@open-mercato/core 0.6.6-develop.6530.1.6d8442bafd → 0.6.6-develop.6534.1.6f4f994802

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3471 entry points
+[build:core] found 3472 entry points
 [build:core] built successfully
 [build:core:generated] found 186 entry points
 [build:core:generated] built successfully

package/dist/modules/api_keys/api/keys/route.js

@@ -9,6 +9,8 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { enforceTenantSelection, resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { assertActorCanGrantRoles } from "@open-mercato/core/modules/auth/lib/grantChecks";
+import { isOrganizationAccessAllowed } from "@open-mercato/shared/lib/auth/organizationAccess";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 const listQuerySchema = z.object({
   page: z.string().optional(),
   pageSize: z.string().optional(),
@@ -273,18 +275,30 @@ const crud = makeCrudRoute({
       const { translate } = await resolveTranslations();
       if (!auth?.tenantId) throw json({ error: translate("api_keys.errors.tenantRequired", "Tenant context required") }, { status: 400 });
       const em = ctx.container.resolve("em");
-      const record = await em.findOne(ApiKey, { id, deletedAt: null });
-      if (!record) throw json({ error: translate("api_keys.errors.notFound", "Not found") }, { status: 404 });
       const scopedCtx = ctx;
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx);
-      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {
-        throw json({ error: translate("api_keys.errors.forbidden", "Forbidden") }, { status: 403 });
-      }
       const allowedIds = ctx.organizationScope?.allowedIds ?? null;
-      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(record.organizationId)) {
-          throw json({ error: translate("api_keys.errors.organizationOutOfScope", "Organization out of scope") }, { status: 403 });
-        }
+      const recordFilter = {
+        id,
+        tenantId: auth.tenantId,
+        deletedAt: null
+      };
+      if (!isSuperAdmin && Array.isArray(allowedIds)) {
+        recordFilter.organizationId = { $in: allowedIds };
+      }
+      const record = await findOneWithDecryption(
+        em,
+        ApiKey,
+        recordFilter,
+        void 0,
+        { tenantId: auth.tenantId, organizationId: null }
+      );
+      if (!record || record.tenantId !== auth.tenantId || !isOrganizationAccessAllowed({
+        isSuperAdmin,
+        allowedOrganizationIds: allowedIds,
+        targetOrganizationId: record.organizationId ?? null
+      })) {
+        throw json({ error: translate("api_keys.errors.notFound", "Not found") }, { status: 404 });
       }
       scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null;
     },

package/dist/modules/api_keys/api/keys/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_keys/api/keys/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const record = await em.findOne(ApiKey, { id, deletedAt: null })\n      if (!record) throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {\n        throw json({ error: translate('api_keys.errors.forbidden', 'Forbidden') }, { status: 403 })\n      }\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(record.organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AAgBzC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,UAAI,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AACxE,YAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACxC,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,WAAW,KAAK,CAAC;AAC/D,UAAI,CAAC,OAAQ,OAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AACtG,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,UAAI,CAAC,gBAAgB,OAAO,YAAY,OAAO,aAAa,KAAK,UAAU;AACzE,cAAM,KAAK,EAAE,OAAO,UAAU,6BAA6B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC5F;AACA,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,UAAI,OAAO,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AAC/E,YAAI,CAAC,WAAW,SAAS,OAAO,cAAc,GAAG;AAC/C,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { ApiKey } from '../../data/entities'\nimport { createApiKeySchema } from '../../data/validators'\nimport { generateApiKeySecret, hashApiKey } from '../../services/apiKeyService'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype ApiKeyCrudCtx = CrudCtx & {\n  __apiKeySecret?: { secret: string; prefix: string }\n  __apiKeyHash?: string\n  __apiKeyRoleIds?: string[]\n  __apiKeyRoles?: Role[]\n  __apiKeyOrganizationId?: string | null\n  __apiKeyTenantId?: string | null\n}\n\ntype ApiKeyEntityWithMeta = ApiKey & {\n  __apiKeySecret?: string\n  __apiKeyRoles?: Role[]\n}\n\nconst listQuerySchema = z.object({\n  page: z.string().optional(),\n  pageSize: z.string().optional(),\n  search: z.string().optional(),\n})\n\nconst apiKeyRoleSchema = z.object({\n  id: z.string().describe('Role identifier or alias assigned to the key'),\n  name: z.string().nullable().describe('Display name of the mapped role, if available'),\n})\n\nconst apiKeyListItemSchema = z.object({\n  id: z.string().describe('API key identifier'),\n  name: z.string().describe('Friendly label used to identify the key'),\n  description: z.string().nullable().describe('Optional free-form description'),\n  keyPrefix: z.string().describe('Public prefix exposed to clients'),\n  organizationId: z.string().uuid().nullable().describe('Organization scope of the key'),\n  organizationName: z.string().nullable().describe('Resolved organization display name'),\n  createdAt: z.string().describe('Creation timestamp (ISO 8601)'),\n  lastUsedAt: z.string().nullable().describe('Last time the key was observed in use (ISO 8601)'),\n  expiresAt: z.string().nullable().describe('When the key expires (ISO 8601)'),\n  roles: z.array(apiKeyRoleSchema).describe('Effective roles applied when this key authenticates'),\n})\n\nconst apiKeyCollectionResponseSchema = z.object({\n  items: z.array(apiKeyListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().nonnegative(),\n})\n\nconst apiKeyCreateResponseSchema = z.object({\n  id: z.string().describe('Newly created API key identifier'),\n  name: z.string(),\n  keyPrefix: z.string(),\n  secret: z.string().describe('Full API key value. Shown once for secure persistence.').optional(),\n  tenantId: z.string().uuid().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  roles: z.array(apiKeyRoleSchema),\n})\n\nconst deleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction json(payload: unknown, init: ResponseInit = { status: 200 }) {\n  return new Response(JSON.stringify(payload), {\n    ...init,\n    headers: { 'content-type': 'application/json', ...(init.headers || {}) },\n  })\n}\n\nconst crud = makeCrudRoute<\n  z.infer<typeof createApiKeySchema>,\n  never,\n  z.infer<typeof listQuerySchema>\n>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['api_keys.view'] },\n    POST: { requireAuth: true, requireFeatures: ['api_keys.create'] },\n    DELETE: { requireAuth: true, requireFeatures: ['api_keys.delete'] },\n  },\n  orm: { entity: ApiKey, orgField: null },\n  list: { schema: listQuerySchema },\n  create: {\n    schema: createApiKeySchema,\n    mapToEntity: (input, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const keyHash = scopedCtx.__apiKeyHash\n      if (!secretData || !keyHash) throw new Error('API key secret not prepared')\n      const roleIds = Array.isArray(scopedCtx.__apiKeyRoleIds) ? scopedCtx.__apiKeyRoleIds : []\n      const organizationId = scopedCtx.__apiKeyOrganizationId ?? null\n      const tenantId = scopedCtx.__apiKeyTenantId ?? null\n      return {\n        name: input.name,\n        description: input.description ?? null,\n        tenantId,\n        organizationId,\n        keyHash,\n        keyPrefix: secretData.prefix,\n        rolesJson: roleIds,\n        createdBy: ctx.auth?.sub ?? null,\n        expiresAt: input.expiresAt ?? null,\n      }\n    },\n    response: (entity) => {\n      const meta = entity as ApiKeyEntityWithMeta\n      const secret = meta.__apiKeySecret\n      const roles = meta.