.organizationId)\n\n    if (parsed.body !== undefined) note.body = parsed.body\n    if (parsed.authorUserId !== undefined) {\n      note.authorUserId = resolveAuthor(ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null)\n    }\n    if (parsed.appearanceIcon !== undefined) note.appearanceIcon = parsed.appearanceIcon ?? null\n    if (parsed.appearanceColor !== undefined) note.appearanceColor = parsed.appearanceColor ?? null\n    note.updatedAt = new Date()\n\n    await em.flush()\n\n    const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'updated',\n      entity: note,\n      identifiers: {\n        id: note.id,\n        organizationId: note.organizationId,\n        tenantId: note.tenantId,\n      },\n      indexer: noteCrudIndexer,\n      events: noteCrudEvents,\n    })\n\n    return { noteId: note.id }\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    return await loadNoteSnapshot(em, result.noteId)\n  },\n  buildLog: async ({ snapshots }) => {\n    const { translate } = await resolveTranslations()\n    const before = snapshots.before as NoteSnapshot | undefined\n    if (!before) return null\n    const after = snapshots.after as NoteSnapshot | undefined\n    const changes =\n      after && before\n        ? buildChanges(\n            before as unknown as Record<string, unknown>,\n            after as unknown as Record<string, unknown>,\n            ['body', 'authorUserId', 'appearanceIcon', 'appearanceColor']\n          )\n        : {}\n    return {\n      actionLabel: translate('sales.audit.notes.update', 'Update note'),\n      resourceKind: 'sales.note',\n      resourceId: before.id,\n      parentResourceKind: before.contextType ? `sales.${before.contextType}` : null,\n      parentResourceId: before.contextId ?? null,\n      tenantId: before.tenantId,\n      organizationId: before.organizationId,\n      snapshotBefore: before,\n      snapshotAfter: after ?? null,\n      changes,\n      payload: {\n        undo: {\n          before,\n          after: after ?? null,\n        } satisfies NoteUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<NoteUndoPayload>(logEntry)\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const context = await requireContext(em, before.contextType, before.contextId).catch(() => null)\n    if (!context) return\n    let note = await findOneWithDecryption(em, SalesNote, { id: before.id }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })\n    if (!note) {\n      note = em.create(SalesNote, {\n        id: before.id,\n        organizationId: before.organizationId,\n        tenantId: before.tenantId,\n        contextType: before.contextType,\n        contextId: before.contextId,\n        order: before.orderId ? context.order ?? null : null,\n        quote: before.quoteId ? context.quote ?? null : null,\n        body: before.body,\n        authorUserId: before.authorUserId,\n        appearanceIcon: before.appearanceIcon,\n        appearanceColor: before.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(note)\n    }\n    note.organizationId = before.organizationId\n    note.tenantId = before.tenantId\n    note.contextType = before.contextType\n    note.contextId = before.contextId\n    note.order = before.orderId ? context.order ?? null : null\n    note.quote = before.quoteId ? context.quote ?? null : null\n    note.body = before.body\n    note.authorUserId = before.authorUserId\n    note.appearanceIcon = before.appearanceIcon\n    note.appearanceColor = before.appearanceColor\n    note.updatedAt = new Date()\n    await em.flush()\n\n    const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n    await emitCrudUndoSideEffects({\n      dataEngine,\n      action: 'updated',\n      entity: note,\n      identifiers: {\n        id: note.id,\n        organizationId: note.organizationId,\n        tenantId: note.tenantId,\n      },\n      indexer: noteCrudIndexer,\n      events: noteCrudEvents,\n    })\n  },\n}\n\nconst deleteNoteCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, { noteId: string }> =\n  {\n    id: 'sales.notes.delete',\n    async prepare(input, ctx) {\n      const id = requireId(input, 'Note id required')\n      const em = ctx.container.resolve('em') as EntityManager\n      const snapshot = await loadNoteSnapshot(em, id)\n      return snapshot ? { before: snapshot } : {}\n    },\n    async execute(input, ctx) {\n      const id = requireId(input, 'Note id required')\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const note = await findOneWithDecryption(em, SalesNote, { id }, {})\n      if (!note) throw new CrudHttpError(404, { error: 'sales.notes.not_found' })\n      ensureTenantScope(ctx, note.tenantId)\n      ensureOrganizationScope(ctx, note.organizationId)\n      em.remove(note)\n      await em.flush()\n\n      const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n      await emitCrudSideEffects({\n        dataEngine,\n        action: 'deleted',\n        entity: note,\n        identifiers: {\n          id: note.id,\n          organizationId: note.organizationId,\n          tenantId: note.tenantId,\n        },\n        indexer: noteCrudIndexer,\n        events: noteCrudEvents,\n      })\n      return { noteId: note.id }\n    },\n    buildLog: async ({ snapshots }) => {\n      const before = snapshots.before as NoteSnapshot | undefined\n      if (!before) return null\n      const { translate } = await resolveTranslations()\n      return {\n        actionLabel: translate('sales.audit.notes.delete', 'Delete note'),\n        resourceKind: 'sales.note',\n        resourceId: before.id,\n        parentResourceKind: before.contextType ? `sales.${before.contextType}` : null,\n        parentResourceId: before.contextId ?? null,\n        tenantId: before.tenantId,\n        organizationId: before.organizationId,\n        snapshotBefore: before,\n        payload: {\n          undo: {\n            before,\n          } satisfies NoteUndoPayload,\n        },\n      }\n    },\n    undo: async ({ logEntry, ctx }) => {\n      const payload = extractUndoPayload<NoteUndoPayload>(logEntry)\n      const before = payload?.before\n      if (!before) return\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const context = await requireContext(em, before.contextType, before.contextId).catch(() => null)\n      if (!context) return\n    let note = await findOneWithDecryption(em, SalesNote, { id: before.id }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })\n    if (!note) {\n      note = em.create(SalesNote, {\n        id: before.id,\n        organizationId: before.organizationId,\n        tenantId: before.tenantId,\n        contextType: before.contextType,\n        contextId: before.contextId,\n        order: before.orderId ? context.order ?? null : null,\n        quote: before.quoteId ? context.quote ?? null : null,\n        body: before.body,\n        authorUserId: before.authorUserId,\n        appearanceIcon: before.appearanceIcon,\n        appearanceColor: before.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(note)\n    }\n      note.organizationId = before.organizationId\n      note.tenantId = before.tenantId\n      note.contextType = before.contextType\n      note.contextId = before.contextId\n      note.order = before.orderId ? context.order ?? null : null\n      note.quote = before.quoteId ? context.quote ?? null : null\n      note.body = before.body\n      note.authorUserId = before.authorUserId\n      note.appearanceIcon = before.appearanceIcon\n      note.appearanceColor = before.appearanceColor\n      note.updatedAt = new Date()\n      await em.flush()\n\n      const dataEngine = ctx.container.resolve('dataEngine') as DataEngine\n      await emitCrudUndoSideEffects({\n        dataEngine,\n        action: 'created',\n        entity: note,\n        identifiers: {\n          id: note.id,\n          organizationId: note.organizationId,\n          tenantId: note.tenantId,\n        },\n        indexer: noteCrudIndexer,\n        events: noteCrudEvents,\n      })\n    },\n  }\n\nregisterCommand(createNoteCommand)\nregisterCommand(updateNoteCommand)\nregisterCommand(deleteNoteCommand)\n"],
+  "mappings": "AAAA,SAAS,uBAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,yBAAyB,iBAAiB,mBAAmB,0BAA0B;AAqBhG,MAAM,kBAAkB;AAAA,EACtB,YAAY,EAAE,MAAM;AACtB;AAEA,MAAM,iBAAmC;AAAA,EACvC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc,CAAC,SAAS;AAAA,IACtB,IAAI,IAAI,YAAY;AAAA,IACpB,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEA,eAAe,iBAAiB,IAAmB,IAA0C;AAC3F,QAAM,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC;AAClE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,SAAS,KAAK,QAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,KAAM;AAAA,IACtF,SAAS,KAAK,QAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,KAAM;AAAA,IACtF,MAAM,KAAK;AAAA,IACX,cAAc,KAAK,gBAAgB;AAAA,IACnC,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