__apiKeyRoles\n      return {\n        id: String(entity.id),\n        name: entity.name,\n        keyPrefix: entity.keyPrefix,\n        secret,\n        tenantId: entity.tenantId ?? null,\n        organizationId: entity.organizationId ?? null,\n        roles: Array.isArray(roles)\n          ? roles.map((role) => ({ id: String(role.id), name: role.name ?? null }))\n          : (Array.isArray(entity.rolesJson) ? entity.rolesJson.map((id: string) => ({ id, name: null })) : []),\n      }\n    },\n  },\n  del: { idFrom: 'query' },\n  hooks: {\n    beforeList: async (query, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const page = Math.max(parseInt(query.page ?? '1', 10) || 1, 1)\n      const pageSize = Math.min(Math.max(parseInt(query.pageSize ?? '20', 10) || 20, 1), 200)\n      const search = (query.search ?? '').trim().toLowerCase()\n\n      const organizationIds = Array.isArray(ctx.organizationIds) ? ctx.organizationIds : null\n      if (organizationIds && organizationIds.length === 0) {\n        throw json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n      }\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const qb = em.createQueryBuilder(ApiKey, 'k')\n      qb.where({ deletedAt: null })\n      qb.andWhere({ tenantId: auth.tenantId })\n      if (organizationIds && organizationIds.length > 0) {\n        qb.andWhere({ organizationId: { $in: organizationIds } })\n      } else if (auth.orgId) {\n        qb.andWhere({ organizationId: auth.orgId })\n      }\n      if (search) {\n        const pattern = `%${escapeLikePattern(search)}%`\n        qb.andWhere({\n          $or: [\n            { name: { $ilike: pattern } },\n            { keyPrefix: { $ilike: pattern } },\n          ],\n        })\n      }\n      qb.orderBy({ createdAt: 'desc' })\n      qb.limit(pageSize).offset((page - 1) * pageSize)\n      const [items, total] = await qb.getResultAndCount()\n\n      if (!items.length) {\n        throw json({ items: [], total, page, pageSize, totalPages: Math.ceil(total / pageSize) })\n      }\n\n      const roleIdSet = new Set<string>()\n      const orgIdSet = new Set<string>()\n      for (const item of items) {\n        if (Array.isArray(item.rolesJson)) {\n          for (const roleId of item.rolesJson) roleIdSet.add(String(roleId))\n        }\n        if (item.organizationId) orgIdSet.add(String(item.organizationId))\n      }\n\n      const roleIdArray = Array.from(roleIdSet)\n      const organizationIdArray = Array.from(orgIdSet)\n      const roleFilter: FilterQuery<Role> = { id: { $in: roleIdArray } }\n      const organizationFilter: FilterQuery<Organization> = { id: { $in: organizationIdArray } }\n      const [roles, organizations] = await Promise.all([\n        roleIdArray.length ? em.find(Role, roleFilter) : [],\n        organizationIdArray.length ? em.find(Organization, organizationFilter) : [],\n      ])\n      const roleMap = new Map(roles.map((role) => [String(role.id), role.name ?? null]))\n      const orgMap = new Map(organizations.map((org) => [String(org.id), org.name ?? null]))\n\n      const payload = {\n        items: items.map((item) => ({\n          id: item.id,\n          name: item.name,\n          description: item.description ?? null,\n          keyPrefix: item.keyPrefix,\n          organizationId: item.organizationId ?? null,\n          organizationName: item.organizationId ? orgMap.get(String(item.organizationId)) ?? null : null,\n          createdAt: item.createdAt,\n          lastUsedAt: item.lastUsedAt ?? null,\n          expiresAt: item.expiresAt ?? null,\n          roles: Array.isArray(item.rolesJson)\n            ? item.rolesJson.map((id) => ({ id, name: roleMap.get(String(id)) ?? null }))\n            : [],\n        })),\n        total,\n        page,\n        pageSize,\n        totalPages: Math.ceil(total / pageSize),\n      }\n\n      throw json(payload)\n    },\n    beforeCreate: async (input, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n\n      const requestedTenant = Object.prototype.hasOwnProperty.call(input, 'tenantId') ? input.tenantId : auth.tenantId\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const targetTenantId = await enforceTenantSelection(scopedCtx, requestedTenant)\n      scopedCtx.__apiKeyTenantId = targetTenantId\n\n      const secretData = generateApiKeySecret()\n      scopedCtx.__apiKeySecret = secretData\n      scopedCtx.__apiKeyHash = await hashApiKey(secretData.secret)\n\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const roleTokens = Array.isArray(input.roles) ? input.roles.filter((value) => typeof value === 'string' && value.trim().length > 0) : []\n      const roleEntities: Role[] = []\n      const roleIds: string[] = []\n      for (const token of roleTokens) {\n        const value = token.trim()\n        const rawTenantId = targetTenantId ?? auth.tenantId ?? null\n        const effectiveTenantId = typeof rawTenantId === 'string' && rawTenantId.trim().length > 0 ? rawTenantId.trim() : null\n        const normalizedEffectiveTenantId = effectiveTenantId ? effectiveTenantId.toLowerCase() : null\n        let role: Role | null = null\n        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {\n          role = await em.findOne(Role, { id: value, deletedAt: null })\n        }\n        if (!role) {\n          const nameFilter: FilterQuery<Role> = { name: value, deletedAt: null }\n          if (normalizedEffectiveTenantId) {\n            nameFilter.$or = [\n              { tenantId: effectiveTenantId },\n              { tenantId: null },\n            ]\n          } else {\n            nameFilter.tenantId = null\n          }\n          const candidates = await em.find(Role, nameFilter, { limit: 5 })\n          if (normalizedEffectiveTenantId) {\n            role =\n              candidates.find((candidate) => {\n                if (!candidate.tenantId) return false\n                return String(candidate.tenantId).toLowerCase() === normalizedEffectiveTenantId\n              }) ??\n              candidates.find((candidate) => candidate.tenantId === null) ??\n              null\n          } else {\n            role = candidates.find((candidate) => candidate.tenantId === null) ?? null\n          }\n          if (!role) {\n            role = candidates[0] ?? null\n          }\n        }\n        if (!role) {\n          throw json({ error: translate('api_keys.errors.roleNotFound', `Role ${value} not found`, { identifier: value }) }, { status: 400 })\n        }\n        const roleTenantId = role.tenantId ? String(role.tenantId) : null\n        const normalizedRoleTenantId = roleTenantId ? roleTenantId.toLowerCase() : null\n        if (normalizedRoleTenantId && normalizedEffectiveTenantId && normalizedRoleTenantId !== normalizedEffectiveTenantId) {\n          throw json({ error: translate('api_keys.errors.roleWrongTenant', `Role ${role.name} belongs to another tenant`, { role: role.name ?? value }) }, { status: 400 })\n        }\n        roleEntities.push(role)\n        roleIds.push(String(role.id))\n      }\n      await assertActorCanGrantRoles({\n        em,\n        rbacService: ctx.container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        roles: roleEntities,\n      })\n      scopedCtx.__apiKeyRoles = roleEntities\n      scopedCtx.__apiKeyRoleIds = roleIds\n\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null\n      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {\n        if (!allowedIds.includes(organizationId)) {\n          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })\n        }\n      }\n      scopedCtx.__apiKeyOrganizationId = organizationId ?? null\n\n      return { ...input, organizationId }\n    },\n    afterCreate: async (entity, ctx) => {\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const secretData = scopedCtx.__apiKeySecret\n      const roles = scopedCtx.__apiKeyRoles\n      if (secretData) (entity as ApiKeyEntityWithMeta).__apiKeySecret = secretData.secret\n      if (roles) (entity as ApiKeyEntityWithMeta).__apiKeyRoles = roles\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${entity.id}`)\n      } catch {}\n    },\n    beforeDelete: async (id, ctx) => {\n      const auth = ctx.auth\n      const { translate } = await resolveTranslations()\n      if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })\n      const em = (ctx.container.resolve('em') as EntityManager)\n      const scopedCtx = ctx as ApiKeyCrudCtx\n      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)\n      const allowedIds = ctx.organizationScope?.allowedIds ?? null\n      const recordFilter: FilterQuery<ApiKey> = {\n        id,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      }\n      if (!isSuperAdmin && Array.isArray(allowedIds)) {\n        recordFilter.organizationId = { $in: allowedIds }\n      }\n      const record = await findOneWithDecryption(\n        em,\n        ApiKey,\n        recordFilter,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: null },\n      )\n      if (\n        !record ||\n        record.tenantId !