,iBAAiB,KAAK,mBAAmB;AAAA,EAC3C;AACF;AAEA,eAAe,eACb,IACA,aACA,WACA,gBACA,UAMC;AACD,MAAI,gBAAgB,SAAS;AAC3B,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,eAAe,CAAC;AAC7G,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,IACzE;AACA,QAAI,kBAAkB,UAAU;AAC9B,sBAAgB,OAAO,gBAAgB,QAAQ;AAAA,IACjD;AACA,WAAO;AAAA,MACL,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,gBAAgB,SAAS;AAC3B,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,eAAe,CAAC;AAC7G,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,IACzE;AACA,QAAI,kBAAkB,UAAU;AAC9B,sBAAgB,OAAO,gBAAgB,QAAQ;AAAA,IACjD;AACA,WAAO;AAAA,MACL,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,gBAAgB,YAAY,eAAe;AACxD,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU;AAAA,IAChB,CAAC;AAAA,IACD,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,EACzE;AACA,MAAI,kBAAkB,UAAU;AAC9B,oBAAgB,QAAQ,gBAAgB,QAAQ;AAAA,EAClD;AACA,SAAO;AAAA,IACL,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,SAAuC;AAC5D,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,YAAY;AAClB,SAAO,UAAU,KAAK,GAAG,IAAI,MAAM;AACrC;AAEA,MAAM,oBAAsG;AAAA,EAC1G,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,iBAAiB,MAAM,YAAY,CAAC,CAAC;AACpD,sBAAkB,KAAK,OAAO,QAAQ;AACtC,4BAAwB,KAAK,OAAO,cAAc;AAClD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM,eAAe,IAAI,OAAO,aAAa,OAAO,WAAW,OAAO,gBAAgB,OAAO,QAAQ;AACrH,UAAM,eAAe,cAAc,IAAI,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI;AAEpF,UAAM,OAAO,GAAG,OAAO,WAAW;AAAA,MAChC,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,OAAO,QAAQ,SAAS;AAAA,MACxB,OAAO,QAAQ,SAAS;AAAA,MACxB;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,MAAM,OAAO;AAAA,MACb,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,IAAI;AACf,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,EAAE,QAAQ,KAAK,IAAI,cAAc,KAAK,gBAAgB,KAAK;AAAA,EACpE;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,WAAO,iBAAiB,IAAI,OAAO,MAAM;AAAA,EAC3C;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,UAAU,MAAM;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,WAAW,UAAU;AAC3B,WAAO;AAAA,MACL,aAAa,UAAU,4BAA4B,aAAa;AAAA,MAChE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB,UAAU,cAAc,SAAS,SAAS,WAAW,KAAK;AAAA,MAC9E,kBAAkB,UAAU,aAAa;AAAA,MACzC,UAAU,UAAU,YAAY;AAAA,MAChC,gBAAgB,UAAU,kBAAkB;AAAA,MAC5C,eAAe,YAAY;AAAA,MAC3B,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,YAAY;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,SAAS,UAAU,cAAc;AACvC,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC;AAC9E,QAAI,UAAU;AACZ,SAAG,OAAO,QAAQ;AAClB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AAAA,EACA,MAAM,eAA0G;AAAA,IAC9G,aAAa;AAAA,IACb,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,SAAS,CAAC,EAAE,IAAI,IAAI,SAAS,MAC3B;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,GAAG;AAAA,MACL;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,SAAS,eAAe;AAAA,IACzE;AAAA,IACF,kBAAkB,CAAC,cAAc;AAAA,MAC/B,IAAI,SAAS;AAAA,MACb,gBAAgB,SAAS;AAAA,MACzB,UAAU,SAAS;AAAA,MACnB,aAAa,SAAS;AAAA,MACtB,WAAW,SAAS;AAAA,MACpB,MAAM,SAAS;AAAA,MACf,cAAc,SAAS;AAAA,MACvB,gBAAgB,SAAS;AAAA,MACzB,iBAAiB,SAAS;AAAA,MAC1B,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB;AAAA,IACA,eAAe,OAAO,EAAE,IAAI,SAAS,MAAM;AACzC,YAAM,UAAU,MAAM,eAAe,IAAI,SAAS,aAAa,SAAS,SAAS,EAAE,MAAM,MAAM,IAAI;AACnG,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,MACzE;AACA,aAAO;AAAA,QACL,OAAO,SAAS,UAAU,QAAQ,SAAS,OAAO;AAAA,QAClD,OAAO,SAAS,UAAU,QAAQ,SAAS,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,IACA,aAAa,CAAC,YAAY,EAAE,QAAQ,OAAO,IAAI,cAAc,OAAO,gBAAgB,KAAK;AAAA,EAC3F,CAAC;AACH;AAEA,MAAM,oBAAyE;AAAA,EAC7E,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,iBAAiB,MAAM,YAAY,CAAC,CAAC;AACpD,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,WAAW,MAAM,iBAAiB,IAAI,OAAO,EAAE;AACrD,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,iBAAiB,MAAM,YAAY,CAAC,CAAC;AACpD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC;AAC7E,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAC1E,sBAAkB,KAAK,KAAK,QAAQ;AACpC,4BAAwB,KAAK,KAAK,cAAc;AAEhD,QAAI,OAAO,SAAS,OAAW,MAAK,OAAO,OAAO;AAClD,QAAI,OAAO,iBAAiB,QAAW;AACrC,WAAK,eAAe,cAAc,IAAI,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI;AAAA,IACrF;AACA,QAAI,OAAO,mBAAmB,OAAW,MAAK,iBAAiB,OAAO,kBAAkB;AACxF,QAAI,OAAO,oBAAoB,OAAW,MAAK,kBAAkB,OAAO,mBAAmB;AAC3F,SAAK,YAAY,oBAAI,KAAK;AAE1B,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,EAAE,QAAQ,KAAK,GAAG;AAAA,EAC3B;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,WAAO,MAAM,iBAAiB,IAAI,OAAO,MAAM;AAAA,EACjD;AAAA,EACA,UAAU,OAAO,EAAE,UAAU,MAAM;AACjC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,QAAQ,UAAU;AACxB,UAAM,UACJ,SAAS,SACL;AAAA,MACE;AAAA,MACA;AAAA,MACA,CAAC,QAAQ,gBAAgB,kBAAkB,iBAAiB;AAAA,IAC9D,IACA,CAAC;AACP,WAAO;AAAA,MACL,aAAa,UAAU,4BAA4B,aAAa;AAAA,MAChE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB,OAAO,cAAc,SAAS,OAAO,WAAW,KAAK;AAAA,MACzE,kBAAkB,OAAO,aAAa;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,gBAAgB;AAAA,MAChB,eAAe,SAAS;AAAA,MACxB;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,UACA,OAAO,SAAS;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAoC,QAAQ;AAC5D,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM,eAAe,IAAI,OAAO,aAAa,OAAO,SAAS,EAAE,MAAM,MAAM,IAAI;AAC/F,QAAI,CAAC,QAAS;AACd,QAAI,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe,CAAC;AACjJ,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,WAAW;AAAA,QAC1B,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,MAAM,OAAO;AAAA,QACb,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,iBAAiB,OAAO;AAAA,QACxB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,IAAI;AAAA,IACjB;AACA,SAAK,iBAAiB,OAAO;AAC7B,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,OAAO;AAC1B,SAAK,YAAY,OAAO;AACxB,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,OAAO,OAAO;AACnB,SAAK,eAAe,OAAO;AAC3B,SAAK,iBAAiB,OAAO;AAC7B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,oBAAI,KAAK;AAC1B,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,wBAAwB;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;AAEA,MAAM,oBACJ;AAAA,EACE,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,WAAW,MAAM,iBAAiB,IAAI,EAAE;AAC9C,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC;AAClE,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAC1E,sBAAkB,KAAK,KAAK,QAAQ;AACpC,4BAAwB,KAAK,KAAK,cAAc;AAChD,OAAG,OAAO,IAAI;AACd,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,EAAE,QAAQ,KAAK,GAAG;AAAA,EAC3B;AAAA,EACA,UAAU,OAAO,EAAE,UAAU,MAAM;AACjC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,aAAa,UAAU,4BAA4B,aAAa;AAAA,MAChE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB,OAAO,cAAc,SAAS,OAAO,WAAW,KAAK;AAAA,MACzE,kBAAkB,OAAO,aAAa;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,gBAAgB;AAAA,MAChB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAoC,QAAQ;AAC5D,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM,eAAe,IAAI,OAAO,aAAa,OAAO,SAAS,EAAE,MAAM,MAAM,IAAI;AAC/F,QAAI,CAAC,QAAS;AAChB,QAAI,OAAO,MAAM,sBAAsB,IAAI,WAAW,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe,CAAC;AACjJ,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,WAAW;AAAA,QAC1B,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,OAAO,OAAO,UAAU,QAAQ,SAAS,OAAO;AAAA,QAChD,MAAM,OAAO;AAAA,QACb,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,iBAAiB,OAAO;AAAA,QACxB,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,IAAI;AAAA,IACjB;AACE,SAAK,iBAAiB,OAAO;AAC7B,SAAK,WAAW,OAAO;AACvB,SAAK,cAAc,OAAO;AAC1B,SAAK,YAAY,OAAO;AACxB,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,QAAQ,OAAO,UAAU,QAAQ,SAAS,OAAO;AACtD,SAAK,OAAO,OAAO;AACnB,SAAK,eAAe,OAAO;AAC3B,SAAK,iBAAiB,OAAO;AAC7B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,oBAAI,KAAK;AAC1B,UAAM,GAAG,MAAM;AAEf,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,wBAAwB;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,KAAK;AAAA,QACT,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;AAEF,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6472.1.1673e7e66b",
+  "version": "0.6.6-develop.6480.1.309f47ca1c",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6472.1.1673e7e66b",
-    "@open-mercato/shared": "0.6.6-develop.6472.1.1673e7e66b",
-    "@open-mercato/ui": "0.6.6-develop.6472.1.1673e7e66b",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6480.1.309f47ca1c",
+    "@open-mercato/shared": "0.6.6-develop.6480.1.309f47ca1c",
+    "@open-mercato/ui": "0.6.6-develop.6480.1.309f47ca1c",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6472.1.1673e7e66b",
-    "@open-mercato/shared": "0.6.6-develop.6472.1.1673e7e66b",
-    "@open-mercato/ui": "0.6.6-develop.6472.1.1673e7e66b",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6480.1.309f47ca1c",
+    "@open-mercato/shared": "0.6.6-develop.6480.1.309f47ca1c",
+    "@open-mercato/ui": "0.6.6-develop.6480.1.309f47ca1c",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/progress/api/active/route.ts