== auth.tenantId ||\n        !isOrganizationAccessAllowed({\n          isSuperAdmin,\n          allowedOrganizationIds: allowedIds,\n          targetOrganizationId: record.organizationId ?? null,\n        })\n      ) {\n        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })\n      }\n      scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null\n    },\n    afterDelete: async (id, ctx) => {\n      try {\n        const rbac = (ctx.container.resolve('rbacService') as RbacService)\n        await rbac.invalidateUserCache(`api_key:${id}`)\n      } catch {}\n    },\n  },\n})\n\nexport const metadata = crud.metadata\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const DELETE = crud.DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage API keys',\n  description:\n    'Provides list, creation, and deletion capabilities for API keys scoped to the authenticated tenant and organization.',\n  methods: {\n    GET: {\n      summary: 'List API keys',\n      description:\n        'Returns paginated API keys visible to the current user, including per-key role assignments and organization context.',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Collection of API keys',\n          schema: apiKeyCollectionResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Tenant context missing', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden by organization scope', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create API key',\n      description:\n        'Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: createApiKeySchema,\n        description: 'API key definition including optional scope and role assignments.',\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'API key created successfully',\n          schema: apiKeyCreateResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing tenant context', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete API key',\n      description:\n        'Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.',\n      query: z.object({\n        id: z.string().uuid().describe('API key identifier to delete'),\n      }),\n      responses: [\n        { status: 200, description: 'Key deleted successfully', schema: deleteResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing or invalid identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Organization outside allowed scope', schema: errorSchema },\n        { status: 404, description: 'Key not found within scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAG9B,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,sBAAsB,kBAAkB;AACjD,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB;AAClC,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,6BAA6B;AAgBtC,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,oBAAoB;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,EACnE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,gCAAgC;AAAA,EAC5E,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EACjE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EACrF,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,SAAS,+BAA+B;AAAA,EAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,EAC7F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC3E,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS,qDAAqD;AACjG,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC1D,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,SAAS,wDAAwD,EAAE,SAAS;AAAA,EAC/F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,KAAK,SAAkB,OAAqB,EAAE,QAAQ,IAAI,GAAG;AACpE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,GAAI,KAAK,WAAW,CAAC,EAAG;AAAA,EACzE,CAAC;AACH;AAEA,MAAM,OAAO,cAIX;AAAA,EACA,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,IAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,IAChE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EACpE;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ,UAAU,KAAK;AAAA,EACtC,MAAM,EAAE,QAAQ,gBAAgB;AAAA,EAChC,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa,CAAC,OAAO,QAAQ;AAC3B,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,UAAU,UAAU;AAC1B,UAAI,CAAC,cAAc,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B;AAC1E,YAAM,UAAU,MAAM,QAAQ,UAAU,eAAe,IAAI,UAAU,kBAAkB,CAAC;AACxF,YAAM,iBAAiB,UAAU,0BAA0B;AAC3D,YAAM,WAAW,UAAU,oBAAoB;AAC/C,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM,eAAe;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,WAAW;AAAA,QACtB,WAAW;AAAA,QACX,WAAW,IAAI,MAAM,OAAO;AAAA,QAC5B,WAAW,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AACpB,YAAM,OAAO;AACb,YAAM,SAAS,KAAK;AACpB,YAAM,QAAQ,KAAK;AACnB,aAAO;AAAA,QACL,IAAI,OAAO,OAAO,EAAE;AAAA,QACpB,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,UAAU,OAAO,YAAY;AAAA,QAC7B,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,OAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,EAAE,IACrE,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,CAAC,QAAgB,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AAAA,EACA,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,IACL,YAAY,OAAO,OAAO,QAAQ;AAChC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,EAAE,KAAK,GAAG,CAAC;AAC7D,YAAM,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,YAAY,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AACtF,YAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AAEvD,YAAM,kBAAkB,MAAM,QAAQ,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACnF,UAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,MACnE;AAEA,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,KAAK,GAAG,mBAAmB,QAAQ,GAAG;AAC5C,SAAG,MAAM,EAAE,WAAW,KAAK,CAAC;AAC5B,SAAG,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC;AACvC,UAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,WAAG,SAAS,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAC1D,WAAW,KAAK,OAAO;AACrB,WAAG,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAAA,MAC5C;AACA,UAAI,QAAQ;AACV,cAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,WAAG,SAAS;AAAA,UACV,KAAK;AAAA,YACH,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,YAC5B,EAAE,WAAW,EAAE,QAAQ,QAAQ,EAAE;AAAA,UACnC;AAAA,QACF,CAAC;AAAA,MACH;AACA,SAAG,QAAQ,EAAE,WAAW,OAAO,CAAC;AAChC,SAAG,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,QAAQ;AAC/C,YAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG,kBAAkB;AAElD,UAAI,CAAC,MAAM,QAAQ;AACjB,cAAM,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,MAAM,UAAU,YAAY,KAAK,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC1F;AAEA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,WAAW,oBAAI,IAAY;AACjC,iBAAW,QAAQ,OAAO;AACxB,YAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AACjC,qBAAW,UAAU,KAAK,UAAW,WAAU,IAAI,OAAO,MAAM,CAAC;AAAA,QACnE;AACA,YAAI,KAAK,eAAgB,UAAS,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,MACnE;AAEA,YAAM,cAAc,MAAM,KAAK,SAAS;AACxC,YAAM,sBAAsB,MAAM,KAAK,QAAQ;AAC/C,YAAM,aAAgC,EAAE,IAAI,EAAE,KAAK,YAAY,EAAE;AACjE,YAAM,qBAAgD,EAAE,IAAI,EAAE,KAAK,oBAAoB,EAAE;AACzF,YAAM,CAAC,OAAO,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/C,YAAY,SAAS,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AAAA,QAClD,oBAAoB,SAAS,GAAG,KAAK,cAAc,kBAAkB,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC;AACjF,YAAM,SAAS,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,YAAM,UAAU;AAAA,QACd,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,WAAW,KAAK;AAAA,UAChB,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,kBAAkB,KAAK,iBAAiB,OAAO,IAAI,OAAO,KAAK,cAAc,CAAC,KAAK,OAAO;AAAA,UAC1F,WAAW,KAAK;AAAA,UAChB,YAAY,KAAK,cAAc;AAAA,UAC/B,WAAW,KAAK,aAAa;AAAA,UAC7B,OAAO,MAAM,QAAQ,KAAK,SAAS,IAC/B,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,IAC1E,CAAC;AAAA,QACP,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,KAAK,QAAQ,QAAQ;AAAA,MACxC;AAEA,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElI,YAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,IAAI,MAAM,WAAW,KAAK;AACxG,YAAM,YAAY;AAClB,YAAM,iBAAiB,MAAM,uBAAuB,WAAW,eAAe;AAC9E,gBAAU,mBAAmB;AAE7B,YAAM,aAAa,qBAAqB;AACxC,gBAAU,iBAAiB;AAC3B,gBAAU,eAAe,MAAM,WAAW,WAAW,MAAM;AAE3D,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;AACvI,YAAM,eAAuB,CAAC;AAC9B,YAAM,UAAoB,CAAC;AAC3B,iBAAW,SAAS,YAAY;AAC9B,cAAM,QAAQ,MAAM,KAAK;AACzB,cAAM,cAAc,kBAAkB,KAAK,YAAY;AACvD,cAAM,oBAAoB,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,IAAI,YAAY,KAAK,IAAI;AAClH,cAAM,8BAA8B,oBAAoB,kBAAkB,YAAY,IAAI;AAC1F,YAAI,OAAoB;AACxB,YAAI,6EAA6E,KAAK,KAAK,GAAG;AAC5F,iBAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AAAA,QAC9D;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,aAAgC,EAAE,MAAM,OAAO,WAAW,KAAK;AACrE,cAAI,6BAA6B;AAC/B,uBAAW,MAAM;AAAA,cACf,EAAE,UAAU,kBAAkB;AAAA,cAC9B,EAAE,UAAU,KAAK;AAAA,YACnB;AAAA,UACF,OAAO;AACL,uBAAW,WAAW;AAAA,UACxB;AACA,gBAAM,aAAa,MAAM,GAAG,KAAK,MAAM,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,cAAI,6BAA6B;AAC/B,mBACE,WAAW,KAAK,CAAC,cAAc;AAC7B,kBAAI,CAAC,UAAU,SAAU,QAAO;AAChC,qBAAO,OAAO,UAAU,QAAQ,EAAE,YAAY,MAAM;AAAA,YACtD,CAAC,KACD,