@@ -4,7 +4,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ProgressJob } from '../../data/entities'
 
 const routeMetadata = {
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['progress.view'] },
 }
 
 export const metadata = routeMetadata

package/src/modules/progress/api/jobs/[id]/route.ts

@@ -7,7 +7,7 @@ import { updateProgressSchema } from '../../../data/validators'
 import type { ProgressService } from '../../../lib/progressService'
 
 const routeMetadata = {
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['progress.view'] },
   PUT: { requireAuth: true, requireFeatures: ['progress.update'] },
   DELETE: { requireAuth: true, requireFeatures: ['progress.cancel'] },
 }

package/src/modules/progress/api/jobs/route.ts

@@ -16,7 +16,7 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 const logger = createLogger('progress').child({ component: 'jobs' })
 
 const routeMetadata = {
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['progress.view'] },
   POST: { requireAuth: true, requireFeatures: ['progress.create'] },
 }
 

package/src/modules/sales/api/document-history/route.ts

@@ -9,6 +9,7 @@ import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/er
 import { NextResponse } from 'next/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { buildHistoryEntries } from '../../lib/historyHelpers'
 import { SalesNote } from '../../data/entities'
@@ -73,6 +74,16 @@ export async function GET(req: Request) {
       })
     }
 
+    const requiredFeature = query.kind === 'order' ? 'sales.orders.view' : 'sales.quotes.view'
+    const rbac = container.resolve('rbacService') as RbacService
+    const hasAccess = await rbac.userHasAllFeatures(auth.sub, [requiredFeature], {
+      tenantId: auth.tenantId,
+      organizationId,
+    })
+    if (!hasAccess) {
+      throw new CrudHttpError(403, { error: translate('api.errors.forbidden', 'Forbidden') })
+    }
+
     const resourceKind = query.kind === 'order' ? 'sales.order' : 'sales.quote'
 
     const actionLogService = container.resolve('actionLogService') as ActionLogService
@@ -178,6 +189,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'History entries', schema: documentHistoryResponseSchema },
         { status: 400, description: 'Invalid query', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },
         { status: 404, description: 'Document not found', schema: z.object({ error: z.string() }) },
       ],
     },

package/src/modules/sales/api/notes/route.ts

@@ -1,8 +1,11 @@
 import { z } from 'zod'
-import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
-import { SalesNote } from '../../data/entities'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { SalesNote, type SalesDocumentKind } from '../../data/entities'
 import { noteCreateSchema, noteUpdateSchema } from '../../data/validators'
 import { withScopedPayload } from '../utils'
 import { E } from '#generated/entities.ids.generated'
@@ -27,6 +30,91 @@ const listSchema = z
   })
   .passthrough()
 
+type NoteListQuery = z.infer<typeof listSchema>
+type NoteAction = 'view' | 'manage'
+
+const noteFeatureByContext: Record<SalesDocumentKind, Record<NoteAction, string>> = {
+  order: { view: 'sales.orders.view', manage: 'sales.orders.manage' },
+  quote: { view: 'sales.quotes.view', manage: 'sales.quotes.manage' },
+  invoice: { view: 'sales.invoices.manage', manage: 'sales.invoices.manage' },
+  credit_memo: { view: 'sales.credit_memos.manage', manage: 'sales.credit_memos.manage' },
+}
+
+const allNoteViewFeatures = Array.from(
+  new Set(Object.values(noteFeatureByContext).map((features) => features.view)),
+)
+const allNoteManageFeatures = Array.from(
+  new Set(Object.values(noteFeatureByContext).map((features) => features.manage)),
+)
+
+function resolveNoteListContextType(query: NoteListQuery): SalesDocumentKind | null {
+  if (query.contextType) return query.contextType
+  if (query.orderId) return 'order'
+  if (query.quoteId) return 'quote'
+  return null
+}
+
+function requiredNoteFeatures(action: NoteAction, contextType: SalesDocumentKind | null): string[] {
+  if (contextType) return [noteFeatureByContext[contextType][action]]
+  return action === 'view' ? allNoteViewFeatures : allNoteManageFeatures
+}
+
+async function ensureNotePermission(
+  ctx: CrudCtx,
+  action: NoteAction,
+  contextType: SalesDocumentKind | null,
+  translate: (key: string, fallback?: string) => string
+) {
+  const auth = ctx.auth
+  if (!auth?.sub) {
+    throw new CrudHttpError(401, { error: translate('api.errors.unauthorized', 'Unauthorized') })
+  }
+
+  const requiredFeatures = requiredNoteFeatures(action, contextType)
+  const rbac = ctx.container.resolve<RbacService>('rbacService')
+  const ok = await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {
+    tenantId: auth.tenantId ?? null,
+    organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,
+  })
+
+  if (!ok) {
+    throw new CrudHttpError(403, {
+      error: translate('api.errors.forbidden', 'Forbidden'),
+      requiredFeatures,
+    })
+  }
+}
+
+async function loadNoteForPermission(
+  ctx: CrudCtx,
+  id: string,
+  translate: (key: string, fallback?: string) => string
+): Promise<SalesNote> {
+  const em = ctx.container.resolve<EntityManager>('em')
+  const note = await findOneWithDecryption(em, SalesNote, { id }, {}, {
+    tenantId: ctx.auth?.tenantId ?? undefined,
+    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? undefined,
+  })
+
+  if (!note) {
+    throw new CrudHttpError(404, {
+      error: translate('sales.documents.detail.error', 'Document not found or inaccessible.'),
+    })
+  }
+
+  return note
+}
+
+async function ensureExistingNotePermission(
+  ctx: CrudCtx,
+  id: string,
+  action: NoteAction,
+  translate: (key: string, fallback?: string) => string
+) {
+  const note = await loadNoteForPermission(ctx, id, translate)
+  await ensureNotePermission(ctx, action, note.contextType, translate)
+}
+
 const routeMetadata = {
   GET: { requireAuth: true },
   POST: { requireAuth: true },
@@ -47,6 +135,12 @@ const crud = makeCrudRoute({
   indexer: {
     entityType: E.sales.sales_note,
   },
+  hooks: {
+    beforeList: async (query, ctx) => {
+      const { translate } = await resolveTranslations()
+      await ensureNotePermission(ctx, 'view', resolveNoteListContextType(query as NoteListQuery), translate)
+    },
+  },
   list: {
     schema: listSchema,
     entityId: E.sales.sales_note,
@@ -84,7 +178,9 @@ const crud = makeCrudRoute({
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations()
-        return noteCreateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        const input = noteCreateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        await ensureNotePermission(ctx, 'manage', input.contextType, translate)
+        return input
       },
       response: ({ result }) => ({
         id: result?.noteId ?? result?.id ?? null,
@@ -97,7 +193,9 @@ const crud = makeCrudRoute({
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations()
-        return noteUpdateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        const input = noteUpdateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        await ensureExistingNotePermission(ctx, input.id, 'manage', translate)
+        return input
       },
       response: () => ({ ok: true }),
     },
@@ -114,6 +212,7 @@ const crud = makeCrudRoute({
         if (!id) {
           throw new CrudHttpError(400, { error: translate('sales.documents.detail.error', 'Document not found or inaccessible.') })
         }
+        await ensureExistingNotePermission(ctx, id, 'manage', translate)
         return { id }
       },
       response: () => ({ ok: true }),

package/src/modules/sales/commands/documents.ts

@@ -4738,10 +4738,14 @@ const createQuoteCommand: CommandHandler<
           linkHref: `/backend/sales/quotes/${quote.id}`,
         });
 