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAC1D;AAAA,UACJ,OAAO;AACL,mBAAO,WAAW,KAAK,CAAC,cAAc,UAAU,aAAa,IAAI,KAAK;AAAA,UACxE;AACA,cAAI,CAAC,MAAM;AACT,mBAAO,WAAW,CAAC,KAAK;AAAA,UAC1B;AAAA,QACF;AACA,YAAI,CAAC,MAAM;AACT,gBAAM,KAAK,EAAE,OAAO,UAAU,gCAAgC,QAAQ,KAAK,cAAc,EAAE,YAAY,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACpI;AACA,cAAM,eAAe,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC7D,cAAM,yBAAyB,eAAe,aAAa,YAAY,IAAI;AAC3E,YAAI,0BAA0B,+BAA+B,2BAA2B,6BAA6B;AACnH,gBAAM,KAAK,EAAE,OAAO,UAAU,mCAAmC,QAAQ,KAAK,IAAI,8BAA8B,EAAE,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QAClK;AACA,qBAAa,KAAK,IAAI;AACtB,gBAAQ,KAAK,OAAO,KAAK,EAAE,CAAC;AAAA,MAC9B;AACA,YAAM,yBAAyB;AAAA,QAC7B;AAAA,QACA,aAAa,IAAI,UAAU,QAAQ,aAAa;AAAA,QAChD,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AACD,gBAAU,gBAAgB;AAC1B,gBAAU,kBAAkB;AAE5B,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,iBAAiB,MAAM,kBAAkB,IAAI,0BAA0B,KAAK,SAAS;AAC3F,UAAI,kBAAkB,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AACxE,YAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACxC,gBAAM,KAAK,EAAE,OAAO,UAAU,0CAA0C,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzH;AAAA,MACF;AACA,gBAAU,yBAAyB,kBAAkB;AAErD,aAAO,EAAE,GAAG,OAAO,eAAe;AAAA,IACpC;AAAA,IACA,aAAa,OAAO,QAAQ,QAAQ;AAClC,YAAM,YAAY;AAClB,YAAM,aAAa,UAAU;AAC7B,YAAM,QAAQ,UAAU;AACxB,UAAI,WAAY,CAAC,OAAgC,iBAAiB,WAAW;AAC7E,UAAI,MAAO,CAAC,OAAgC,gBAAgB;AAC5D,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,MACvD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,IACA,cAAc,OAAO,IAAI,QAAQ;AAC/B,YAAM,OAAO,IAAI;AACjB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAI,CAAC,MAAM,SAAU,OAAM,KAAK,EAAE,OAAO,UAAU,kCAAkC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClI,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,YAAM,YAAY;AAClB,YAAM,eAAe,MAAM,oBAAoB,SAAS;AACxD,YAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,YAAM,eAAoC;AAAA,QACxC;AAAA,QACA,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AACA,UAAI,CAAC,gBAAgB,MAAM,QAAQ,UAAU,GAAG;AAC9C,qBAAa,iBAAiB,EAAE,KAAK,WAAW;AAAA,MAClD;AACA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK;AAAA,MAClD;AACA,UACE,CAAC,UACD,OAAO,aAAa,KAAK,YACzB,CAAC,4BAA4B;AAAA,QAC3B;AAAA,QACA,wBAAwB;AAAA,QACxB,sBAAsB,OAAO,kBAAkB;AAAA,MACjD,CAAC,GACD;AACA,cAAM,KAAK,EAAE,OAAO,UAAU,4BAA4B,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3F;AACA,gBAAU,yBAAyB,OAAO,kBAAkB;AAAA,IAC9D;AAAA,IACA,aAAa,OAAO,IAAI,QAAQ;AAC9B,UAAI;AACF,cAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,cAAM,KAAK,oBAAoB,WAAW,EAAE,EAAE;AAAA,MAChD,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AACtB,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,SAAS,KAAK;AAEpB,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,YAAY;AAAA,MACrF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO,EAAE,OAAO;AAAA,QACd,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,8BAA8B;AAAA,MAC/D,CAAC;AAAA,MACD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/dictionaries/fields/dictionary.js

@@ -49,9 +49,12 @@ function DictionaryFieldDefEditor({ def, onChange }) {
   const [error, setError] = React.useState(null);
   const multiId = React.useId();
   const inlineCreateId = React.useId();
+  const inlineCreateHintId = React.useId();
+  const defaultValueHintId = React.useId();
   const selectedId = typeof def?.configJson?.dictionaryId === "string" ? def?.configJson?.dictionaryId : "";
   const inlineCreate = def?.configJson?.dictionaryInlineCreate !== false;
   const isMulti = def?.configJson?.multi === true;
+  const inlineCreateDisabled = !selectedId || isMulti;
   const errorLoadLabel = t("dictionaries.customFields.errorLoad", "Failed to load dictionaries.");
   React.useEffect(() => {
     let cancelled = false;
@@ -120,47 +123,56 @@ function DictionaryFieldDefEditor({ def, onChange }) {
       /* @__PURE__ */ jsx("span", { children: t("dictionaries.customFields.selectedHint", "Entries from this dictionary populate the field.") }),
       /* @__PURE__ */ jsx("a", { href: manageHref, className: "font-medium text-primary hover:underline", target: "_blank", rel: "noreferrer", children: t("dictionaries.customFields.manageLink", "Manage dictionaries") })
     ] }) : null,
-    /* @__PURE__ */ jsxs("div", { className: "inline-flex items-center gap-2 text-xs", children: [
-      /* @__PURE__ */ jsx(
-        Checkbox,
-        {
-          id: multiId,
-          checked: isMulti,
-          onCheckedChange: (checked) => {
-            const enabled = checked === true;
-            onChange({ multi: enabled, defaultValue: enabled ? void 0 : def?.configJson?.defaultValue });
-          },
-          disabled: !selectedId
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "label",
-        {
-          htmlFor: multiId,
-          className: selectedId ? "cursor-pointer select-none" : "cursor-not-allowed opacity-60",
-          children: t("dictionaries.customFields.allowMultiple", "Allow selecting multiple entries")
-        }
-      )
+    /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+      /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-2 sm:flex-row sm:flex-wrap sm:items-center sm:gap-x-4", children: [
+        /* @__PURE__ */ jsxs("div", { className: "inline-flex items-center gap-2 text-xs", children: [
+          /* @__PURE__ */ jsx(
+            Checkbox,
+            {
+              id: multiId,
+              checked: isMulti,
+              onCheckedChange: (checked) => {
+                const enabled = checked === true;
+                onChange({ multi: enabled, defaultValue: enabled ? void 0 : def?.configJson?.defaultValue });
+              },
+              disabled: !selectedId
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "label",
+            {
+              htmlFor: multiId,
+              className: selectedId ? "cursor-pointer select-none" : "cursor-not-allowed opacity-60",
+              children: t("dictionaries.customFields.allowMultiple", "Allow selecting multiple entries")
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxs("div", { className: "inline-flex items-center gap-2 text-xs", children: [
+          /* @__PURE__ */ jsx(
+            Checkbox,
+            {
+              id: inlineCreateId,
+              checked: !isMulti && inlineCreate,
+              onCheckedChange: (checked) => onChange({ dictionaryInlineCreate: checked === true }),
+              disabled: inlineCreateDisabled,
+              "aria-describedby": isMulti ? inlineCreateHintId : void 0
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "label",
+            {
+              htmlFor: inlineCreateId,
+              className: !inlineCreateDisabled ? "cursor-pointer select-none" : "cursor-not-allowed opacity-60",
+              children: t("dictionaries.customFields.allowInlineCreate", "Allow inline creation inside forms")
+            }
+          )
+        ] })
+      ] }),
+      isMulti ? /* @__PURE__ */ jsx("p", { id: inlineCreateHintId, className: "text-xs text-muted-foreground", children: t(
+        "dictionaries.customFields.inlineCreateSingleOnly",
+        "Inline creation is available for single-entry dictionary fields only."
+      ) }) : null
     ] }),
-    !isMulti ? /* @__PURE__ */ jsxs("div", { className: "inline-flex items-center gap-2 text-xs", children: [
-      /* @__PURE__ */ jsx(
-        Checkbox,
-        {
-          id: inlineCreateId,
-          checked: inlineCreate,
-          onCheckedChange: (checked) => onChange({ dictionaryInlineCreate: checked === true }),
-          disabled: !selectedId
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "label",
-        {
-          htmlFor: inlineCreateId,
-          className: selectedId ? "cursor-pointer select-none" : "cursor-not-allowed opacity-60",
-          children: t("dictionaries.customFields.allowInlineCreate", "Allow inline creation inside forms")
-        }
-      )
-    ] }) : null,
     selectedId && !isMulti ? /* @__PURE__ */ jsx(
       DictionaryDefaultSelector,
       {
@@ -168,7 +180,10 @@ function DictionaryFieldDefEditor({ def, onChange }) {
         defaultValue: typeof def?.configJson?.defaultValue === "string" ? def.configJson.defaultValue : "",
         onChange: (value) => onChange({ defaultValue: value || void 0 })
       }
-    ) : null
+    ) : selectedId && isMulti ? /* @__PURE__ */ jsx("div", { className: "inline-flex items-center gap-2 text-xs", children: /* @__PURE__ */ jsx("p", { id: defaultValueHintId, className: "text-xs text-muted-foreground", children: t(
+      "dictionaries.customFields.defaultValueMultiUnavailable",
+      "Default values are not available for multi-select dictionary fields."
+    ) }) }) : null
   ] });
 }
 function DictionaryFieldInput({ value, setValue, disabled, def }) {

package/dist/modules/dictionaries/fields/dictionary.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dictionaries/fields/dictionary.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport type { CrudCustomFieldRenderProps } from '@open-mercato/ui/backend/CrudForm'\nimport { FieldRegistry } from '@open-mercato/ui/backend/fields/registry'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { DictionarySelectControl } from '../components/DictionarySelectControl'\nimport { useDictionaryEntries } from '../components/hooks/useDictionaryEntries'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'dictionary-field' })\n\ntype DictionaryFieldDefinition = {\n  dictionaryId?: string\n  dictionaryInlineCreate?: boolean\n  multi?: boolean\n  defaultValue?: string\n}\n\ntype Props = CrudCustomFieldRenderProps & { def?: DictionaryFieldDefinition }\n\ntype DictionarySummary = {\n  id: string\n  name: string\n  key: string\n  isActive: boolean\n}\n\nfunction DictionaryDefaultSelector({\n  dictionaryId,\n  defaultValue,\n  onChange,\n}: {\n  dictionaryId: string\n  defaultValue: string\n  onChange: (value: string) => void\n}) {\n  const t = useT()\n  const { data, isLoading } = useDictionaryEntries(dictionaryId)\n  const entries = data?.entries ?? []\n  const isStale = defaultValue && entries.length > 0 && !entries.some((e) => e.value === defaultValue)\n\n  return (\n    <div className=\"space-y-1\">\n      <label className=\"text-xs font-medium text-muted-foreground\">\n        {t('dictionaries.customFields.defaultValue', 'Default value')}\n      </label>\n      <Select\n        value={defaultValue ?? ''}\n        onValueChange={(next) => onChange(next ?? '')}\n      >\n        <SelectTrigger size=\"sm\">\n          <SelectValue placeholder={t('dictionaries.customFields.defaultValueNone', 'No default')} />\n        </SelectTrigger>\n        <SelectContent>\n          {entries.map((entry) => (\n            <SelectItem key={entry.value} value={entry.value}>\n              {entry.label}\n            </SelectItem>\n          ))}\n        </SelectContent>\n      </Select>\n      {isLoading ? (\n        <p className=\"text-xs text-muted-foreground\">\n          {t('dictionaries.customFields.loading', 'Loading dictionaries\u2026')}\n        </p>\n      ) : null}\n      {isStale ? (\n        <p className=\"text-xs text-status-warning-text\">\n          {t('dictionaries.customFields.defaultValueStale', 'Default entry not found \u2014 it may have been deleted or renamed.')}\n        </p>\n      ) : null}\n    </div>\n  )\n}\n\nfunction DictionaryFieldDefEditor({ def, onChange }: { def: { configJson?: DictionaryFieldDefinition } | undefined; onChange: (patch: Partial<DictionaryFieldDefinition>) => void }) {\n  const t = useT()\n  const [items, setItems] = React.useState<DictionarySummary[]>([])\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const multiId = React.useId()\n  const inlineCreateId = React.useId()\n  const selectedId = typeof def?.configJson?.dictionaryId === 'string' ? def?.configJson?.dictionaryId : ''\n  const inlineCreate = def?.configJson?.dictionaryInlineCreate !== false\n  const isMulti = def?.configJson?.multi === true\n  const errorLoadLabel = t('dictionaries.customFields.errorLoad', 'Failed to load dictionaries.')\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setLoading(true)\n      setError(null)\n      try {\n        const call = await apiCall<{ items?: unknown[]; error?: string }>(\n          '/api/dictionaries?includeInactive=true',\n        )\n        if (!call.ok) {\n          const message =\n            typeof call.result?.error === 'string' ? call.result.error : 'Failed to load dictionaries'\n          throw new Error(message)\n        }\n        const entries = Array.isArray(call.result?.items) ? call.result!.items : []\n        if (!cancelled) {\n          setItems(\n            entries.map((entry: any) => ({\n              id: String(entry.id),\n              name: typeof entry.name === 'string' && entry.name.trim().length ? entry.name : String(entry.key ?? entry.id),\n              key: typeof entry.key === 'string' ? entry.key : '',\n              isActive: entry.isActive !== false,\n            })),\n          )\n        }\n      } catch (err) {\n        if (!cancelled) {\n          logger.error('Failed to load dictionaries list', { err })\n          setError(errorLoadLabel)\n        }\n      } finally {\n        if (!cancelled) {\n          setLoading(false)\n        }\n      }\n    }\n    load().catch(() => {})\n    return () => {\n      cancelled = true\n    }\n  }, [errorLoadLabel])\n\n  const manageHref = '/backend/config/dictionaries'\n\n  return (\n    <div className=\"mt-3 space-y-3 rounded border border-dashed border-muted-foreground/40 bg-muted/30 p-3\">\n      <div className=\"space-y-1\">\n        <label className=\"text-xs font-medium text-muted-foreground\">\n          {t('dictionaries.customFields.dictionaryLabel', 'Dictionary source')}\n        </label>\n        <Select\n          value={selectedId ?? ''}\n          onValueChange={(next) => onChange({ dictionaryId: next || undefined })}\n        >\n          <SelectTrigger size=\"sm\">\n            <SelectValue placeholder={t('dictionaries.customFields.dictionaryPlaceholder', 'Select a dictionary')} />\n          </SelectTrigger>\n          <SelectContent>\n            {items.map((item) => (\n              <SelectItem key={item.id} value={item.id}>\n                {item.name}\n                {item.isActive ? '' : ` (${t('dictionaries.customFields.inactive', 'inactive')})`}\n              </SelectItem>\n            ))}\n          </SelectContent>\n        </Select>\n        {loading ? (\n          <p className=\"text-xs text-muted-foreground\">\n            {t('dictionaries.customFields.loading', 'Loading dictionaries\u2026')}\n          </p>\n        ) : null}\n        {error ? <p className=\"text-xs text-status-error-text\">{error}</p> : null}\n        {!loading && !error && items.length === 0 ? (\n          <p className=\"text-xs text-muted-foreground\">\n            {t('dictionaries.customFields.empty', 'No dictionaries available yet. Create one first.')}\n          </p>\n        ) : null}\n      </div>\n      {selectedId ? (\n        <div className=\"flex flex-wrap items-center justify-between gap-2 rounded bg-background/80 px-2 py-1 text-xs text-muted-foreground\">\n          <span>{t('dictionaries.customFields.selectedHint', 'Entries from this dictionary populate the field.')