-        await notificationService.createForFeature(notificationInput, {
-          tenantId: quote.tenantId,
-          organizationId: quote.organizationId ?? null,
-        });
+        // Bulk-import backfills opt out of the per-record notification fan-out (and its inline
+        // e-mail delivery); interactive creates are unaffected.
+        if (!ctx.bulkImport?.skipNotifications) {
+          await notificationService.createForFeature(notificationInput, {
+            tenantId: quote.tenantId,
+            organizationId: quote.organizationId ?? null,
+          });
+        }
       }
     } catch (err) {
       // Notification creation is non-critical, don't fail the command
@@ -5741,10 +5745,14 @@ const createOrderCommand: CommandHandler<
           linkHref: `/backend/sales/orders/${order.id}`,
         });
 
-        await notificationService.createForFeature(notificationInput, {
-          tenantId: order.tenantId,
-          organizationId: order.organizationId ?? null,
-        });
+        // Bulk-import backfills opt out of the per-record notification fan-out (and its inline
+        // e-mail delivery); interactive creates are unaffected.
+        if (!ctx.bulkImport?.skipNotifications) {
+          await notificationService.createForFeature(notificationInput, {
+            tenantId: order.tenantId,
+            organizationId: order.organizationId ?? null,
+          });
+        }
       }
     } catch (err) {
       // Notification creation is non-critical, don't fail the command

package/src/modules/sales/commands/notes.ts

@@ -124,7 +124,13 @@ async function requireContext(
     }
   }
   const repo = contextType === 'invoice' ? SalesInvoice : SalesCreditMemo
-  const entity = await em.findOne(repo as any, { id: contextId }) as (SalesInvoice | SalesCreditMemo) | null
+  const entity = await findOneWithDecryption(
+    em,
+    repo as any,
+    { id: contextId },
+    {},
+    { tenantId, organizationId },
+  ) as (SalesInvoice | SalesCreditMemo) | null
   if (!entity) {
     throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })
   }
@@ -139,11 +145,11 @@ async function requireContext(
   }
 }
 
-function resolveAuthor(inputAuthor: string | undefined, authSub: string | null): string | null {
-  if (inputAuthor) return inputAuthor
-  if (!authSub) return null
+function resolveAuthor(authSub: string | null): string | null {
+  const sub = authSub?.trim()
+  if (!sub) return null
   const uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
-  return uuidRegex.test(authSub) ? authSub : null
+  return uuidRegex.test(sub) ? sub : null
 }
 
 const createNoteCommand: CommandHandler<NoteCreateInput, { noteId: string; authorUserId: string | null }> = {
@@ -154,7 +160,7 @@ const createNoteCommand: CommandHandler<NoteCreateInput, { noteId: string; autho
     ensureOrganizationScope(ctx, parsed.organizationId)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const context = await requireContext(em, parsed.contextType, parsed.contextId, parsed.organizationId, parsed.tenantId)
-    const authorUserId = resolveAuthor(parsed.authorUserId, ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null)
+    const authorUserId = resolveAuthor(ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null)
 
     const note = em.create(SalesNote, {
       organizationId: parsed.organizationId,
@@ -278,7 +284,9 @@ const updateNoteCommand: CommandHandler<NoteUpdateInput, { noteId: string }> = {
     ensureOrganizationScope(ctx, note.organizationId)
 
     if (parsed.body !== undefined) note.body = parsed.body
-    if (parsed.authorUserId !== undefined) note.authorUserId = parsed.authorUserId ?? null
+    if (parsed.authorUserId !== undefined) {
+      note.authorUserId = resolveAuthor(ctx.auth?.isApiKey ? null : ctx.auth?.sub ?? null)
+    }
     if (parsed.appearanceIcon !== undefined) note.appearanceIcon = parsed.appearanceIcon ?? null
     if (parsed.appearanceColor !== undefined) note.appearanceColor = parsed.appearanceColor ?? null
     note.updatedAt = new Date()