}</span>\n          <a href={manageHref} className=\"font-medium text-primary hover:underline\" target=\"_blank\" rel=\"noreferrer\">\n            {t('dictionaries.customFields.manageLink', 'Manage dictionaries')}\n          </a>\n        </div>\n      ) : null}\n      <div className=\"inline-flex items-center gap-2 text-xs\">\n        <Checkbox\n          id={multiId}\n          checked={isMulti}\n          onCheckedChange={(checked) => {\n            const enabled = checked === true\n            onChange({ multi: enabled, defaultValue: enabled ? undefined : def?.configJson?.defaultValue })\n          }}\n          disabled={!selectedId}\n        />\n        <label\n          htmlFor={multiId}\n          className={selectedId ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}\n        >\n          {t('dictionaries.customFields.allowMultiple', 'Allow selecting multiple entries')}\n        </label>\n      </div>\n      {!isMulti ? (\n        <div className=\"inline-flex items-center gap-2 text-xs\">\n          <Checkbox\n            id={inlineCreateId}\n            checked={inlineCreate}\n            onCheckedChange={(checked) => onChange({ dictionaryInlineCreate: checked === true })}\n            disabled={!selectedId}\n          />\n          <label\n            htmlFor={inlineCreateId}\n            className={selectedId ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}\n          >\n            {t('dictionaries.customFields.allowInlineCreate', 'Allow inline creation inside forms')}\n          </label>\n        </div>\n      ) : null}\n      {selectedId && !isMulti ? (\n        <DictionaryDefaultSelector\n          dictionaryId={selectedId}\n          defaultValue={typeof def?.configJson?.defaultValue === 'string' ? def.configJson.defaultValue : ''}\n          onChange={(value) => onChange({ defaultValue: value || undefined })}\n        />\n      ) : null}\n    </div>\n  )\n}\n\nfunction DictionaryFieldInput({ value, setValue, disabled, def }: Props) {\n  const t = useT()\n  const dictionaryId = def?.dictionaryId\n  if (!dictionaryId) {\n    return (\n      <div className=\"rounded border border-dashed p-3 text-sm text-muted-foreground\">\n        {t('dictionaries.config.entries.error.load', 'Failed to load dictionary entries.')}\n      </div>\n    )\n  }\n  const normalizedValue = typeof value === 'string' ? value : Array.isArray(value) ? String(value[0] ?? '') : undefined\n  return (\n    <DictionarySelectControl\n      dictionaryId={dictionaryId}\n      value={normalizedValue ?? ''}\n      onChange={(next) => setValue(next ?? undefined)}\n      allowInlineCreate={def?.dictionaryInlineCreate !== false}\n      disabled={disabled}\n    />\n  )\n}\n\nFieldRegistry.register('dictionary', {\n  input: DictionaryFieldInput,\n  defEditor: (props) => <DictionaryFieldDefEditor {...props} />,\n})\n"],
-  "mappings": ";AAqDM,cAGA,YAHA;AAnDN,YAAY,WAAW;AAEvB,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,mBAAmB,CAAC;AAkBnF,SAAS,0BAA0B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,EAAE,MAAM,UAAU,IAAI,qBAAqB,YAAY;AAC7D,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,UAAU,gBAAgB,QAAQ,SAAS,KAAK,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAEnG,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,wBAAC,WAAM,WAAU,6CACd,YAAE,0CAA0C,eAAe,GAC9D;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,gBAAgB;AAAA,QACvB,eAAe,CAAC,SAAS,SAAS,QAAQ,EAAE;AAAA,QAE5C;AAAA,8BAAC,iBAAc,MAAK,MAClB,8BAAC,eAAY,aAAa,EAAE,8CAA8C,YAAY,GAAG,GAC3F;AAAA,UACA,oBAAC,iBACE,kBAAQ,IAAI,CAAC,UACZ,oBAAC,cAA6B,OAAO,MAAM,OACxC,gBAAM,SADQ,MAAM,KAEvB,CACD,GACH;AAAA;AAAA;AAAA,IACF;AAAA,IACC,YACC,oBAAC,OAAE,WAAU,iCACV,YAAE,qCAAqC,4BAAuB,GACjE,IACE;AAAA,IACH,UACC,oBAAC,OAAE,WAAU,oCACV,YAAE,+CAA+C,qEAAgE,GACpH,IACE;AAAA,KACN;AAEJ;AAEA,SAAS,yBAAyB,EAAE,KAAK,SAAS,GAAmI;AACnL,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAA8B,CAAC,CAAC;AAChE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,UAAU,MAAM,MAAM;AAC5B,QAAM,iBAAiB,MAAM,MAAM;AACnC,QAAM,aAAa,OAAO,KAAK,YAAY,iBAAiB,WAAW,KAAK,YAAY,eAAe;AACvG,QAAM,eAAe,KAAK,YAAY,2BAA2B;AACjE,QAAM,UAAU,KAAK,YAAY,UAAU;AAC3C,QAAM,iBAAiB,EAAE,uCAAuC,8BAA8B;AAE9F,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,eAAS,IAAI;AACb,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,UACJ,OAAO,KAAK,QAAQ,UAAU,WAAW,KAAK,OAAO,QAAQ;AAC/D,gBAAM,IAAI,MAAM,OAAO;AAAA,QACzB;AACA,cAAM,UAAU,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AAC1E,YAAI,CAAC,WAAW;AACd;AAAA,YACE,QAAQ,IAAI,CAAC,WAAgB;AAAA,cAC3B,IAAI,OAAO,MAAM,EAAE;AAAA,cACnB,MAAM,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,OAAO,OAAO,MAAM,OAAO,MAAM,EAAE;AAAA,cAC5G,KAAK,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAAA,cACjD,UAAU,MAAM,aAAa;AAAA,YAC/B,EAAE;AAAA,UACJ;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,iBAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,mBAAS,cAAc;AAAA,QACzB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,WAAW;AACd,qBAAW,KAAK;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AACA,SAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACrB,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,aAAa;AAEnB,SACE,qBAAC,SAAI,WAAU,0FACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,6CACd,YAAE,6CAA6C,mBAAmB,GACrE;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,cAAc;AAAA,UACrB,eAAe,CAAC,SAAS,SAAS,EAAE,cAAc,QAAQ,OAAU,CAAC;AAAA,UAErE;AAAA,gCAAC,iBAAc,MAAK,MAClB,8BAAC,eAAY,aAAa,EAAE,mDAAmD,qBAAqB,GAAG,GACzG;AAAA,YACA,oBAAC,iBACE,gBAAM,IAAI,CAAC,SACV,qBAAC,cAAyB,OAAO,KAAK,IACnC;AAAA,mBAAK;AAAA,cACL,KAAK,WAAW,KAAK,KAAK,EAAE,sCAAsC,UAAU,CAAC;AAAA,iBAF/D,KAAK,EAGtB,CACD,GACH;AAAA;AAAA;AAAA,MACF;AAAA,MACC,UACC,oBAAC,OAAE,WAAU,iCACV,YAAE,qCAAqC,4BAAuB,GACjE,IACE;AAAA,MACH,QAAQ,oBAAC,OAAE,WAAU,kCAAkC,iBAAM,IAAO;AAAA,MACpE,CAAC,WAAW,CAAC,SAAS,MAAM,WAAW,IACtC,oBAAC,OAAE,WAAU,iCACV,YAAE,mCAAmC,kDAAkD,GAC1F,IACE;AAAA,OACN;AAAA,IACC,aACC,qBAAC,SAAI,WAAU,sHACb;AAAA,0BAAC,UAAM,YAAE,0CAA0C,kDAAkD,GAAE;AAAA,MACvG,oBAAC,OAAE,MAAM,YAAY,WAAU,4CAA2C,QAAO,UAAS,KAAI,cAC3F,YAAE,wCAAwC,qBAAqB,GAClE;AAAA,OACF,IACE;AAAA,IACJ,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,iBAAiB,CAAC,YAAY;AAC5B,kBAAM,UAAU,YAAY;AAC5B,qBAAS,EAAE,OAAO,SAAS,cAAc,UAAU,SAAY,KAAK,YAAY,aAAa,CAAC;AAAA,UAChG;AAAA,UACA,UAAU,CAAC;AAAA;AAAA,MACb;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,SAAS;AAAA,UACT,WAAW,aAAa,+BAA+B;AAAA,UAEtD,YAAE,2CAA2C,kCAAkC;AAAA;AAAA,MAClF;AAAA,OACF;AAAA,IACC,CAAC,UACA,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,iBAAiB,CAAC,YAAY,SAAS,EAAE,wBAAwB,YAAY,KAAK,CAAC;AAAA,UACnF,UAAU,CAAC;AAAA;AAAA,MACb;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,SAAS;AAAA,UACT,WAAW,aAAa,+BAA+B;AAAA,UAEtD,YAAE,+CAA+C,oCAAoC;AAAA;AAAA,MACxF;AAAA,OACF,IACE;AAAA,IACH,cAAc,CAAC,UACd;AAAA,MAAC;AAAA;AAAA,QACC,cAAc;AAAA,QACd,cAAc,OAAO,KAAK,YAAY,iBAAiB,WAAW,IAAI,WAAW,eAAe;AAAA,QAChG,UAAU,CAAC,UAAU,SAAS,EAAE,cAAc,SAAS,OAAU,CAAC;AAAA;AAAA,IACpE,IACE;AAAA,KACN;AAEJ;AAEA,SAAS,qBAAqB,EAAE,OAAO,UAAU,UAAU,IAAI,GAAU;AACvE,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,KAAK;AAC1B,MAAI,CAAC,cAAc;AACjB,WACE,oBAAC,SAAI,WAAU,kEACZ,YAAE,0CAA0C,oCAAoC,GACnF;AAAA,EAEJ;AACA,QAAM,kBAAkB,OAAO,UAAU,WAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI;AAC5G,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,OAAO,mBAAmB;AAAA,MAC1B,UAAU,CAAC,SAAS,SAAS,QAAQ,MAAS;AAAA,MAC9C,mBAAmB,KAAK,2BAA2B;AAAA,MACnD;AAAA;AAAA,EACF;AAEJ;AAEA,cAAc,SAAS,cAAc;AAAA,EACnC,OAAO;AAAA,EACP,WAAW,CAAC,UAAU,oBAAC,4BAA0B,GAAG,OAAO;AAC7D,CAAC;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport type { CrudCustomFieldRenderProps } from '@open-mercato/ui/backend/CrudForm'\nimport { FieldRegistry } from '@open-mercato/ui/backend/fields/registry'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { DictionarySelectControl } from '../components/DictionarySelectControl'\nimport { useDictionaryEntries } from '../components/hooks/useDictionaryEntries'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'dictionary-field' })\n\ntype DictionaryFieldDefinition = {\n  dictionaryId?: string\n  dictionaryInlineCreate?: boolean\n  multi?: boolean\n  defaultValue?: string\n}\n\ntype Props = CrudCustomFieldRenderProps & { def?: DictionaryFieldDefinition }\n\ntype DictionarySummary = {\n  id: string\n  name: string\n  key: string\n  isActive: boolean\n}\n\nfunction DictionaryDefaultSelector({\n  dictionaryId,\n  defaultValue,\n  onChange,\n}: {\n  dictionaryId: string\n  defaultValue: string\n  onChange: (value: string) => void\n}) {\n  const t = useT()\n  const { data, isLoading } = useDictionaryEntries(dictionaryId)\n  const entries = data?.entries ?? []\n  const isStale = defaultValue && entries.length > 0 && !entries.some((e) => e.value === defaultValue)\n\n  return (\n    <div className=\"space-y-1\">\n      <label className=\"text-xs font-medium text-muted-foreground\">\n        {t('dictionaries.customFields.defaultValue', 'Default value')}\n      </label>\n      <Select\n        value={defaultValue ?? ''}\n        onValueChange={(next) => onChange(next ?? '')}\n      >\n        <SelectTrigger size=\"sm\">\n          <SelectValue placeholder={t('dictionaries.customFields.defaultValueNone', 'No default')} />\n        </SelectTrigger>\n        <SelectContent>\n          {entries.map((entry) => (\n            <SelectItem key={entry.value} value={entry.value}>\n              {entry.label}\n            </SelectItem>\n          ))}\n        </SelectContent>\n      </Select>\n      {isLoading ? (\n        <p className=\"text-xs text-muted-foreground\">\n          {t('dictionaries.customFields.loading', 'Loading dictionaries\u2026')}\n        </p>\n      ) : null}\n      {isStale ? (\n        <p className=\"text-xs text-status-warning-text\">\n          {t('dictionaries.customFields.defaultValueStale', 'Default entry not found \u2014 it may have been deleted or renamed.')}\n        </p>\n      ) : null}\n    </div>\n  )\n}\n\nfunction DictionaryFieldDefEditor({ def, onChange }: { def: { configJson?: DictionaryFieldDefinition } | undefined; onChange: (patch: Partial<DictionaryFieldDefinition>) => void }) {\n  const t = useT()\n  const [items, setItems] = React.useState<DictionarySummary[]>([])\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const multiId = React.useId()\n  const inlineCreateId = React.useId()\n  const inlineCreateHintId = React.useId()\n  const defaultValueHintId = React.useId()\n  const selectedId = typeof def?.configJson?.dictionaryId === 'string' ? def?.configJson?.dictionaryId : ''\n  const inlineCreate = def?.configJson?.dictionaryInlineCreate !== false\n  const isMulti = def?.configJson?.multi === true\n  const inlineCreateDisabled = !selectedId || isMulti\n  const errorLoadLabel = t('dictionaries.customFields.errorLoad', 'Failed to load dictionaries.')\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setLoading(true)\n      setError(null)\n      try {\n        const call = await apiCall<{ items?: unknown[]; error?: string }>(\n          '/api/dictionaries?includeInactive=true',\n        )\n        if (!call.ok) {\n          const message =\n            typeof call.result?.error === 'string' ? call.result.error : 'Failed to load dictionaries'\n          throw new Error(message)\n        }\n        const entries = Array.isArray(call.result?.items) ? call.result!.items : []\n        if (!cancelled) {\n          setItems(\n            entries.map((entry: any) => ({\n              id: String(entry.id),\n              name: typeof entry.name === 'string' && entry.name.trim().length ? entry.name : String(entry.key ?? entry.id),\n              key: typeof entry.key === 'string' ? entry.key : '',\n              isActive: entry.isActive !== false,\n            })),\n          )\n        }\n      } catch (err) {\n        if (!cancelled) {\n          logger.error('Failed to load dictionaries list', { err })\n          setError(errorLoadLabel)\n        }\n      } finally {\n        if (!cancelled) {\n          setLoading(false)\n        }\n      }\n    }\n    load().catch(() => {})\n    return () => {\n      cancelled = true\n    }\n  }, [errorLoadLabel])\n\n  const manageHref = '/backend/config/dictionaries'\n\n  return (\n    <div className=\"mt-3 space-y-3 rounded border border-dashed border-muted-foreground/40 bg-muted/30 p-3\">\n      <div className=\"space-y-1\">\n        <label className=\"text-xs font-medium text-muted-foreground\">\n          {t('dictionaries.customFields.dictionaryLabel', 'Dictionary source')}\n        </label>\n        <Select\n          value={selectedId ?? ''}\n          onValueChange={(next) => onChange({ dictionaryId: next || undefined })}\n        >\n          <SelectTrigger size=\"sm\">\n            <SelectValue placeholder={t('dictionaries.customFields.dictionaryPlaceholder', 'Select a dictionary')} />\n          </SelectTrigger>\n          <SelectContent>\n            {items.map((item) => (\n              <SelectItem key={item.id} value={item.id}>\n                {item.name}\n                {item.isActive ? '' : ` (${t('dictionaries.customFields.inactive', 'inactive')})`}\n              </SelectItem>\n            ))}\n          </SelectContent>\n        </Select>\n        {loading ? (\n          <p className=\"text-xs text-muted-foreground\">\n            {t('dictionaries.customFields.loading', 'Loading dictionaries\u2026')}\n          </p>\n        ) : null}\n        {error ? <p className=\"text-xs text-status-error-text\">{error}</p> : null}\n        {!loading && !error && items.length === 0 ? (\n          <p className=\"text-xs text-muted-foreground\">\n            {t('dictionaries.customFields.empty', 'No dictionaries available yet. Create one first.')}\n          </p>\n        ) : null}\n      </div>\n      {selectedId ? (\n        <div className=\"flex flex-wrap items-center justify-between gap-2 rounded bg-background/80 px-2 py-1 text-xs text-muted-foreground\">\n          <span>{t('dictionaries.customFields.selectedHint', 'Entries from this dictionary populate the field.')}</span>\n          <a href={manageHref} className=\"font-medium text-primary hover:underline\" target=\"_blank\" rel=\"noreferrer\">\n            {t('dictionaries.customFields.manageLink', 'Manage dictionaries')}\n          </a>\n        </div>\n      ) : null}\n      <div className=\"space-y-2\">\n        <div className=\"flex flex-col gap-2 sm:flex-row sm:flex-wrap sm:items-center sm:gap-x-4\">\n          <div className=\"inline-flex items-center gap-2 text-xs\">\n            <Checkbox\n              id={multiId}\n              checked={isMulti}\n              onCheckedChange={(checked) => {\n                const enabled = checked === true\n                onChange({ multi: enabled, defaultValue: enabled ? undefined : def?.configJson?.defaultValue })\n              }}\n              disabled={!selectedId}\n            />\n            <label\n              htmlFor={multiId}\n              className={selectedId ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}\n            >\n              {t('dictionaries.customFields.allowMultiple', 'Allow selecting multiple entries')}\n            </label>\n          </div>\n          <div className=\"inline-flex items-center gap-2 text-xs\">\n            <Checkbox\n              id={inlineCreateId}\n              checked={!isMulti && inlineCreate}\n              onCheckedChange={(checked) => onChange({ dictionaryInlineCreate: checked === true })}\n              disabled={inlineCreateDisabled}\n              aria-describedby={isMulti ? inlineCreateHintId : undefined}\n            />\n            <label\n              htmlFor={inlineCreateId}\n              className={!inlineCreateDisabled ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}\n            >\n              {t('dictionaries.customFields.allowInlineCreate', 'Allow inline creation inside forms')}\n            </label>\n          </div>\n        </div>\n        {isMulti ? (\n          <p id={inlineCreateHintId} className=\"text-xs text-muted-foreground\">\n            {t(\n              'dictionaries.customFields.inlineCreateSingleOnly',\n              'Inline creation is available for single-entry dictionary fields only.',\n            )}\n          </p>\n        ) : null}\n      </div>\n      {selectedId && !isMulti ? (\n        <DictionaryDefaultSelector\n          dictionaryId={selectedId}\n          defaultValue={typeof def?.configJson?.defaultValue === 'string' ? def.configJson.defaultValue : ''}\n          onChange={(value) => onChange({ defaultValue: value || undefined })}\n        />\n      ) : selectedId && isMulti ? (\n        <div className=\"inline-flex items-center gap-2 text-xs\">\n          <p id={defaultValueHintId} className=\"text-xs text-muted-foreground\">\n            {t(\n              'dictionaries.customFields.defaultValueMultiUnavailable',\n              'Default values are not available for multi-select dictionary fields.',\n            )}\n          </p>\n        </div>\n      ) : null}\n    </div>\n  )\n}\n\nfunction DictionaryFieldInput({ value, setValue, disabled, def }: Props) {\n  const t = useT()\n  const dictionaryId = def?.dictionaryId\n  if (!dictionaryId) {\n    return (\n      <div className=\"rounded border border-dashed p-3 text-sm text-muted-foreground\">\n        {t('dictionaries.config.entries.error.load', 'Failed to load dictionary entries.')}\n      </div>\n    )\n  }\n  const normalizedValue = typeof value === 'string' ? value : Array.isArray(value) ? String(value[0] ?? '') : undefined\n  return (\n    <DictionarySelectControl\n      dictionaryId={dictionaryId}\n      value={normalizedValue ?? ''}\n      onChange={(next) => setValue(next ?? undefined)}\n      allowInlineCreate={def?.dictionaryInlineCreate !== false}\n      disabled={disabled}\n    />\n  )\n}\n\nFieldRegistry.register('dictionary', {\n  input: DictionaryFieldInput,\n  defEditor: (props) => <DictionaryFieldDefEditor {...props} />,\n})\n"],
+  "mappings": ";AAqDM,cAGA,YAHA;AAnDN,YAAY,WAAW;AAEvB,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,mBAAmB,CAAC;AAkBnF,SAAS,0BAA0B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,EAAE,MAAM,UAAU,IAAI,qBAAqB,YAAY;AAC7D,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,UAAU,gBAAgB,QAAQ,SAAS,KAAK,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAEnG,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,wBAAC,WAAM,WAAU,6CACd,YAAE,0CAA0C,eAAe,GAC9D;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,gBAAgB;AAAA,QACvB,eAAe,CAAC,SAAS,SAAS,QAAQ,EAAE;AAAA,QAE5C;AAAA,8BAAC,iBAAc,MAAK,MAClB,8BAAC,eAAY,aAAa,EAAE,8CAA8C,YAAY,GAAG,GAC3F;AAAA,UACA,oBAAC,iBACE,kBAAQ,IAAI,CAAC,UACZ,oBAAC,cAA6B,OAAO,MAAM,OACxC,gBAAM,SADQ,MAAM,KAEvB,CACD,GACH;AAAA;AAAA;AAAA,IACF;AAAA,IACC,YACC,oBAAC,OAAE,WAAU,iCACV,YAAE,qCAAqC,4BAAuB,GACjE,IACE;AAAA,IACH,UACC,oBAAC,OAAE,WAAU,oCACV,YAAE,+CAA+C,qEAAgE,GACpH,IACE;AAAA,KACN;AAEJ;AAEA,SAAS,yBAAyB,EAAE,KAAK,SAAS,GAAmI;AACnL,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAA8B,CAAC,CAAC;AAChE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,UAAU,MAAM,MAAM;AAC5B,QAAM,iBAAiB,MAAM,MAAM;AACnC,QAAM,qBAAqB,MAAM,MAAM;AACvC,QAAM,qBAAqB,MAAM,MAAM;AACvC,QAAM,aAAa,OAAO,KAAK,YAAY,iBAAiB,WAAW,KAAK,YAAY,eAAe;AACvG,QAAM,eAAe,KAAK,YAAY,2BAA2B;AACjE,QAAM,UAAU,KAAK,YAAY,UAAU;AAC3C,QAAM,uBAAuB,CAAC,cAAc;AAC5C,QAAM,iBAAiB,EAAE,uCAAuC,8BAA8B;AAE9F,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,eAAS,IAAI;AACb,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,UACJ,OAAO,KAAK,QAAQ,UAAU,WAAW,KAAK,OAAO,QAAQ;AAC/D,gBAAM,IAAI,MAAM,OAAO;AAAA,QACzB;AACA,cAAM,UAAU,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AAC1E,YAAI,CAAC,WAAW;AACd;AAAA,YACE,QAAQ,IAAI,CAAC,WAAgB;AAAA,cAC3B,IAAI,OAAO,MAAM,EAAE;AAAA,cACnB,MAAM,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,OAAO,OAAO,MAAM,OAAO,MAAM,EAAE;AAAA,cAC5G,KAAK,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAAA,cACjD,UAAU,MAAM,aAAa;AAAA,YAC/B,EAAE;AAAA,UACJ;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,iBAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,mBAAS,cAAc;AAAA,QACzB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,WAAW;AACd,qBAAW,KAAK;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AACA,SAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACrB,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,aAAa;AAEnB,SACE,qBAAC,SAAI,WAAU,0FACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,6CACd,YAAE,6CAA6C,mBAAmB,GACrE;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,cAAc;AAAA,UACrB,eAAe,CAAC,SAAS,SAAS,EAAE,cAAc,QAAQ,OAAU,CAAC;AAAA,UAErE;AAAA,gCAAC,iBAAc,MAAK,MAClB,8BAAC,eAAY,aAAa,EAAE,mDAAmD,qBAAqB,GAAG,GACzG;AAAA,YACA,oBAAC,iBACE,gBAAM,IAAI,CAAC,SACV,qBAAC,cAAyB,OAAO,KAAK,IACnC;AAAA,mBAAK;AAAA,cACL,KAAK,WAAW,KAAK,KAAK,EAAE,sCAAsC,UAAU,CAAC;AAAA,iBAF/D,KAAK,EAGtB,CACD,GACH;AAAA;AAAA;AAAA,MACF;AAAA,MACC,UACC,oBAAC,OAAE,WAAU,iCACV,YAAE,qCAAqC,4BAAuB,GACjE,IACE;AAAA,MACH,QAAQ,oBAAC,OAAE,WAAU,kCAAkC,iBAAM,IAAO;AAAA,MACpE,CAAC,WAAW,CAAC,SAAS,MAAM,WAAW,IACtC,oBAAC,OAAE,WAAU,iCACV,YAAE,mCAAmC,kDAAkD,GAC1F,IACE;AAAA,OACN;AAAA,IACC,aACC,qBAAC,SAAI,WAAU,sHACb;AAAA,0BAAC,UAAM,YAAE,0CAA0C,kDAAkD,GAAE;AAAA,MACvG,oBAAC,OAAE,MAAM,YAAY,WAAU,4CAA2C,QAAO,UAAS,KAAI,cAC3F,YAAE,wCAAwC,qBAAqB,GAClE;AAAA,OACF,IACE;AAAA,IACJ,qBAAC,SAAI,WAAU,aACb;AAAA,2BAAC,SAAI,WAAU,2EACb;AAAA,6BAAC,SAAI,WAAU,0CACb;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,IAAI;AAAA,cACJ,SAAS;AAAA,cACT,iBAAiB,CAAC,YAAY;AAC5B,sBAAM,UAAU,YAAY;AAC5B,yBAAS,EAAE,OAAO,SAAS,cAAc,UAAU,SAAY,KAAK,YAAY,aAAa,CAAC;AAAA,cAChG;AAAA,cACA,UAAU,CAAC;AAAA;AAAA,UACb;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS;AAAA,cACT,WAAW,aAAa,+BAA+B;AAAA,cAEtD,YAAE,2CAA2C,kCAAkC;AAAA;AAAA,UAClF;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,IAAI;AAAA,cACJ,SAAS,CAAC,WAAW;AAAA,cACrB,iBAAiB,CAAC,YAAY,SAAS,EAAE,wBAAwB,YAAY,KAAK,CAAC;AAAA,cACnF,UAAU;AAAA,cACV,oBAAkB,UAAU,qBAAqB;AAAA;AAAA,UACnD;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS;AAAA,cACT,WAAW,CAAC,uBAAuB,+BAA+B;AAAA,cAEjE,YAAE,+CAA+C,oCAAoC;AAAA;AAAA,UACxF;AAAA,WACF;AAAA,SACF;AAAA,MACC,UACC,oBAAC,OAAE,IAAI,oBAAoB,WAAU,iCAClC;AAAA,QACC;AAAA,QACA;AAAA,MACF,GACF,IACE;AAAA,OACN;AAAA,IACC,cAAc,CAAC,UACd;AAAA,MAAC;AAAA;AAAA,QACC,cAAc;AAAA,QACd,cAAc,OAAO,KAAK,YAAY,iBAAiB,WAAW,IAAI,WAAW,eAAe;AAAA,QAChG,UAAU,CAAC,UAAU,SAAS,EAAE,cAAc,SAAS,OAAU,CAAC;AAAA;AAAA,IACpE,IACE,cAAc,UAChB,oBAAC,SAAI,WAAU,0CACb,8BAAC,OAAE,IAAI,oBAAoB,WAAU,iCAClC;AAAA,MACC;AAAA,MACA;AAAA,IACF,GACF,GACF,IACE;AAAA,KACN;AAEJ;AAEA,SAAS,qBAAqB,EAAE,OAAO,UAAU,UAAU,IAAI,GAAU;AACvE,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,KAAK;AAC1B,MAAI,CAAC,cAAc;AACjB,WACE,oBAAC,SAAI,WAAU,kEACZ,YAAE,0CAA0C,oCAAoC,GACnF;AAAA,EAEJ;AACA,QAAM,kBAAkB,OAAO,UAAU,WAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI;AAC5G,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,OAAO,mBAAmB;AAAA,MAC1B,UAAU,CAAC,SAAS,SAAS,QAAQ,MAAS;AAAA,MAC9C,mBAAmB,KAAK,2BAA2B;AAAA,MACnD;AAAA;AAAA,EACF;AAEJ;AAEA,cAAc,SAAS,cAAc;AAAA,EACnC,OAAO;AAAA,EACP,WAAW,CAAC,UAAU,oBAAC,4BAA0B,GAAG,OAAO;AAC7D,CAAC;",
   "names": []
 }

package/dist/modules/entities/backend/entities/system/[entityId]/page.meta.js

@@ -2,6 +2,7 @@ const metadata = {
   requireAuth: true,
   requireFeatures: ["entities.definitions.manage"],
   pageTitle: "Edit Definitions",
+  pageTitleKey: "entities.userEntities.edit.pageTitle",
   pageGroup: "Data designer",
   navHidden: true
 };

package/dist/modules/entities/backend/entities/system/[entityId]/page.meta.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/entities/backend/entities/system/%5BentityId%5D/page.meta.ts"],
-  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['entities.definitions.manage'],\n  pageTitle: 'Edit Definitions',\n  pageGroup: 'Data designer',\n  navHidden: true,\n}\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,6BAA6B;AAAA,EAC/C,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AACb;",
+  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['entities.definitions.manage'],\n  pageTitle: 'Edit Definitions',\n  pageTitleKey: 'entities.userEntities.edit.pageTitle',\n  pageGroup: 'Data designer',\n  navHidden: true,\n}\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,6BAA6B;AAAA,EAC/C,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AACb;",
   "names": []
 }